ML20137W383

Rev 2 to Hazards Analysis:Potential for Boron Dilution of Rcs

ML20137W383
Person / Time
Site:	Three Mile Island
Issue date:	09/30/1985
From:	GENERAL PUBLIC UTILITIES CORP.
To:
Shared Package
ML20137W376	List: ML20137W372 ML20137W383
References
4430-84-007R, 4430-84-007R-R02, 4430-84-7R, 4430-84-7R-R2, NUDOCS 8510040296
Download: ML20137W383 (150)

Text

'

, I

'!' ll l! -

!! 4430-84-007F i ,! l; ! l l llIl ll l Nuclear TMI-2 DIVISION HAZARDS ANALYSIS

\

n g POTENTIAL FOR i BORON DILUTION l OF REACTOR COOLANT cl SYSTEM il L--===_ a

__ ll 1

Prepared by:

TMI 2 Licensing and Nuclear Safety Dept.

Risk Assessment Section l Septanber 1985 - Rev. 2

$$ U$D0h 0 $0 P

i

4430-84-007R Revision 2 September 1985 HAZARDS ANALYSIS:

POTENTIAL FOR BORON DILUTION OF REACTOR COOLANT SYSTEN Risk Assessment Section

, q ^-

Director, Licensing Mcle.r Safety

\t I n.g&

E s,_es, g er j

TABLE OF CONTENTS Page 1.0 PURPOSE . . . . . . . . . . . . . . . . . . . . . . . . . 1 2.0 APPLICABILITY / SCOPE . . . . . . . . . . . . . . . . . . . 2 3.0

SUMMARY

OF RESULTS ................... 3 4.0 ANALYSIS ........................ 4 4.1 Introduction ................... 4 4.2 Analysis Approach . . . . . . . . . . . . . . . . . 5 4.3 Assumptions and Limitations . . . . . . . . . . . . 7 4.4 Calculation . . . . . . . . . . . . . . . . . . . . 9 4.4.1 Potential RCS Dilution Points . . . . . . 9 4.4.2 Potential Oilution Sources. . . . . . . . 10 4.4.3 Isolation Barriers ........... 17 4.4.4 Failure Probability per Pathway . . . . . 34 4.4.5 Estimate of Plant Dilution Probability . 46 4.4.5.1 Dilution Volume. . . . . . . . . . . 46 4.4.5.2 Dilution Rate. . . . . . . . . . . . 48 4.4.5.3 Detection and Mitig.ation . . . . . . 51 4.4.5.4 Probability of RCS Dilution. . . . . 61

5.0 CONCLUSION

S . . . . . . . . . . . . . . . . . . . . . . . 64 6.0 RECOMMENDATIONS . . . . . . . . . . . . . . . . . . . . . 66

7.0 REFERENCES

....................... 68 Appendix A: RCS Feed and 81eed ............... A-1 Appendix B: IIF Fill .................... B-1 Appendix C: Refueling Canal Fill .............. C-1 Appendix 0: IIF Processing ................. 0-1 j Appendix E: Defueling Water Cleanup System ......... E-1 l2

1 List of Tables and Figures Table PAgg.

4.4-1 Potential Dilution Points to RCS Primary . . . . . . . . 12 4.4-2 Potential Dilution Sources for RCS Dilution Points . . . 15

, 4.4-3 Isolation Barriers to be Placed on 24-hour Checklist During Static Conditions . . . . . . . . . 18 4.4-4 Isolation Barrier Configurations per RCS Area . . . . . . 19

, 4.4-5 Hardware Failure Probabilities for Various Types of Ollution Barriers . . . . . . . . . . . . . 34

4.4-6 Probability of Selection (Type I) Error .

. . . . . . . 37 4.4-7 Probability of Incorrect Procedure Use (Type iib) Error . 42 4.4-8 Probability of Failure per Isolation 8arrier Configurations . . . . . . . . . . . . . . . 45 4.4-9 Total Failure Probability per Isolation Type. . . . . . . 62 6-1 Recommended Monitoring Frequencies. . . . . . . . . . . . 67 i

Fiaure 4.1 RCS Primary Side 011ution Points. . . . . . . . . . . . . 13 4.2 RCS Secondary Side 011ution Points. . . . . . . . . . . . 14 E.1 Simplified Schematic of RV Processing Using Oedicated DWC S C ompon en t s . . . . . . . . . . . . . . . . . . . . . E- 7 2 E.2 Simplified Schematic of RV Processing Using DWCS and SOS Components ...................E-12 1

e m

• I

1.0 PURPOSE The purpose of this analysis is to assess the potential for boron dilution of the TMI-2 reactor coolant system. Revision 0 of this analysis identified methods of isolating the RCS that provide a high degree of assurance that a dilution event will not occur. Revision 0 considered several plant operations that have been important to recovery operations to date. The isolation methods recommended in Revision 0 were implemented through appropriate plant procedures.

Revision 1 of this analysis was issued primarily to consider the effects of criticality analyses which indicated that a higher boron concentration (4350 ppm 8) was applicable under some circumstances than was assumed in the Revision 0 (3500 ppm B). Other changes in Revision 1 included the addition of references that described the mixing characteristics of a potential dilution inflow and a more refined analysis of dilution /

mitigation capability. Modifications made in Revision 1 are indicated by a vertical line with the number "1".

2 The purpose of this revision is to consider the boron dilution potential associated with operation of the Defueling Water Cleanup System (0WCS).

The DWCS analysis is provided as a new appendix, Appendix E; modifications to preexisting sections of the report are indicated by a vertical line with the number "2". It should be noted that, due to schedular constraints, only minor editorial changes were made in report sections other than Appendix E. Thus, the main body of the report has not yet been modified to include specific additional issues as requested by various groups (e.g., Design Engineering TAAG, SRG); it is planned that an additional revision will be made to include these issues. The 0WCS analysis in Appendix E is not affected by modifications to be made in other sections of this report.

1055Y RA

2.0 APPLICABILITY / SCOPE A new filtration and ion exchange system for processing RCS water will be added to aid defueling operations. This system is termed the "Defueling Water Cleanup System" (0WCS). Two modes of DWCS operation may be used in defueling. The first mode utilizes only dedicated DWCS components for filtration and ion exchange; the second mode uses dedicated OWCS components for filtration and the SDS System for ton exchange. This 2 revision considers the potential for RCS boron dilution that is associated with DWCS operation as well as the dilution potential associated with other plant conditions.

The main body of this report covers plant operations during static conditions while in the level control mode as described by TMI-2 Operating Procedure OP 2104-10.2. Additional plant maneuvers / conditions are covered in the appendices, as indicated below.

• RCS Feed and 81eed (OP 2104-10.2- Section 4.2) Appendix A

!!F Fill (OP 2104-10.2 Section 4.3.2) Appendix 8 Refueling Canal Fill (OP 4210 Ops 3254.01) Appendix C IIF Processing (OP 2104-8.18) Appendix 0 OWCS Processing Appendix E l2 1055Y RA

3.0

SUMMARY

OF RESULTS References 16 and 17 indicate that the minimum acceptable boron concentration until the start of core alterations is 3500 ppm. Reference 13 indicates th'at a concentration of 4350 ppm will assure subcriticality in the presence of intentional fuel disturbances. The probability of occurrence of a dilution event is a function of the ability to isolate the RCS and not of the acceptable boron concentration. The probability of a large dilution rate event occurring during static conditions was found to be very small (-3 x 10

-4 per year); the probability of a small rate dilution was somewhat larger (- 5 x 10 -3 per year). The probability of a dilution occurring during particular plant maneuvers varies because the number of potential dilution paths varies; the probability of a dilution occurring during each maneuver is presented in the appropriate appendix. If a dilution event were to occur, the probability of terminating it before it becomes a safety concern is a function of the minimum acceptable boron concentration. However, because there is significant margin between either minimum acceptable baron concentration and the actual RCS concentratio.n of 5050 (i 100 ppm), an y appropriate detection / mitigation program can be developed for either minimum concentration. Considering the detection / mitigation capabilities along with the occurrence probability, the probability of an inadvertent dilution causing a criticality was found to be negligible (about 10

-4 per year) for planned operations until the start of defueling.

Isolation boundaries for the RCS during static conditions and various plant maneuvers have been recommended. The isolation boundaries in this report generally reflect the input of the Safety Review Group and Site Operations and are incorporated into appropriate plant procedures.

Sampling and inventory monitoring frequencies have also been reconuended. These recommendations were incorporated into SER commitments or are already consistent with plant practice (N.B. Af ter start of IIF processing, L&NS committed to a more frequent sampling frequency than that recommended in this report in order to reduce uncertainties about mixing of the potential diluent.)

Detailed conclusions and reconmendations are presented in Sections 5.0 and 6.0, respectively.

1055Y RA

4.0 ANALYSIS 4.1 Introduction Soron dilution of the reactor coolant system is a concern at TMI-2 bec[useofitspotentialtocauseacriticalitywithpossible personnel and public safety implications.I Thus, RAS has performed a plant specific analysis of the boron dilution potential at TMI-2. Section 4.2 provides a summary of the analysis approach. Section 4.3 summarizes the assumptions used and the limitations of the analysis. Section 4.4 provides the details of the calculation.

1 To gain a perspective on the significance of this issue, a summary of 4

industry experience is helpful. Based on actual industry experience, the probability of an unplanned boron dilution of a PWR during maintenance

, and refueling has been estimated as 0.09 per reactor-year (Reference 1).

The NRC estimates the probability of an inadvertent criticality due to a

! boron dilution event to be 2 x.10-3 to 2 x 10-4 per year depending on the neutron monitoring in use at a plant (Reference 2). Of additional interest at TMI-2 is the probability of an unplanned dilution of a borated tank, which has been estimated, based on industry experience to be about 0.1 per year (Reference 1). Equipment failures were the cause of 20% of the RCS boron dilution events; 80% were the result of personnel error. Interestingly, 81% of the boron dilution events were "other than those postulated in the design analyses in the PWR FSARs ..."

(Reference 1).

]

i 1

I 1055Y RA r

- , ,-,~ ~ ,,_ , - ,,w,-,--,--

. - , , - . - , , . . , - , _ _ , _ _ _ _ , - , , , , - , , , , , , _,_-,,,,,,...,,,n - - - - -

4.2 Analysis Approach The boron dilution analysis can be summarized by the following p...- ___. tasks:._ ._,_ _ . - . - - -

(I) : Identify the potential points of water injection to the RCS.

These_ points were identified by review of current P& ids and knowledge of temporary connections. Dilution through any a

part of the RCS was considered, e.g. core flood tanks, 4

pressurizer, RC pump seals and vessel nozzles. The secondary side of the steam generators was also considered a potential RCS injection point. Details of this task are provided in Section 4.4.1.

(II) Track each potential RCS injection point to potential dilution sources.

Each injection point identified in Task I was tracked to determine potential boron dilution sources for that point.

The potential boron dilution sources found in this manner may be isolated either by barriers near the sources themselves or by barriers associated with the RCS injection point. Details of the task are provided in Section 4.4.2.

(III) Identify isolation barriers for each dilution source.

Isolation barriers were identified for the injection points identified in Task I. (An equivalent isolation barrier could be used if there are operational problems with the barrier forming the basis of this analysis.) An additional measure of protection could be gained by isolating the dilution j sources as well as the injection points. The details of this l task are presented in Section 4.4.3. ,

i l

1 1055Y RA

.- - ~ . . _ . _ _ . _ _ , _ . _ , _ _ _ . _ _ _ . . - _ . - - - - . _ . _ . . _ _ , , _ . . _ , _ _ , . _ _ . . - _ - - - . _ . _ _ _ . , . . . . _ _ _ _ _ _ _ _

(IV) Determine probability of failure of isolation barrier configuration.

An analysis was performed to assess the probability of failure of various dilution barriers identified in Task III

due to hardware faults and human error. This analysis is presented in Section 4.4.4.

(V) Estimate total plant boron dilution potential {

The total plant boron dilution potential was estimated considering the number of injection paths, the reliability of each isolation barrier, and credit for operator error in detecting and terminating a boron dilution event. This analysis is presented in Section 4.4.5.

1055Y RA

_ . . _ . _ _ . . - _ _ _ _ _ _ . _ _ . .--.J___.____-. _ . _ _ . ,

4.3 Assumptions and Limitations e Recent analyses have indicated that an RCS boron l concentration of 4350 ppe should be the basis for some recovery operations. At other times, 3500 ppm remains the

[ minimum acceptable boron concentration. The actual RCS boron concentration is being maintained at an administrative limit of 5050 ppm (i 100 ppm); recent monthly average boron concentrations have been over $100 ppe. Thus, it was assumed that the initial boron concentration for a postulated 1 dilution event is 5050 ppe and that terminating a dilution event prior to reaching 3500 or 4350 ppm, as appropriate, assures that there is not a safety impact from the event.

• The analysis was performed for RCS operation in both static conditions during the level control mode and for various plant manuevers. Potential dilution through an open vessel head was judged to have a negligible probability for the scope of this analysis because of (1) the low probability of an in-containment fire coupled with personnel error that I would direct flow over the RCS, (11) the low probability of inadvertent containment spray actuation and, (iii) the presence of the IIF work platform which would inhibit a dilution event through the vessel head.

• The analysis does not take into account water that may be stored in piping. However, the approach used in the analysis whereby isolation is generally achieved "close" to the RCS

! minimizes this potential concern.

L L

[.

4 1055Y RA  !

J-._.-._.. --

e To calculate dilution times, Rev. O assumed that a potential dilution flow would mix uniformly with the borated volume in the reactor vessel; no credit was taken for water in the RCS loops. Since then, the mixing characteristics of a potential dilution inflow have been analyzed in more detail (References 11 and 12). These analyses indicate that the dilution inflow is likely to float to the upper plenum and IIF regions through the cold fit-up gap rather than proceeding down the 1

CSA annulus and through the core. This effect is due to the density difference between the lighter dilution inflow and the borated water in the vessel. These analyses indicate that the core region is likely to be the last area of the vessel to see a dilution flow; thus, the uniform mixing assumption represents a bounding condition.

• To assure compliance with SER commitments, double barrier isolation'of all dilution paths with appropriate administrative control must be demonstrated. In fact, many more closed valves, pulled spoolpieces, elevation differences, etc., may be in place which prohibits dilution through a particular path. In some of these cases, neither verification of barrier position nor administrative control could be assured and no credit was given to these barriers.

Thus, the analysis may be somewhat conservative for many potential dilution paths.  ;

• The quantification performed in this analysis was based on l point estimates of hardware failure and human error probabilities; i.e. error bands were not propagated through the calculation. This approach has been used in other analyses (e.g. Reactor Safety Study Methodology Applications Program) for drawing conclusions about relative and dominant risks.

1 1055Y RA >

4.4 Calculation i

In this section, the details of the boron dilution analysis are provided. They include identification of RCS injection points,

, identification of potential dilution sources of the RCS, estimates of the I

failure probability of individual isolation barriers, and an estimate of the total plant boron dilution probability.

~

4.4.1 Potential RCS Dilution Points Points of potential dilution of the RCS were identified based on a review of P&ID's. At this stage, dilution through any part of the RCS was considered, e.g., core flood tanks, pressurizer, RC pump seals and vessel nozzles. The points of potential dilution of the RCS primary side are listed in Table 4.4-1 and shown schematically as Figure 4.1.

The secondary side of the steam generators was also considered a point of potential RCS dilution. Although the steam generator tubes provide a boundary from the primary system, they were not credited as a dilution barrier because i their integrity above elevation 313' has not been demonstrated for several years. Instead, the approach used in this analysis was to prevent the addition of unborated I

water to the steam generator itself. Isolation of the steam generator is illustrated in Figure 4.2. We have concluded l that the number of barriers isolating the generators and l their small exposure to operator error result in a negligible contribution to the probability of RCS dilution from the l steam generator secondary side. Additional details of the I steam generator analysis are provided in RAS Calculation 4430-84-007.

4 1055Y RA l

Dilution through the top of the open vessel was not explicitly analyzed because the probability of such an event was judged to be exceedingly small. This judgment was based on the following considerations: (1) the vessel will only be

. open for a short interval between removal of the head and

[installationoftheIIFworkplatform,(ii)dilutionwith fire fighting equipment requires the occurrence of a fire and misoperation of the equipment and (iii) dilution via the building sprays requires multiple component failures or human errors.

4.4.2 Potential Dilution Sources Af ter the potential RCS dilution points were identified, flowpaths to these points were tracked back through the plant until a potential dilution source was reached. These sources consist of tanks, coolers, demineralizers, evaporators, heaters, closed cooling water systans and the' fuel pool, i.e., any collection of water that could be a potential source of boron dilution. These dilution sources are shown in Table 4.4-2. No consideration was made of the fact that some sources may only be filled to a partial capacity or may ,

have water borated to some level below the minimum acceptable boron concentration; it is assumed that they could be full of unborated water or other liquid at some time. (An exception is the BWST which was judged not credible to dilute because of the amount of water that would have to be added without detection.) When tracing potential paths from a dilution source, flow was considered possible through either direction of a pipe. Credit was not given to complete prevention of flow by a check valve because small dilution flows may not be adequate to assure seating of the valve; however, a check

! valve was credited as preventing full backflow through a j pipe. Paths leading to drains, atmospheric vents, local

! sampling points, hose nozzles and sumps were assumed not to 1

1055Y RA

be potential dilution paths to the RCS and were not tracked further. The tracking of the flow paths to the dilution sources is presented in RAS Calculation 4430-84-07.

,. One method of reducing the RCS boron dilution probability is I to isolate the sources shown in Table 4.4-2. However, since most sources could communicate with several RCS injection points, isolation of a single source could require more than a dozen isolation barriers. Therefore, because fewer barriers were required, isolation was generally recommended at an RCS injection point. Isolation in this nenner has the effect of isolating all RCS dilution sources, regardless of their volume and minin'izes concern about unborated water in piping. (As noted in Section 4.4.5.2 isolation of several sources which have the volume to dilute the RCS and are at sufficient elevation to gravity feed into the vessel would be an added preventative measure.) ,

1055Y RA

t TABLE 4.4-1 POTENTIAL DILUTION POINTS TO RCS PRIMARY DILUTION POINTS ELEVATION ASSOCIATED YALVE ASME Code Relief Valve 355' RC-RIA ASME Code Relief Valve 355' RC-RIB ENOV with PORV 355' RC-V2 Pressurizer Spray Line 353' RC-V3 Pressurizer Drain Line 310' RC-V106 Pressurizer Vent Line 355' RC-V114 Pressurizer. Sampling Line 310' RC-V117

^

Pressurizer Sampling Line 310' RC-V122 Pressurizer Drain Line 353' RC-V142 LPI Pressurizer Spray Line 353' RC-V149 Pressurizer Drain Line to RC Drain Tank 356' RC-V155 Steam Generator 1A Primary Drain 301' RC-V104A Steam Generator 18 Primary Drain 301' RC-V1048 S.G. IA N2 Primary 81anketing Supply and Vent 365' RC-V100A S.G.18 N2 Primary 81anketing Supply and Vent 365' RC-V1008 Reactor Coolant Pump Cold Leg Drains 314' RC-V118A, C & D Let Down Nozzle (RCP-1A Cold Leg Drain) 314' RC-V121 & RC-V1188 Reactor Vessel Gasket Leakage Recovery Drain 322' RC-V124 Decay Heat Drop Line 314' DH-VI & V171 Core' Flood & LPI Nozzle A 316' CF-VIA & DH-V4A Core Flood & LPI Nozzle 8 316' CF-VIB & DH-V4B Core Flood Nozzle A Drain 316' CF-V121A Core Flood Nozzle 8 Drain 316' CF-V1218 LPI Nozzle 8 Drain 316' CF-V119 Core Flood Tank 1A Drain 318' CF-V102A Core Flood Tank 18 Drain 318' CF-V1028 HPI Injection Nozzle 314' NU-V16A,8,C,0 & V18 RC Pump Seal Injection Returns 316' NU-V33A,8,C.D RC Pump Seal Injection Supply 316' NU-V415A,8,C,0 Decay Heat Line Drain 316' DH-V159A & B Core Flood Tank Vent 342' CF-V3A, 3B Core Flood Tank Bleed Line 336' CF-V2A, 28 Core Flood Tank Fill Line 338' CF-V147 V148 Steam Generator Tubes t

e.

'9 1055Y RA

4- w 4._3

_ a_ ...

-= &_

Op 57PLF E RJD

..n.,

as a. 4 g

• e. =. =

"' - 3 32F gg I fs  ! [ D R "*

E M. m-n E a

s g

6 g

[

j 8

g _ , - . , _

Ia rumac . naam l. ns sans

.., 73 r lM s

.=. ,

=

3 s

-l -p4-

) 6 I th ,

! p 5;,

v- _ v:-Q_ r h --

(j e

p. 4- --+ .. e 41

,,,,m M -

8

$ E'"m">

4

.

\. _ .g X.

I, ..n1, E p W a

.w

[ aan .

n

. g g, ,-

=

m .=. a M.-n2.

_A_A_ -_-- __

q' ,s x._

ar*

N t l

go G 6 W k m.am EM,

% = M_ _., l m., -- ,

"E GB.363 - -bN 8M8 m ggg D&W2 K+18 um I m E-,-8 pughnIf3 FI22M3

/

=.- _.

22.'s ,...

="*

R C i's

- * - _: r..

- . = "10

- =i g,=====

."TA> .g.

JISI$ ==> ->= ggg== =

a s, " "llll*a""n,".a*_il".'!!"

s, v 8

"" 4 aO u"ms . u.s.ia". "Sa"" *'""

r+2.

r =-,.a - 32 _m._..m.,og m g=.

y e .a. t.

.p hhi l

r- + l  ; 1  ; -- -

-_-= e.=w

_=

-=.

= _ . = =-- = . = .

wn t.

==>,- "'

.=3 - . = L"."u."."J'

.. * *. O' "

-. p.3g E"3 queinz *13 F438 l a "3A".;

- - -- T_A

s. ._ y _,. g l *_,,. sa 3 v,e4 w - -

g

-+a g*

C a

~

l* T

-- X I

u v um .n m

-u 4,

==' , , . , . 1$= 3 s ".%"?' B.3,4 ***

==$ -e _ . . . , , ..

x+. ht~ ' ' tw

>"- egg

., gy.u, _ = inv -t i

,m. .., . .m ..: .. s m : ... ,

,,am msm. ....

. _ - - _ . ~ _

e4 1 0 ll .i Il 1

!k!fifif!fb!!  !

3 W

lll

_] E

!$ w! '

bi!Il

! l lg

'-v 1 gy"-

I X! ,

!di I I

11,an n !X 11 lb.~

if ! f _*s 4 Il! g ll i li i vff-si T-!

4G,L i

l

-=

Ii -

li al ,A."

8

!a

% ali e 84 I '

, i 5 II T, eY l 1

, ~T.

i, j. a. 3 .

l ,l a

..l 3 l -

.e a._

m

-2r4+l  :

! 7, i ivf, t-* a gf ~

li 'n B1 l, - ,,, m )!l I! ii 7' 9 i X! g %! l q! O r- " g t!Il ___ ___

lIf j, 5

!$ *! ,! 2 o

' W ifly!f!f!k!f2 I! -

ni3 ii

>; i7..

18

TABLE 4.4-2 POTENTIAL DILUTION SOURCES FOR RCS DILUTION POINTS Centerline Capacity above Capacity Elevation Alarm i (Gallons) (Feet) SetDoint Core Flooding Nake-Up Tank (CA-T-8) 560 333'0" NA Main Condensers (CO-C-1A, 18) 25,610 ea. 282'7" 7.964 Sodium Hydroxide Storage Tank (OH-T-2) 14.285 331'0" 1,473 Decay Heat Rem. Coolers (OH-C-1A, 18) 932 ea. 284'6" NA Demin. Water Storage Tank (DW-T-1) 50,000 313'6" 25,758 Vacuum Degasifier (DW-T-2) 1,575 318'0" NA Unit #1 Demin. Water Storage Tank 1,000,000 329'6" NA Make-Up Tank (MU-T-1) 4,500 312'0" 3,967 Letdown Coolers (MU-C-1A, 18) 111 ea. 286'3" NA RCP Seal Water Coolers (MU-C-2A, 28) 41 ea. 312'0" NA Spent Fuel Coolers (SF-C-1A, 18) 418 ea. 313'8" NA Spent Fuel Demineralizer (SF-K-1) 246 309'0" NA~

4 Fuel Transfer and Storage Pools 690,000 327'0" NA

! Reactor Bldg. Sump 2,514 279'6" NA RC Bleed Tanks (WOL-T-1A, 18, 1C) 82,286 ea. 291'6" NA i Misc. Waste Holdup Tank (WOL-T-2) 19,518 312'0" NA RC Orain Tank (WOL-T-3) 7,240 289'0' 1,140 n1U&P Demineralizers (MU-K-1 A,18) 570 ea. 309'0" NA Condensate Store. Tanks (C0-T-1 A,18) 250,000 ea. 321'6" 98,485' Giand Steam Condenser (GS-C-1) 244 307'0" NA Feedwater Drain Coolers (FW-C-1 A, .18) 2.163 ea. 294'6" NA Feedwater Heaters (FW-J-5A, 58) 7,932 ea. 336'0" NA Feedvater' Heaters (FW-J-6A, 68) 13,965 ea. 311'0' NA Int. LCW Coolers (IC-C-1A, 18) 645 ea. 313'0" NA Nuc. Service CCW Coolers (NS-C-1A, 18) 1,949 ea. 313'0" NA Ammonium Hydroxide Feed Tank (AM-T-1) 150 283'0" 106 Hydrazine Feed Tank (AM-T-2) 150 283'0" 106

Ammonium Hydroxide Mix Tank (AM-T-7) 60 283'6" NA

! Boric Acid Mix Tank (CA-T-1) 7,590 338'0" 6,415 Lithium Hydroxide Mix Tank (CA-T-3) 50 335'0" NA Sod. Thio. & Cause. Mix Tank (CA-T-5) 200 334'0' NA Sulphuric Acid Mix Tank (CA-T-9) 200 336'0" NA Of f-Spec. Water Rec. Bat. Tank (CC-T-1) 85,978 324'6" 80,020 Regeneration Tank (CO-T-2) 1,866 289'6" NA l Mixing & Storage Tank (CD-T-3) 1,911 289'6" NA l Hot Water Tank (CO-T-4) 936 288'0' NA Reactor Coolant Evaporator (WOL-Z-1) 3,541 291'6" NA Debor. Demineralizers (WOL-K-1 A,18) 1,517 ea. 312'O' NA Clean-up Demineralizers (WOL-K-2A, 28) 253 ea. 286'0" NA Evap. Cond. Demin. (WOL-K-3A, 38) 248 ea. 286'0" NA Aux. 81dg. Sump Tank (WOL-T-5) 3,155 286'0" NA

, 1055Y RA

> = ~ - ~ - ,_ . - . - - n,,- , , , - - - - , - , - , - , _ , , , - - - - _ , - , , , , , - , --,__yg.,,---, ---,-m,____-,,,,m-,g,-,.v-n,,n_,,_,w.. e- - , ,,,-g,

TABLE 4.4-2 POTENTIAL DILUTION SOURCES FOR RCS DILUTION POINTS (Continued)

Centerline Capacity above Capacity Elevation Alarm j (Gallons) (Feet) Setpoint i,

Neutralizer Tanks (WOL-T-8A, 88) 9,646 ea. 291'0' NA l Evap. Cond. Tanks (WOL-T-9A, 98) 11,860 ea. 291'6" NA Spent Resin Store. Tanks (WOS-T-1A, 18) 3,861 ea. 288'6" NA -

Concentrated Waste Tank (WOS-T-2) 9,646 334'9" 8,224 -

Reclaimed Boric Acid Tank (WOS-T-3) 9,646 291'0" 8,224 Clarif. Coagulator Floc Tank (WT-T-1) 350 311'O' NA Clearwell Tank (WT-T-2) 50,000 289'O' NA Caustic Feed Tank (WT-T-6) 340 309'O' NA Sodium Sulphite Store. Tank (WT-T-11) 50 309'0" NA Mixed Bed Demineralizers (WT-K-3A, 38) 1,249 ea. 284'0" NA Clean Water Receiving Tank (CC-T-2) 133,689 322'6" 130,137 SOS Monitor Tanks (SDS-T-1A, 18) 12,000 ea. 322'0" 10,530 Processed Water Store. Tanks (PW-T-1,2) 500,000 ea. 322'0' NA Mech. Draf t Cooling Tower (CW-C-2) NA 1 Represents the maximum volume of 11guld that could be removed from

, dilution source before a level alarm is activated. 'NA" means that no alarm is in use.

t 1055Y RA

- - - - -- . , _ - - - - . _ . , , , , _ _ . _ _ - _ _w-,__,.w. , - _ _ - - , _-__.---_-__-.,.---.m . , _ , - , _ . , - - -

4.4.3 Isolation Barriers Preventing flow through all of the RCS injection points in Table 4.4-1 will prevent dilution of the RCS through piping interfaces during static conditions. To prevent

potential inflow, the TMI-2 Safety Evaluition Reports  !

(SERs) have committed to a double barrier configuration consisting of a combination of removed spoolpieces, closed valves, heat exchanger tubes or pumps (with elevation or head difference). Thus,afirstprior$iyof this analysis has to ensure that the SER commitment was met. Where possible, we employed the additional constraint that the barriers be ' independent" which, from a reliability viewpoint, minimizes concern about common mode failures due either to physical effects or operator error (Reference g).

In the level control mode, with no water processing (static conditions), it was found that there are 404 paths that require closure to isolate all of the RCS injection points. The isolation of the 404 RCS injection paths is achieved with a total of 125 components which are identified in Table 4.4-3. Table 4.4-3 represents a set of components which have been agreed to by RAS, SRG and Site Operations and have been placed on a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> j checklist for isolation of the RCS during static  ;

! conditions. This checklist is Appendix C to Operating Procedure 2104-10.2. (Also included in Appendix C to 2104.10.2 are valves recommended in Appendices A and B which isolate during IIF fill and feed / bleed.)

l In Table 4.4-4, the suggested isolation barriers are grouped according to the functional area of the RCS with i

l which they are associated. This grouping illustrates the double barrier isolation achieved for each potential j dilution path.

1055Y RA

Table 4.4-3 1 i

Isolation Barriers to be Placed on 24-hour Checklist Durina Static Conditions BS-V3A CF-V146 IC-V3 MU-V144C SNS-V23 WOL-V523 BS-V3B / DH-V3 IC-V4 MU-V169 SNS-V50 WOL-V543A BS-V134 OH-V4A IC-V5 MU-V224A SNS-V53 WOL-V5438 BS-V139A DH-V4B MU-V8 MU-V224B SNS-V128 WOL-V994 BS-V1398 OH-VSA MU-V10 MU-V226 SNS-V140 WOL-V996 CA-V104 DH-V5B MU-V12 MU-Y289 SNS-VISO WOL-V1091 CA-V107 OH-V7A MU-V13 MU-V294 SNS-V158 WOL-V1092 CA-Vill DH-V78 MU-V16A MU-V319 WDG-V2 WOL-Y1125 CA-V112 DH-V100A MU-Y16B MU-V376 WOG-V199 WOL-V1152 CA-V136 DH-V1008 MU-V16C MU-V378 WOL-V22 WOL-V1171 CA-V138 DH-V109 MU-V160 MU-V439 WOL-V288 CA-V140 DH-V120 MU-V18 NM-V52 WOL-V29B ,

CA-V173 DH-V128A MU-V25 NM-V104 WOL-V37 )

CA-V175 DH-V1288 MU-V27 RC-VII7 WOL-V59

\

CF-VIA OH-V134A MU-V28 RC-V122 WOL-V65A CF-V18 DH-V1348 MU-V36 RC-V123 WOL-V81A CF-V3A DH-V187 MU-V37 SF-V122 WOL-V818 CF-V3B DW-V101A MU-V107A SF-V133 WOL-V118A CF-V107 DW-Y1018 MU-V1078 SF-V186 WOL-V1188 CF-V114A DW-V195 MU-V127 SF-V214 WOL-V153A CF-V114B DW-V227 MU-V133 SF-V217 WOL-V521A CF-V115 DW-V238 MU-V144A SN-V182 WOL-V5218 CF-V145 DW-V465 MU-V1448 SNS-V20 WOL-V521C

. 1055Y RA l

Table 4.4-4  ;

Double Barrier Isolation Confiourations for Potential Oilution Paths (The barrier combinations in this table are composed of various

. combinations of the valves listed in Table 4.4-3)

I. N0ZZlES A. HPI: 1. MU-V16A -- MU-V144A

2. MU-V16A -- MU-V1448

3. MU-V16A -- MU-V144C

4. MU-V16A -- MU-V289

5. MU-V16A -- MU-V133

6. MU-V16A -- MU-V127

7. MU-V16A -- CA-V107

8. MU-V16A -- CA-V112

9. MU-V16A -- SN-V182

10. MU-V16A -- MU-V8

11. MU-V16A -- MU-V10

12. MU-V16A -- MU-V319

13. MU-V16A -- CF-V145

14. MU-V16A -- CF-V146

15. MU-V16A -- CA-V175

16. MU-V168 -- MU-V144A

17. MU-V168 -- MU-V1448

18. MU-V168 -- MU-V144C

19. MU-V168 - MU-V289

20. MU-V168 -- MU-V133

21. MU-V168 - MU-V127

22. MU-V168 -- CA-V107

23. MU-V168 -- CA-V112

24. MU-V168 -- SN-V182

25. MU-V168 -- MU-VB

26. MU-V168 -- MU-V10 1055Y RA

__,.__,_.,.~.___.__ ___ _ --

I. N0ZZLES (continued) 1 l

27. MU-V168 -- MU-V319 4

28. MU-V168 -- CF-V145

~

29. MU-V168 -- CF-V146

[ 30. MU-V168 -- CA-V175 )

31. MU-V16C -- MU-V144A

32. MU-V16C -- MU-V1448 l

33. MU-V16C -- MU-V144C

34. MU-V16C -- MU-V289

35. MU-V16C -- MU-V133

36. MU-V16C -- MU-Y127

37. MU-V16C -- CA-V107

38. MU-V16C -- CA-V112

39. MU-V16C -- SN-V182

40. MU-V16C -- MU-V8

41. MU-V16C -- MU-VIO

42. MU-V16C -- MU-V319 .

43. MU-V16C -- CF-V145

44. MU-V16C -- CF-V146

45. MU-V16C -- CA-V175

46. MU-V160 -- MU-V144A

47. MU-V160 -- MU-V144B

48. MU-V160 -- MU-V144C

49. MU-V160 -- MU-V289

50. MU-V160 -- MU-V133

51. MU-V160 -- MU-V127

52. MU-V16D -- CA-V107

53. MU-V160 -- CA-V112

54. MU-V160 -- SM-V182

55. MU-V160 -- MU-V8

56. MU-V160 -- MU-V10

57. MU-V16D -- MU-V319

58. MU-V160 -- CF-V145

59. MU-V160 -- CF-V146

60. MU-V160 -- CA-V175 1055Y RA

I. N0ZZLES (continued)

61. MU-V18 -- MU-V144A

62. MU-V18 -- MU-V144B

63. MU-V18 -- MU-V144C

[ 64. MU-V18 -- MU-V289

65. MU-V18 -- MU-V133

66. MU-V18 -- MU-V127

67. MU-V18 -- CA-V107

68. MU-V18 -- CA-V112

69. MU-V18 -- SN-V182

70. MU-V18 -- MU-V8

71. MU-V18 -- MU-V10

72. MU-V18 -- MU-V319

73. MU-V18 -- CF-V145

74. MU-V18 -- CF-V146

75. MU-V18 -- CA-V175 B. LPI and Core Flood:

1. DH-V4A -- DH-V109

2. DH-V4A -- DH-V120

3. DH-V4A -- OH-V128A

4. DH-V4A -- DH-V1288

5. DH-V4A -- DH-V7A j 6. DH-V4A -- DH-V78

7. DH-V4A -- SNS-V53

8. DH-V4A -- SNS-V128

9. DH-V4A -- SNS-V140

10. DH-V4A -- SNS-V158

11. DH-V4A -- DW-V238

12. DH-V4A -- DW-V465

13. DH-V4A -- M0H-HX-1A (tubes)

14. DH-V4A -- MOH-HX-18 (tubes)

15. DH-V48 -- DH-V109 l 16. DH-V48 -- DH-V120

. 1055Y RA

I. N0ZZLES (continued)

17. DH-V4B -- DH-V128A

18. OH-V4B -- OH-V1288

19. DH-V4B -- OH-V7A

[ 20. DH-V4B -- DH-V78

21. DH-V4B -- SNS-V53

22. DH-V4B -- SNS-V128

23. DH-V4B -- SNS-V140

24. DH-V4B -- SNS-V158

25. DH-V4B -- DW-V238

26. DH-V4B -- DW-V465

27. DH-V4B -- MDH-HX-1A (tubes)

28. DH-V4B -- MDH-HX-18 (tubes)

C. Letdown:

1. MU-V376 -- CA-V136

2. MU-V376 -- CA-V140

3. MU-V376 -- CF-V107

4. MU-V376 -- MU-R3

5. MU-V376 -- MU-V8

6. MU-V376 -- MU-V10

7. MU-V376 -- MU-V107A

8. MU-V376 -- MU-V1078

9. MU-V376 -- MU-V169

10. MU-V376 -- MU-V224A

11. MU-V376 -- MU-V2248

12. MU-V376 -- MU-V226

13. MU-V376 -- MU-V294

14. MU-V376 -- MU-V319

15. MU-V376 -- SF-V214

16. MU-V376 -- WOL-V288

17. MU-V376 -- WOL-V298

18. MU-V376 -- WOL-V37

19. MU-V376 -- WOL-V59 1055Y RA

I. N0?ZLES (continued)

20. MU-V376 -- WOL-V65A

21. MU-V376 -- WOL-V81A

,22. MU-V376 -- WOL-V818

[ 23. MU-Y376 -- WOL-V118A

24. MU-V376 -- WOL-V1188

25. MU-V376 - WOL-V153A

26. MU-V376 - WOL-V521 A

27. MU-V376 - WOL-V5218

28. MU-V376 - WOL-V521C

29. MU-V376 - WOL-V523

30. MU-V376 -- WOL-V543A

31. MU-V376 -- WOL-V5438

32. MU-V376 -- WOL-V994

33. MU-V376 -- WOL-V996

34. MU-V376 -- WOL-V1091

35. MU-V376 -- WOL-V1092

36. MU-V376 -- WOL-V1125

37. MU-V376 -- WOL-V1152

38. MU-V376 -- WOL-V1171 l 39. MU-V376 - WOL-T-18

40. MU-C-1 A (tubes) - IC-V3

41. MU-C-1A (tubes) -- IC-V4

42. MU-C-1A (tubes) -- IC-V5 l 43. MU-C-18 (tubes) - IC-V3

44. MU-C-18 (tubes) - IC-V4

45. MU-C-18 (tubes) - IC-V5 D. Decay Heat Drop 11ne:

1. DH-V3 - OH-V100A

, 2. DH-V3 -- DH-V1008 l

l 3. DH-V3 -- SNS-V53

4. DH-V3 -- SNS-V128

5. DH-V3 -- SNS-V140 i

1055Y RA

I. N0ZZLES (continued)

6. OH-V3 -- SNS-V158

7. OH-V3 - MOH-HX-1 A (tubes)

,. 8 . DH-V3 - MOH-HX-18 (tubes)

! 9. DH-V3 -- DW-V238

10. DH-V3 -- DW-V465 II. CORE FLOOD TANKS A. 81eed:

1. CF-VIA -- CF-V115 -- (CF-V107) (check valve)

2. CF-V18 - CF-V115 - (CF-V107) (check valve)

B. Fill:

1. CF-VIA -- CF-V146

2. CF-V18 -- CF-V145 III. PRESSURIZER SPRAY A. LPI Supply:

1. DH-V187 -- DH-V128A

2. OH-V187 -- OH-V1288 IV. REACTOR COOLANT PUMP SEAL WATER l

i A. Injection (via MU-V330, 378, and 439)I :

1. MU-V378 - MU-V144A

2. MU-V378 - MU-V1448 Barrier combinations 31 through 219 provide double barrier isolation of potential injection paths through MU-V330. The same barriers also result in triple barrier isolation of MU-V378 and MU-V439. Further, these barriers act as an additional barrier for paths through MU-V16's.

1055Y RA

IV. REACTOR COOLANT PUMP SEAL WATER (continued)

3. MU-V378 -- MU-V144C

4. MU-V378 -- MU-V289

5. MU-V378 -- MU-V133

[ 6. MU-V378 -- MU-V127

7. MU-V378 -- CA-V107

8. MU-V378 -- CA-V112

9. MU-V378 -- SN-V182

10. MU-V378 -- MU-V8

11. MU-V378 -- MU-V10

12. MU-V378 -- MU-V319

13. MU-V378 -- CF-V145

14. MU-V378 -- CF-V146

15. MU-V378 -- CA-V175

16. MU-V439 -- MU-V144A

17. MU-V439 -- MU-V1448

18. MU-V439 -- MU-V144C

19. MU-V439 -- MU-V289

20. MU-V439 -- MU-V133

21. MU-V439 -- MU-V127

22. MU-V439 -- CA-V107

23. MU-V439 -- CA-V112

24. MU-V439 -- SN-V182

25. MU-V439 -- MU-V8

26. MU-V439 -- MU-V10

27. MU-V439 -- MU-V319

28. MU-V439 -- CF-V145

29. MU-V439 -- CF-V146

30. MU-V439 -- CA-V175

31. MU-V144A -- DH-VSA

32. MU-V144A -- DH-V58

33. MU-V144A -- DH-V7A

34. MU-V144A -- DH-V78

35. MU-V144A -- DH-V128A l 36. MU-V144A -- DH-V1288 I

. 1055Y RA  ;

l IV. REACTOR COOLANT PUNP SEAL WATER (continued) l

37. MU-V144A - DH-C-1A (tubes)

38. MU-V144A -- OH-C-1B (tubes)

, 39. MU-V144A -- DH-V109 I 40. MU-V144A -- DH-V134A

41. MU-V144A -- DH-V134B

42. MU-V144A -- SF-V122

43. MU-V144A -- SF-V133

44. MU-V144A -- SF-V186

45. MU-V144A -- SF-V214

46. MU-V144A -- SF-V217

47. MU-V144A -- SF-C-1A (tubes)

48. MU-V144A -- SF-C-1B (tubes)

49. MU-V144A -- SF-K-1 2

50. MU-V144A -- BS-V3A

51. MU-V144A -- BS-V3B

52. MU-V144A -- MU-V12

53. MU-V144A -- MU-V36 Ss. MU-V144A -- OH-V120

55. MU-V144A -- CA-V175

56. MU-V144A -- DW-V195

57. MU-V1448 -- DH-VSA

58. MU-V1448 -- OH-V5B

! 59. MU-V1448 -- DH-V7A

60. MU-V1448 -- OH-V78 i 61. MU-V1448 -- OH-V109

62. MU-V1448 -- DH-V120

63. MU-V1448 -- OH-V128A

64. MU-V1448 -- OH-V1288

65. MU-V1448 -- DH-V134A

66. MU-V1448 -- OH-V1348

67. MU-V1448 -- DH-C-1A (tubes)

68. MU-V1448 -- OH-C-18 (tubes)

69. MU-V1448 -- BS-V3A

70. MU-V1448 -- BS-V3B Represents components in vent header system which must fall to allow flow,' (e.g., check valves) but cannot be placed on a daily checklist.

1055Y RA

IV. REACTOR COOLANT PUMP SEAL WATER (continued)

71. MU-V144B -- CA-V175 )

72. MU-V1448 -- DW-V195  !

73. MU-V1448 -- SF-V122

[ 74. MU-V1448 -- SF-V133 l

75. MU-V144B -- SF-V186

76. MU-V1448 -- SF-V214

77. MU-V144B -- SF-V217

78. MU-V1448 -- SF-C-1A (tubes)

79. MU-V144B -- SF-C-18 (tubes)

80. MU-V1448 -- MU-V12

81. MU-V1448 -- MU-V36 2

82. MU-V144B -- SF-K-1

83. MU-V144C -- DH-VSA

84. MU-V144C -- DH-V5B

85. MU-V144C -- DH-V7A

86. MU-V144C -- DH-V78

87. MU-V144C -- DH-V109

88. MU-V144C -- DH-V120

89. MU-V144C -- DH-V128A

90. MU-V144C -- OH-V1288

91. MU-V144C -- DH-V134A

92. MU-V144C -- DH-V1348

93. MU-V144C -- OH-C-1A (tubes)

94. MU-V144C -- OH-C-1B (tubes)

95. MU-V144C -- BS-V3A

96. MU-V144C -- 8S-V3B

97. MU-V144C -- CA-V175

98. MU-V144C -- DW-V195

99. MU-V144C -- SF-V122 100. MU-V144C -- SF-V133 101. MU-V144C -- SF-V186 102. MU-V144C -- SF-V214 103. MU-V144C -- SF-V217 Represents components in vent header system which must fall to allow flow, (e.g., check valves) but cannot be placed on a daily checklist.

1055Y RA

_ . _ _ _ _ _ _ _ _ _ _ _ - - _ _ _ _ . _.___________.____-__L____._.._____--

IV. REACTOR COOLANT PUMP SEAL WATER (continued) i 104. MU-V144C -- SF-C-1A (tubes) 105. MU-V144C -- SF-C-18 (tubes) 2 106. MU-V144C -- SF-K-1

.107. MU-V144C -- MU-V12 108. MU-V144C -- MU-V36 109. MU-V8 -- CA-V136 110. MU-V8 -- CA-V140 111. MU-V8 -- CF-V107 112. MU-V8 -- MU-VIO 113. MU-V8 -- MU-V107A 114. MU-V8 -- MU-V1078 115. MU-V8 --.MU-V169 116. MU-V8 -- MU-V224A 117. MU-V8 -- MU-V2248 118. MU-V8 - MU-V226 119. MU-V8 -- MU-V294 120. MU-V8 -- MU-V319 121. MU-V8 -- SF-V214 122. MU-V8 -- WCL-V288 123. MU-V8 -- WOL-V29B 124. MU-V8 -- WOL-V37 125. MU-V8 -- WOL-V59 126. MU-V8 -- WOL-V65A 127. MU-V8 -- WOL-V81A 128. MU-V8 -- WOL-V818 129. MU-V8 -- WOL-V118A 130. MU-V8 -- WOL-V1188 131. MU-V8 -- WOL-V153A 132. MU-V8 -- WOL-V521A 133. MU-V8 -- WOL-V5218 134. MU-V8 -- WOL-V521C Represents components in vent header system which must fall to allow flow. (e.g., check valves) but cannot be placed on a daily checklist.

. 1055Y RA

IV. REACTOR COOLANT PUMP SEAL WATER (centinuid) 135. MU-V8 -- WOL-V523 136. MU-V8 -- WOL-V543A 137. MU-V8 -- WOL-V5438 138. MU-V8 -- WOL-V994 139. MU-V8 -- WOL-V996 140. MU-V8 -- WOL-V1091 141. MU-V8 -- WOL-V1092 142. MU-V8 -- WOL-V1125 143. MU-V8 -- WOL-V1152 144. MU-V8 -- WOL-V1171 2

145. MU-V8 -- WOL-T-18 146. MU-V289 -- MU-C-2A (tubes) 147. MU-V289 -- MU-C-28 (tubes) 148. MU-V289 -- DW-V227 149. MU-V133 -- MU-V13 150. MU-V133 -- MU-V27 151. MU-V133 -- MU-V28 152. MU-V133 -- MU-V169 2

153. MU-V133 -- MU-T-1 154. MU-V127 -- CA-V138 155. CA-V107 -- CA-V104 156. CA-V107 -- CA-VIII 157. CA-V112 -- CA-V104 158. CA-V112 -- CA-Vill 159. MU-V10 -- CA-V136 160. MU-V10 -- CA-V140 161. MU-V10 -- CF-V107 162. MU-V10 -- MU-V169 163. MU-V10 -- MU-V294 164. MU-V10 -- SF-V214 165. MU-V10 -- WOL-V288 166. MU-VIO -- WOL -V298  :

167. MU-V10 - WOL-V37 168. MU-V10 -- WOL-V59 Represents components in vent header system which must fall to allow flow (e.g., check valves) but cannot be placed on a daily checklist.

, 1055Y RA

IV.REACTORCOOLANTPUMPS[ALWATER(continued) 169. MU-VIO -- WOL-V65A 170. MU-V10 -- WOL-V81A 171. MU-V10 -- WOL-V818

I72. MU-V10 -- WOL-V118A 173. MU-V10 -- WOL-V1188 174. MU-V10 -- WOL-V153A 175. MU-V10 -- WOL-V521A 176. MU-VIO -- WOL-V5218 177. MU-V10 -- WOL-V521C 178. MU-V10 -- WOL-V523 179. MU-V10 -- WOL-V543A 180. MU-V10 -- WOL-V5438 181. MU-VIO -- WOL-V994 182. MU-V10 -- WOL-V996 183. MU-VIO -- WOL-V1091 184. MU-V10 -- WOL-V1092 185. MU-V10 -- WOL-V1125 186. MU-V10 -- WOL-V1152 187. MU-V10 -- WOL-V1171 188. MU-Y319 -- CA-V136 189. MU-V319 -- CA-Y140 190. MU-V319 -- CF-V107 191. MU-V319 -- MU-V169 192. MU-V319 -- MU-V294 )

193. MU-V319 -- SF-V214 194. MU-V319 -- WOL-V288 195. MU-V319 -- WOL-V298 s 196. MU-V319 -- WOL-V37 197. MU-V319 -- WOL-V59 l

198. MU-V319 -- WOL-V65A

{

199. MU-V319 -- WOL-V81A 200. MU-Y319 -- WOL-V818 201. MU-V319 -- WOL-V118A 202. MU-V319 -- WOL-V1188 1055Y RA

IV. REACTOR COOLANT PUMP SEAL WATER (continued) 203. MU-V319 -- WOL-V153A 204. MU-V319 -- WOL-V521A i 205. MU-V319 -- WOL-VS21B  ;

.706. MU-V319 -- WOL-V521C 207. MU-V319 -- WOL-V523 208. MU-V319 -- WOL-V543A 209. MU-V319 -- WOL-V5438 210. MU-V319 -- WOL-V994 211. MU-V319 -- WOL-V996 212. MU-V319 -- WOL-V1091 213. MU-V319 -- WOL-V1092 214. MU-V319 -- WOL-V1125 215. MU-V319 -- WOL-V1152 216. MU-V319 -- WOL-V1171 217. CF-V145 -- CF-V114A 218. CF-V146 -- CF-V1148 219. CA-V175 -- CA-V173

8. Discharge:

1. MU-V25 -- MU-V289

2. MU-V25 -- MU-V37

3. MU-V25 -- DW-V227

4. MU-V25 -- MU-C-2A (tubes)

5. MU-V25 -- MU-C-28 (tubes)

V. NITROGEN PRESSURE AND BLANKETING A. Steam Generators and Pressurizer:

1. MM-V104 -- NM-VS2 -- (elevation difference) 1055Y RA

~._._________-___.- _

8. Core Flood Tanks:

1. CF-V114A -- NM-V104 -- (NM-V52)

2. CF-V1148 -- NM-V104 -- (NM-V52)

VI.SAMPLINGdINES A. Pressurizer:

1. RC-V117 -- SNS-V20 -- (SNS-V23)

2. RC-V117 -- SNS-V50 -- (SNS-VIS0)

3. RC-V122 -- SNS-V20 -- (SNS-V23)

4. RC-V122 -- SNS-V50 -- (SNS-VISO)

8. Letdown:

1. RC-V123 -- SNS-V20 -- (SNS-V23)

2. RC-V123 -- SNS-V50 -- (SNS-VIS0)

VII. VENTS A. Steam Generators and Pressurizer:

1. WOG-V2 -- WOG-V199 -- (elevation difference)

B. Core Flood Tanks:

1. CF-VIA -- CF-V3A -- (WOG-V2)

2. CF-V18 -- CF-V38 -- (WOG-V2)

VIII. ORAINS A. RCS Orain Lines:

1. WOL-V22 -- WOG-V1125 1055Y RA

IX. DEMINERALIZED WATER A. Building Spray System:

,. 1 . DW-V101 A - BS-V139A -- (BS-V3A) i 2. DW-V101B -- 8S-V139B -- (8S-V38)

3. DW-V4A -- BS-V134

4. DW-V4B -- 8S-V134 1055Y RA

4.4.4 Failure Probability per Pathway 8ecause of the possibility that some pathways may have additional barriers in place at various times, or that could not be accounted for, it was assumed that the boron

dilution probability for a pathway is equivalent to the failure probability of the identified isolation barrier configuration for that pa'thway. This probability is a i function of hardware faults and human error. Hardware faults are the easier of the two to estimate:

TA8LE 4.4-5 .

H HARDWARE FAILURE PR08A8ILITIES FOR VARIOUS TYPES OF DILUTION 8ARRIERS HARDWARE 8ARRIER FAILURE PROBABILITY SOURCE OF ESTIMATE Removed Spoolpiece: Negligible RAS Closed MOV; A0V:I Leak 6.3 x 10-3/yr NPRD A02/A03 Rupture 8.8 x 10-5/yr WASH-1400, Table III 2-1 Circuit Short to Power 8.8 x 10-5/yr WASH-1400, Table III 4.2 Closed Manual Valve:

Leak 6.3 x 10-3/yr NPRD A02/A03 l

Rupture 8.8 x 10-5/yr WASH-1400, Table III 4.2 Pump:2 l

Circuit Short to Power 8.8 x 10-5/yr WASH-1400, Table III 4.2 l

Heat Exchanger; Coolers:

Leak 2.1 x 10-2/yr NPRD A02/A03 I

i I NOV - Motor Operated Valve; A0V - Air Operated Valve 2 Pump required because of elevation / pressure differential; a pump is not l

l considered a barrier if gravity feed is possible.

l l

i 1055Y RA

i Human error is the more difficult to assess. The assessment is complicated because of the variety of " performance shaping factors" that exist over the range of conditions that must be encompassed by this analysis. For example, some valves which are used as isolation barriers may be siellar in appearance, location, position, etc., to other valves which are manipulated for various recovery operat{onst thus the potential for operator error in these cases is

{

higher than for isolation valves which are in remote locations and could not logically be associated with recovery operations. A detailed analysis is not feasible for each particular isolation barrier. Rather a generic analysis was j performed for each type of barrier using characteristics that apply to all barriers of that type. Thus, in many cases the results may be conservative l for a particular barrier.

The human error of concern is that plant personnel will accidentally defeat an '

isolation barrier. Three categories of error can be postulated to defeat an isolation barrier.

Type I: Operator. erroneously selects an isolation barrier when he intends to interact with another component.

Type II: Operator fails to completely or correctly implement procedure.

l s

Type III: Errors in the preparation of plant procedures. ,

)

Other possible errors exist when an operator interacts with a valve but their l probabilities have been judged to be small relative to those of the above j categories. One such error is the " reversal" error, i.e. an operator cycles the desired valve as directed but closes it instead of opening it, or vice versa. For this to result in an incorrect valve position, two errors would have to occur. First, the valve would have to be in an incorrect or l unexpected position initially and second, an operator must fall to recognize that it was already in the position he desired. This error was estimated to l have a negligible probability in NUREG/CR-1278 (Chapter 14). The other 1

possible error is referred to as " stuck valve", e.g., the possibility that a valve may not be fully shut after an attempt to shut it. The detection of l

j 1055Y RA 4

,__-._..ym..__..,_ ..-.__ .. ,. ,_ __

,,.m._._ - _m.,_ , , . . . . , . . . - _ _ _ - _ _ . _ _ . . _ m_

1 this type of error is a function of the valve type, (e.g., rising stem), or whether there is position indication. In NUREG/CR-1278, the probability of a valve sticking in this manner was estimated as 0.001 per demand; failure to detect this error for a valve with neither a rising stem or position indicator was estimated (, Table 14-2, NUREG/CR-1278) as 0.01/ demand. This error would be l

more likely to be detected in valves with position indication. Thus, the probability of this type of error should be no higher than 10 '/ demand per valve which is small in relation to the Type I selection error. At TNI-2,

, there is the unique case in which the detection of partially open valves may be difficult because checking requires a man rem exposure; thus some valves i

are not checked routinely in order to keep exposure as low as reasonably achievable. With the passage of time, fewer of these valves will be

! considered to have ALARA concerns which will assure that the probability of this type of error remains negligible.

TYPE I The following table provides information used to determine the applicable human error probabilities for a Type I error. The asterisk indicates the generic value used for this study.

i i

j 1055Y RA

t TABLE 4.4-6 PROBASILITY OF SELECTION (TYPE I) ERRORS l

PERFORMANCE PROBABILITY OF SOURCE OF BARRIER SHAPING FACTOR OF ERROR ESTIMATE NOV; A0V Valyhcontrolsidentified 3 x 10-3/ demand Table 20-12 1

by labels only NUREG/CR-1278

, Valve controls in well 1 x 10-3/ demand

• Table 20-12 delineated functional groups NUREG/CR-1278 Valve controls part of well- 5 x 10-4/ demand Table 20-12 defined mimic layout NUREG/CR-1278 Manual Clearly and unambiguously .1 x 10-3/ demand Table 20-13 Valve labelled; set apart from all NUREG/CR-1278 valves with any similarities in size, shape, state, presence of tags

}

Clearly and unambiguously 3 x 10-3/ demand Table 20-13 i labelled, part of a valve NUREG/CR-1278 l group with similarities in one of the following: size, shape. -

state, presence of tags As above, but with " Level l' 1 x 10-3/ demand

• Table 20-15 l tagging ** .NUREG/CR-1278 4

Unclearly or ambiguously 1 x 10-2/ demand Table 20-13 labelled, part of a valve group NUREG/CR-1278 that is similar in all of the following: size, shape, state presence of tags Spoolpiece Unclearly or ambiguously 5 x 10-3/ demand Table 20-13 labelled, set apart from spool NUREG/CR-1278 pieces that are similar in all of the following: size, shape, presence of tags Unclearly or ambiguously 8 x 10-3/ demand Table 20-13 labelled, part of a group of NUREG/CR-1278 pieces that are similar in one of the following: size, shape, presence of tags 1055Y RA i

. _ _ . . _ _ _ . _ . _ . . _ _ _ _ . _ _ . . _ . , . _ _ _ _ . . _ , . _ . . _ _ _ _ _ , __....__._...___..._._.___._._______...[__.~.________._.___. .

l l

l TABLE 4.4-6 (Continued)  ;

PERFORMANCE PROBABILITY OF SOURCE OF BARRIER SHAPING FACTOR OF ERROR ESTIMATE Same as above but accounting 8 x 10-5/ demand

• RAS for 90% recovery factors for eachrof: (1) the required opening of red tagged and identified valves around the spoolpiece; (ii) physical effects such as water flowing /

not flowing in expected locations Heat N/A Exchanger Pump Pump controls identified by 3 x 10-3/ demand Table 20-12 labels only NUREG/CR-1278 Pump controls in well defined 1 x-10-3/ demand

• Table 20-12 functional groups NUREG/CR-1278 Pump controls part of well 5 x 10-4/ demand Table 20-12 defined mimic layout NUREG/CR-1278

• Generic value forning the basis of the analysis; however, value was sometimes modified to reflect plant specific conditions e.g. number of valves on a control panel.

• • The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> checklist procedure, by which red-tagged valves are checked against a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> valve lineup list, was judged equivalent to the " Level l' tagging scheme defined in NUREG/CR-1278.

1

, 1055Y RA

- - . - .. - . . - - - - . - - . - -- - = _ . . _ - _ - - - . . - . .

TYPE II The maintenance of the RCS and all plant maneuvers required for the recovery are performed in accordance with written procedures. A Type II error refers to two categories of errors relating to the incorrect use of. procedures which could defeat an isolation barrier. Specifically, Type II errors are (1) selecting and ja'plementing an incorrect procedure, referred to as Type iia and (11) skipping a step or steps in the correct procedure, referred to as Type iib. These errors are of particular concern because more than a single isolation barrier may be affected; 1.e., a common mode failure.

TYPE iia Each operating procedure at TMI-2 is designed to maintain the plant in a safe condition. Thus, the implementation of any single procedure will not result lnalignmentofadilutionsourcetotheRCS. However, the concern with a Type iia error is that the valve lineup associated with an incorrect procedure may be partially implemented before the incorrect procedure is recognized.

That valve lineup combined with the valve lineup associated with the correct procedure may result in inadequate isolation of the RCS.

There seems to be little-information in the human factors literature describing the Type iia error. The closest error having any relationship to a

! Type iia that has been analyzed is one in which the operator must make a diagnostic decision in response to an abnormal event. In those events, the median probability of improper diagnosis by the entire control room staff,

~

given an extended time period for making a decision, can approach 10 ' per act. Based on discussions with operating personnel, a TMI-2 procedure can be selected and implemented by a single control room operator; this approach tends to make a Type iia error more prob:ble than if a procedure selection were confirmed by a second person. However, the selection of an operating procedure is made under low stress, practiced situations, which would tend to minimize the Type iia error. Further, the implementation of an improper procedure should not cause a boron dilution event in the absence of other errors. Once the selection of an incorrect procedure is identified, it is presumed that the operators will restore the plant to its original configuration before implementing the appropriate procedure. Thus, given the 1055Y RA 1

i

-,.-- --- - - - - . .

• _ ___- .,-.. ,.~. - m,w, _ . - _ , - - _ . - - . .-,,,_---.,..,_,..__-m.me., ,- - - - - , , - ,_ ---,,mm--._,_e__e.vy

-J - -

low likelihood of the initial error and the possibility for recovery of that error, a Type iia error is judged to be snell relative to other contributors to the boron dilution probability.

TYPE iib .

A Type iib error assumes that the correct procedure is in use, but the operator does not follow it; for example, a step is skipped or a section of the procedure is omitted. In many cases, the procedure step that is skipped may simply have been to verify that a barrier was in its proper condition. In

-other cases, however, the omitted step may have called for closing a valve.

If an entire section of a procedure is omitted, several isolation barriers may be affected. The most vulnerable isolation barrier configuration for which l the impact of this error would be significant is one involving only MOVs or manual valves because the error of a single individual could result in defeat of the configuration. The least vulnerable is a configuration which relies on e

physical conditions, e.g., heat exchanger tubes or an elevation difference.

These types of configurations will not be defeated by a Type iib error.

Failure to comply with or follow a procedure is often influenced by the extent of operator confidence in the procedure and whether the operators find it easy j to use and comprehensive. From NUREG/CR-1278, the probability of plant personnel omitting an item when implementing a procedure in~which a written checklist is used has been estimated as 0.003. This probability can be improved by up to a factor of 10 with the use of "well designed written procedures and checklists", i.e., those that eliminate the following factors that have been found as deficient in many procedures reviewed throughout the industry.

(1) Serious deficiencies in content and format (ii) Inconsistencies between nomenclature in procedures and on panel components (iii) Instructions for control actions that don't indicate the expected system response.

(iv) Excessive burden on operator short-term memory (v) Charts and graphs not integrated with text

. 1055Y RA

d

.(vi) Lack of a clear identification of which procedures apply to which situations (v11) No formal means of getting operator input into updates of procedure and (viii) . Deficient instructions for assisting operators in diaanosina

1. )

. the problem. l A procedure task force has reviewed key. recovery procedures to minimize some of the above deficiencies. Other deficiencies should be minimized by the inhouse review process which includes consideration by an independent Safety  ;

Review Group. Conversely, poor validation of the procedures prior to their implementation for a recovery task can increase the probability of errors in '

executing a procedure. A suggested method of validation is a trial " walk through"; often such walk throughs detect deficiencies in-the procedure.

These walk throughs also increase operator familiarity with the procedure i

which tends to reduce his chance of executing it improperly, increase his confidence in it..and enable him to recognize when a part of the procedure i might not have been performed correctly. For this analysis, a generic value of .0003 per act was used to depict the probability that a control room

operator would skip a part of a procedure and 0.003 per act that other plant personnel would skip a procedure section. The difference is due to the NUREG/CR-1278 observation that " Reactor operators are more likely to use written procedures (correctly) than are calibration technicians who, in turn, are more likely to use them than maintenance personnel". This distinction is made in the analysis of barriers operated. In the control room (or a control panel) e.g., NOVs and pumps versus barriers operated locally, e.g.,

spoolpieces, manual valves.

A common mode failure probability was judged to exist only for barriers of like kind, e.g., two MOVs, two manual valves. The basis for this is that, generally, individual steps of a procedure do not six valve types. That is, a single procedure step may call for closing a group of valves, but that step would include only control room valves. A separate step would "Have personnel enter R.B. and perform the following valve lineup *, which would involve moving several manual valves. Thus, two different valve types would not be subject to.a single error. The resultant error rates are shown on Table 4.4-7.

. 1055Y RA l >

TABLE 4.4-7 Probability of Incorrect Procedure Uso (Type iib) Error PROBABILITY OF PROBABILITY OF SINGLE DEPENDENCE

• TWO OR MORE SOURCE OF BARRIER ERROR (PER DEMAND) FOR TWO BARRIERS ERRORS (PER DEMAND) ESTIMATE MOV or A0V 0.003 N/A N/A Table 15-3 NUREG/CR-1278 with good procedures 0.0003 Manual 0.003 N/A N/A Table 15-3 NUREG/CR-1278 Spoolpiece 0.001** N/A N/A RAS Heat Exchanger N/A N/A N/A Table 15-3 NUREG/CR-1278 Pump 0.003 N/A N/A NUREG/CR-1278 MOV - MOV N/A Low 1.5 x 10-4 With good procedures N/A 1.5 x 10-5 Pg. 10-26 NUREG/CR-1278 MOV - Manual N/A None 9 x 10-6 NUREG/CR-1278 with good procedures N/A Negligible MOV - spoolpiece N/A None Negligible NUREG/CR-1278 MOV - pump N/A None Negligible NUREG/CR-1278 MOV - heat exchanger N/A None Negligible NUREG/CR-1278 Manual - Manual N/A Same as MOV; MOV NUREG/CR-1278

• The authors of NUREG/CR-1278 "...usually assume zero dependence when estimating the error probabilities for carrying out individual steps in a written procedure."

This was judged to be a factor of 3 less likely than movement of an MOV because replacement of a spoolpiece requires work authorization papers.

,q, 1055Y

TYPE III The Type III error applies to a variety of errors that could occur in the preparation of written procedures, for example, an error by the procedure writer in the accuracy or completeness of a valving checklist. From '

NUREG/CR-1278, "There are no means to quantify the probabilities of (these) types of inadequacies in written materials. Such errors reflect failure to test the procedures in a dynamic situation.... as well as failure to anticipate.the full scope of situations in which the procedure must be used (the TMI incident)."

Within those limitations, NUREG/CR-1278 did assign a probability of 0.003 to the probability that an item intended for a procedure will either be omitted '

or misrepresented. At TMI-2, procedures are reviewed independently by the

! Safety Review Group in addition to the internal checks associated with the originating organizations. A recovery factor of 5 was credited for these reviews detecting a single it'em being left off of the procedure. Thus the probability of a single item being left off the procedure and not being i

identified in the review process was judged to be 0.0006.

The possibility for a common mode failure of a complete barrier configuration exists for a Type III error; 1.e., the procedure preparer leaves both components of the configuration off of the procedure. In RAS Calculation 4430-84-07, the probability of leaving a complete barrier configuration off of

~

a procedure was estimated as 7.1 x 10 per procedure.

i Summina Hardware Failure and Human Error Probabilities  ;

i The final step in evaluating the probability that particular barrier 1 configurations will be defeated is to sum the contributors from the hardware

. and human error failure modes.

l l

i 1055Y RA l

This was done with the following general equation, which is completed in I detail in RAS Calculation 4430-84-07 for each barrier configuration:

P {both barriers fai1} = P { barrier 1 fails}

• P { barrier 2 fails}

+ P (Common mode failure}

-Pj (Hardware + Type 1 + Type II + Type III)

• P2 (Hardware + Type 2 + Type II + Type III)

+ Pg ,{ Type II + Type III}

The resulting failure probabilities for various barrier configurations are shown in Table 4.4-8 which includes the range associated with various maneuvers as well as static conditions. Table 4.4-8 also includes the failure probabilities for valves that are exposed to error more than once per year.

Thus, a judgment of the number of times each barrier could be exposed to error was made and used to convert "per demand" failure rates to yearly failure rates.-

)

i l

, 1055Y RA

TA8LE 4.4-8 PR08 ABILITY OF FAILURE PER ISOLATION BARRIER CONFIGURATION FAILURE PR08 ABILITY

• BARRIER CONFIGURATION (PER YEAR)

NOV. NOV -

7.2 x 10-5 to 1.9 x 10-3 M0V; Manual 7.5 x 10-5 to 2.6 x 10-3 MOV; Pump ** 1.5 x 10-5 M0V; Heat Exchanger 1.6 x 10-4 NOV; Spoolpiece 5 x 10-5 Manual; Manual 8 x 10-5 Manual; Pump 1.6 x 10-5 Manual; Heat Exchanger 1.7 x 10-4 Manual; Spoolpiece 5.1 x 10-5 Pump; Heat Exchanger O 4 x.10-5 ,

Pump; Spoolpiece 2.6 x 10-5 Heat Exchanger; Spoolpiece 1.4 x 10-4 Triple Barrier Configurations *** 1.2 x 10-7 to 5.5 x 10-5 Failure probability varies due to varying number of exposures to operator error and difference between leak and rupture failures.

Pump required because of elevation / pressure difforential; a pump is not considered a barrier if gravity feed is possible.

• • • Triple barrier configurations consisted of combinations of the above barriers as well as: tanks which hold an inadequate volume to dilute the RCS, valves which are known to be closed from " operational verification" or ' documental evidence *, gaseous vent headers and other barriers which are known to be present but are not placed on a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> checklist (e.g.,

Appendix C to OP 2104-10.2). Less credit was given for these barriers because they are not checked regularly.

1055Y RA

. -. - _ - . . _ _ _ __ __ _ _ _ ~ _ _ - _ . _ - . . ._ - . .

i 4.4.5 Estimate of Plant Boron Dilution Probability l In Section 4.4.3, an estimate was made of the probability

! of failure of each of the configurations used to isolate the TMI-2 RCS from a boron dilution source. In this section, the total plant boron dilution probability is estimated. To do this, the following factors must be considered:

)

i (1) Volume of unborated water that must be injected into the RCS to have a potential safety impact.

(ii) Dilution rate

(iii) Potential detection and mitigation.

(iv) Total probability of occurrence found by l ,

summing all potential dilution paths.

4.4.5.1 Dilution Volume i The amount of unborated water necessary to dilute the RCS concentration to a concentration that is a safety concern

! is a function of (1) the initial RCS boron concentration (11) the minimum acceptable boron concentration (iii) the characteristics of the dilution inflow and (iv) the RCS processing status (i.e., static or processing mode).

The RCS is currently being maintained at a boron i

concentration of 5050 ppe (i 100 ppe). The measured 1

average concentration for a recent two week period was 5152 ppm (Reference 15). Thus, 5050 ppm is an appropriate assumption for the initial RCS boron concentration for a dilution event.

I 1

i, 1055Y RA

+

The minimum acceptable boron concentration that assures j subcriticality is currently 3500 ppm. Recently completed analyses (Reference 13) indicate that a boron concentration of 4350 ppe may be required to assure subcriticality for some recovery operations, including defueling. Thus, the dilution volume that could result in criticality will vary according to the recovery stage.

The characteristics of the dilution inflow, specifically mixing of the underborated inflow with the RCS volume,

! affects the dilution volume estimate. Recent insights

! provided in References 11 and 12 indicate that j underborated water is likely to float directly to the

internals indexing fixture (IIF) rather than being drawn

. down through the CSA annulus and then to the core. Those references suggest that the core region is probably the last volume that will see a dilution which would suggest that a very large dilution volume would be necessary to ,

dilute the core region. For this analysis, however, it

is assumed that inflow into the RCS mixes uniformly with

the entire vessel and IIF volume. Volumes in the RCS 1

legs (with the exception of the volume between the

dilution inflow point and the vessel itself) are not assumed to mix with the dilution flow.

The fourth consideration is estimating the volume to dilute the RCS is the RCS processing status. If the RCS is in a static condition, i.e., with no water processing, the dilution is simply an addition of water to the system. If water is being moved into and out of the RCS (for example, as part of a clean up) then an exponential mixing equation must be used.  !

j l h

4 1055Y RA

From the above considerations, it was determined that a j dilution inflow of approximately 15,900 gallons of i unborated water is required to dilute the vessel to 3500 ppm during' static conditions and approximately l 13,200 gallons during RCS processing. Dilution to 1 4350 ppm requires 5,800 gallons during static conditions and 5,370 gallons during processing.

4.4.5.2 Dilution Rate A spectrum of dilution rates is possible depending on the driving force associated with each dilution path.

However, an upper aound on a credible dilution rate can be estimated by physical considerations such as the effects of line size in limiting flow, pump capacities and elevation differences. The maximum credible rate can also be bounded ny probabilistic considerations such as ,

the number of faults required,to input unborated water via a particular path. These considerations result in a maximum credible dilution rate to the RCS of about 150 gpm. This flow could occur if there is a misalignment of a flow path connecting one running demineralized water pump to the RCS. A flow of this magnitude could also occur by a path misalignment resulting in gravity feed from several water sources which are at elevations above the RCS injection point and have sufficient capacity to significantly dilute the RCS. (In these cases flow is limited by the minimum pipe size through which the flow must pass.) These water sources are:

I Sodium Hydroxide Storage Tank (DH-T-2)

Demin. Water Storage Tank (DW-T-1)

Processed Water Storage Tanks (PW-T-1,2)

Unit #1 Demineralizer Water St. Tank Fuel Transfer and Storage Pools l

l l

1 1055Y RA i

-Misc. Waste Holdup Tank-(WOL-T-2)

Condensate Storage Tank (C0-T-1A) i Condensate Storage Tank (C0-T-18)

Off-Spec. Waste Receiving Batch Tank (CC-T-1)

Clean Water Receiving Tank (CC-T-2)

In Section 4.4.5.4, the probability of occurrence of the maximum credible flow rate (up to 150 gpe) is estimated as 3 x 10 -4 per year during the static conditions.

This probability is so small that we judge that no specific mitigation considerations need to be made for this event. (This judgment is based on guidance provided by the NRC for safety goals at nuclear power plants, Reference 18. The guidance has been adopted in this analysis as a guideline for the extent of RCS isolation and dilution detection capability that must be 1 I provided.) However, the use of the RCS level indication and alarm, which are described in Section 4.4.5.3 provide a capability to detect a large rate dilution event in time to allow the operators to isolate the RCS before a safety limit is reached. As an additional preventative measure (although the results provided here indicate that it is unnecessary), the probability of gravity feed from the other dilution sources listed could be reduced even further by adding isolation barriers for a source to the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> checklist, draining the source or borating the source, as appropriate. The Fuel Transfer i and Storage Pools can be isolated by putting the l following valves on the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> checklist to be closed:

l SF-V150 SF-V125, SF-V157 and SF-V105. Condensate Storage Tank 1A can be isolated by: EF-V9, CO-V76A, CO-V768, CO-V98A and CO-V988. The Off-Spec Tank, CC-T-1 can be isolated by closing ALC-V004 ALC-V031. ALC-V033, ,

ALC-V086 and ALC-V080. Currently, Co-T-18, CC-T-2,

DH-T-2 and WOL-T-2 do not contain enough unborated water to dilute the vessel.

l

! . 1055Y RA

l In Section 4.4.5.4, the probability of a lower rate l dilution event is estimated to be more likely than the maximum rate discussed above. A lower dilution rate was I

found to be more likely than the maximum rate because

,. (1) the probability of component failures resulting in j  : leakage is much greater than for passing full flow (Table 4.4-4), (11) the probability of dilution through the sampling lines which are manipulated often is high relative to other paths and (iii) the potential exists for dilution via component seal water which is designed for some inleakage (important during plant maneuvers).

Therefore, provisions must be taken to assure that the l

RCS will not be diluted to the minimum acceptable boron  ;

4 concentration by the lower, but more probable rates.

I t From Reference 10, the maximum flow through the 3/8'

! diameter sampling lines is no greater than about eight gpe. Reference 7 states that maximum seal water 1 i

inleakage would not typically exceed a few gallons per day (seal water inleakage would be a concern only during processing). There is no absolute definition in the industry for the distinction between leakage and gross l

valve failure. In this report it was assumed that j passage of 105 or more of maximum flow would be termed -

' gross' or " rupture' failure. Ten percent of the maximum credible flow is 15 gps. This flow rate encompasses the

! . potential sampling and seal water flows. Thus, it is recommended that this flow rate be used to set inventory monitoring frequencies during static conditions.

(Subsequent to the issuance of Rev. O. RAS has consulted l with the manufacturers of several types of valves used at TMI-2. The manufacturers indicate that the 105 leakage l assumption is conservative. It was also noted that the pressure for which the valves were qualified generally exceed the demand placed on them at TMI-2, thus reducing  ;

the potential for leakage across the valve.) '

l l

1055Y RA l

414.5.3 Detection and Mitigation Mitigation of a boron dilution event consists of terminating the event prior to reaching the Tech. Spec.

boron concentration limit. Mitigation of boron dilution prior to reaching the Tech. Spec. limit requires isolation of the RCS from potential dilution paths, once the dilution is detected. Therefore, credit for mitigation is heavily dependent on the detection capability. At TMI-2, the means of detecting a boron dilution event are suenarized below.

Detection Methods (1) Reactor Coolant Level Monitoring On SPC Panel 3 in the control room, there is digital RCS level monitoring and pressure indication (which can be used even during drain down to indicate a level based on the weigh't of water). Level instrument RC-LI-100A and the pressure readout are based on a single level transmitter / instrument, RC-LT-100, connected to the RCS hot leg. The instrument is rated at an accuracy of i 3 inches for measurement of an absolute water level. However, a level differential of i 1 inch can be read, which corresponds to an RCS volume of less than 160 gallons. A second level instrument, RC-LI-102, has recently been installed and may be read on SPC Panel 3. Instrument RC-LI-102 monitors the level in the !!F and is physically independent of the t instrumentation connected to the hot leg. The RCS level is checked hourly and recorded on the ' Station Daily Log Sheet".

~ $1 - 1055Y RA 9

. - _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ __. _ _ ~ . _ _ _ _ . _

l 1

As a backup to the control room indication, the RCS 4

level can be read on a Sarton meter, RC-LI-101A, located at the 282' elevation of the Fuel Handling Suilding or in a tygon tube located outside the l D ring in the Reactor Building.

1 i t

. An RCS level alarm has been installed which will j alarm in the control room if the RCS level changes j i 6 inches from the operational level in the !!F.

f

! (11) Monitoring of 011ution Sources

I

, In Table 4.4.2, a number of water collection points,

! (tanks, coolers, etc.) that could act as dilution sources were identified. Some of these sources are f

monitored by low and high level alarms and/or (b) l verification of level via ' Primary Aux operator  !

Check Sheet'. Level alarms may be indicated in the control room directly; or a satellite alarm may be

! in the control room with specific indication on a j local panel. The primary Auxiliary Operator Check i Sheet is executed every shift by an auxiliary operator and checked at the end of the shif t by a reactor operator and a senior reactor operator.

A review of the Primary Auxiliary Operator Check

! List showed that many of the dilution sources in I

Table 4.4-2 were not on that list. Also, Table 4.4-2 shows that many alarm setpoints are not set adequately high to be useful in detecting a loss of I

the volume of water required to dilute the vessel.

There would be some value in alanning all dilution

! sources in Table 4.4-2 or placing them on a shif t checklist. However, the likelihood of detecting a ,

dilution in this manner is very small given the more i  !

1055Y RA

direct indications available. Further, there are some difficult practical problems associated with this approach, e.g. accounting for water use by TMI-1 from the Unit 1 Domineralized Water Tank.

,. Thus, no credit is given for detecting a dilution

>  ; event by this method.

(iii) Mass Balance (a) Per Procedure 4301-51, Appendix B, a mass balance calculation is performed every 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. In the level control mode two slightly different techniques are used.

These calculations will indicate the RCS

boron concentration.

I (b) Every 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> the RCS is isolated for 4

, hours to perform a leak test. From discussions with plant personnel, these calculations will detect an inleakage as low as about 0.6 gpe. (However, the use of this test for detecting a dilution event is 1 limited for plant maneuvers because the isolation of the RCS may itself prevent l continued dilution.) '

(iv) Equipment Checklist The position of valves, pumps and breakers that are important to the implementation of certain plant procedures are monitored by control room personnel every 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> per Appendix C to Operating Procedure 2104-10.2, " Primary Plant Operating Procedure."

This monitoring is accomplished by checking the position as indicated in the control room, checking a log in which changes in status of " red-tagged" components is kept, or directly surveying the components.

1

. 1055Y RA

)

1 I

(v) Neutron Detection A potential fifth indication of a boron dilution-event is the operable source range neutron i

detectors NI-1 and NI-2. These indicators are

[ checked hourly and readings are recorded on the Station Daily Log Sheet. However, there is uncertainty about the significance of the source

range response. Although these indica' tors may trend increased neutron flux in a range very close to criticality, there may be no significant response as the boron concentration approaches the minimum acceptable RCS boron concentration used as a basis 1

for this analysis. This is because conservatisms i

exist in the referenced criticality analyses making

. it likely that significant shutdown margin remains at the minimum accepta' L boron concentration for

most core configurations, Thus, no credit was given .

I for detecting a dilution event by this means prior to reaching the minimum acceptable boron j concentration used in this analysis.

(vi) RCS Boron Sample A weekly RCS boron sample is taken as required by Technical Specifications. Depending on the time at which a dilution event would occur, a dilution rate of about 1 gpa could cause a dilution below the minimum acceptable boron concentration before the Tech. Spec. sample is taken. Thus, little credit can be given for this sample detecting inleakage of unborated water. It does, however, provide a 4

periodic check on the 5050 administrative limit and provides some assurance that a phenomenological effect (e.g., stratification) is not occurring.

l 1055Y RA

Given the other means of detecting a dilution event, it is judged that there is not a significant risk reduction gained by increasing the boron sampling frequency during static conditions. However, sampling is a useful means of detecting dilution

[ during some plant maneuvers.

i

. Detection Reliability i

l The RAS judges that a simultaneous RCS dilution and leak of the same magnitude is not credible. Thus, any dilution event during static conditions will result in a changing RCS level. The failure to "see" this level change is a 1

function of the capability of the level instruments. Redundant instruments, RC-LI-100A and RC-LI-102, provide level readout in the control room. Level is read and logged hourly and a level alarm is set to detect a level deviation of j six inches. In the event of failure of the remote indication, RCS level may i

be read from a local instrument at the 282' elevation of the fuel handling

building (RC-LI-101A) or from a tygon tube outside a "O" ring. Instrument RC-LI-101A uses the same tap from the 'B' steam generator hot leg as control room instrument RC-LI-100A. Instrument RC-LI-102 uses taps in the internals indexing fixture. The tygon tube is connected to the RCS pump 2A cold leg and

! thus, is physically independent of the other instrumentation. Under normal circumstances, indication outside of the control room is not relied upon on a regular basis. (Currently, additional level instrumentation, RC-LI-100 and RC-LI-102A, is associated with the SPC system; this instrumentation uses the j same transmitters as the control room indication.) Thus, there are three i i

Independent channels and one dependent (Barton meter) channel available for use in determining RCS level. The failure causes of multiple channel instrumentation strings can be grouped into two broad categories; combinations of independent causes and common cause failures. These contributions can be quantified and summed to obtain the total probability of losing level

, indication.

A level instrumentation string typically has an unavailability of better than

3 x 10-2/ year; this implies that the probability of the TMI-2 level indication becoming unavailable due to independent faults is less than

-5 3 x 10 / year.

1055Y RA t

j Common cause failure modes for losing level indication also exist. However, no credible connon cause has been identified at TMI-2 that would result in j

! simultaneous loss of all level indication currently installed. The potential l l

cosmon cause contribution to level indication failure is reduced at TMI-2 over l what is normally encountered due to the diversity among channels. Mechanisms l that exist for a common cause loss of level indication are: l (1) Loss of power - transmitter RC-LT-100 and associated indicators RC-LI-100 ) '

and RC-LI-100A are powered from PNL-2-12R while transmitter RC-LT-102 and j associated indicators RC-LI-102 and RC-LI-102A are powered from PNL-2-22R.

{ These panels are supplied by power trains 1A and 18, respectively. Loss of I power to both trains concurrently without connon cause (e.g., loss of offsite i l power) is unlikely. In the event of a loss of offsite power, the need for l

level indication is reduced because the probability for a boron dilution event conditional upon loss of offsite power is negligible. Additionally, RC-LI-101A (the 8arton meter) and the level reading from the tygon tube are

not dependent on power so they may still be used for indication. The L

contribution to the loss of level indication from loss of power can be bounded  ;

by 2 x 10 / year.

i .

i I (2) Loss of sensing pressure to transmitter or failure of transmitter - the loss of sensing pressure could occur if any line to the pressure transmitter i is blocked or leaking. This could be caused by closed or plugged valves, ,

leaking fittings or in the case of RC-LT-100, failure of the nitrogen system.  !

The root valves, and to a lesser extent the Parker fittings at the 1

transmitter, are vulnerable to human error. In fact, RC-LT-100 may have been unavailable for a short time period due to an inadvertent closing of its root I valve (IER 50-320-84-047). As a result, plant personnel were alerted to such a' problem and "00 NOT OPERATE

• tags are now placed on key valves to minimize  ;

this occurrence. Loss of proper level indication could also result from

blocked sensing lines (e.g., by core debris) or if the transmitter itself failed. Simultaneous plugging of all sensing lines, however, is not judged to i be credible as substantial differences in tap locations exist. The common

! cause contribution from this category is estimated to be less than

-4 4 x 10 / year. l i

3

! 1055Y RA

(3) Miscalibrated instruments - The transmitters and indicators are periodically (once a year on difforent schedules) calibrated under Procedure 4221-PMI-3620.01. The contribution from miscalibration errors is reduced by the differing equipment design and operating principles, staggered maintenance scheduling, and different personnel performing calibration using clearly written procedures. The contribution to level unavailability from the category is estimated to be 5 x 10-4/ year.

Many of the postulated failure modes discussed would not result in an unsafe  ;

failure (i.e., indication failed as is while level is rising). Another factor i reducing the unavailability is that of immediate feedback (i.e., conflicting l readings among channels) to the operator. Ignoring the beneficial effect of l these two factors produces a value for losing all level indication of 9.5 x 10-4/ year. The bounding value of .001 used in this report for j unavailability of all RCS level monitoring therefore can be considered as very l conservative.

L Regular sampling of the RCS is another primary means of detecting a dilution event before it becomes a safety concern. Sample' frequency is a function of f the minimum acceptable boron concentration, the potential flow rate that must l be detected and the mixing characteristics of the dilution inflow. There is ,

no justification for implementing a sampling program during static conditions l or to detect the largest potential dilution inflows specified in Section y j 4.4.5.2 given the low probability of occurrence and reliability of the level l indication. Under some processing circumstances, however, a sample program (

should be used to provide detection capability when sensitivity of the level f indications may be lost. The recomended sampling frequencies are provided in i the appropriate appendices. A sampling program can also be implemented if f level indication is unavailable for any reason. '

l l

The reliability of the sample is a function of its representativeness and the l implementation of proper analysis techniques. The current method of taking an  !

RCS sample is +o draw through a path from the RCS sample pump to the sample

(

sink. A recent Licensee Event Report (LER 84-102) indicated that some samples  ;

may not have been representative of the RCS because of a misinterpretation of i a meter. This problem has been corrected and it is assumed that sampling is 1055Y RA

now representative. There is also a possibility that a particular sample may be analyzed incorrectly to that an RCS concentration that is low is incorrectly found to be within specifications. plant personnel indicate there have been two incorrect samples in approximately 250 weekly Tech Spec.

samples. Using this experience and assuming that any sample error will result 1 in failure to detect a dilution in progress, the probability of failure to diagnose a dilution event because of erroneous analyses is less than 0.01.

As stated previously, no credit was given to the neutron monitors, the weekly Tech. Spec. sample and the once per shif t check of dilution sources for detecting a dilution event in progress. Checking the valve lineup is a means for recovering from a valve misalignment and credit was applied in the estimates for barrier failure in Section 4.4-4. The asss balance calculation will provide information on the current RCS boron concentration every 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Therefore, a conservative estimate of the failure to detect a dilution can be made by considering only the unavailability of the level monitoring and sampilng frequency.

ILW.aA11ea Mitigation of an event requires that an operator act upon the detection and take the proper actions to isolate the dilution source or the RC5 itself. The following general equation describes the probability of failure to detect and mitigate a dilution event:

p { failure to detect and mitigate) = p (failure to detect) + p (fallure to altigate given that event is detected)

In the previous subsection, the probability of failure to detect a dilution event using level indication or boron sampilng was estimated. Failure to mitigate a dilution could occur by operator failure to respond, operator error in responding or hardware faults. Because of valves in series, there are several ways by which the RC5 could be isolated from a dilution flow. Thus, the failure to mitigate an event is dominated by operator failure to respond or an incorrect operator response. The operator response is affected by the 1 number of control room demands and the time required for the response.

10$$Y RA

The TMI-2 plant state is now much simpler in comparison to an operating reactor in terms of parameters that must be monitored. Thus, a boron dilution  ;

will not result in many control room alarms in a short time period as may be  !

characteristic of an incident at an operating reactor. Rather, it will be ,

identified by a single annunciator, such as a level alarm or an unacceptable l massbalance,hwhichanoperatormayfocushisresponse. Thus, the  !

estimates provided in NUREG/CR-1270 for operator response to a single annunciator provided the basis for a judgment of the offectiveness of operator response to a dilution. NUREG/CR-1278 noted a difference in operator response to an alarm depending on whether a plant was in a power generation or maintenance condition. The difference between the two operational conditions f

was that during the maintenance mode, control room personnel night expect l alarms that are due to maintenance activities in the plant and thus be less I concerned; conversely, during power generation each alarm would be taken more seriously. The difforence is a factor of 10; failure to respond to a single i alare during power generation was estimated as 0.0001 and during maintenance (

as 0.001. At TMI-2 it might be expected that alarms at anytime would be i pursued with equal concern because they are not as frequent as in an operating plant. However, for conservatism we assumed that the observed dif forence in  !

response between the power generation and maintenance modes would correspond 1 to a difference in response during actual maneuvers (e.g., IIF processing) and l static conditions, respectively, f l

l An incorrect operator response is due to an operator error in selecting the i correct component when a decision is made to act; these errors were described I as Type I errors in Section 4.4.4. At TMI-2, isolation of the RCS can be achieved by movement of M0Vs from the control room; the error rate judged applicable in Table 4.4-6 to the selection of the wrong valve was 1 x 10~3/ demand. This analysts used this estimate as the ' nominal' value for an incorrect operator response. An additional factor that influences the probability of an incorrect operator response is the time in which he must ,

respond to mitigate a dilution. This factor is considered by modifying the  !

nominal operator error probabilities to reflect significant variations in the required action time. That is, as the period to respond becomes shorter, the  !

nominal operator error probabilities are increased untti they eventually approach one; as the response time lengthens, operator error probabilities  ;

l

- Sg - . 1055Y RA

tend to decrease until some plateau is reached. As noted earlier, there is a spectrum of possible dilution rates, each with a corresponding time to dilute the vessel to the minimum acceptable boron concentration. The probability of the largest rate dilution events (greater than 15 gpm up to 150 gpm) is so small that no specific mitigation measures are required, although there is some existing capability for mitigation. The taost extreme rate of dilution scenario (.150 gpm inleakage during a feed and bleed type operation with detection by the level alarm) provides about 1 1/2 hours after detection for the operator to isolate the vessel before the concentration reaches 3500 ppm.

In our judgnent, nominal operator error rates could be increased by a factor of 10 for this unlikely scenario. If the lower boron concentration is assumed to be 4350 ppm, under the same worst case conditions, there would only be about 1/2 hour for action af ter detection by level alarm. Because of the relatively short operator response time, the operator error rates used for this scenario were increased by a factor of 100 over the nominal error rates.

(n.b., The actions that could be taken to terminate this unlikely dilution event are not as extensive as those that could be accomplished in a longer time. Rather than proceed through an isolation checklist, it is recommended that the consideration be given to isolating the demineralized water pumps and 1 the large water sources identified in Section 4.4.5.2, if this event is observed.) For the smaller and more likely dilution rates, the most extreme situation (!!F processing in the automatic mode, thus, limiting the ability of the level instrumentation to detect a change) a sampling frequency can be developed (see Appendix 0) to assure adequate time for operator action. The operator error rate in responding to sampling or level indications for the more likely, smaller dilution rate events is the nominal value 0.001/ demand.

As a conservatism, no credit is given for a recovery factor that would take into account the long response time allowed for most dilution events and the supervision of senior control room personnel.

In summary, the probability of failure to mitigate an event, P (failure to mitigate given that event is detected)

= P (failure to respond + operator error in responding + hardware faults) 1055Y RA

i From the previous discussion, several estimates of the probability of failure t

to mitigate can be developed to bound numerous plant situations. These

! estimates can'be combined with the probability of failure to detect a dilution to form the probability of failure to detect and mitigate a potential dilution.

I Condition  ! P (failure to mitigate given P (failure to detect and detection) (oer demand) mitiaate dilution) (per demand) l 1

1 l ,

Static, 3500 ppm 2 x 10~3 to 1.1 x 10-2 3 x 10-3 to 1.2 x 10 -2 Processing, 3500 ppm 1.1 x 10 -3 to 1.0 x 10-2 1.1 x 10 -2 to 2.0 x 10 -2 Static 4350 ppm 2 x 10-3 to 1.0 x 10~I 3 x 10 -3 to 1.0 x 10'I Processing, 4350 ppm 1.1 x 10 -3 to 1.0 x 10'I 1.1 x 10-2 to 1.1 x 10 -I 4.4.5.4 Probability of RCS Dilution The total probability of dilution of the RCS below a minimum acceptable concentration is the sum of the probabilities of dilution through the individual paths

) (or, equivalently, of the failure probabilities of j individual dilution barriers) multiplied by the

] probability of the operator failure to detect and I

mitigate the event. The probability of occurrence of a dilution event of any magnitude during static conditions

was estimated as 5.4 x 10 -3 per year. This is due

almost entirely to the " leakage" probability of 5.1 x

-3 10 per year; the rupture or " gross' leakage probability contributes 2.7 x 10 -4 per year. (The probability of the gross rupture is so small that we i

1 l judge that no specific mitigation considerations need be made for this event, based on NRC guidance I (Reference 10).)

i The contributions are summarized in Table 4.4-g according l to the types of isolation and the number of paths with

! that isolation. It should be noted that although about 400 barrier configurations are required to isolate the RCS during static conditions, only 125 components are ,

) ,

1055Y RA L.- -.-. -. - . . _ .

1 I

l l

required. This is because many components contribute to the. isolation of more than one path. Triple barrier isolation is not reautred for RCS isolation, however, in many cases, triple barrier isolation occurs during static conditions because Appendix C to 2104-10.2 combines the

[ valves required for " double barrier" isolation during various processing maneuvers with those required for static conditions. Thus, there is additional isolation during static conditions. Triple barrier isolation was I recommended for some paths because of the number of potential exposures to human error. Finally, although SER commitments require double barrier isolation to be j administratively controlled by Appendix C to 2104-10.2  !

(or its equivalent for IIF processing), the reliability analysis was able to take credit for barriers which are known to exist but cannot be placed on an isolation

, checklist. (An example would be a valve in a high radiation area which is known closed by " operational verification" or " documented evidence". Less credit was given for these types of barriers. See RAS Calculation 4430-84-007 for more details).

Table 4.4-9 Total Failure Probability Summed for All Barriers per Isolation Tvoe durina Static Conditions Isolation Tvoe Total Probability MOV-MOV-MAN 1.6 x 10-3 MOV-MAN-MAN 1.1 x 10-3 MISC. 0008tE* 9.7 x 10-4 MISC. TRIPLE

• 7.0 x 10-4 4

NOV-MAN 3.8 x 10-4 MAN-MAN-MAN 3.5 x 10-4 MOV-MOV-MOV 2.9 x 10-4

• Miscellaneous barriers consist of valves used in conjunction with Heat Exchangers, Relief Valves, Hose Connections Spool Pieces and Tanks.

1055Y RA

Taking into account credit for operator mitigation results in an estimate for the probability of dilution to 3500 ppe during static

-5 conditions of 2 x 10 / year, which can be termed " negligible."

(The probability of dilution to 4350 ppe was estimated to be about

-5 5 x 10 / year, which can also be termed negligible.) 1 1055Y RA

~

5.0 CONCLUSION

S This section summarizes the conclusions from the main report and the appendices.

(1) The se of the valve lists suggested in this report and its appendices assures that the SER commitment for double barrier isolation is achieved.

(2) The probability of a boron dilution event of any magnitude occurrina during static, level control conditions with the vessel

-3 was estimated as 5.7 x 10 per year. This probability was dominated by potential human errors associated with valve ~ 1 positioning.

The additional probability of dilution that is incurred during IIF processing (which may be performed up to about 50 days pe'r year)

-3 was estimated at 5 x 10 . per year. The additional probability of dilution during IIF fill and feed and bleed operations (which are expected to be performed much less frequently, if at all) was

-3 -3 estimated as 5.6 x 10 and 7.3 x 10 , respectively.

(3) The detection mechanisms described in Section 4.4.5.3 allow for significant credit to be given for operator action in terminating a dilution event prior to reaching the minimum acceptable boron concentration. The probability of failure to detect and mitigate a dilution varied according to the RCS water processing conditions and the minimum acceptable boron concentration.

(4) The probability of a boron dilution occurring and diluting the RCS from 5050 ppe to 3500 ppe without being terminated was estimated as 2 x 10 ' per year during static conditions; the probability of a dilution to a minimum concentration of 4350 ppm was estimated as 5 x 10 /yr during static conditions. The additional i probabilities of dilution that are associated with possible

~

maneuvers range from about 6 x 10 to 9 x 10 per year for a

. 1055Y RA

minimum RCS concentration of 3500 ppm; the range is 1.0 x 10 -4 to 1.3 x 10 -4 for a minimum RCS concentration of 4350 ppe. These are consistent with the safety goal guidance provided by the NRC 1 (Reference 18). Thus, we conclude that the potential for boron dilution presents a mininal and acceptable risk to the recovery.

(5) A spectrum of potential dilution inflows to the RCS is possible.

Prevention and existing level monitoring instrumentation provide adequate protection for a broad spectrum of potential dilution inflows and plant conditions. However, under some conditions, sampling and/or inventory monitoring (e.g., mass balance) may be required; in these situations, the frequency should be based on a dilution rate of up to 15 gpe.

1055Y RA

,,y- -

,c - g- -

re---ms,.oy w , w , - ,--- - ww - w

6.0 RECOMMENDATIONS The following summarize the major reconsnendations of the report. More detailed recommendations are in the " Conclusions / Recommendations" section of each a endix.

(1) Assure that the " Isolation Valve List" presented as Table 4.4-3 is implemented and that the barriers on that list, or an equivalent alternative, are placed on a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> checklist. Isolation lists for particular plant maneuvers are provided in the appropriate appendices to this report and should also be implemented and placed on a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> checklist. The appropriate checklists are expected to be Appendix C to 2104-10.2 and Appendix G to 2104-8.18.

(2) Assure that recommended monitoring frequencies for static conditions and planned maneuvers summarized in Table 6-1 are 1 implemented. (Details are provided in the appendices.)

1 (3) a. Assure that the emergency procedure for responding to a dilution event specifies that all processing be terminated and references appropriate actions to isolate the RCS in the event dilution occurs. Appendix C to 2104-10.2 could be used to isolate the RCS.

b. Consideration should be given to adding a step in Emergency Procedure 2202-1.2 to trip off a running demineralized water pump if a dilution event is in progress or if the RCS cannot 1 be isolated in a timely manner. (This action will eliminate the most likely driving force for a dilution.)

l (4) Assure that operators have the opportunity to " walk-through" all new procedures prior to their implementation.

(5) Assure that the detailed recommendations presented in the l

" Conclusions / Recommendations" section of each appendix are implemented. I 1055Y RA

.--,-_._---q , . . . , . , , , _ _ . , , - , , , - . , - _ - _ _ _ , , , , - ..,,,...-,m,,-..,,,,,,-m,.. .m,,, s. .mw,.7,,,_,,_-_-...,,--.,_.-.emy.-

I TAutz 6.1 IEGMBEED MylI1tNtIIC FIEQtBICIES RNt IEli!CrIGt OF BGEnt DIIEFIG4 1

i f ,! FED Ale "M f f CAN4I. FIIL IDITIINt1  : S11 TIC  : less than 'k" gal.: Creater than 'k" gel. IIF FIIL ! IIF PlW WSSIIC  :. (GDtrIN[BICY 110rFFERIE) i  ; 3 i i i ~~

. t i IK5 80108 E=lrly . Fbilowing processirg: After process initia- ! Following See Appendix D.  ! Ilot applicable / required SAMLING  : 1 I tion mui prior to 'k" ' fill l Table D.3 g  :

!.  !. I 881* ' ' I CANAI. BOIEBi  ! Itot applicable / lIlotapplicable/ !Notapplicable/  !!Iot applicable! loot applicable / Before deep and filled l

SAN TING  : required  : required  ; required  :/ required  ; required  ;

, w - -

v ilm IEVII. l Hourly Recordirg;j Hourly IIncording; { Hourly  ; l Hourly l Hourly llecordirg;  ! Hourly Recording and High MEfrIURING e High Invel m  : High Invel m  ; High Invel m :llecordings . High Invel m Alana :Invel m Alans

!. Alam  : Alam 3

j 4 ICLEL 1EAK l Daily 2 iDaily 2 { Daily 2 l Daily 2 j Daily l Daily 2 sist  :  :  :  :  ;  :

!' Daily 4 IsotATIGE  : Daily  : Daily  : Daily j Daily  : Ikily

BAlutIm oux .

:  : .  :

(APP C; I

• I I  :  :

2104-10.2) l l  ! t  :

DIIDrION SDUIKEj Shift 2 3 Shift 2 Shift Z 8 Shift 2  : Shift 4 3 Shift Z O H K (PRIMARY . I I I I

:  : i i

Aux.

onx surr)orsRA10n :!  !  !  :  :

IICS/RQrr 80106 l Daily 2 jDaily2  ! Dolly 2  ! Daily 2 l Daily 2 jDaily 2 4

caNc. isrImis :  :  :  : .  :

! (PER 4301-SI) :  !  :  !  :

j llCS/RCET MASS j Not applicable / jIttapplicable/ jHourly jNotapplica-j Hourly jN/A BALANCE (APP.F;e required jreguired  ; jble/requiredj j l 2104-8.15)  : . . s . .

I SIEAM Q) ERA 10R! Weekly  ! matriy  ! mairly iWeekly  ! Weekly !Notapplicable/ required Izvn. oux  :  ;  ;  ;  ;  ;

1 1

4 5 1 "Isot applicable /r=rydred indicates that a partim1=r type of umstitoring is either not appliembla to the procedre or does not significantly reesce the baron dilution potential

. 2 Osrrent frequency at idiidi action is beira perfannede frequency any be =Arad and not significantly affect the baron dilution potential

3 Item ==mdations apply to the process of canal fill. After canal fill. annitortsg frequencies are as specified in Appendix C 4 '%" = 10.000 dallone if suinismsm acceptable RCS boren concentration = 3500 ppes x = 5000 gallons if minhuse concentration is 4350 opa i

1 j

1 4

l 1

l l

7.0 REFERENCES

j 1. NUREG/CR-2798. " Evaluation of Events Involving Unplanned Boron Dilution in Nuclear Power Plants" E. W. Hagen, July 1982.

I

2. Enclosure (Inadvertent Boron Dilution) in letter to Dr. Robert E. Uhrig Florida Power & Light, f rom Robert A. Clark, USNRC, dated April 26, 1982. Docket No. 50-335.

3. NUREG/CR-1278, " Handbook of Human Reliability Analysis with Emphasis on

, Nuclear Power Plant Applications", Final Report, August 1983.

l

4. WASH-1400, " Reactor Safety Study - An Assessment of Accident Risks in U.S. Connercial Nuclear Power Plants", October 1975.

i

5. NPRD A02/A03 Reports, INP0 82-029 "1981 Annual Reports - Annual Reports of Cumulative System and Component Reliability", November 1982.

6. GPU Memo #4420-84-0010, " Spool Piece Identification and Designation",

G. A. Kunder to S. Levin, dated February 12, 1984.

7. GPU Memo #4340-84-0197, " Elimination of Potential Boron Dilution Pathways" D. R. Buchanan to S. Levin, dated March 23, 1984.

8. GPU Memo #4400-84-0101, "L&NS Recommendations on RCS Boron Sampling Frequency", J. E. Larson to B. K. Kanga, dated April 13, 1984.

9. GPU Memo #4430-84-0053, " Boron Dilution Pathways Criteria." J. J. Curry to J. E. Larson, dated March 22, 1984.

10. Crane Technical Paper No. 410. " Flow of Fluids Through Valves, Fittings and Pipe," 1980.

11. GPU Memo #4430-84-0232, " Flow Distribution for Boron Dilution Inside TNI-2 Vessel " E. D. Fuller to R. E. Rogan, dated August 27, 1984.

12. GPU Memo #4342-84-0188, " Vent Valve Opening," W. E. Austin to D. R.

Buchanan, dated September 21, 1984.

13. " Criticality Report for the Reactor Coolant System of TMI-2," October 1984.

4

14. GPU Memo # 4400-84-0279, " Maintenance of Subcriticality," R. E. Rogan to Distribution, dated October 25, 1984.

15. GPUN Memo #4000-84-5-656, "TMI-2 Biweekly Significaat Events Report for Period Ending October 5,1984 " F. R. Standerfer to P. R. Clark, October 19, 1984.

1

16. " Methods and Procedures of Analysis for TMI-2 Criticality Calculations to r Support Recovery Activities through Head Removal", BAW-1738, June 1982; Add.1, October 1982; Add. 2, December 1982.

q 1055Y RA

17. 'TMI-2 Criticality Analyses for a heavy Load Drop Accident in Support of Recovery Activities through Reactor Vessel Head Removal", BAW-77-114 6499-00, December 1983.

1

18. Nuclear Regulatory Commission, " Safety Goal Development Program," Federal Register, Vol. 48, No. 50, March 14,1983.

19. Applicable # Procedures:

TMI-2 Operating Procedure 2104-8.18 Revision 0 (DRAFT), "IIF Processing Through SDS".

TMI-2 Operating Procedure 2104-10.1, Revision 8. " Operation of the Secondary Plant System" February 21, 1984.

TMI-2 Operating Procedure 2104-10.2, Revision 6, " Primary Plant Operating Procedure", February 13, 1984.

20. Appilcable Drawings:

Burns & Roe Drawing #2002, Revision 33, " Main and Reheat Steam".

Burns & Roe Drawing #2004, Revision 26, " Auxiliary Steam".

Burns & Roe Drawing #2005, Revision 36, "Feedwater & Condensate".

.8 urns & Roe Drawing #2006, Revision 26,' ' Makeup Water Treatment &

Condensate Polishing".

Burns & Roe Drawing #2007, (Sheet 1), Revision 25. "Vac. Degasifier

& Demin. Service Water T/8".

Burns & Roe Drawing #2007, (Sheet 2), Revision 23 "Demin. Serv.

Water Aux. Cont., Serv. , & Reactor 81dg.".

Burns & Roe Drawing #2009. Revision 25 "Feedwater Heater Drains".

Burns & Roe Drawing #2013. Revision 9. " Domestic Water".

Burns & Roe Drawing #2015 Revision 18. " Secondary Plant Sampling System".

Burns & Roe Drawing #2018. Revision 22, " Secondary Services Closed Cooling Water".

Burns & Roe Drawing #2023, Revision 27, " Circulating & Secondary Services Water".

Burns & Roe Drawing #2025 Revision 19 " Chemical Addition".

Burns & Roe Drawing #2026 Revision 30, " Spent Fuel Cooling & Decay Heat Removal".

. 1055Y RA

20. Applicable Drawings (Continued)

Burns & Roe Drawing #2027, Revision 27, 'Radwaste Disposal Reactor Coobnt Liquid".

Burns & Roe Drawing #2028, Revision 27, "Radwaste Disposal - Gas".

Burns & Roe Drawing #2029, Revision 26. " Intermediate Closed Cooling Water".

Burns & Roe Drawing #2030, Revision 27. " Nuclear Services Closed Cooling Water".

Burns & Roe Drawing #2031, Revision 16. " Sampling Nuclear System". l Burns & Roe Drawing #2033, Revision 26. " Nuclear Services River Water". '

Burns & Roe Drawing #2034, Revision 28, " Reactor Building Emer.

Spray & Core Flooding".

Burns & Roe Drawing #2035. Revision 20, " Decay Heat closed Cooling Water".

Burns & Roe Drawing #2036, Revision' 19, " Nitrogen for Nuclear and Radwaste Systems".

Burns & Roe Drawing #2039, Revision 19. "Radwaste Disposal - Solid".

. Burns & Roe Drawing #2045, Revision 23, "Radwaste Disposal Miscellaneous Liquids".

Burns & Roe Drawing #2046, Revision 18 " Reactor 81dg. Normal Cooling".

Burns & Roe Drawing #2601, Revision 11. " Reactor Coolant Pump Seal Recire. & Cooling Water".

Burns & Roe Drawing #2606, Revision 9. "0TSG Cleaning System".

Burns & Roe Drawing #2414, Revision 20, " Steam Generator Secondary Side Vents & Drains".

Burns & Roe Drawing #2626 Revision 9, Lab and Penetration Pressurization Gas Systems and Hydrogen for MU Tank".

Burns & Roe Drawing #2632, Revision 9. Radweste Disposal Reactor Coolant Leakage Recovery".

l Burns & Roe Drawing #M006, Revision 17, " Auxiliary 81dg. Emergency l Liquid Cleanup System".

1055Y RA

_ - - - _ . - _ . _ - - . .- - . . . . - . . - - - . : - - -. -.- -l

20. Applicable Drawings (Continued)

Burns & koe Drawing #M0014, Revision 15, " Fuel Pool Waste Storage System".

Burns & Roe Drawing #M022. Revision 25. " Standby Pressure Control System".

Burns & Roe Drawing #M043 Revision 11. " Mini Decay Heat Removal".

Burns & Roe Drawing #M044, Revision 6. " Temporary Nuclear Sampling" (Sheet 1)

Bechtel Drawing #2-M75-DWC01, Revision 2, " Schematic Diagram IIF Processing System".

Bechtel Drawing #2-M75-DWCO2, Revision 2, " Schematic Diagram IIF '

Processing System".

Bechtel Drawing #2-P70-DWC01, Revision 6. "Defueling Water Cleanup System Reactor Building".

Gilbert Drawing #C-302-692, Revision 22 " Liquid Waste Disposal".

8&W Drawing #42-40-002-01, (Revision # Not Discernible - File

1. 7-00-0216), " Seal System Schematic Thrpttle Bushing Arrangement".

GPU Drawing #2R-950-21-001, Revision 4 "P&ID Composite Submerged Demineralizer System".

i I

I I

.71 - . 1055Y RA I

APPENDIX A: RCS FEED AND BLEED l

A.1 SCOPE While in he static, level control mode, it may be advantageous to perform a " feed and bleed" operation before head removal in order to reduce the RCS activity or after head removal if IIF processing could not be conducted. This maneuver would be performed in accordance with i

Section 4.2 of Operating Procedure 2104-10.2. The boron dilution potential directly associated with this maneuver constitutes the scope of this analysis.

i A-1 ,

0165x RA

A.2 INTRODUCTION The flow paths used for feed and bleed are described separately in the calculation. The feed pathway draws from the "A" bleed tank through the MU&P System and injects into the RCS via valves MU-V16A, 8, C and D. The bleed path draws from the normal letdown line through MU-V376, the WOL System and into the 'C' bleed tank. The feed and bleed operation differs from the static, level control situation in the following aspects:

1

~

(1) Makeup valves MU-V376, -V101, which provide isolation under static conditions must be opened for the bleed path.

(11) Makeup valves MU-V16A, 8, C, O and -V145 which provide 1

1 solation under static conditions, must be opened for the feed path.

(iii) The ability to interpret a dilution event by monitoring i RCS inventory change may be affected since although the level should ideally remain constant, it is subject to fluctuations by the nature of the maneuver.

i In performing this analysis it has been assumed that:

1) The initial concentration of boron in the RCS and the 'A' bleed tank is 5050 ppm 8.

2) The '8" bleed tank is either empty or full of l i

RCS grade water. '

I 1

A-2 ,

0165x RA

1

3) A " dilution event" involves a drop in boron concentration.to a minimum acceptable concentration.

1

,- 4) All barriers which wre in effect during the static, level-controlled mode are also maintained during feed and bleed except those required by the maneuver; i.e., MU-V16A 8, C, O,-V376.

5) Feed and bleed may be required before head lift and is not expected to be required after head lift. To estimate exposure of certain barriers to operator error, a frequency of once per year was assumed for feed and bleed operations.

i

6) Type I selection errors on valves operated from the control room were given a' recovery factor l

of 10 to account for the number of qualified personnel witnessing operations. Type I errors on valves operated from the Radweste Panel were given a recovery factor of 5 to account for the general use of a simic board; less credit was given for recovery than for valves operated from the control room. Type I selection errors on manual valves were given a recovery factor of 2 to account for operator recognition of an error from the system effects-of the error.

7) Feed rates are about 10 gpm or less (based on experience during draindown).

A-3 -

0165x RA

A.3 CALCULATION A.3.1 - Prevention of Dilution - Bleed To compensate for the loss of isolation barriers associated with opening valves MU-V376, WOL-V46 and WOL-V963 for the letdown path, a new group of 105 isolation barriers was identified. These barriers are provided as Table A.1. The valves in Table A.1 are summarized in Table A.3. It is recommended that the valvas in Table'A.3 be added to those in Table 4.4-3 of the sein report to form the isolation barrier checklist in OP 2104-10.2.

I A-4 , 0165x RA

TABLE A.1 FEED AND BLEED - LETDOWN ACTION AFFECTED PATH COMPENSATION MU-V376 MU&P Demineralizers MU-V226 -Y224A, -V2248,

,/ MU-V6A, -V68 MU&P Demineralizers MU-V107A,8; MEF Sytem 0FF, DW-U308, MU-K-1 Deborating Demineralizers WOL-V81A, -V818 WOL-V70A, 708, 72A, 728,109A, 1098, 109C. 1090, 118A, 1188, 163A, 1638, 190A, 1908, 532A, 5328 WOL-V46 SF System SF-V214 SF-V122, 186, 217, DH-V109 MU-T-1 Drain MU-V169 MU-V12,13,27,28,133,MU-T-1 Core Flood Tank Bleed CF-V107 and Sample CF-V144 MWHT WOL-V533 WOL-V1091 l1 l

)

i RC Drain Header WOL-V22 l WOL-V1125 l WOL-V963 Recirculation Line Must be open for processing Nitrogen Must be open for processing Waste Gas Vent Header Must be open or processing and Gas Analyzer Letdown Relief Valve Discharge Must be open for processing

)

l l

l l

A-5 ,

0165x RA

A.3.2 Prevention of Dilution - Feed To compensate for the loss of isolation barriers associated with open)ng Makeup valves MU-V16A,8,C and D for the makeup (feed) path, a group of new isolation barriers was identified. These barriers are provided as Table A.2. The valves in Table A.2 are summarized in Table A.3. It is recommended that the valves in Table A.3 be added to those in Table 4.4-3 to form the isolation barrier checklist for OP 2104-10.2.

i 1

A-6 .

0165x RA

TA8LE A.2 FEED AND BLEED - MAKEUP ACTION AFFECTED PATH COMPENSATION MU-V16A,8,C,0, MU-P-1A,B C Discharge MU-V144A, -V1448, -V144C,

,. MU-V36 -V12 DW-V195,

SF-K-1*, BS-V3A,8, DH-VSA,8 DH-V100A,8. -V7A,8 -V128A,8

-V109, -V120. -V134A,8, DH-C-1A,8, SF-V217, -V186,

-V214. -V122. SP-C-1A,8 SPC System Not Required for Boron 011ution CF Makeup CA-V175 CA-V173 CF Tanks CF-V114A,8, -VIA,8, -V115 CF-V145. -V146 Seal Return Coolers MU-V289 MU-C-2A,8, MU-V37, DW-V227 Makeup Tank MU-V133 MU,-V12,13.27,28,169, MU-T-1*

CA-T2A, -28, -3 CA-V107; -V112 CA-P-1 off, CA-P-2 off CA-T-1 MU-V127 CA-V138 Pressurizer Sampling SN-V182 Return Cut & Capped Pipe MU-V10 Deborating Demins WOL-V118A, -V1188 WOL-K-1A, -18 WOL-V109A, 1098, 109C, 1090, 70A, 708, 72A, 728, 163A, 1638, 81A, 818, 532A, 5328, 190A, 1908, DW-U313. U314 WOL-U301 WOL-V543A WOL-V544A WOL-V5438 WOL-V5448

• Isolates vent header: failure of isolation requires tank overflow.

A-7 0165x RA

_ _ - . - - - - - . - , - , _ _ - - - _ _ _ . - _ _ - - - - - - - . -m. -----, . ,-----m., _ , ,

, , - , _ _ _ . . , _ _ - -. y. -- - . - - - -

ACTION AFFECTED PATH COMPENSATION CA-T-1 CA-V140 CA-P-4A,8 off, CA-V135,136,154, CA-T-8*

l DW Connection MU-V294 j OW-V92 l WOL-V40 Other WOL Sources WOL-V176, -V1171 l WOL-V175, V59. -V41 l WOL-V33A Isolation of WOL Sources WOL-V65A from Recirc. Line WOL-V658, -V206A,8 WOL-V167 Boric Acid Pump Discharge CA-V136 WOL-V21A(C) CA-V-133A -V1338 -V135

-V154 CA-T-8*

!solate Sampling from WOL-V37 Recirculation line SNS-V53, 140, 158, 23, 1 SNS-T-6**, hose next to i

SNS-V139 or SNS-V139 l1 WOL-V31A Demin. Water Flush WOL-V523 DW-V223 l

Isolation of WOL-T-18 WOL-V298, 288 from Injection Path WOL-V1668 WOL-V29A (C) RC Orain Tank WOL-V11534, 1153C WOL-V1092 WOL-T-Vent Header and Must be open for processing Gas Analyzer Waste Gas Discharge Header Must be open for processing Nitrogen Line Must be open for processing Makeup Tank Relief Discharge MU-R1 MU-V12.13.27,28,289,169, MU-T-1* l

Decon Conn. WOL-V18A, -V18C SNS-V97 -V128 RC Evaporator WOL-V18A,18C, WOL-V42 RC Evaporator WOL-V117 WOL-V521A, 521C  ;

!

• Isolates vent header: failure of isolation requires tank overflow. j

• • Tank Volume limits dilution potential.

l A-8 0165x RA

ACTION AFFECTED PATH COMPENSATION RC Evaporator WOL-V138 WOL-V658, -V1170 WOL-T-9A,8 WOL-V959 .,

,- WOL-V521A, 521C 0W Flush through RCF System Disconnected &

RCF System Removed 1

i m

)

i l

l 1

l i

l l

A-9 -

0165x RA

A.3.3 Mitigation of a Potential Dilution Event During feed and bleed, the operator may not be able to recognize that a boron dilution event is occurring by a deviation from a

! constant. level indication. Further, since feed and bleed requires the movement of large volumes of water in a matter of hours, many of the administrative controls which are performed once per shif t or once per day could not be depended upon to detect a potential dilution event.

In order to provide the capability to detect a boron dilution event during feed and bleed, it is recommended that:

3

1) Immediately after processing, sample the RCS to reestablish a l i

benchmark for maintenance of the system at an acceptable boron  :

concentration. 1 i

2) When processing more than 10,000 gallons and the minimum acceptable RCS boron concentration is 3500 ppe, sample the RCS 1 prior to injection of 10,000 gallons to verify the correctness of the valve lineup. (If the minimum acceptable concentration

( is 4350 ppe, sample prior to injection of 5000 gallons.) This a

will allow for corrective action to be taken prior to injection of enough water to dilute the vessel to the minimum acceptable concentration.

l l

i l A-10 ,

0165x RA

3) A mass balance calculation similar to that described in Procedure'2104-8.18, Appendix F, should be performed hourly when more than 10,000 gallons (5000 gallons for a minimum 1

acceptable concentration of 4350 ppm) is being processed.

4) Sample the bleed tank selected for mkeup prior to processing.

5) Monitor the RCS level every hour during feed and bleed processing to verify RCS level is not changing beyond the normal expected variation.

6) Perform isolation barrier check daily in accordance with Procedure 2104-10.2, Appendix C, to verify barriers have not been breached and provide recovery potential from any misalignment.

7) Perform boron concentration estimate daily in accordance with Procedure 4301-S1. ,

A.3.4 Probability of Boron Dilution During Feed and Bleed For feed and bleed operations, there are 392 barrier configurations

! in addition to those in the baseline analysis-(Table 4.4-4). It is assumed that fud and bleed will be performed only once before head lift, therefore the frequency of demand is taken to be once per year i i I

per barrier. The number of each barrier type was multiplied by the l

A-11 ,

0165x RA )

_-,______L..__-

failure / demand / barrier type as given in Section 4.3 taking the increased frequency of demand into account to yield a failure

-3

] probability of 7.3 x 10 / year. This is the probability that at L

least one of the barriers will be breached with the potential to cause an RCS boron dilution. Multiplication of the probability of barrier failure by the probability that an operator will fail to detect and properly mitigate the dilution will yield the probability of diluting the RCS boron concentration below a minimum acceptable

. boron concentration during a feed and bleed operation. This

~

probability has been calculated to be about 8.6 x 10 / year for

~

dilution to 3500 ppe and 1.3 x 10 */ year for dilution to 4350 ppm.

i A-12 ,

0165x RA

A.4 CONCLUSIONS /RECONNENDATIONS

, This section summarizes the conclusions and recomendations discussed in i . Appendix A,.

1) The probability of a boron dilution assuming during feed and bleed operations is estimated as 6.8 x 10 -3 yr-I for leak

-4 yr-I and 5.5 x 10 for rupture. This probability is due to the required isolation of about 390 additional paths for the maneuver. Considering detection and mitigation capability, the probability of dilution to 3500 ppe due to this manuever was estimated as 8.6 x 10 -5 /yr. I

. The probability of dilution to 4350 ppe was estimated as 1.3 x

~

~

10 */yr.

2) Table A.3 supplements Table 4.4-3 in that it provides isolation of the RCS to compensate for the valves opened by ,

the feed and bleed procedure. Thus, the valves in Table A.3 should be added to' Append.ix C to 2104-10.2; this will assure i

compliance with the SER Commitment for double barrier isolation.

3) Sampling of the RCS should be performed after completion of the operation to benchmark the RCS boron concentration. If the minimum acceptable boron concentration is 3500 ppe, sample l - prior to feeding 10,000 gallons. If the minimum acceptable concentration is 4350 ppe, sample prior to feeding 5000 1 i gallons.

A-13 -

0165x RA

_- , _ _ - . _ . . _ _ -. . _ _ _ _ _ . . _ . _ _ _ _ _ _ _ _ . . _ . _ - . _ _ _ _ _ - ~ _ . _ - . _

4) Monitor the RCS level hourly to detect variations that exceed what may be expected. l

5) .The current frequencies of executing Appendix C to 2104-10.2,

' the dilution source check in the Primary Aux. Operators Check i l Sheet, the boron concentraticn calculation in 4301-S1 and steam generator level checks are acceptable.

6) A mass balance calculation similar to that described in .

OP 2104-8.18, Appendix F, should be performed hourly when 10,000 gallons (or 5000 gallons if 4350 ppe is the minimum  !

acceptable concentration) or more is being processed. 1 i

I l

i l

l 1

l l

l l

l A-14 .

0165x RA

l

. TABLE A.3 8ARRIER LIST FOR FEED AND BLEED (Feed and bleed is accomplished per Section 4.2 of Operating Procedure 2104-10.2. Procedure 2104-10.2 is structured such that all valves required for isolation during static conditions or for any maneuver covered by 2104-1.02 are placed on a single checklist - Appendix C to 2104-10.2. Thus. l the following valves are recommended to be placed on Appendix C to 2104-10.2 in addition to those in Table 4.4-3 of this report. The valves listed here 1solate the process flow path.) '

CA-V133A WOL-V109C CA-V1338 WOL-V1090 CA-V135 WOL-V117 CA-V154 WOL-V138 CF-V144 WOL-V163A DW-V92 WDL-Y1668 DW-V223 WOL-V175 MU-V6A WOL-V176 MU-V68 WOL-V190A SNS-VI WOL-V1908 SNS-V97 WOL-V206A WOL-V18A. WOL-V2068 WOL-V18C WOL-V532A WOL-V41 WOL-V5328 WOL-V42 WOL-V533 WOL-V658 WOL-V544A 1 WOL-V70A WOL-V5448 .

WOL-V708 WOL-V959 WOL-V72A WOL-V1153A WOL-V728 WOL-V1153C WOL-V109A WOL-V1170 WOL-V1098 A-15 0165x RA

, - , . - . . - . . . _ , _ , , , _ , .-. _. ,_._-4 ,,-__._,-,.7 .-__,4 .-.. _ _ _ _ _ _ , . . _ .,m, ,_._ _-.-.,.__.--,-%..,.

APPENDIX 8: IIF FILL 8.1 SCOPE After installation of the Internals Indexing Fixture (IIF), the RCS water level will be raised to approximately 144". This maneuver is performed per Section 4.3.2 of Operating Procedure 2104-10.2. The boron dilution potential directly associated with this maneuver constitutes the scope of this analysis. It is expected that this will be a one time only procedure. After its completion, RCS level adjustments will be made with the IIF processing system or a feed and bleed operation. Thus, the 1

minimum acceptable RCS boron concentration is assumed to be 3500 ppe.

l f

1

)

i l

B-1 ,

0488x RA 1

l

. _ = - -. . _ _ - - _-__-. . _ .

8.2 INTRODUCTION

The flow path used for !!F fill will be the same as that used for previous refill and feed maneuvers: 1.e., draindown from RC bleed tanks A or C and RCS injection through makeup valves 16A, 8. C and D using a WOL pump. The details of the IIF fill maneuver differ from those analyzed for the static, level control situation in the following aspects:

(1) Makeup valves 16A 8, C and/or O which provide isolation under static conditions may be opened for the IIF fill.

I (11) The ability to interpret a dilution event by monitoring any RCS inventory change is affected because the IIF fill produces an increasing level by design.

1 4

The IIF fill entails increasing the RCS level from 72 1 3 inches to 14413 inches, or the injection of about 11,500 gallons. The instrument

! accuracy (1 3 inches) corresponds to about i 475 gallons.

In performing this analysis, it has been assumed that:

i

1) the initial concentration of boron in the RCS and the source bleed tank is 5050 ppm 8. l

2) The '8' bleed tank is either empty or full of RCS grade water.

3) The dilution event of concern involves a drop in the RCS boron concentration below 3500 ppe.

l 8-2 -

0488x RA

j 4) All barriers which were in effect during the static, level-controlled mode are also maintained during IIF fill except those required by the maneuver e.g. MU-V168.

5) iThe IIF fill operation will be performed only once.

Therefore, a frequency of barrier valve manipulation of 1

-I yr was assumed.

6) Type I selection errors on valves operated from the control room were given a recovery factor of 10 to account for the 4

number of qualified personnel witnessing operations. Type I errors on valves operated from the Radwaste Panel were given a recovery factor of 5 to account for the general use of a mimic board; less credit was given for recovery than for valves operated from the control room. Type I errors on manual valves were given a recovery factor of 2 to account for operator recognition of an error from the effects of a valve misalignment.

l i

i B-3 0488x RA

. . - , ,, ,-n,-- - , -- .-n--. . , ----- - m-ww ---wre --w"r e--~~w-"'' " " * * ~ ' * ' ^ ~ " ' ' ' " " " " ' ' ' ~ ~ * " ' ' " " ^ ' ' ~ " ~ ~'

8.3 CALCULATION 8.3.1 Prevention of Oilution i

To coepensate for the loss of isolation barriers associated wiro opening the IIF fill path, a group of isolation barriers w -

identified. This group is provided as Table 8.1. The valves in Table 8.1 are summarized in Table 8.2. It is recommended that the valves in Table 8.2 be added to those in Table 4.4-3 of the main report to form the isolation. barrier checklist in OP 2104-10.2.

4 8-4 ,

0488x RA

TABLE 8.1 ACTION AFFECTED PATH COMPENSATION MU-V16A,8,C,0,,' ku -P-1 A,8,C Discharge MU-V144A, -V1448, -V144C SPC-V86 MU-V36. -V12. DW-V195, DH-VSA,8, 100A,8 DH-V7A,8, -V128A,B, DH-C-1A,8, -V109, ~~120, l DH-V134A,8, SF-V217, 186, 1 133. SF-C-1A,8, -V214, '

-V122. SF-K-1, BS-V3A,8,  ;

SPC System (Isolation not required for boron dilution prevention)

CF Makeup CA-V175 CA-V173 CF-Tanks CF-V145. -V146; CF-VIA,8

-V115. -V114A,8 Seal Return Coolers MU-V289 Md-C-2A 28 tubes, -V37. DW-V227 Makeup Tank MU-V133

MU-V12,13,27,28 MU-T-1*,169 RC 81eed Hold-Up Tanks MU-V8 or Deborating Demins. WOL-V81A,8 WOL-V1091. -V1125 SF-V214. MU-V169, CF-V107 WOL-V994, -V996, -V37,

-V1171, WOL-V1152. -V523,

-V153A, -V1092. -V65A,

-V298, WOL-V288,

-V521A,8,C, CA-V136, WOL-T-18,*

• Isolation vent header; fallare of isolation requires tank overflow.

8-5 , 0488x RA

. _ _ _ __ _ _ _ _ _ _ _ _ _ _ _ = . . _ . _ _ _ . . . _ _ _ _ __ . . _ . _ _ . _ _ _ . _ _ _ . . . _ _ _ _ _ .

ACTION AFFECTED PATH CONPENSATION CA-T-2A,~28.

- -3 CA-V107, 112 CA-P-1 off, CA-P-2 off CA-T-1 MU-V127 CA-V138 MU-K-1A, -18 MU-V8 4

MU-V107A,v, -V224A,8, -V226 RCS Letdown Coolers MU-V8 MU-V376 NU-V10 Deborating Domins WOL-V118A, -V1188 WOL-K-1A, -18 WOL-V72A, -V728, DW-U313. -U314 WOL-V532A,8, -V109A,8,C,0,

-V70A,8, -V163A,8, WOL-V81A,8, -V190A,8, WOL-U301 CA-T-1 WOL-543A WOL-544A WOL-5438

, WOL-5448 CA-V140 CA-P-4A,8 off, CA-V135

-V136 -V154, CA-T-8*

DW Connection MU-V294 DW-V92 I

WOL-V40 Other WOL Sources WOL-V176, -V1171 WOL-V175. -V59. -V41 WOL-V33A Isolation of WOL Sources WOL-V65A from Recirc. Line WOL-V658. -V206A,8 WOL-V167 Boric Acid Pump 01scharge CA-V136 WOL-V21C(A) CA-V133A,8 -V135, -V154, CA-T-8*

4 Isolate Sampling from WOL-V37 Recirculation Line SNS-V158. SNS-140, SNS-53, SNS-T-6*, SNS-V23, -V1. Hose 4

next to SNS-V139 or SNS-V139 1 i

l 8-6 ,

0488x RA

ACTION AFFECTED PATH COMPENSATION WOL-V31A Demin Water Flush WOL-V523 DW-V223 Isolation of WOL-T-18 WOL-V298, -28B from Injection Path WOL-V1668 WOL-V29C(A) RC Orain Tank WOL-V1153C, -V1153A WOL-V1092 Relief Valve Letdown MU-R3 Line MU-V107A,8, MU-V226, MU-V224A,B, 376 WOL-T-Vent Header and Must be open for processing Gas Analyzer Waste Gas Discharge Header Must be open for processing Nitrogen Line Must be open for processing Makeup Tank Relief Discharge MU-RI.

MU-V12.13,27,28,289,169, MU-T-1*

Decon Connection WOL-V18C(A)

SNS-V97 -V128 RC Evaporator WOL-V117 -V18A.C WOL-V521C, 521A, -V42 RC Evaporator WOL-V138 WOL-V658, V1170 WOL-T-9A,8 WOL-V959 WOL-V521C(A)

DW-Flush Through RCF System RCF System Disconnected and Removed B-7 ,

0488x RA

8.3.2 Mitigation of Potential Oilution Event During !!F fill, the operator is not able to determine that a dilution event is occurring by a deviation from a constant level indication. Further, the IIF fill requires increasing the level from 7213 inches to 14413 inches at a rate of about 30 gpm.

< This results in completion of the IIF fill maneuver in about 61/2 hours. Thus, because most of the administrative controls described i

in Section 4.4.5.2 are perforised on a shif t or daily basis, the only detection of a dilution would be a low level alarm on a dilution source. However, this does not present a significant boron dilution hazard because the total volume added is not enough to dilute the vessel concentration to 3500 ppe.

Thus, the following recommendation are made:

(1) Sample the bleed tank from which the IIF will be filled prior to start of fill.

(2) Sample the RCS after completion of IIF fill to 4

reestablish the 5050 ppe benchmark.

(3) Perform a mass balance of the RCS and source bleed tank j every hour to identify discrepancies which could indicate a dilution event in progress.

B-8 ,

0488x RA

..___ _ _ ,_. _ . . _ . . _ _ _ _ _ _ _ _ _ . . . . - . . _ _ _ _ __.___L__-_____

8.4 CONCLUSION

S and RECOMMENDATION This section sunmarizes the conclusion and recoe.nendations for IIF fill.

l .

1) The probability of a boron dilution occurring that is associated with IIF fill is estimated as 5.2 x 10-3 for leaks and 3.9 x 10 -4 for ruptures. This probability is due to the required isolation of 363 paths. The detection capability associated with the IIF fill results in a

probability of boron dilution to 3500 ppe due to this maneuver

' ~

to be about 6.6 x 10 per year. 1

2) .The valves listed in Table B.2 sho~uld be added to Appendix C to 2104-10.2. These valves provide at least double barrier isolation of the IIF fill path to compensate for the isolation valves that are opened for the maneuver. The isolation valves in Appendix C to 2104-10.2 that are not explicitly required for the IIF fill must remain closed to assure double barrier isolation.

3) Sample the bleed tank from which the IIF will be filled prior

, to the start of the fill (since the total fill volume is less than that required to dilute the vessel to 3500 ppm).

l

4) Perform hourly mass balances of the RCS and bleed tanks during the maneuver.

I B-9_ , 0488x RA )

Table 8.2 Barrier List for IIF Fill (Filling of the IIF is accomplished per Section 4.2 to Operating Procedure p104-10.2. Procedure 2104-10.2 is structured such that all valves required for isolation during static conditions or for any nuneuver covered under 2104-10.2 are placed on a single checklist -

Appendix C to 2104-10.2. Thus, the following valves are recommended to be placed on Appendix C to 2104-10.2 in addition to those in Table 4.4-3 of this report. The valves listed here isolate the process flow path.)

MU-V6A WOL-V117 MU-V68 WOL-V138 SNS-V26 WOL-V1668 SNS-V97 WOL-V176 WOL-V18A WOL-V206A WOL-V18C WOL-V2068 .

WOL-V28A WOL-V532A WOL-V28C WOL-V5328 WOL-V29A WOL-V959 WOL-V29C WOL-V963 WOL-V41 WOL-V964 WOL-V45 WOL-V1153A WOL-V46- WOL-V1153C WOL-V658 WOL-V1170 WOL-V72A WOL-V728 8-10 ,

0488x RA

APPENDIX C: REFUELING CANAL FILL l

l C.1 SCOPE After the installation of the internals indexing fixture (IIF), there is a contingency plan to fill the refueling canal if a leak in the IIF seal wre to develop. The maneuver wuld be performed by Operating Procedure 4201-0PS-3254.01. The potential for dilution of the RCS when conducting this maneuver constitutes the scope of this analysis.

The most likely time for an IIF seal leak muld have been immediately af ter installation, which ws part of the head lift operation. For head lift, the minimum acceptable RCS boron concentration a s 3500 ppe.

Although a leak of the IIF did not occur; and therefore, the likelihood of filling the refueling canal is now diminished, this appendix has been updated to include the boron dilution hazard of filling the refueling canal if the minimum RCS boron concentration wre 4350 ppe.

C-1 ,

0489x RA

C.2 INTRODUCTION i

Under this contingency, the refueling canal is to be filled to approximat ly the top of the IIF. This corresponds to an elevation of 327 feet and requires the transfer of about 105,000 gallons from the 8WST. The maneuver may be conducted with pump SF-P-1A, SF-P-18 or FCC-P-2. Whichever pump is used, the required flow path is from the BWST through portions of the decay heat and spent fuel systems and through flexible hosing (connected at FCC-U-2) into the canal. ,

The canal fill maneuver differs primarily from static conditions in that it is more difficult to detect a dilution event by level change when a flooded canal comunicates with the RCS. This is because a one inch increase in water. level as read on the RCS level indicators corresponds to roughly 915 gallons when the canal is filled versus about 160 gallons i

if only the IIF were filled. From a dilution viewpoint, the additional water in the canal has little beneficial effect because it must be assumed that a dilution through a piping interface will not six with the canal volume before reaching the core.

The loss of level monitoring sensitivity becomes more important for slow dilution events (.15 gpm). This is because, at faster dilution rates  ;

the operators may be able to judge that a dilution event is in progress  !

l by the unexpected n ie at which the canal is being filled or if the

]

dilution rate is by a piping interface, by a surge in the IIF level.

C-2 ,

0489x RA

-..-.-.--.-.--,-L-.--,-.. .--

C.3 CALCULATION There are three aspects of the dilution potential that are associated 1 l

with the canal fill maneuver: (1) the potential for dilution into the ,

4 canal fill pathway during the fill itself, (2) the potential for dilution l

l of the RCS from a diluted canal volume after the fill is completed and j (3) dilution of the RCS through RCS piping interfaces after the canal is filled.

In the first case, the concern is that a portion of the flow into the canal is unborated water. As mentioned in Section C.2, it is likely that a dilution flow that was comparable to the desired fill flow would be detected by a greatly increased canal fill rate (or a relatively slowly decreasing 8WST level). However, flows significantly less than the fill rate would probably go unnoticed in this maneuver. In any event, if a canal sample were taken prior to overflowing into the shallow end, any 4

m.

dilution event could be detected before affecting the RCS.

In the second case, the refueling canal volume acts as an additional mixing volume to inhibit dilution of the RCS. The water in the canal itself is approximately three times that in the reactor vessel. To dilute the uolume of'both the vessel and canal to a boron concentration of 3500 (4350) ppe would require approximately 60,000 (22,500) gallons, which would correspond to a canal level increase of over 5 (2) feet. It is extremely unlikely that this amount of additional water would go undetected.

C-3 ,

0489x RA ,

i ~

\

i The potential of dilution via RCS piping interfaces after the canal is  ;

filled represents the third, and most restrictive, case. The probability of a dilution occurrence through piping interfaces is not i ,

related td whether the refueling canal is filled. However, the ability to detect such an occur.rence is more difficult because of the loss of l

1evel instrument sensitivity with the canal filled (or partially filled) with water. Further, the canal volume cannot count as a mixing volume for any unborated water through piping interfaces because it must be assumed that the water above the vessel will not six before the unborated  ;

water will reach the core. In this case, the level increase before a

, l potential dilution to 3500 ppe would be about 13 inches (915 gallons / inch canal volume). At any credible dilution rate (see main report), this l

would require at least an hour. For the morer likely rates, dilution l

would not occur in less than about 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br />. However, if the minimum acceptable RCS boron concentration is 4350 ppe, the volume of water required to dilute the vessel to this concentration would result in a level increase of only six inches. Thus, the current level alarm setpoints are not appropriate for detection of a dilution under these circumstances. In the event of canal fill with the minimum RCS concentration specified at 4350 ppe, (1) the level alarm should be reset i

to i 2 inches or (2) an.RCS sampling program with a frequency of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> f or less should be implemented to provide timely notification of a 1 potential dilution during static conditions. If RCS processing must be undertaken with a filled canal, there are additional monitoring requirements associated with each operation. These additional requirements are specified in the appropriate appendix.

C-4 . 0489x RA l

(Detailed quantification of the dilution potential associated with the canal fill maneuver was not performed because the risk was judged to be negligible,, given the low likelihood of occurrence of the contingency canal fill, the low probability of dilution occurring and the detection capability. The dominant risk associated with the maneuver is judged to occur through piping interfaces after the canal is filled because of the loss of sensitivity of the level instrumentation. However, in this case, there will be adequate time for operator response to an event of any credible flow rate (see main report). The probabilities of occurrence of a dilution through piping interfaces are the same as estimated for plant conditions in other sections of this report.

4 i

4 4

c C-5 . 0489x RA

)

C.4 CONCLUSIONS /RECONNEN0ATIONS l (1) Sample the canal prior to filling the deep end to assure that the water with the desired concentration is being added.

l (2) Provide isolation of the canal fill pathway. In this regard, Rev.

l 0 of 4210-0PS-3254.01 was reviewed and verified that, with the j exception noted below, isolation of the canal fill path is f achieved with the valve lineup presented in the procedure. (N.8.

This list does not provide ' double barrier" isolation of the fill j path. However, this is not required from a reliability standpoint

given that injection is into the canal and that a sample will be

! taken just prior to filling the shallow end. If double barrier -

] isolation is required due to SER commitments, an isolation list which achieves this is available in RAS Calculation 4430-84-007.)

Valve SF-V222 in Section 7.3 of 4210-0PS-3254.01 should be closed i

to isolate the flow path. No indication of the correct position is 4

shown.

(3) In the event of canal fill with the RCS minimum acceptable baron concentration of 3500 ppe, assure that the RCS level alarm is set I to detect a level increase of no more than about 6 inches; this j will allow for operator action to isolate the RCS from dilution through piping interfaces. In the event of canal fill with the RCS minimum acceptable concentration of 4350 ppe, (1) the RCS level alarm setpoint should be plus two inches or (2) a sampling program with a frequency of two hours or less should be implemented.

C-6 , 0489x RA

APPENDIX 0 ANALYSIS OF 80RON DILUTION POTENTIAL DURING IIF PROCESSING i

0.1 SCOPE This appendix describes the boron dilution potential directly associated with the operation of the IIF processing system. For the purposes of this analysis, a draf t procedure for IIF processing was used (2104-8.18).

Since most of the administrative controls Lila h cre in place under 2104-10.2 will also be in place under h k .,ru W re, this analysis addresses those operations which diverge frota the level control mode, or which in some way ' . fluence the controls which were taken credit for in the baseline analysis.

l l

l 0-1 0490x RA

0.2 INTRODUCTION

l Operation of the IIF Processing System impacts the baseline (static RCS) assessment in the following ways:

1) Opening of MU-V168 l

2) Installation and operation of DWC-P-1

3) Manual maintenance of level in the Reactor Coolant System from the Radwaste Panel For each of these changes to the baseline asse>. ment for boron dilution, compensating and/or mitigating measures have been evaluated.

To compensate for the opening of MU-V168 and the operation of DWC-P-1, j additional valve closures have been recommended and appropriate accident sequences have been postulated.

To compensate for the potential to accommodate and mask a small unborated 4

injection by the level controller, an increased sampling frequency is i

recommended. No credit has been taken for operation of a boronometer.

Given the post head lift experience, it is anticipated that the IIF processing system will operate no more than 50 days between head lift and start of defueling. This translates to a maximum of about nine batches on a yearly basis. A batch consists of about 50,000 gallons of RCS water. An extended (>8 hrs) shutdown isolation list would be implemented

at the end of each batch per Section 6.1.10 of 2104-8.18; a temporary 0-2 ,

0490x RA

4 shutdown isolation is implemented on a daily basis during the batch process per Section 6.2 of 2104-8.18. These shutdowns enable operators to make their daily leakrate checks and to handle any temporary abnormalities which may be' encountered in the SDS system. One system trip annua ly was also assumed.

With respect to manual maintenance of level, it was assumed that this I maintenance would be performed only on the makeup side from the Radwaste panel and that letdown flow through SDS would remain constant.

In performing this analysis it has also been assumed that:

1) Th.e initial concentration of boron in the RCS and the bleed tank used for makeup is 5050 ppm 8.-

2) The '8" bleed tank is either empty or full of RCS grade water.

3) A ' dilution event' involves a drop in boron concentration to the appropriate RCS minimum acceptable boron concentration of 1

3500 ppe or 4350 ppe.

4

4) All barriers which were in effect during the static, level-controlled mode are also maintained during IIF processing except those barriers involving NU-V16A, 8, C D.

5) Type I selection errors on valves operated from the control room were given a correction factor of 10 to account for the number of qualified personnel witnessing operations.

0-3 ,

0490x RA y- ,w.,_ _,,,-~v.,-w.---,

- .,,-.,.,-.m--

- - - ~ , , , - - , .w,---------.

-.,_,,,,-,.w---.,.-.,-._v.m. ~ , - , ..,.%,. , _ ,7v,,- -- %

l l

6) Type I selection errors on valves operated from the Radwaste l Panel were given a correction factor of 5 to account for the mimic board and the potential for operator recognition of errors because a maneuver might have failed following his '

valve lineup.

7) Type I selection errors on manual valves were givea a correction factor of 2 to account for operator recognition of errors because a maneuver might have failed following his valve lineup.

D-4 0490x RA m

---,.,-m-m.-,, ,,rm-,,,,.._,-,,,- -- ,-.,- ,.,n.__m,.,_,,,,m,, -peww-- -,-e --m---

0.3 CALCULATIONS Operation of the Internals Indexing Fixture Processing System introduces a new pathway which is not present during the normal, level-controlled mode of plant operation. It can be viewed as an extension of the RCS from the vessel through the SDS system, into the RCBT's and back to the vessel via the Make-Up and i rif!.e' ion System. Intrusion of the RCS system is made in two places w i-.6 c.st be compensated for by the isolations along the path which makes up the !!F Processing System.

0.3.1 Prevention of Dilution The additional risk due to the operation of the IIF processing system is composed of two components:

1) Otlution while processing and

2) Oilution after processing has ceased, or between batches.

The total probabilities of leak and rupture dilutions have been calculated to be 4.4 x 10 ~3 and 5.0 x 10 -4 yr-I,

-I yr 1 respectively. The specific components of these numbers are discussed in the sections to follow.

0-5 .

0490x RA

I 0.3.1.1 Letdown During Processing l I

l The first intrusion is made on the top of the IIF where reactor coolant is pumped out to the FH8, through the SDS

[ System,andintothebasementoftheAuxiliaryBuildingto l WOL-T-1A(C). Compensating valve closures are listed in Table 0.1. Except for the first two hose ce,n.ii.ctions, only the first isolation boundary is listed on the letdown path. Shown there are 20 manual and 13 NOV valves, each of which is combined with 4 N0V's to make 136 barrier configurations.

Three of the four M0V's (29A(C) 28A(C), 963(964)) have an adjacent manual valve (WOL-V166A(C), 996(994)), which it is assumed would be cycled during long term shutdown. As 1 mentioned, it is assumed that one trip per year would demand .

FCC-V003 as a barrier in combination with each of the 13 NOV and 20 manual valves. .

I When the IIF System is operating, the only means of RCS dilution on the letdown (SOS) side of the system is by inadvertent line-up of the WOL pump to the wrong bleed tank, or by letdown to the bleed tank being used for makeup (given that a dilution occurs on the letdown path). l 4

l l

l i

l 0-6 0490x RA

,,-~,.,r - - - - ,-r-- - , , _ ,n, ,,_w,n .,a-v - n._ e n . . , . , - - - - - - en_m -,,,-,,,m-n,---,-

Since the frequency of operation is the driving factor which increases the probability of dilution for letdown, a third valve for these pathways was required to reduce this probability.

The leak and rupture components due to the letdown side during processing are 2.6 x 10 ~3 yr-I and 2.3 x 10-4 yr-I ,

I respectively.

I i

i

)

i 0-7 .

0490x RA i

- , , , . _ . . _ . - . _ _ _ . . . - _ . . . _ . _ . - , _ . _ _ , _ , . - , . _ , _ _ _ - _ _ . , _ _ , , _ . _ . , , . _..-.___._,__,__,,___-m_ _ , . , _ , , ,

TABLE D.1 .

IIF PROCESSING - LETDOWN ACTION AFFECTED PATH COMPENSATION Open FCC-V003 From canal drain pump FCC-V002 DH-(1 1/2") p. (1 1/2" hose) Disconnect puerp From sump sucker (1" hose) FCC-V001 Disconnect pump Open SWS-VI From Service Watcr System SWS-V6 drain (3/4")

Open SWS-V2 Flush Conn. (3/4") Step 4.2.3 of OP 2104-8.18 precludes connection of flushing apparatus during processing Open CN-V-RC-364 Return line from Monitor Tanks CN-RC-362 (SDS-T-1A,-18)

Off-gas 1ine CN-V-RC-362 RCS Clean-up manifold sump CN-V-RC-362 High-Rad filter manifold sump CN-V-RC-362 CN-V-RC-363 WG-P-1 discharge WG-V71 Flush connection Step 4.2.3 of OP 2104-8.1B precludes connection of flushing apparatus during

processing MWHT, RCBT WG-V71 WG System WG-V71. -V95 l

CN-V-FL-1 Flush Conn. Step 4.2.3 of OP 2104-8.18 1 precludes connection of )

flushing apparatus during processing Sample conn. & vent Not credible for dilution l CN-V-FL-3 Vent & sample conn. Not credible for dilution CN-V-FL-14 Sample line & vent Not credible for dilution D-8 0490x RA

,._,..--...n..-,-w..--------,.-p , , - . , - - - ,--.,-,c- - - - , . , . - . - . . . , -

- - , - . , , , , . , - . - - , . . , . - - - - - . - .v-.-. , , ,.

ACTION AFFECTED PATH COMPENSATION CN-V-FL-6 Vent line & sample line Not credible for dilution WG-P-1 discharge WG-V69 MWHT & RC8T WG-V69

Flush conn. Step 4.2.3 of OP 2104-8.18 precludes connection of flushing apparatus during ,

processing Demin Water WG-V69 SDS-T-1A, 8 CN-V-RC-366 CN-V-RC-369 Flush conn. Step 4.2.3 of OP 2104-8.18 precludes connection of apparatus for flushing during processing Hi-Rad sample glove box Not a credible source for dilution CN-V-IX-25(26) Flush conn. Step 4.2.3 of OP 2104-8.18 precludes connection of flushing apparatus during processing CN-V-IX-29(31) Flush conn. Step 4.2.3 of OP 2104-8.18 precludes connection of flushing apparatus during processing CN-V-IX-30(32) Tie-in to MDH Tie-in not made Utility heter supply CN-V-IX-58 Flush connection Step 4.2.3 of OP 2104-8.18 precludes connection of i flushing apparatus during processing Monitor tank (SDS-T-1A, 8) CN-V-PF-62 Flush Conn. for Sampling CN-V-SA-294, CN-V-PM-196 MWHT and Radweste System CN-V-IX-102 D-9 0490x RA ee -,-~ , - -m--e e m--,~.,--.- , - , , w,- . , - - , - , - , - , - - - - - . , , , - - - , - owe-~,o-+->e.w, - _w,,.-e,-a ,.--e_,, , - - ~,,,a-------- -a-+,-- - - - - - --

ACTION AFFECTED PATH COMPENSATION SF-V158 Spent Fuel System . SF-VISO i SF Pool SF-V159 Fuel Storage Pool SF-V161 SF-V125 [ Sample Line SF-V126 OH System SF-V240 SF System SF-V240 OH Letdown SF-V122 SF System SF-V121A SF System SF-V1218 SF-V214 Core Flood Tank 81eed CF-V107 and Sample MWHT WOL-V1091 RC Orain Header WOL-V-1125 MU-K-1A,8, WOL-K-1A,8 WOL-V81A,8, MU-V8, -V107A,8 Makeup System MU-V226~, -V224A,8, -V376 Makeup Tank MU-V169 WOL-V964(-V963) -Isolate Letdown Tank WOL-V-28A(C),-V29A(C),-V533 from Makeup Line/ Tank WOL-V166A(C) 1 Isolate WOL-T-18 from WOL-V288, -V298 Makeup Line WOL-V1668 Isolate WOL-T-18 from WOL-V995 Letdown Line 0-10 0490x RA

--.-.__.l__--.-_--.__--,-

0.3.1.2 Makeup Ouring Processing The second intrusion to the RCS is made by making up from WOL-T-1C(A) through WOL-V40 and MU-V168. Compensating valve clos,ures are listed in Table 0.2 yielding double valve isolation to any unborated water source. The path is traced from MU-V168 back through the MU&P System and the Liquid Radweste System to the bleed tank WOL-T-1C(A).

The frequency of manipulation for these compensating valves is assumed to be once per year. That means that no allowance has been assumed for moving valves around on the makeup side of the system during shutdown except at the bleed tank.

The resulting leak and rupture probabilities for the 400 barrier configurations on the makeup ~ side during processing are 1.4 x 10-3 yr'I and 1.1 x 10~4 yr-I, respectively. l1 0-11 ,

0490x RA

I

.-----~-_,---em_--__ ., . ,-- ---.,_ . __ .,..,,,.,,m,__,,e,,,-,y,,,,,,,-_p. -,, ,w,, , . . , , , , , , , - -,-m,-.

TA8LE D.4 ACTION AFFECTED PATH COMPENSATION NU-V16A,8,C,0 MU-P-1A,8,C Discharge MU-V144A, -V1448 -V144C SPC-V86 MU-V36. -V12 DW-V195, SF-K-1*, 85-V3A,8, OH-VSA,8

/ -V7A,8, -V100A,B, -V128A,8,

! -V109, OH-V120 -V134A,8, DH-C-1A,8, SF-C-1A,8 SF-V217. -V186, -V122 SPC System Isolation not required to prevent boron dilution CF Makeup CA-V175 CA-V173 CF-Tanks CF-V145. -V146, CF-V114A,8. -VIA,8, -V115 MU-V151 Seal Return Coolers MU-V289 MU-C-2A,8, MU-V37 DW-V227 Makeup Tank MU-V133 MU-V12,13.27,28,169, MU-T-1*

Deborating Demins MU-V8, WOL-V81A,8 MU-V149 CA-T-2A, -28 -3 CA-V107, 112 CA-P-1 off, CA-P-2 off CA-T-1 MU-V127 CA-V138 MU-K-1A, -18 MU-V8 MU-V107A,B, -V224A,8 -V226 RCS Letdown Coolers MU-V8 MU-V376

• Tank volume limits potential for dilution.

0-12 0490x RA e

, , - - - , _.,m . - - . - ,,,,__~_-_-___,~_.c w, . _ _ _ , - - , _,m-_- .,.,e,n.,,or , . . _ _ , - - . - - - - - - . . . - - . - - - , - - - - -

ACTION AFFECTED PATH COMPENSATION MU-V118 Deborating Demins WOL-V118A, -V1188 WOL-K-1A, -18 WOL-V72A, -V728, OW-V84 WOL-V532A,8 -V109A,8,C,0,

-V70A,8, -V163A,8 WOL-V81A,8,

-V190A,8 WOL-U301

[ WOL-V544A,8 WOL-V543A,8 CA-T-1 CA-V140 CA-V133A,8 -V135 -V136, -V154 CA-T-8

• MU-V9 DW Connection MU-V294 DW-V92 WOL-V40 Other WOL Sources WOL-V176, -V1171 WOL-V175. -V59, -V41 WOL-V33A Isolation of WOL Sources WOL-V65A, from Recirc. Line WOL-V658. -V206A,8 WOL-V167 Isolate WOL-T-18. -T-1A(C) WOL-V963(964),-V18A,V521C from Rectrc. Line WOL-V996(994), 521A, 8. WOL-T-18*,

-V18C WOL-T-1A(C) *, WCL-V995 Boric Acid Pump Discharge CA-V136 CA-V133A,8, -V135. -V154, CA-T-8

• Isolate Sampling from WOL-V37 Recirculation Line $NS-V158, SNS-V140, SNS-V53 -V23, i

-V1, SNS-V139 l

WOL-V31A Demin Water Flush WOL-V523 l OW-V223 l Isolation of WOL-T-1A(C) WOL-V29A(C). V28A(C) l from Injection Path (All 1st isolation barriers used for letdown) ***,  ;

WOL-V166A(C)

Isolation of WOL-TIS WOL-V298. -288 from Injection Path WOL-V1668 WOL-V29C(A) RC Orain Tank WOL-V1153C(A)

WOL-V1092

• Tank volume limits potential for dilution.

• • • Triple barrier isolation is required due to human error vulnerability introduced by frequent valve manipulation.

0-13 0490x RA

_ _ _ . _ - - - _ - _--__--__-.._-_-___-_._.-.-.:-._-- --___--._J

ACTION AFFECTED PATH COMPENSATION Relief Valve Letdown Line MU-R3, i MU-V107A,8, MU-V226, MU-V224A,8 -V376 l WOL-T-Vent Header and Required to be open for l

,- Gas Analyzer processing Weste Gas Discharge Header Required to be open for '

processing i

Nitrogen Line Required to be open for processing ,

i  !

i Makeup Tank Relief Discharge MU-R1, MU-V12, 13, 27, 20, 289, 169, MU-T-1*

Decon Connection WOL-V18C(A);

SNS-V97, -V128. WOL-V42 I1 RC Evaporator WOL-V117 WOL-V521C(A)

RC Evaporator WOL-V138 WOL-V658, V1170 WOL-T-9A, a WOL-V959 WOL-V521C(A)

OW-Flush Through RCF System RCF System Disconnected and Removed

• Tank volume limits potential for dilution.

l 0-14 0490x RA l

. .-. _ _ _ . - - - -- __ _ -. . = - - ._ - __ _

On the makeup side of the system,-all potential _ dilution sources

, are isolated by at least two independent barriers. There are 284 potential injection points, all of which meet the two independent valve closure criteria during operation of the IIF. When the syst trips, there is an additional barrier (WOL-V40) for the WOL barriers all of which are upstream of WOL-V40. Therefore, the more j conservative assessment of boron dilution probability comes from i

! the scenario in which the IIF processing system is in operation.

! 0.3.2 Probability of a Dilution - Impact of Shutdown i

! The calculation of a boron dilution event initiation after processing has ceased, or between batches has been performed by l determining the increase in vulnerability due to starting and I

stopping the processing system. This determination was made l separately for letdown and makeup.

l 0.3.2.1 Impact of Shutdown on the Letdown path i

j When the system is shutdown for an extended (>8 hrs) time, FCC-V003 forms four triple barriers with SWS-VI, SWS-V2;

. SWS-VI, SWS-V6; FCC-V001, pump; FCC-V002, pump. If SWS-V2 can be added to the temporary shutdown list, then the calculation for temporary shutdown will incorporate extended i

I i D-15 ,

0490x RA

_ _ _ . _ . _ ._._ .. _ __ _-_ _. _ ... _ .___ _ _ _.i_..____.__.._______

shutdown for the letdown path except for 33 barrier configurations.- Assuming daily temporary shutdowns for each workweek (1 batch takes approximately a week to process), the leak and rupture probabilities of boron dilution through the letdown path during shutdown are 1.1 x 10

• and 8 x 10- ,

respectively. Triple barrier configurations were needed to keep this probability acceptably low.

D.3.2.2 Impact of Shutdown on the Makeup Path Again, the system is assumed to be shutdown -e times / year l1 for an extended period (> 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />) if the system is operated for a year. On the makeup (injection) side of the system, MU-V168, MU-V9, MU-VIO will be closed in addition to the isolations already in effect for processing. Allowance has been made for manipulation of the valves upstream of MU-V10 in order to prepare the bleed tanks for further processing. That component is included in the calculation for dilution during processing. Therefore, the only additional component to the risk is that due to the manipulation of three valves (MU-V168,

-V9, -V10) for each long term shutdown. The leak and rupture probabilities for this component are 1.5 x 10-6 yr

-I and 1

2.6 x 10 $ yr-I , respectively. Moting that the rupture probability is almost twenty times the leak probability, one concludes that this failure mode is dominated by human error, owing to the high frequency of valve manipulation.

D-16 0490x RA

-- y ,e- - , ,+,.m-- ----* , www.-e-- -,,yww vs,-,--.-,ws-ww-,.v.- w---,- -e,,wwiy,-.,,.-- .

,,y-,--e,-,-wrw=g,yw-.-y.%- -y-y-- -g-ww- . v em e,-nye ay , -%

i Knile the system is shutdown temporarily (<8 hrs), allowance l i

has not been made for the manipulation of processing isolation l

barriers. Only valves in the process stream will be  ;

. manipulated, having negligible impact on the risk of dilution. All isolation barriers which were in place during '

processing will still be in place during temporary shutdown, so the calculation of dilution potential during processing has taken care of this component.

D.3.3 Mitigation As discussed in Section 4.4.5.3, there are several potential methods for detecting a dilution event. The methods for which reliability credit can be given during IIF processing are discussed below:

(1) Level monitoring: The ability of the level instrumentation to detect a dilution event has some limitations during IIF processing. This is because the water movement into and out of the vessel requires some throttling of the makeup source to maintain a constant level in the IIF. (The throttling may be manual or automatic. From the standpoint of boron dilution prevention, direct operator balancing of the flow is preferred to the action of 41 automatic level controller. This is because the operator may be able to make a judgment that the i degree of throttling is excessive for balancing the process.)

4 i

0-17 0490x RA l

, _ - - - _ _ __~.___._____.,___._._.__.__.___._._n___..

This throttling allows the possibility of a dilution inflow being mixed'with the desired makeup flow to maintain level.

As a worst case, the entire makeup flow could be an unborated water source; this unborated water inflow would remain undetected by the level indicators until it exceeded the IIF processing outflow. If the inflow exceeds the outflow, a rising RCS level will detect the dilution event. Experience with the IIF processing indicates that it will probably not be operated at greater than about 15 gpe, which, coincidentally is the bounding rate for most dilution events as discussed in the main report.

(2) Boron sampling: To compensate for the loss of sensitivity of the level indication during IIF processing, a boron sampling i program will provide the capability to detect a dilution event. Because the dilution rate that could be " hidden" from the level indication is a function of the outflow, or IIF processing rate, the sampling frequency varies with the 1 1 ,

processing rate. (Coincidentally, the most likely range for a l dilution event, O to 15 gps, corresponds to the range at which processing will be conducted. If processing exceeded 15 gpm, the boron sampling frequency should be set to detect a dilution inleakage of 15 gpe.) The sampling frequencies recommended are provided in Table 0.3.

0-18 ,

0490x RA

_. . _ _ _ . . -_ ____._..______._____..____._u_____..._.. ,_

Table 0.3 Recommended RCS SamDlina during IIF Processing l Process l RCS Minimum = 3500 com i RCS Minimum = 4350 com l l Flow Rate l Dilution Vol i Samplina Frea 1 Dilution Vol l Samplina Freal l I I I I I I 5 aos l 13.200 cal. l 37 hrs. I 5.370 cal. I 11 hrs. I I It i I I I l 10 L 13.200 1 16 1 5.370 1 3 I I I I I I I I 12 l 13.200 1 13 1 5.370 1 2 1 I I I I I I I 15 l 13.200 1 9 I 5.370 1 1 1 The above table illustrates the difference in the sampling frequency resulting from different minimum acceptable boron 1 concentration. The frequencies in Table D.3 assume (1) no operator action if the sample results are 4950 ppe or greater (n.b., not to be confused with the assumed initial RCS boron concentration of 5050 ppm)

(2) time allowed for sample analyses is three hours (3) time allowed for operator action is one hour.

The sampling frequencies can be lengthened if any of those assumptions were relaxed, e.g., a reduced sample analyses time may be possible for some period of operation.  ;

I l

(3) Mass Balance: Per appendix F to 2104-8.18, a water inventory balance between the RCS and the reactor coolant bleed tanks will be performed every hour during processing. Processing l l

will be terminated if there is a mismatch of more than 5000 ,

l gallons. This method will detect an inflow of water into the '

process system and thus is a backup to RCS sampling.

D-19 ,

0490x RA 1

__._.-,_..,__,,,_-..___.,._,.__.[__,,--..-_,._._.,__c. .

0.4 CONCLUSION

S AND RECOMMENDATIONS Given the assumptiones stated in 0.2, it has been calculated that the IIF processing operations can be implemented and carried out safely with an acceptably low risk of diluting the boron concentration below the minimum acceptable RCS boron concentration. The calculated probabilities of le2

-3 -I ~4 and rupture dilution initiations are 4.4 x 10 yr and 5.0 x 10

-I yr , respectively. Accounting for operator mitigation of the event, the probability of dilution below 3500 ppe during IIF processing was

~

estimated to be 6.6 x 10 ' yr in addition to the baseline risk; the probability of dilution below 4350 ppm was estimated to be an additional 1.0 x 10~4 per year above the baseline risk.

These probabilities are contingent upon th'e following recommendations:

1) The valves listed in Table 0.4 should be maintained closed during operation of the IIF processing system.

2) The applicable RCS boron sampling frequency from Table D.3 is procedura11 red and implemented.

! 3) Valve SWS-V2 should be added to the temporary shutdown list in Section 8.2 of 2104-8.18.

D-20 0490x RA e

-m e w-y , ,, ' , - .p9--y,.,,wmy-,-em-.y,-g-#,%.,i.,wy.,m

. q.,- y e -y.-e.-,y_,, e -rii.--

TABLE D.4 BARRIER LIST FOR IIF PROCESSING (IIF processing is accomplished per Operating Procedure 2104-8.18. Procedure 2104-8.18 is structured such that all valves required for isolation during any maneuver are placed on checklists for periodic verification. Checklists applicable to IIF processing are Appendix C to 2104-10.2 and Appendix G (to be added as developed) to 2104-8.18. Thus, the following valves are recommended to be placed onione of these checklists in addition to those in Table 4.4-3 of this report. The valves listed here isolate the process flow path.

CA-V133A* SF-V121A WOL-V29C WOL-V190A* l CA-V1338* SF-V1218 WOL-V42* WOL-V1908*

CA-V135* SF-V126 WOL-V658* WDL-V206A*

CA-V154* SF-V150 WOL-V70A* WOL-V2068*

CA-P-1* OFF SF-V159 WOL-V708* WOL-V532A*

CA-P-2* OFF SF-V161 WOL-V72A* WOL-V5328*

CN-V-IX-58 SF-Y240 WOL-V728* WOL-V533 CN-V-IX-102 SNS-VI* WOL-V109A* WOL-V544A*

CN-V-PF-62 SNS-V97* WOL-V109B* WOL-V5448*

CN-V-PM-196 SNS-V139 ,

WOL-V109C* WOL-V959*

CN-V-RC-362 SWS-V6 WOL-V1090* WOL-V963*

CN-V-RC-366 WOL-V18A* WOL-V117* WOL-V964*

CN-V-SA-294 WOL-V18C* 1 WOL-V138* WOL-V995 DW-V84* WOL-V28A WOL-V163A* WOL-V1153A*

DW-V92* WOL-V28C WOL-V1638* WOL-V1153C*

DW-V223* WOL-V29A WOL-V166A WOL-V1170*

FCC-V001 WOL-V1668* WOL-U301 removed FCC-V002 WOL-V166C* WG-V69 (Pumps WOL-V175* WG-V71 disconnected) WOL-V176* WG-V95**

l1

• Valves which have already been incorporated into 2104-10.2 App. C.

• • Valve removed and pipe capped 0-21 0490x RA

---

,._------,-w,,,,,g- -, ,.,- ,---ny,, ,-

APPENDIX E: CEFUELING WATER CLE'NUP E.1 SCOPE This appendix describes the boron dilution potential directly associated with the operation of the Defueling Water Cleanup System (DHCS) as described by Operating Procedures 4215-0PS-3525.01 (Reactor Vessel portion), 4215-OPS-3525.03 (FTC/SFP portion) and 4215-OPS-3525.04 (Early Defueling DHCS operation). Since most of the administrative controls required by Operating Procedure 4210-0PS-3200.02 (formerly 2104-10.2) will remain applicable, this analysis addresses only those operations which vary from the static condition, or which in some way influence the controls which were applied during static conditions. The boron dilution potential directly associated with DHCS operation constitutes the scope of this analysis. -

4 E-1 0714x RA w -- _. y_, , . , - - , . _ , .

_--..f.-,-,_,,_~y-, ..,_.m.- , - -,.yy--, - , - . -.- - - . - , . , , , - _ _ , - - - - - - - _ _ . - .

,r

l E.2 INTRCDUCTION When fully operational, the Defueling Water Cleanup System (DHCS) will l i

provide the capability to remove particulate material or radionuclides l

from reactor vessel water or water in the fuel transfer canal and spent {

fuel pool A. During early defueling, the SDS System will be utilized in lieu of dedicated DHCS lon exchangers. Except for operation during early defueling, the flow paths used for defueling water cleanup are independent of those used for Feed and Bleed, IIF Fill, and IIF  !

Processing. The DHCS utilizes two closid loop processing flow paths, one l for the Reactor Vessel, and a second for the Fuel Transfer Canal (FTC)

and the Spent Fuel Pool (SFP). Two submersible pumps (deep well type) have been dedicated to each volume of water (i.e., a total of 6 pumps).

The two pumps for the Reactor Vessel cleanup train are installed in' wells j located in the fuel storage pit (south of the reactor vessel) in the shallow end of the Fuel Transfer Canal. The FTC/SFP loop includes the-two pumps located in the' deep end of the Fuel Transfer Canal and the two l

l pumps installed in the Spent Fuel Pool. Each pump has a capacity of 200 gpm and recirculates 20 gpm to protect the pump motor from runout.

This arrangement allows each loop to filter 200 or 400 gpm from the Reactor Vessel and Fuel Transfer Canal / Spent Fuel Pool depending on whether one or two pumps is operating. The defueling water cleanup processing differs from the static, level control mode of operation in the following aspects: __.

(1) Reactor coolant water is circulated through filters and, if I necessary, through a dedicated DHCS lon exchanger (s). During early i

l l

E-2 0714x RA

--,y,n__,g -, ,

-w .m. - - + - .------,-.y. ,e -, ,, - , -- _ - , - , , , - , , .g,,,,,w -, , , - - . , - - . _ , - , ~ . , - . y_ n_,,,,,mn m , ,m y y

cefueling. the SDS System dill re;;1 ace tne icn eachange cord p ;f the DHCS until installation of the DWCS lon exchange loops is completed.

(2) After DHCS filtration, process water generally will be returned directly to the vessel. An exception to this is the use of the SDS lon exchangers, either for "early defueling" purposes or to remove radionuclides not removed by the DHCS lon exchange resins.

~

(3) Although the sampling points used durirlg static conditions will also be available during DHCS operation, sampling points have also been incorporated into the DHCS design which will serve as the primary method of RCS boron sampilng during DHCS operation. The various sample points are routed to two sample glove boxes whlch are located in the Fuel Handling Bu'llding. It is planned that the boron concentration of the ion exchanger effluent in the RV Cleanup System will be constantly monitored and displayed at a local control panel.

In performing this analysis it has been assumed that:

1) The initial concentration of boron in the Reactor Vessel is 5050 ppe; the Fuel Transfer Canal / Spent Fuel Pool A is 4350 ppmB.

2) All RCS isolation barriers which were in place during the static, level-control mode as defined in operating procedure 4210-0PS-3200.02, are also maintained during defueling water E-3 0714x RA

cleanup. By procedure, correct positioning of barriers require $ ta isolate the DHCS process stream will be verified on a daily basis.

Some of these barriers may be removed if required for operational reasons, e.g., line flushing.

3) Criticality analyses of the defueling canisters in their storage racks have been performed (Reference TER 15737-2-G03-ll4, "TMI-2 Technical Evaluation Report for Defueling Canisters"). These

' analyses indicate that an array of canisters will be subcritical in unborated water. Thus, dilution o'f Fue'l Pool A or the fuel transfer canal was not considered to be a safety concern and was not included within the scope of this analysis.

4) Typical operations may not require the DHCS to be operating at" maximum capacity, i.e., both filter'and ion exchange loops (either dedicated DHCS lon exchange loops or SDS lon exchange loops).

Additional valving would be closed if only a portion of the DHCS were operating. For the purpose of estimating the dilution probability, this analysis assumed the DHCS was operating at.

maximum capacity; thus, the largest number of potential dilution pathways was considered.

5) The SPC Charging Water Storage Tank (SPC-T-4) i s assumed to contain RCS grade (5050 ppmB) water at all times when the DHCS is operating. SPC-T-4 is equipped with level sensors which continuously indicate the water level and actuate an alarm when the level reaches 37% (~ 1600 gallons) of capacity.

E-4 0714x RA

- - - - - , - --,, - , , n e 6 e -- - , - - - -m

E.3 CALCULATIONS Operation of the Defueling Water Cleanup System introduces additional potential dilution pathways which were not present during the static, level-control mode'of plant operation. The new pathways into the Reactor Vessel are through the Internals Indexing Fixture (IIF) which rests on the top of the Reactor Vessel. Six separate lines, i.e., two suction lines and four return lines, enter the IIF via the work platform.

Section E.3.1 describes the prevention of boron dilution by the isolation of the process stream. Two methods of DHCS processing are considered.

One method uses dedicated DHCS components; the second method uses DHCS filtration in conjunction with 505 lon exchange. Section E.3.2 discusses the capability to detect and mitigate a dilution event during DHCS operation.

E.3.1 Dilution Prevention This section describes the prevention of boron dilution; prevention is achieved by use of barriers which isolate the ONCS process stream from other flutd sources. Two modes of DHCS operation are considered; one using only dedicated DHCS components, the other using the OHCS in conjunction with the SDS system.

E-5 0714x RA

_ . . ~ _ -. ..-m v.e , . ., . . . - , - - _ _ . - . _ , - - . - - _ _ _

E.3.1.i Reactcr Vessel Clearuc usin; Ceci ste: C..C3 C: c; e 1 Processing of RCS water using dedicated DHCS components is shown schematically in Figure E-l'. Several potential points at which unborated water could be introduced into the processing stream were identified, e.g., flush lines, reactor coolant bleed tank feed lines, and sampilng lines.

Double barrier isolation of the process stream has been identified for each of these interface points.

The potential points of introduction of unborated water and their associated isolation barriers are provided in Table E.1. Barriers to dilution through these points have been chosen in Table E.1 based on reliability considerations such as diversity of design and operational requirements such as accessibility for. position verification. However, other isolation barriers which have comparable reliability could be substituted. As noted in Table E.1, there are 19 barrier configurations required to isolate the RV processing loop; these configurations are formed with a total of 21 manual valves and 4 air operated valves. The isolation valves identified in Table E.1 are summarized in alpha-numeric order in Table E.3 of Section E.4,

" Conclusion and Recommendations".

E-6 0714x RA l

, ....c-h y sj ; ,2; :c.-ac J.-C '

~

ta-x

( E lg- @ j l8 $

2 al. ' '

s i I l h e e

= -

ni s gg al ,) ,

9 1, ig

=

_ l

=

g

" i:

Sll W I .

.a I ,, e g g

a i; na g -= " E8 s

l} Tll llf

!!8  !!8 c -

a h[ am a ma k [ -

S

- a i

r -

e l 1, T *l ym o mm T* IM g h, _

n mm z- m h

om ,- - [

m q g mm g == g 4 h a h B W g I-Am ggA-agg C-Paru d 1 1 1

i e ,in ,

11- l r iin i11~l 1e

~: W

= LnC -

Y '

WC I vz-m L l' a-m L E-7

---,-,a7,,..--_,,.,,--.,-,----,-,.-----,,,-----,---------,,.n- --

To estimate t e pccoacility cf cilution of :ne prccessi g loop, the following assumptions were made in addition to the assumptions identified in Sections 4.3 and E.2:

(1) The filter loop of the OHC System is assumed to be operating continuously except during filter change

. over and during system modification or repairs.

(11) It was assumed that flow will be circulated

~

continually through one ion exchanger. When the ion exchangers (KI, K3) are being utilized, a boronometer (AE-17) which will monitor the boron concentration of the water leaving the ion exchangers may be in service.

(111) The borated water flush lines are used only during filter /lon exchanger change over or system maintenance to reduce excessive radiation levels.

(iv) Operationally, a third valve must be closed on the sample lines to avoid an erroneous sample. In calculating the dilution probability through these paths credit was given for this barrier. It was not required, however, that its position be verified on a daily basis.

E-8 0714x RA

, - -n ... - .y---- , , , - - -s. - - --e -

' Tne procaolli ty cf.coron Oilution due to :.ca :cera:':n ;'

the DHCS was estimated as 2.0 x 10-' per year; this probability is almost entirely due to the " leak" type of dilution as defined in the main report. The " rupture" dilution event probability was estimated to be 7.3 x 10-5

. per year.

k T

i 4

i t

i e

4 i

'i E-9 0714x RA

• ' wra v c,- g- ...-rm,--. -m,,

- . - - . , . - - 3 -,- , ei-,v-,e., .- e +- ~, - , .,, o,-,-,--,,,-,m- . .---ws--,... w--~ .r.eer.-

IA5LE E.'

OWCS PROCESSING - REACTOR VESSEL POTENTIAL UNB0 RATED LIQUID SOURCES ISOLATION BARRIERS Reactor Coolant Bleed Tanks OHC-V063 (WOL-T-1A, T-1B, T-1C) DHC-V033, V073 Borated Water Flush, RV Filters ONC-V034A, V034B (OHC-F-1, F-2, F-3, F-4) OH-V187 Borated Water Flush, DNC Ion OWC-V051 Exchangers OHC-V106, V313, V314 (OHC-K-1, K-3) V321, V322, V323 Sample Line, RV Filters -

0HC-V041A (OHC-F-1, F-2, F-3, F-4) OWC-V039A, V0398-(DWC-V170)*

Sample Line, ONC Pumps OHC-V0418 (OHC-P-2A, 28) OHC-V042A, V0428 (OHC-V165)*

Sample Line, DWC Ion' OWC-V062 -

Exchangers Olscharge OHC-V180 (OHC-K-1, K-3) (OHC-V178, V179)*

Sample Line, DWC Ion DHC-V065 Exchanger Feed DHC-V175 (OHC-K-1, K-3) (OHC-V173, V174)*

Sample Return Line CF-V1288 CF-V1148 Valves which are not on 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> checklist but are normally closed.

E-10 07144 RA

E.3.1.2 "Early Cefueling ' Reac:or vessel Cleanup System  ;

For "early defueling" the Submerged Demineralizer System (SDS) may be utilized in lieu of the DHCS lon exchange loop in accordance with Operating Procedure 4215-0PS-3525.04. A slip stream (1 30 gpm) is to be taken from the RV filtration loop and processed through the SDS in a manner similar to IIF processing (see Appendix D). The SDS effluent then flows into the basement of the Auxiliary Building to reactor coolan't bleed tank HDL-T-1A(C) A simplified schematic of RV cleanup using this process is shown as Figure E-2. To compensate for the removal of borated water from the reactor vessel, reactor grade water is fed from another bleed tank (e.g., either WOL-T-IC'(A))

through WOL-V40 and one of 'the makeup "16" valves (typically MU-V-16B) to maintain a constant level in the reacn r vessel.

The makeup path to the RV is the same as that used in IIF processing; thus, the isolation barrier configurations shown in Table 0.2 are still appropriate. The letdown side of the IIF Processing connections have been modified for use of SOS with the DNCS. This modification requires new isolation barrier configurations as shown in Table E.2.

The isolation valves identified in Tables 0.2 and E.2 are sunmarized alpha-numerically in Table E.4 of Section E.4,

" Conclusions and Recommendations".

E-Il 0714x RA

~,------n, , - - , - , - - - , , - - . ---------,n.-- ---- -- --, ,, , ,

i P.______ w ._, y2 ..; ..

I -t>G , u.-n l l I k h b s a a i P 5' o

52 d S aX d

l 099 tam l 8 l a99 tam l

, t_.

4 l t _ u _ _ _ _g__________ ________ g i MRl v99tA*

r i 4

I $g j g l W ll3 g

l a a 45 .

n

_ a me 6 i m 8

g all glt a -

S l_ u e

_d e-l  :

- I v 11 _ n _

-w-- 11 la a

,_ .-m m. ,- -

2 1 9 g g VITA-apa tit m g g

% C C gla

- t-m na c- m 1  ;

-i 1 l P al8 t ll-l- Pail8 I l-9%g4 w W

~ i.

- m t ~ i. .. m t bN

,-,,,-------,---------.,,,--,.---,-------------e-------,,,--.--.,-,----------,e--,e- ww----- ------w g- - - - - , - -

The total number and type ;f isciaticn valves 3n: 03r: : 2- <

configurations are largely the same as with IIF processing only the valve designation numbers change. (Note: Some  !

l minor operational changes have been made. For example, FCC-V002 will be open during normal processing while FCC-V003 is closed. Valves SF-V125 and V214 must be closed to give double valve isolation from tha Spent Fuel Cooling system and from the modifications being made to support the FTC/SFP cleanup portion of the DNCS system. A new valve, CN-V-IX-63, has been added. Th'Is valve must remain open to allow SOS effluent to flow to the WOL-T-1A, 18 and 1C bleed tanks; its failure does not influence the boron dilution probability.) Therefore, the estimate for the dilution probability using the early defueling processing scheme is based on the value calculated in Appendix 0 for IIF processing and the additional modifications for DHCS operations. The probability of " leak" and " rupture" dilution events are 5.2 x 10-' yr-' and 5 x 10-* yr-', respectively.

E.3.1.3 Fuel Transfer Canal / Spent Fuel Pool (FTC/SFP) Cleanup System The FTC/SFP Cleanup System is expected to be operating continuously except during filter change, resin change or system modification / repair. Sampilng for boron concentration will be performed weekly on both the filter loop and lon exchange loop. Dilution of the fuel transfer canal or the spent fuel pool is not a nuclear sr.fety

.oncern in itself, based on the results of criticality 1 E-13 0714x RA

TABLE E.2 EARLY DEFUELING ION EXCHANGE PROCESSING - LETOOWN POTENTIAL PATH FOR ACTION UNB0 RATED LIQUID COMPENSATION Open FCC-V002 From canal drain pump FCC-V003_and disconnect IIF (1 1/2" hose) processing pump From sump sucker FCC-V001 and disconnect pump (l" hose)

Open SHS-VI From Service Water System SHS-V6 -- SWS-V7 drain (3/4")

Open SHS-V2 Flush Conn. (3/4") SWS-V4 and flush line connec-tion. Administratively controlled by 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> checklist CN-V-RC-364 WG-P-1 discharge CN-V-RC-363 -- WG-V71 Pre-filter inlet CN-V-RC-363 -- CN-V-FL-1 DWC Booster pump CN-V-RC-363 -- DHC-V236 Open CN-V-RC-362 Return line from Monitor CN-V-RC-360 -- S05-V052 Tanks (SDS-T-1A, -18)

Off-gas line (Bottoms pump) CN-V-RC-360 -- CN-V-VA-245 RCS Clean-up manifold sump Not a credible source High-Rad filter manifold Not a credible source sump Open CN-V-RC-366- Final filter discharge CN-V-RC-367 -- CN-V-FL-6 Sample box CN-V-RC-367 -- CN-V-SA-258 NG-P-1 pump discharge CN-V-RC-357 -- WG-V29 Manifold connection CN-V-RC-367 -- CN-V-RC-374 CN-V-RC-369 Flush conn. CN-V-IX-61 -- Hose connection Hi-Rad sample glove box Not a credible source E-14 0714x RA

_, ., , _ , , , ,. - - - - , _ . _ _ , _ .._--__-,.,,__-_,,,,_,,,,n - - . , - . . - . - , , , -

TABLE E.2 ( 'entinued)

POTENTIAL PATH FOR ACTION UNB0 RATED LIQUID CCMPENSATION CN-V-IX-25(26) Flush conn. CN-V-IX-34 -- Hose connection CN-V-IX-36 -- Hose connection CN-V-IX-29(31) Flush conn. CN-V-IX-38 -- Hose connection CN-V-IX-40 -- Hose connection CN-V-IX-30(32) Tle-in to HDH Tle-in not made DHCS Return to FTC/SFP CN-V-IX-58 -- DWC-V102 DHC-K1, 2, 3 Return OWC-V33 -- DHC-V63 DHC-V33 -- DHC-V73 Flush connection CN-V-PF-72 -- CN-V-PF-71 Monitor tank (SDS-T-1A, B) CN-V-PF-62 -- CN-V-PF-68 Flush conn. for sampling CN-V-SA-294 -- CN-V-PM-196 MWHT and Radwaste System CN-V-IX-102 -- CN-V-IX-103 SOS Post Filter ' CN-V-PF-70 -- CN-V-PF-72 CN-V-IX-63 Core Flood Tank Bleed CF-V107 -- CF-V144 and Sample MWHT WOL-V1091 -- WOL-V533 RC Orain Header WOL-V1125 -- WOL-V22 MU-K-1A, 8 WOL-V46 -- MU-V107A WOL-V46 -- MU-V1078 WOL-V46 -- MU-V224A WOL-V46 -- MU-V2248 WOL-V46 -- MU-V226 WOL-V46 -- MU-V376 WDL-K-1A, 8 WOL-V46 -- WOL-V81A WOL-V46 -- WOL-V818 WOL-V1060 -- WOL-V81A WOL-V1060 -- WOL-V818 E-15 0714x RA

TABLE E.2 (Continuec)

POTENTIAL PATH FOR ACTION .'JNBORATED LIQUID COMPENSATION CN-V-IX-63 Makeup Tank Orain MU-V169 -- MU-V12 (continued)

MU-V169 -- MU-V13 MU-V169 -- HU-V27 MU-V169 -- HU-V28 MU-V169 -- HU-V133 Spent Fuel System SF-V214 -- SF-V121A SF-V214 -- SF-V121B SF-V214 -- SF-V122 SF-V214 -- SF-V125

. SF-V214 -- SF-V240 WOL-V964 (-V963) Isolate Letdown tank from WDL-V166A(C) -- WOL-V28A(C)

Makeup line/ tank WOL-V166A(C) -- WDL-V29A(C)

WDL-V166A(C) -- WOL-V533 Isolate WOL-T-1B from WOL-V1668 -- WOL-V288 Makeup line WOL-V1668 -- WOL-V298-Isolate WOL-T-1B from WOL-V995 --WOL-V965 letdown line E-16 0714x RA

, ,_,.,,,m,

--v-- --

analyses for fuel canisters sucmerged i n unccrate: .s a : + -

Thus, operation of the FTC/SFP Cleanup System is a concern only to the extent that it could be associated with dilution of the RCS. There are two methods by which this coi!;d occar; one accurs if the FTC/SFP acts as a source of underborated water, the second is associated with the dilution of the FTC/SFP Cleanup System process stream.

The possibility that the FTC/SFP would act as an RCS dilution source during DHCS pro' cessing is not considered credible. The bases for this conclusion are:

(1) The combined volume of the FTC and spent fuel pool A during defueling operations will be about 290,0d0 gallons; this volume'of water will be borated to at <

1 east 4350 pga. A large amount of water would be required to dilute the FTC/SFP to a concentration which would represent a meaningful RCS dilution source (e.g., dilution of the FTC/SFP to 4000 ppm would require the addition of over 25,000 gallons of unborated water),

(11) Level in the fuel transfer canal and fuel pool A is checked each shift and E-17 0714x RA

., .n .--,-- ,,- -- , . . . ,

,,,r. , ,, , ,, ----e---.,.--. - , -e .,

(iii) In tne event that tne FTC or SFP were ciiutec. ::

other water were introduced (e.g., into the shallow end.of the FTC), additional component failures (e.g.,

a suction hose break, failure of the double isolation between the RV and FTC cleanup systems) must occur to dilute the RV.

Tne other mechanism which could introduce diluted water to the RCS is through the FTC/SFP Cleanup System piping. The concern is the possibility that unborated fluid could enter the FTC/SFP Cleanup System piping, be diverted into the RV Cleanup System piping and flow into the reactor vessel.

This was judged not to be a credible scenario for diluting the PCS based on the following considerations:

(1) Double barrier isolation exists between the RV process loop and the FTC/SFP process loop. These isolation barriers will be placed under administrative control and vertfled to be correctly positioned on a daily basis, (11) Mixing would occur between the 200 to 400 gpm process flow and the dilution inflow into the FTC/SFP loop; this mixing would alnlatze the dilution rate seen by the RCS, E-18 0714x RA

. . , - - w - n - -- -, ,,m,, - , - - - -- -, , - - , - , - , - - - , - - , - - - -

(iiii A1:nougn /ai/ing anica i solate; tre F'C,3F; " ;,

other pathways is not under administrative controls, such valving must be in place to conduct the operation. Thus, additional barriers besides those used to separate the RV and FTC/SFP cleanup loops are typically in place and (iv) A dilution into the RCS from the FTC/SFP interface would be detected by boron sampilng or as a level increase by RV level instrumentation.

No credible Reactor Vessel dilution scenario associated with the FTC/SFP has been identified. The FTC and SFP need not be isolated from a dilution given the criticality-analysis of canisters in unborated water. The valves required to isolate the FTC/SFP cleanup loop from the RV cleanup loop were included in the overall isolation schere for the RV cleanup loop (see Table E.3). Thus, no further actions are needed to prevent dilution of the fuel transfer canal or spent fuel pool A.

E-19 0714x RA

. - - - . . - - - - -. -e, --.,n - - , , , . . , , - , , -,,n -a. , , , , , . , - - . , . - - , , - - - - -

E.3.2 Cetiction anc Mi:igatten Of a 3ctent'ai Ci:uticn E/en:

As discussed in Section 4.4.5.3, there are several methods to detect a dilution event; mitigation requires termination of the dilution event prior to dilution of the RCS to 4350 ppmB. An analysis has been performed to determine which controls that are available for detecting a dilution in the static condition are applicable during OWCS operation. Operation of the DWCS in each of the two modes was considered. Operation with dedicated DHCS components was considered in Section E:3.2.1; modified OWCS operation which uses a slipstream through SOS while making up from a reactor coolant bleed tank is described in Section E.3.2.2.

E.3.2.1 Detection of a Potential Ollution Event During Operation of Using Dedicated DHCS Components Normal operation of the DHCS results in circulation of RCS water from the RV through a closed loop and return into the RV. There are no significant holdup points nor is flow balancing between different feed and bleed sources required. Thus, DHCS operatlogs represents an essentially steady state operati.on and level instrumentation provides an effective means for detecting a boron dilution event.

E-20 0714x RA

- - - , - - , , , . - . , . , . --u- ---w.r ----- -- -. , . -.-..;.. _ . , ..-,,

l There is redundant and diverse level indication dvallable during DHCS operation. Level instrument RC-LI-100A uses taps from the Decay Heat Removal System drop line off of the steam generator "B" hot leg and h read in the control room. Level instruments RC-LT-102 and RC-LIS-103 are bubbler type instruments supplied by the same sensing tube

~

which uses taps in the IIF. Level instrument RC-LT-102 provides level indication locally and in the control room; RC-LIS-103 is interlocked with DHCS operation. Instrument RC-LIS-103 will alarm and trip'the DHCS pumps at a low level reading of 63 inches (el 327'3") and will alarm at a high level of 69 inches (el 327'9"); the alarms are annunciated both locally and in the control room. The RCS level is checked hourly and recorded on the " Station Daily Log Sheet". As a backup to the Control Room indication and the DHCS local panel indication, the RCS level can be read on a Barton meter, RC-LI-101A, located at the 282' elevation of the Fuel Handling Building or on a tygon tube located outside the D-ring in the Reactor Building. Since normal operation of the DHCS is a closed system, a level alarm will occur only due to the unplanned addition or loss of water due to an abnormal condition, such as a dilution event. (No feed and bleed type of processing will be-performed except to make adjustments in boron concentration or to makeup inventory lost by evaporation or defueling operations.)

E-21 0714x RA

i Since tne aoilitj to etect a ci:ution ese,: :n ugn ee monitoring will be unaffected by 0HCS operation, the weekly

{

Technical Specification sample is used to benchmark the I i

boron concentration once each seven days. Although no  !

additional sampling would be required for normal operation, l

l It is noted that a daily boron sample will be taken while operating the'DHCS filter loop and once every twelve hours while operating the ion exchange loop.

The probability of failuri to detect a dilution event is estimated as 1 x 10-' per demand. The bases for this estimate were provided in the bounding analysis for failure to detect a dilution during static conditions (see Section 4.4.5.3). The major aspects of DHCS operation which justify use of the bo'unding estimate are:

1) Processing with cnly dedicated DHCS components results in a simple recirculation of RCS water; there is no inherent characteristic which would mask a dilution inflow (e.g., different feed and bleed sources, automatic level controller),

11) There is redundant and diverse level Instrumentation which is read in the control room; backup instrumentation which can be read locally is also available and E-22 0714x RA

,- --,,v - - - - . __.,,-w, - - . - - -v. m +n e-~-, -- - - - - - - -- ,n.--- - - - - -

(iii) Ine potential Jiluticn rate int tne arcca:  ::cer

.does not exceed the rak identified for other process conditions. The magnitude of this dilution rate is a function of the dilution source (e.g., size limitations, pumping capabilities)-and not of the rate at which RCS water is circulated.

The probability of mitigating a' dilution event was estimated as 2 x 10-' per demand for a " leak" (i 15 gpm) type dilution, based on tile anilyses performed in Section 4.4.5.3. (The probability of a " rupture" event occurring was estimated as so low as not to require

-j specific mitigating actions. However, consistent with Section 4.4.5.3, the probability of operator failure to mitigate such an event was' assumed to be 0.1 per demand).

The relevant aspects of this estimate are the time allowed for the required operator action and the type of required actions. Because the potential dilution rate is comparable to that previously considered for the static case, the time allowed for action prfor to reaching 4350 ppm is also comparable to the Gch condition. The required action would be to tegaau. .qCS operation and take additional actions to identify the dilution source and isolate the RCS. Termination of DNCS flow into the RV due to low boron concentration has been procedura112ed (see operating procedure 4215-OPS-3525.02) and is accomplished by an operator stationed at the local control panel; additional E-23 0714x RA

r operator actions have been proceduralized in appropriate emergency procedures (e.g., emergency procedure 4210-EAP-1300.01).

Combining the detection failure and mitigation failure probabilities yields a probability of failure to detect and mitigate a dilution event of 3 x 10-' per demand for

" leak" type dilutions (0.1 per demand for " rupture" dilution rates). Combining this probability with the dilution probability as determined in Section E.3.1.1 yields a total probability of diluting the RCS to 4350 ppm of 1.3'x 10-5 per year. Thus, the probability of RCS dilution during operation of the dedicated DHCS RV Cleanup '

, System is considered negligible.

The analysis-in this section took credit only for the available level instrumentation. It should be noted that a continuous boron sampling capability may be available by either a boronometer situated in the Temporary Nuclear Sampilng System (TNSS), or a boronometer planned to be installed in the ion exchange portion of the RV cleanup system. The reliability ~of these boronometers has not been estimated. However, given adequate startup testing and calibration against grab samples, it is expected that a

. boronometer will provide an additional effective detection capability which is comparable to manual boron sampling (see Section E.3.2.2). Thus, a boronometer may substitute for an extended outage of level instrumentation.

E-24 0714x RA L.

E.3.2.2 Cetection of a Potential Boron Oilution Event Ouring :. G Operation in Conjunction with SDS Early in the defueling process, the ion exchange loop of the DHCS may not be available for Reactor Vessel processing. For this reason, an alternate processing method has been developed. This method takes a slipstream from the filter train of the DHCS, processes it through SDS, and returns it to a bleed tank; simultaneous makeup to the RV is from another bleed tank through the HPI lines.

This operation is nearly identical to the IIF processing

~

capability described in Appendix D. Major characteristics of the process are:

1) Reactor Coolant Syste' s water is being recirculated through particulate filters at a flow rate of 200/400 gpm; flow to the ion exchange loop will be drawn from the flitration loop at a rate of 1 30 gpm, instead of ,

directly from the RV.

1

2) The capability for automatic level control in the IIF '

exists using makeup from the reactor coolant bleed tanks (SDS effluent is returned to the bleed tanks).

Thus, there is the possibility of masking a dilution inflow in a manner stellar to IIF operation; an E-25 0714x RA

--,y . - . , . - . . . . , . .- - - - . . . . .,-----e , , , y

unaetected dilutten at a rate : mparac;e :: :ne rate at which water is removed by the ion exchange loop cou'Id occur. (This potential masking effect could also occur as an operator manually balances feed and bleed from the different bleed tanks.)

3) No unique dilution sources or driving forces were identified for this mode of operation. Thus, the potential dilution rates are the same as those analyzed in the mair$ repdrt.

One option to compensate for the potential inability to detect a 15 gpm unborated injection rate with level instrumentation is to institute a boron sampling program.

Such a sampling program cou'Id be accomplished by taking i

manual samples with sufficient frequency to detect a dilution before the vessel reaches the Technical

- Specification limit of 4350 ppe. The frequency of the sampling program would vary according to the process flow rate, which determines the maximum inflow that could be hidden from the level indication. The following table provides sampling frequencies as a function of process flow rate. The assumptions used in developing the table are the same as those used in Appendix Section 0.3.3.

E-26 0714x RA

, _ ~ . . . . . , . . . . .

._,wc- . . _ , _ _ _ _ _

.,,r_ _ _ , . .__,g,,. .y..7 ..,_,,_,,,,_,n,y__.,,._ -

Process Flow 53rcit9; Rate Dilution Volume Frequency (qom) (callons) (hrs) 5 5370 12 6.5 5370 8 10 5370 3 12 5370 2 15 5370 1 The estimated probabilities of failure to detect and mitigate a dilution event were based on the analyses performed in Section 4.5.3. The probability of an erroneous grab sample was, estimated as 0.01; the probability of operator error in responding to a " leak" type of dilution was estimated as 2 x 10-'. Combining these probabilities yleids an estimate of 1.2 x 10-2 per demand for failure to detect and mitigate a leak type.

dilution. In the rupture case, a higher operator error rate of 0.1 was assigned due to the shorter time for operator action; this results in a probability of failure to detect and mitigate of 1.02 x 10-' per demand.

Combining the leak and rupture probabilities with the detection and mitigation probabilities yleids a total probabillty of RCS dilution to 4350 ppm during DMCS processing with SDS lon exchange; this probability estimate is 1.1 x 10-* per year.

1 l

E-27 0714x RA 1

. l

Baron sampling ccuid also te ac :mclisne: .v i t n a n : . - 'a boronometer. Such an instrument is currently installed in the discharge of the RV sample pump in the TNS system.

This boronometer analyzes a sample drawn from the core region or the annulus between the inner vessel wall and the thermal shield. It provides a local readout of boron concentration and a control room alarm if the boron concentration drops below 4950 ppm. Either the TNSS boronometer or the regular sampling program provides the capability to detect a bo'on r dilution in the absence of level indication. No specific reliability data was available for TNSS boronometer. The failure mode of concern with the boronometer is one in which the boronometer indicates an acceptable sample result but'19 fact a dilution is occurrin'g; this failure must also be non-detectable normally (or else a manual sampling program would have been instituted to compensate for the failure).

J It is judged that the boronometer, once checked and calibrated, would have at least a reliability comparable to that used for the manual sampling.

Another means to detect a dilution is to conduct an hourly mass balance to monitor changes in the inventory of the RCS and bleed tanks. The precision of the existing E-28 0714x RA

,,. - _ _ _ . .__ , .y_. . -__ -. . . - . _ . , , , , . _ _ . , , _ ,-,

instrumentatico en :ne RV and tre oleed tarr; res;1: 3 th the ability to determine volume changes to within 300 gallons. No estimate of the reliability of this detection method was made given the reliability of the boron sampling methods.

/

E-29 0714x RA

E.4 CCNCLUSICNS AND RECOMMENDATICNS This section summarizes the conclusions and recommendations of the analysis of the ONCS boron dilution potential. The conclusions noted herein ar6 contingent upon the assumptions used in the analysis and implementation of the specified recommendations. '

E.4.1 Conclusions i

(1) The probability of RV dilution'to 4350 ppm during DHCS processing using only dedicated DHCS components was estimated as 1.3 x 10 per year, which can be considered negligible. Thus, operation of the ONCS with dedicated components presents a minimal and acceptable risk.

(2) The probability of RV dilution to 4350 ppm during DHCS processing using the SDS for ton exchange was estimated as ,

1.1 x 10-* per year which can be considered negligible.

Thus, operation of the DHCS in_ conjunction with the SDS presents a minimal and acceptable risk.

(3) Dilution of the reactor vessel due to a dilution associated with the FTC/SFP Cleanup System was not considered credible.

E-30 0714x RA

(4) Level instrumentation provides acequate cete::i:n capability during operation of the OHCS with dedicated components. Either an on-line boronometer or a manual sampilng program provides adequate detection capability during OWCS operation in conjunction with the SDS.

E.4.2 Recommendations

~ (1) The isolation barriers identified in Table E.3 should be placed on a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> checkiist t'o verify proper positioning during operation of the dedicated component DHCS.

(Operational difficulties or ALARA concerns may preclude the use of the. recommended barriers; in such instances, an '

equivalent barrier may be used).

t (2) When the dedicated component DHCS system is shutdown, the RV must be isolated from the associated OHCS connections.

This can be accomplished by continued use of the isolation list provided in Table E.3 during shutdown. If the position of the valves in Table E.3 will not be verified 4

when the DHCS is shutdown, alternative isolation barriers must be placed on the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> checklist in Section 7.3 of operating procedure 4210-OPS-3200.02. An alternative isolation list is provided at the end of Recommendation 4.

E-31 0714x RA p-- ,m,mme - - - , - > .

,.pm.- , - - - , - -,,c . - - , - . r --- , - - , , ,n ,,,,, _ , m,-.,,_q_,_ w.,. , , ..-w. , ~ . - , p 4-, -

(3) The isolation barriers identified in Table E.4 should be placed on a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> checklist to verify proper positioning during operation of the DHCS in conjunction with the SDS.

(Substitute barriers may be used if operational difficulties or ALARA concerns preclude the use of the recommended barrier).

(4) When the DHCS system is used in conjunction with the SDS system, isolation from flow paths associated with this operational mode must be in place during shutdown. This can be accomplished by continued use of the isolation checklist provided in Table E.4 during shutdown.

Alternatively, the alternate shutdown list identified below must be placed in procedure 4210-OPS-3200.02.

Alternative Shutdown List (Equivalent valves may be used if operational considerations or ALARA concerns preclude use of the recommended valves)

Pathway Isolated Double Valve Isolation

'A' Filter Train Suction DHC-V284A, DHC-V4A

'B' Filter Train Suction DHC-2848, DHC-V4B

'A' Filter Train Discharge DHC-285A, DHC-16A

'B' Filter Train Discharge DHC-2858, DHC-16B Sample Return Line DHC-V286, CF-V125B RV Ion Exchange Discharge DHC-V287, WDL-V1095 E-32 0714x RA

(5) During DHCS processing with dedicated DHCS components, level instrumentation should be utilized as the primary method of detecting a boron dilution event. During DHCS operation in conjunction with the SDS, a boron sampling program should be utilized as the primary method of detecting a dilution; either an on-line boronometer or the manual sampling program outlined in Section E.3.2.2 would serve this purpose.

E-33 0714x RA

TABLE E.3 BARRIER LIST USING ONLY DEDICATED DWCS SYSTEM Processing with dedicated DHCS components is accomplished per operating procedure 4215-OPS-3525.01. The valves specified in this table provide isolation of the OWCS flow path. Thus, it is recommended that the valves in this table be placed on a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> checklist for position verification. The checklist may be placed in procedure 4215-0PS-3525.01 or in Section 7.3 of procedure 4210-0PS-3200.02, " Primary Plant Operating Procedure."

CF-V1148 DHC-V062 CF-V1288 DHC-V063 DH-V187 OWC-V065 DHC-V033 DHC-V073 OHC-V034A OWC-V106 OHC-V0348 OWC-V175 DHC-V039A '0HC-V180 DHC-V0398 DHC-V313 DHC-V041A OWC-V314 DHC-V0418 DHC-V321 DHC-V042A DHC-V322 DHC-V0428 DHC-V323 ONC-V051 E-34 07i4x RA L..________._ ._m__ . _ _ __ _ . . _ _ . _ _ _ _ _ _ . . _ _ _ _ _ _ . _ . . _ . _ _ _ _ . _ _ . _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ . _ _ _ _ _ _ . _ _ . _ _ . _ . _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ . _ _ _

TABLE E.6 BARRIER LIST FOR EARLY DEFUELING PROCESSING THROUGH SDS Early defueling processing is accomplished utilizing SDS in accordance with Operating Procedure 4215-OPS-3525.04. Procedure 4215-OPS-3525.04 is structured such that all valves required for isolation during any maneuver.are placed on checklists for periodic verification. Thus, the following valves are recommended to be placed on a checklist in addition to those in Table 4.4-3 of this report. The valves listed here isolate the DHCS filtration loop and the flow path through SDS. (It should be noted that if only the DHCS filtration loop were operated, isolation of the SDS system from the filter loop could be achieved with only the closure of FCC-V002 and the removal of the associated hose. However, it is expected that this will not be a frequent occurrence. Thus, this option.was not explicitly presented in this Apperdix.)

CA-Vl33A

• CN-V-SA 94 SWS-V4 WDL-Vl90A CA-V1338

• CN-V-VA-245 SWS-V6 WDL-Vl908 CA-V135 DH-V187 SWS-V7 WDL-V206A CA-V154 DW-V84 WDL-V18A WDL-V2068 CA-P-1

• OFF DW-V92 WDL-V18C WDL-V532A CA-P-2

• OFF * *

• DW-V223 WDL-V28A WDL-V5328 CF-V1288 DWC-V33 WDL-V28C WDL-V533 CF-V144 DHC-V34A WDL-V29A WDL-V544A CN-V-IX-34 DHC-V348 WDL-V29C WDL-V5448

• CN-V-IX-36 DHC-V39A WDL-V41 WDL-V959 CN-V-IX-38 DWC-V398 WDL-V42 WDL-V963

• CN-V-IX-40 DHC-V41A WDL-V46 WDL-V964 CN-V-IX-58 DHC-V418 WDL-V658 WDL-V965 CN-V-IX-61 DHC-V42A WDL-V70A WDL-V995 CN-V-IX-102 DHC-V428 WDL-V708 WDL-V1060 CN-V-IX-103 DHC-V63 WDL-V72A WDL-V1092 CN-V-FL-1 DHC-V73 WDL-V728 WDL-V1095 CN-V-FL-6 DHC-V102 WDL-V109A

• WDL-Vil53A

• CN-V-PF-62 DHC-V236 WDL-V1098

• WDL-V1153C *, '

CN-V-PF-68 FCC-V001 WDL-V109C

• WDL-Vil70

• CN-V-PF-69 FCC-V003 WD' -V1090

• WDL-U301 Removed (Pumps Disconnected)

• CN-V-PF-70 WDL-Vil7 WG-V04 CN-V-PF-71 SF-V121A WDL-V138 WG-V05 CN-V-PF-72 SF-V1218 WDL-V163A

• WG-V24 CN-V-PM-196 SF-V125 WDL-V1638

• WG-V29 CN-V-RC-360 SF-V240 WDL-V166A WG-V30 CN-V-RC-363 SDS-V052 WDL-V166B

• WG-V71 CN-V-RC-367 SNS-V1 WDL-V166C

• WG-V95 CN-V-RC-374 SNS-V97 WDL-V175 CN-V-SA-258 SNS-V139 WDL-V176 *

• Valve already included in 4210-0PS-3200.02 checklist.

Valve removed and pipe capped.

E-35 0714x RA

%____