ML17335A545

Rev 1 to Containment Sump Level Design Condition & Failure Effects Analysis for Potential Draindown Scenarios.

ML17335A545
Person / Time
Site:	Cook
Issue date:	09/28/1999
From:	Coward R, Heinz M MPR ASSOCIATES, INC.
To:
Shared Package
ML17335A542	List: ML17335A541 ML17335A543 ML17335A544 ML17335A545 ML17335A546 ML17335A548
References
NUDOCS 9910060105
Download: ML17335A545 (56)

Text

CONTAINMENTSUMP LEVEL DESIGN CONDITION A FAILURE EFFECTS ANALYSIS FOR POTENTIAL DRAINDOWNSCENARIOS REVISION 1 Prepared by:

Michelle i z Reviewed by:

z zgA Robert . ow d Approved by: ~ ~/n Robert N. Coward QUALITYASSURANCE DOCUMENT This document has been prepared, reviewed, and approved in accordance with the Quality Assurance requirements of IOCFR50 Appendix B, as specified in the MPR Quality Assurance Manual.

99i0060i05 99i00$ ,

PDR,'.ADOCK.050003i5 P PDR

TABLEOF CONTENTS REVISION HISTORY n1

1.0 INTRODUCTION

1.1 Purpose 1.2 Overview 2.0,CONCLUSIONS 8t, RECOMMENDATIONS 2-1 2.1 Conclusions 2.2 Recommendations 2.3 . Open Issues 3.0 EVALUATION 3-1 3.1 Approach 3.2 Accident Scenario 3.3 Key Assumptions 3.4 Design Conditions 3.5 Postulated Failures 3.6 Operator Actions 3.7 Modeling Methods

4.0 REFERENCES

4-1 4

APPENDIX A A-1 Containment Sump Level Design Condition & Failure Effects u Analysis For Potential Draindown Scenarios Revision I

REVISION

SUMMARY

Revision Date Descri tion 0 7/16/99 Initial Draft 9/27/99 U dated to reflect final anal sis assum tions Analysis For Potential Draindown Scenarios

'l Containment Sump Level Design Condition & Failure sects Revision /

Section 1 INTRODUCTION 1.1 Purpose The purpose of this evaluation is to identify and evaluate plant design conditions and postulated equipment failures that could impact the resulting water level in the Cook containment Emergency Core Cooling System (ECCS) recirculation sump following a Loss of Coolant Accident (LOCA) or Main Steam Line Break (MSLB).

The results of this evaluation will be used to verify that analyses performed to predict sump performance following a LOCA or MSLB are boun'ding and that all applicable equipment failure modes have been considered.

In addition, Appendix A is a similar evaluation of the plant design conditions and postulated equipment failures that could impact the resulting containment subcompartment hydrogen concentratio'ns in the containment following a LOCA.

1.2 Overview The Cook contai nment design includes a recirculation sump in the lower portion of containment.

Following an accident, the contents of the Reactor Water Storage Tank (RWST) are pumped into the containment using the containment spray system (CTS) and ECCS. The water injected into the containment and the water discharged from the pipe break drains to the low points in containment. These include the reactor cavity, the recirculation sump, and the pipe annulus (outside the crane wall).

After the RWST is emptied, the CTS and ECCS pumps are switched into the recirculation mode of operation. In this mode, CTS and RHR pump suction is taken from the recirculation sump.

The flow is passed through heat exchangers and injected back into containment (via CTS sprays or RHR sprays) or into the Reactor Coolant System (via ECCS). This process continues as necessary to remove heat from containment.

In order to ensure satisfactory sump operation in the recirculation mode, testing was performed for the Cook sump configuration to verify that vortexing or similar degradation mechanisms will not occur (Reference 4.1). This testing determined that a sump level at or above 602'10" is satisfactory to avoid vortex concerns.

Reviews of the containment design features and the details of previous analyses of containment response following a LOCA determined the analyses included potentially nonconservative assumptions and that the recirculation sump could drain below the minimum required level under certain postulated scenarios (Reference 4.2). The primary reason for the sump level draindown Containment Sump Level Design Condition & Failure Effects 1-1 Analysis For Potential Draindoivn Scenarios Revision 1

during the recirculation mode is that the containment spray system may pump water into areas of the containment that do not completely drain to the sump (e.g., the pipe annulus).

Physical modifications will be made to the Cook units to preclude sump draindown below the minimum level. Transient analyses of the containment response will also be performed to verify the adequacy of the containment/ECCS design.

The purpose of this evaluation is to first review the containment, CTS, and ECCS designs and responses following an accident. The initial design conditions and postulated single failures that correspond to the bounding case for potentially draining the sump are then determined. For example, the size of the postulated pipe break and the CTS actuation set point (based on containment pressure) are design conditions that affect the amount and rate of ice melt (and thus, the resulting sump water level). The potential failure of a CTS pump or other equipment that reduces the spray rate also affect the amount and rate of ice melt.

Containment Sump Level Design Condition & Failure Effects 1-2 Analysis For Potential Draindown Scenarios Revision I

Section 2 CONCLUSIONS & RECOMMENDATIONS

2.1 CONCLUSION

S The assessments described in this evaluation have shown that a large number of plant parameters, operator actions, and postulated equipment failures can impact the recirculation sump water level following a LOCA. Although the influence of most of these parameters is clear (i.e., changes tend to increase or decrease water level), there are a number of parameters that either interact or whose influence is not clear. For this reason, it is not practical to determine a single most limiting case without performing sensitivity analyses. The approach used in this evaluation is to list the parameters, conditions or failures considered to be limiting (i.e., those that should be common for all worst case possibilities) and then list the additional parameters that should be varied to assess the potential limiting cases.

The parameters considered to be bounding are listed in Table 2-1. This table lists the parameter and the bounding value(s). The bases for these conclusions are included in the discussion and tables in Section 3.

The parameters for which there is uncertainty regarding the bounding or limiting values are listed in Table 2-2. The bases for these conclusions are also included in the discussion and tables in Section 3. In order to verify that the limiting case(s) have been considered with regard to these parameters, additional analyses are required to determine the limiting value (see following section).

2.2 RECOMMENDATIONS The results of this evaluation show that several initial condition configurations could potentially represent the limiting case(s) for sump level following a LOCA. As shown below, a number of analysis cases will be required to confidently bound the analysis.

The following recommendations are based on the conclusions presented in Tables 2-1 and 2-2 and are intended to identify the most limiting case(s) for evaluation of potential sump draindown.

1. Complete the necessary evaluations to confirm the key assumptions listed in section 3.3 or include appropriate variability in the final analyses. The appropriateness of each assumption must be verified as part of the final analyses of sump level.

2. All analyses should be performed using the limiting parameters included in Table 2-1. These parameters are limiting values.

3. A series of cases is required to determine the most limiting case (or cases) and to verify that design criteria are satisfied. The approach shown below is based on the parameters listed in Table 2-2 and the analysis assumptions in section 3.3.

Containment Sump Level Design Condition d'c Failure Effects 2-1 Analysis For Potential Draindoivn Scenarios Revision l

~ Use a postulated small (e.g., 2" or less pipe break) to determine the minimum sump level for each of the postulated failures listed in Table 2-2.

This will determine the bounding failure case.

~ Use the following inputs to determine the minimum sump level for variable size pipe breaks:

1) the bounding failure case determined above

2) variable modes of operation (e.g., Mode 1/Mode 3) h These cases will determine the limiting pipe break size.

The minimum sump level determined from the cases listed above represents the worst case conditions for the Cook sump. /

Containment Sump Level Design Condition & Failure Effects 2-2 Analysis For Potential Draindown Scenarios Revision I

.Table 2-1

. Limiting Parameters Parameter Boundin Value Comment Desi n Conditions Break Location RCS piping in Maximum diversion from sump Reactor Cavit Ice Condenser Mass 2.20xl0 lb The revised Tech S ec minimum ice mass.

RWST Usable Volume 280.000 al Minimum available volume at initiation of recirculation.

Accumulator Volume In'ected No in'ection as ion as ressurizer level is controlled RCS Conditions 350'F / Mode 3 Results in minimum energy release. Note that licensing

.basis only requires Mode 1. Mode 3 analysis performed to su ort EOP develo ment.

ECCS Leaka e 1.0 m ESW Temperature & Flow 32'F Maximizes effectiveness of the CTS heat exchangers 4,500 m CCW Temperature & Flow 45'F Maximizes effectiveness of the RHR heat exchangers 9,900 m RWST Tem erature 70OF Minimum tern erature increases CTS effectiveness Containment Temperature 60'F Minimum temperature maximizes heat transfer to structures Containment Pressure 0.3 psig Maximum pressure actuates safety systems sooner followin the accident CTS Flow 3,600 m Maximizes ener removal ECCS Flow Two trains, Increases RWST draindown.

maximum ca abilit Safety System Actuation Lower Containment This approach results in the minimal delay between Uncertainty Pressure - 0.6 psig LOCA and safety system actuation. Since the operation of the containment sprays is considered to have the Pressurizer Prcssure greatest impact on ice melt, this approach results in

+115 si minimal ice melt.

CE Fan Flow 39,000 cfm Minimizes forced flow throu h ice condenser 0 erator Actions RCS Cooldown 100'F Maximizes heat removal and RCS makeu r uirements.

RHR Containmcnt Sprays Initiated 50 minutes Maximizes RHR spray operation, consistent with the after CTS initiation. expected EOP's

, Always on when CI'S o eratin .

Switch RHR/CTS Suction from All trains switch Minimizes volume flow out of RWST RWST to Recirculation Sump when RWST 205o level reached Switch SI and CC suction from All trains switch Minimizes volume flow out of RWST RWST to RHR pump discharge when RWST 11%

level reached Containment Spray Restart CTS system remains The CTS system actuates automatically at 2.9 psig 2 0.6 in operation after psig uncertainty. The operators are instructed to secure one restart the system when the pressure decreases to 1.5 psig, and after the system has run for eight hours. This approach assumes the operator leaves thc system in operation after one restart, even if the ressure dccrcases below 1.5 si .

Pressurizer Level Control Consistent with EOPs, but controlled in a manner that results in maximum rcssurizer level.

Containment Sump Level Design Condition & Failure Effects 2-3 Analysis For Potential Draindown Scenarios Revision I

Parameter Boundin Value Comment RCP Operation Consistent with EOPs, but controlled in a manner that results in minimum ener release.

Modelin Methods Inlet Door Response USAR Upper Bound Minimizes steam flow through the ice condenser.

Curve Containment Structures Heat Maximum Heat Minimizes ice melt Transfer Transfer Ice Condenser Performance Bounding Gas Minimizes ice melt Outlet Tem erature Note:

1. The values included in this table were based on availa6le references. The intent of this evaluation is to determine the directions of conservatism, not necessarily the specific limiting values for the various input parameters. As a result, AEP should review all existing design" documentation to determine the specific limiting values.

Containment Sump Level Design Condition & Failure Effects 2-4 Analysis For Potential Draindown Scenarios Revision l

Table 2-2 Potentially Limiting Parameters Parameter Potentially Comment Boundin Values Desi n Conditions Break Size Variable The limiting break size results in CTS actuation, but doesn't actuate the accumulators and minimizes energy discharge. This break size is considered to be between 1" and 3".

Postulated Failures Postulated Failure Loss of one CEQ Results in minimal air flow through containment, with Fan associated reduced ice melt. The basic configuration for this case is onc RHR train in spray mode, one RHR train in ECCS mode, and one CE fan.

EDG or AC Bus Results in loss of one train in following systems: CC, Failure SI, RHR, CTS, ESW, CCW, and onc CEQ fan.

Depending on the relative effects of loss of a train in each system and the break size, could increase or decrease icc melt.

Containment Sump Level Design Condition & Failure Effects 2-5 Analysis For Potential Draindotvn Scenarios Revision I

Section 3 EVALUATlON 3.1 APPROACH The purpose of this evaluation is to deterrtiine and assess the plant design conditions and postulated equipment failures that could impact the water level in the recirculation sump following a LOCA or MSLB. The objective is to determine the effect of each parameter or failure and use these results to develop the likely'bounding cases for potential sump draindown.

For the purpose of this evaluation, the various plant parameters and postulated failures are separated into four groups. The evaluation of each group differs slightly based on the parameters in the group. The four groups are:

~ Design Conditions Plant parameters associated with equipment design that can vary over a predefined range. For example, the CTS system actuates automatically on a hi-hi ~

containment pressure signal. The nominal setpoint for this signal is 2.9 psig. However, the signal has an uncertainty of &.6 psig, so the signal may actually be received between 2.3 and 3.5 psig. For design conditions, the range of expected values is determined and an assessment is performed to determine the bounding value for potential sump draindown.

~ Postulated Failures Postulated single equipment failures, either active or passive, may occur during the injection or recirculation modes of ECCS and CTS operation. For example, failure of an EDG to start on a LOCA/LOOP would result in a single set of ECCS trains and a single CTS train in operation instead of the normally expected two trains of each. For postulated single failures, a failure modes and effects analysis is performed to determine the impact of the failure on resulting recirculation sump water level.

~ Operator Actions Following a LOCA or MSLB, particularly in the recirculation mode, the Emergency Operating Procedures (EOPs) give the operators the ability to operate safety.

system equipment as necessary to maintain the plant in the desired condition. For example, for a small break LOCA the operators will likely control RCS cooldown through steaming in the steam generators. The cooldown rate is expected to be between 30'F/hr and 100'F/hr.

This difference can impact required RCS makeup rate and required operation of the ECCS and CTS systems. For these operator actions, the range of expected values is determined and an assessment is performed to determine the bounding value.

~ Modeling Methods For some equipment (e.g., the ice condenser inlet doors) the exact response during a LOCA is not known. For these parameters, models are required to predict actual response and an assessment is performed to determine the bounding modeling method characteristics.

Containment Sump Level Design Condition & Failure Effects 3-1 Analysis For Potential'Draindown Scenarios Revision 1

3.2 ACCIDENT SCENARIO In order to identify critical design parameters and potential failures, it is important to define the expected response of the plant systems to a LOCA or MSLB. This section provides an overview description of the accident scenario including safety system response.

The Cook plant design includes passive and active design features to provide core cooling and containment pressure suppression in the event of a LO A or MSLB. The passive features include an ice condenser'inside containment and safety injection (SI) system accumulators that automatically discharge into the RCS when the RCS pressure reduces below the accumulator pressure. The active features include the ECCS trains for coolant injection and the containment spray system.

The physical arrangement of the containment structures and equipment is such that the steam discharge from pipe breaks in the lower containment (reactor cavity, recirculation sump area, steam generator enclosures, etc.) will be forced through the ice condenser to reach the upper containment. The exception is pipe breaks in the pipe annulus (i.e., on the "other" side of the Crane Wall). The arrangement of the containment does not allow the steam discharge from those breaks to directly enter the ice condenser. The steam'must first flow through the Crane Wall into the recirculation sump area and then into the ice condenser.

After the pipe break, the containment pressure increases (at a rate dependent on the break size) as steam continues to discharge. At lower containment pressures of about 0.007 psig the ice condenser inlet doors begin to open sufficiently for steam to enter the ice condenser. The steam entering the ice condenser is condensed and the condensate and melted water flow to the recirculation sump.

When a low pressurizer pressure alarm (( 1815 psig) or high containment pressure alarm () 1.1 psig) is received, the safeguards systems initiate an SI signal. The SI signal initiates several automatic actions, including: reactor trip, emergency diesel generator (EDG) start, opens the boron injection tank (BIT) isolation valves and charging pump RWST suction valves, and starts the centrifugal charging (CC) pumps, SI pumps, and residual heat removal (RHR) pumps. In the modified plant design (see section 3.3) the SI signal will also start the CEQ fans. The effect of these actions is:

~ The CC pumps are operating, attempting to deliver borated water from the RWST to the four RCS cold legs. The CC pumps are high pressure pumps that will provide injection at pressures lower than about 2000 psig. At pressures above 2000 psig a bypass line returns the pump discharge to the pump suction to prevent deadheading. The nominal CC flow is 150 gpm through each train.

~ The SI pumps are operating, attempting to deliver borated water from the RWST to the four RCS cold legs. The SI injection into the cold legs is through the SI accumulator injection lines. This piping is separate from the CC injection location. The SI pumps are moderately high pressure pumps that will provide injection at pressures lower than about 1560 psig. At Containment Sump Level Design Condition & Failure Effects 3-2 Analysis For Potential Draindown Scenarios Revision I

pressures above 1560 psig a minimum flow bypass line is used to return the pump discharge to the RWST to prevent deadheading. The nominal SI flow is 400 gpm through each train.

~ The RHR pumps are operating, attempting to deliver borated water from the RWST to the four RCS cold legs. The RHR pumps are low pressure pumps that will provide injection at pressures lower than about 210 psig. The RHR pumps also inject through the accumulator discharge lines. At pressures above 210 psig a bypass line returns the pump discharge to the pump"suction to prevent deadheading. In addition, the RHR system has the capability to be re-aligned to discharge a portion of the RHR flow through containment ring headers in a containment spray mode of operation. The nominal RHR flow is 3,000 gpm through each train.

~ After a delay of approximately two minutes, the CEQ fans begin operating. The CEQ fans force air circulation between the lower and upper containment through the ice condenser.

There are two redundant trains of ECCS, so there are two CC pumps, two SI pumps, and two RHR pumps. Assuming no equipment failures, all six pumps will be operating. The EDGs are started in the event that the LOCA is coincident with a loss of off-site power (LOOP). The system alignment described above is considered the injection phase of the accident.

On a hi-hi containment pressure signal (2.9 psig), the CTS system actuates. The injection phase alignment of the CTS system draws suction from the RWST and discharges through the upper and lower containment spray ring headers. The nominal CTS flow is 3,200 gpm through each train.

The SI accumulators are vessels filled with borated water and pressurized with nitrogen gas.

While the majority of the equipment associated with the injection mode is initiated by a safety injection signal, the accumulators require no power source or initiation signal. When the RCS pressure falls below 600 psig, mechanically operated check valves normally isolating the accumulators from the RCS open, injecting borated water into the four RCS cold leg. There are four accumulators, one accumulator supplying each cold leg. In the event of a cold leg break, the contents of one accumulator passes through the break and spills onto the containment floor, while the remaining accumulators filla volume outside of the core barrel.

The main objectives during the injection phase are to provide immediate core cooling, replenish lost primary coolant, and suppress containment pressure. At the end of the injection phase, the usable contents of the RWST (about 280,000 gallons) has been transferred to the containment sump and RCS and depending on the break size and RCS response, the SI accumulators may have also discharged (an additional 28,000 gallons).

When the RWST low level alarm is received, the switchover to recirculation mode begins.

Operators initiate recirculation mode by switching the suction of one RHR train to the recirculation sump inside containment, where spilled coolant, injected water, and melted ice have collected during the injection phase. In the recirculation mode, the CC and SI pumps take suction from the RHR pump discharge. One CC pump and one SI pump take suction from each Containment Sump Level Design Condition & Failure Effects 3-3 Analysis For Potential Draindown Scenarios Revision I

RHR pump discharge. The switchover to recirculation mode is completed when operators transfer the suction of the second RHR train (and thus the associated CC and SI pumps) and the CTS pumps (if they are operating) to the recirculation sump.

During the initial recirculation period, the ECCS trains continue to inject through the RCS cold legs. Approximately 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after the accident the ECCS system is re-aligned to inject through the hot legs.

There are several other plant systems that operate along with the ECCS and CTS to accomplish the system functional objectives while in the recirculation mode. The RHR pump discharge is routed through the RHR heat exchangers prior to injection back into the RCS. The RHR heat exchangers are cooled by the Component Cooling Water (CCW) system. The RHR heat

- exchangers are located between the RHR pumps and the CC and SI pump suction points, so the CC and SI injection is also cooled. The CTS pump discharge is routed through the containment spray heat exchangers prior to discharge back into containment. The containment spray heat exchangers are cooled by the Essential Service Water (ESW) system.

'The main objectives of the recirculation mode are to keep the core flooded, suppress containment pressure, and provide long-term core cooling. As the RCS.and containment cool and de-pressurize, operators will manually stop (or start) ECCS and CTS trains as necessary to maintain the RCS/containment in the desired condition.

Table 3-1 shows the expected response of the ECCS and CTS systems, containment and other key systems and equipment following a large break LOCA. This sequence is not necessarily the expected sequence for all LOCA scenarios, particularly small break LOCAs, but it provides a general overview of the design response of the plant.

During a main steam line break event (MSLB), low pressurizer pressure, low steam line pressures or high steam line differential pressure signals would initiate a SI signal. The sequence of events described above would be similar for a MSLB. The ice condenser doors open to reduce containment pressure and additional main steam line isolation actions occur. The ECCS pumps would start as described, but would be providing no flow to the RCS system, because there has been no loss of reactor coolant.

Containment Sump Level Design Condition ck Failure sects 3-4 Analysis For Potential Draindown Scenarios Revision I

.Table 3-1 Large Break LOCA Accident Sequence Time sec Event/ Action Reference 0 sec LOCA occurs, Potentiall coincident with LOOP

= O.sec Ice condenser lower door o en Event Dc endent"'I SI Si nal All um s o eratin, exce t RCP's, are tri ed 4.12, 4.17 Sect 9.2.1 Si nal+ 10 sec Diesels u to rated s eed. MOVs o en 4.2 Sect 6.2 SI Si nal + 13 sec Startcentrifu alchar in um s 4.2 Sect 6.2 Start of CC pumps + 1.1 CC pumps'otors up to speed 4.2 [Table 6.2.5]

sec SI Si nal+ 17 sec StartSI um s 4.2 Sect 6.2]

SI Pum Start+ 1.1 sec SI um s'motorsu tos eed. 4.2 Table 6.2.5 SI Si nal+21 sec StartRHR um s 4.2 Sect 6.2 RHR Pum Start+ 0.7 sec RHR um s'otors u to s eed 4.2 Table 6.2.5 Operator Action/ Event RCP pumps trip 44 De endentt ~

SI si nal+2min' Recirculation/H dro en Skimmer Fans Start Event Dependent Containment HI-HI Signal (Containment Pressure > 2.9 psig) 4.16 [Sect 4.1.2]

CTS Pum s Start 90 Containment S ra Be ins 4.3 CCW um sstarted 4.16 Sect 8.2 sec"'perator ESW um s started 4.17 Sect 9.2.1 Action RWST level < 20%, RHR pumps switched to recirculation 4.11 mode Operator Action RWST level < 11%, CC and SI pumps switched to 4.11 recirculation mode 0 erator Action 50minafterCTS initiation, RHRS ra s Be in 4.13

=12hr Switchover to Hot-Le Recirculation 4.2 [Sect. 6.2]

Notes:

1. Low pressurizer pressure of 1815 psig OR high lower containment pressure of 1.1 psig OR steamline b,P>100 psid OR steam generator pressure < 500 psig.

2. RCP pumps will be operator tripped under either of following conditions:

~ Containment Isolation Phase B (HI-HISignal) OR

~ At least one CCP or SI pump running AND RCS Pressure < 1250 psig

3. This setpoint is stated in the revised EOPs. The current EOPs specify the fans start ten minutes after the hi-hi signal.

4. Reference 4.3 lists a range of times for start of containment spray. The value listed is a nominal value for CTS start with loss of offsite power.

Containment Sutnp Level Design Condition &, Failure Effects Analysis For Potential Draindown Scenarios Revisio>> ."'

3.3 KEY ASSUMPTIONS There are an unlimited number of postulated accident scenarios that the ECCS and containment systems must adequately mitigate. For the purposes of this evaluation, several key assumptions have been made regarding the accidents that must be considered, the response of plant equipment and the response of operators. These assumptions are listed below.

1. The smallest break:size considered is a 1" equivalent pipe. Small breaks tend to minimize the energy released from the RCS. Since the energy release is minimized, the amount of ice melt in the ice condenser is alsa minimized. This reduces the amount of water in the recirculation sump; For this evaluation, it is assumed the operators would identify a very small break (< 1") and take appropriate actions to shut down prior to full ECCS/CTS system operation.

2. The operator response during/following the postulated accident will be consistent with the Cook Emergency Operating Procedures (EOPs). In some instances, the response of operators is a critical factor affecting sump level while in the recirculation mode of ECCS operation.

The Cook EOPs are being revised at the time this evaluation is prepared. This evaluation assumes the operator response willbe consistent with the intent of the revised EOPs, not the existing EOPs. The key differences between the existing and revised EOPs include:

~ RHR Sprays In the existing EOPs, the logic used to start the RHR sprays is based on containment pressure; if the pressure remains below 8 psig, the RHR sprays would not actuate. In the revised EOPs, the RHR sprays are actuated 50 minutes after accident initiation regardless of containment pressure ifboth trains of CTS are not operating.

~ Containment Spray Operation The revised EOPs require the containment sprays to operate for eight hours before they may be secured after the containment pressure drops to 1.5 psig.

~ )

RCP Operation When the RCS pressure is 590 psig, the revised EOPs state the operator should restart one RCP to obtain pressurizer spray flow as part of the cooldown and depressurization.

3. Reactor coolant system piping is located throughout the lower containment. The RCS boundary for the RCS attached piping is taken as the second isolation valve away from the main RCS pipe. Using this definition of RCS boundary, most RCS piping (and thus, postulated break locations) is located inside the Crane Wall. The only piping that travels through the Crane Wall into the pipe annulus are small lines less then 1" diameter and the RHR line for flow leaving the RCS. The RHR line in the pipe annulus is not open during Modes 1, 2 and 3. As a result, this evaluation assumes that pipe breaks in the pipe annulus are not required to be postulated.

4. Pipe breaks could be postulated during any of the operating modes for the plant. These include normal full power operation, startup, shutdown, etc. Based on input from AEP Containment Sump Level Design Condition & Failure Effects 3-6 Analysis For Potential Draindown Scenarios Revtston I

It licensing personnel, this evaluation assunies that the licensing basis requires pipe breaks to be postulated during Mode 1. Breaks during Mode 2 and the portion of mode 3 when the safety systems are in automatic are also considered to support EOP development. Although breaks in Mode 3 are likely less severe than a full power break with regard to peak clad temperature or contairiment conditions, it is likely that these breaks result in a slower ice melt rate and a lower sump level.

5. As part of the resolution of sump drain down issues, AEP is planning to implement several physical modifications to the Cook plants. The design details of these modifications have not been developed, but the conceptual designs (and intent of the changes) are known. This evaluation assumes the planned physical modifications have been implemented. These modifications are:

~ Open Partition Wall The Crane Wall separates the main area of the lower containment (where the recirculation sump is located) from the pipe annulus. The lower CTS header includes spray nozzles in the pipe annulus. In recirculation mode, the CTS draws suction from the sump and discharges a portion of the flow into the pipe annulus. The Crane Wall could potentially prevent this water in the annulus from flowing back into the sump.

In order to prevent a reduced sump level over time, a sufficient flow path between the recirculation sump and pipe annulus is necessary. A flow path will be created in the partition wall between the sump and pipe annulus (the partition wall is a small portion of the Crane Wall near the PRT at the location of the overflow between the recirculation sump and pipe annulus).

Modify CEQ Fan Automatic Start Logic The CEQ fans circulate air in the containment following an accident. The operation of the fans increases ice melt by providing a steady flow of steam/air through the ice condenser. Currently, the CEQ fans start ten minutes after the containment hi-hi signal (2.9 psig). A greater amount of water could be available in the sump if the CEQ fans are started earlier. The CEQ fan actuation logic will be modified to start the fans two minutes after the containment hi pressure sign'al (1.1 psig) rather than ten minutes after the containment hi-hi signal (2.9 psig).

~ Reroute Stairwell and CEQ Fan Room Drains Presently, fluid in the stairwell and CEQ fan room drains to the pipe annulus. This could result in a slow draindown of the sump while in recirculation mode. To preclude this draindown, the drains will be rerouted to the sump.

~ Modify Ice Condenser Ice Mass The melting of ice in the ice condenser helps control containment pressure following an accident. In 1997 the ice condenser mass was increased. It has since been determined that maintaining the new ice mass value would be difficult. The ice mass will be reduced to the value of 2.20 million pounds.

~ Modify RWST Overflow Line The current RWST overflow line configuration consists of an elbow turned upward off the RWST nozzle. This configuration limits the available Contaimnent Sump Level Design Condition dc Failure Effects 3-7 Analysis For Potential Draindown Scenarios Revision 1

RWST volume. The piping elbow off the RWST nozzle will be inverted to increase the RWST water level by preven'ting drainage through the overflow piping.

6. It is likely that there will be leakage out of.the ECCS systems while in recirculation mode (e.g., pump seals, valve packing, etc.). Although this leakage is expected to be small, it is not zero. AnyECCS leakageoutsidecontainmenthas thepotential to reducesump level. This evaluation assumes a worst case leakage of I gpm. This leakage could be greater under certain postulated failure cases, but those cases are bounded by the failures considered in Section 3.5.

7. The instruments used to trigger safety system actuation (e.g., containment pressure) have uncertainties. Plant safety analyses are based on values that represent the nominal plus the maximum expected uncertainty. For the Cook safety analysis, AEP used input values into the safety analysis that were based on the nominal value plus an uncertainty that included additional margin. For example, the safety analysis used a containment hi-hi setpoint of 2.9 (nominal value) + 0.6 (uncertainty) = 3.5 psig. The uncertainty of the pressure instrument loop (as calculated by AEP) was only 0.46 psig; the 0.14 psig difference represents additional margin. For this evaluation, the "additional margin" uncertainties, as calculated by AEP, are used.

8. The operators will not begin the switchover from the RWST to the containment recirculation sump until the RWST has drained to the 20% level prescribed by the revised EOP's.

9. The worst case condition is a pipe break discharging into the reactor cavity. This is because the break flow will flood the cavity prior to filling the sump. For this evaluation, it is assumed that all breaks discharge. into the cavity, regardless of the actual pipe sizes in the cavity.

10. The effective CEQ fan flow is assumed to be 39,000 cfm.

3.4 DESIGN CONDITIONS 3.4.1 Parameters Considered The following plant parameters, or design conditions, are considered to impact the plant response following a LOCA and may affect the resulting water level in the recirculation sump. The following paragraphs provide a description of the impact of each parameter. Table 4-1 prov'ides a summary of this information along with the range of design conditions. The parameters listed below are separated into two groups: parameters considered to have a primary impact on sump water level and those considered to have a secondary, or lesser, impact on sump water level. The breakdown is shown in Table 4-1.

Containment Sump Level Design Condition & Failure Effects 3-8 Analysis For Potential Draindown Scenarios Revision I

LOCA Break Size The Cook containment is arranged such that the steam discharge from a LOCA in the reactor cavity or a steam generator enclosure (i.e., a break in the lower containment) is directed into the lower inlet doors of the ice condenser. The steam is condensed and energy is removed from the discharge through the melting ice. The condensing of the steam tends to minimize containment pressure (and is one of the advantages of the ice containment system). The melted ice, in the form of condensate, flows out of the ice condenser into the recirculation sump. Once in the recirculation sump, the ice condenser condensate is available for use during recirculation mode ECCS and CTS operation.

The rate at which the ice melts is a function of several parameters, including break size. Large energy releases associated with large diameter pipe breaks tend to melt the ice more rapidly than small diameter breaks. The rate at which the ice melt is entering the sump affects the sump level.

The postulated pipe break size also impacts the operation of other systems that affect sump water level. For example, the break size is a contributing factor in determining if the SI accumulators discharge or retain their contents. Also, the break size affects the operation of the CTS system, which can affect redistribution of water within the containment and the rate of ice melt.

For evaluation of potential sump drain down scenarios, it is expected that small break LOCAs will be bounding since the smaller energy release associated with a small break will result in slower ice melt. =

Location of Pi e Break

'I The large diameter RCS piping is essentially confined to the reactor cavity, steam generator enclosures, and other a'reas of the lower containment inside the Crane Wall. Smaller diameter piping is also located in these areas and travels through the Crane Wall to the pipe annulus.

The location of postulated breaks can have a direct impact on recirculation sump level response.

For example, postulated breaks in the reactor cavity must fillthe reactor cavity before RCS discharge contributes to increasing the recirculation sump level. In addition, postulated breaks in the outer pipe annulus would discharge reactor coolant to an area that may not fully drain to the recirculation sump (i.e., some water may be "lost").

As an additional consideration, the analysis of postulated breaks must be consistent with the actual plant design. That is, if a 2" pipe break is considered to be limiting (as an example), that break should not be postulated in locations where there is no 2" diameter piping. Put another way; breaks should only be postulated where the piping is actually installed.

Containment Sump Level Design Condition ck Failure Effects 3-9 Analysis For Potential Draindown Scenarios Revision I

e 0

The approach used in this evaluation to identify postulated break locations is as follows:

~ Breaks are postulated in the reactor cavity and the inner lower containment area (the sump area). Breaks are not postulated in the pipe annulus outside the Crane Wall (see section 3.3, Key Assumptions).,

~ A break in the RCS piping within the biological shield wall (at the nozzle) will result in flow into the reactor ca'vity and into the sump area. Thus, the full range of breaks is postulated to occur in the reactor cavity and the sump area.

It should be noted that the limiting case is to postulate the break in the reactor cavity since the break flow will fill the cavity prior to fillingthe sump. As a result, an RCS LOCA is bounding

-when compared to a MSLB. Ifthe postulated accident is a MSLB, the entire usable contents of the RWST will be used to flood the sump and the cavity will not flood until the sump level reaches the overflow at 610'. Thus, with regards to sump level, MSLBs are not considered..

7 Core Thermal Power The reactor power level is a measure of the energy available to discharge into containment in the event of a LOCA. Typical severe accident analyses assume the maximum core thermal power since that level represents the maximum energy release. However, for recirculation sump draindown scenarios, it is possible that lower power levels could be more limiting, since a lower energy release could result in less ice melt.

~CCS I k During recirculation mode of operation, water is taken from the recirculation sump, passed through the RHR pumps and RHR heat exchangers and injected back into the RCS through the CC, SI or RHR systems. The pumps and heat exchangers are located outside containment. Ifa leak developed out of the ECCS systems following the accident (e.g., pump seal leakage), the water would be removed from the sump and then "lost" outside containment. The long-term net impact would be to decrease sump level.

Ice Condenser Mass Assuming the entire ice condenser eventually melts following a LOCA, the condensate from the ice melt will drain to the recirculation sump. The total mass of ice in the condenser affects the total water available to flow to the sump (based strictly on conservation of mass).

r Containment Sump Level Design Condition & Failure Effects 3-(0 Analysis For Potential Draindown Scenarios Revision I

RWST Usable Volume Immediately following a LOCA, the contents of the RWST are pumped into containment or the RCS (an/ out the break to the containment). The ECCS and CTS systems are used to move the water from the RWST to the recirculation sump. In fact, the RWST volume represents the main source of water available to flood the recirculation sump for a small break LOCA.

The. usable volume of the RWST depends on several parameters, including level instrumentation (both at the high end and the low end) and the point at which operators complete the switchover to recirculation operation. The available RWST usable volume directly impacts the amount of water in the recirculation sump following the LOCA.

Containment S ra Actuation Pressure Operation of the containment spray system can dramatically impact ice melt in the ice condenser, particularly for small break LOCAs. On a containment hi-hi pressure signal the CTS starts automatically. This setpoint is 2.9 psig+ 0.6 psig. The system remains in operation until it has been on for at least eight hours and the containment pressure has reduced to 1.5 psig.

The actual point at which the CTS system actuates (between 2.3 and 3.5 psig) will affect the amount of ice melt, particularly for small pipe break cases. Actuation near the lower end of the range will limit ice melt, while actuation near the upper end of the range will increase ice melt.

The amount of ice melt impacts recirculation sump water level.

ECCS Flow Following a LOCA, the containment pressure will increase as steam is discharged into the containment atmosphere. When the containment hi pressure setpoint of 1.1 psig is reached, an SI signal will be generated automatically and the ECCS systems will start. The CC, SI, and RHR pumps will all start, attempting to inject RWST water into the RCS. The total ECCS flow can impact containment response from two perspectives. First, the greater the total volume of ECCS injection, the greater the potential to absorb energy and reduce ice melt. However, the second effect can potentially offset the first effect. Depending on the postulated break size, the amount of ECCS flow could actually increase the rate that reactor coolant is forced out the pipe break, increasing ice melt.

Containment S ra Flow Previous analyses have shown that CTS operation has a significant effect on ice melt; especially for small break cases. The spray flow condenses steam and absorbs energy. This reduces the energy removed through ice melt, and thus slows the rate condensate is generated in the ice condenser. Conversely, lower spray flow rates. (or no flow at all if the sprays are off), increases the rate of ice melt and condensate generation.

Containment Sump Level Design Condition ck Failure Effects 3-II Analysis For Potential Draindown Scenarios Revision  !

ESW/CCW Tem erature and Flow The containment spray heat exchangers that remove heat from the CTS flow from the recirculation sump during recirculation mode operation are cooled by Essential Service Water (ESW). The CTS flow removed from the recirculation sump is coo!ed prior to discharge back into the containment. In addition, ECCS flow from the recirculation sump is cooled by Component Cooling Water (CCW) in the RHR heat exchangers prior to injection back into the RCS.

These heat exchangers remove energy from the containment and discharge the energy to the ultimate heat sink. As the amount of energy removed by these heat exchangers increases, the amount of energy that must be removed through ice melt decreases. The ESW and CCW flow and temperature affect the heat exchanger performance and will affect the temperature of the water returned to containment as ECCS flow or containment spray and thereby affect how much heat load must be absorbed by ice melt. Lower ESW and CCW temperature, and maximum ESW and CCW flow will reduce the rate of ice melt RWST Tem erature The temperature of the water in the RWST will contribute to the cooling effectiveness of water pumped into the containment building during injection mode ECCS operation and containment spray. The more effective the ECCS and containment spray cooling, the less ice melt and the less water available in the containment sump.

CE Fan 0 eration Recirculation/hydrogen skimmer fans start about two minutes following a containment hi signal (containment pressure of 1.1 psig). The fans move air from the upper to lower containment compartments. This is done to keep the containment atmosphere well mixed and to promote flow of steam through the ice condenser for condensation. The fans also move low volumes of air from the pressurizer and steam generator enclosures and the containment dome to prevent hydrogen gas buildup.

Air circulation within containment following an accident affects the rate of ice melt in the ice condenser. Increases in air flow through the ice condenser increase the rate of ice melt.

Accumulator Actuation There are four SI accumulators installed inside containment. The accumulators each contain approximately 7,000 gallons of water, pressurized by nitrogen to approximately 600 psig. One accumulator is connected to each RCS cold leg. Depending on the RCS response following the postulated pipe break, the accumulators may or may not actuate and discharge into the RCS. For break LOCAs for which the operators can maintain RCS level control in the pressurizer, 'mall the accumulators will be locked out to prevent discharge. If the accumulators actuate, the volume of the four accumulators may be available in the recirculation sump.

Containment Sump Level Design Condition dc Failure Effects 3-12 Analysis For Potential Draindown Scenarios Revtston I

Initial Containment Tem erature Following a postulated pipe break inside containment, the containment atmosphere and the equipment, structures, etc:, inside containment will be heated by the high energy steam released to containment. The energy absorbed by the containment atmosphere is not available to melt ice in the ice condenser (at least not early in the accident sequence). Thus, a lower initial containment temperature would result in less ice melt than a maximum temperature.

Initial Containment Pressure The initial containment pressure can affect the delay before safety systems actuate following a LOCA. Since safety system performance affects ice melt, a shorter delay would minimize ice melt.

0 eration of Non-Safet Related E ui ment The operation, or non-operation, of non-safety related plant equipment during the accident sequence could impact the conditions inside containment and the resulting ice melt. The most important equipment is the normal containment cooling. If this equipment continues to operate during initial phases of a small break LOCA, the resulting amount of ice melt will be decreased.

Continued operation of this equipment could also tend to prevent actuation of the containment spray system.

3.4.2 Bounding Values Table 3-2 outlines the expected bounding values for the design parameters.

Containment Sump Level Design Condition dc Failure Effects 3-13 Analysis For Potential Draindown Scenarios Revision I

Table 3-2 Design Condition Evaluation by Parameter Parameter/ Design Range Reference(s) Bounding Value(s) Effect Condition Prim ParametersAffectin Sum Level LOCA Break Size 3g> ] II 3I ~

Small breaks are limiting for the sump draindown analysis since the accumulators are not expected to discharge and the energy release (and associated ice melt) is low. Most previous analyses for Cook have assumed a 2" pipe break is limiting since the CTS system actuated, but the accumulators did not discharge. However, smaller breaks may actually result in less ice melt and be more conservative.

The break size affects RCS response following the LOCA, so it is possible that the smallest pipe size (1") is not the most limiting. A range of break sizes is considered to identif the limitin case.

Core Thermal 0-3250 Mwt/ Mode 3 /350'F The energy release on a LOCA is dependent on the core thermal power level and RCS Power/ 100'F - -600'F conditions at the time of the break and subsequent to the break. The amount of energy RCS Conditions release affects the amount of ice melt and resulting volume in the recirculation sump'.

Cook is not required to postulate general pipe breaks in Mode 4 or below (for those conditions, the WOG approach is used, see section 3.3). Thus, the limiting conditions for energy release and subsequent ice melt would be a LOCA in Mode 3 near Mode 4.

These conditions are expected to be more limiting than a LOCA at full power since the energy release is reduced and with a lower RCS pressure, the ECCS flow into the RCS will be reater.

Ice Condenser Mass 2.20 x 10 lb (min) Per discussion 2.20x10 lb The less ice available prior to the accident, the less water is available to the sump with AEP following the accident.

ersonnel RWST Usable 280,000- 310,000 gal Per discussion 280,000 gal All of the usable volume in the RWST will be pumped into the containment building Volume with AEP following a LOCA. This value represents the minimum usable volume when ersonnel uncertainties and mar ins are considered.

Containment Sump Level Design Condition & Failure Effects 3-14 Analysis For Potential Draindown Scenarios Revision 1

Parameter/ Design Range Reference(s) Bounding Value(s) Effect Condition Safety System Containment pressure 4.19 Containment A lower containment pressure of 1.1 psig, or a pressurizer pressure of 1815 psig, Actuation 2 0.6 prcssure - 0.6 psig actuates the ECCS system. The instrument measuring the containment pressure has an Uncertainty uncertainty of k 0.6 psig. The pressurizer pressure uncertainty is 115 psig.

Pressure ps'ressurizer Pressurizer Pressure 2115 psig + 115 psig The containment spray system is activated automatically on the containment hi-hi-signal of 2.9 psig. An instrument w'ith an uncertainty of k 0.6 psig is used to measure containment pressure. Prior to the start of containment spray, all heat energy is removed by ice'melt. When the CTS system is in operation, the rate of ice melt is reduced because the sprays also condense steam and remove energy. Hence;the sooner the hi-hi signal is actuated, the earlier CTS flow reaches containment and the less icc melt occurs.

A lower containment pressure of I.I psig actuates the CEQ fans. The same instrument measures containment pressure with the same uncertainty. The shorter the delay of the CEQ fans, the more steam is circulated throughout containment, and hence more ice melt occurs. However, this effect is considered to be small compared to the reduction in ice melt associated with CTS operation.

I Pipe Brcak Location RCS Piping in Lower RCS Break in The flow out of a break in the reactor cavity will flood the reactor cavity. The cavity Containment Areas Reactor Cavity must filland overflow to the sump area for the break effluent to be available to the MSLB in Upper sump (i.e., the cavity does not drain to the sump). Assuming a break in the cavity Containment Areas maximizes the flow diverted away from the sump.

Accumulator 0- 29,050 gal 4.9 Accumulators connected to the RCS cold legs will dump into the RCS on a low Volume Injected pressure signal. After entering the RCS, the water is available to flood the sump when it flows out the break. In addition, accumulator injection minimizes the make-up requirements from the RWST to address RCS shrinkage.

No accumulator actuation will result in a decreased available volume to the containment sump. For small breaks in which the pressurizer level can be controlled, the operators will lock out the accumulators and prevent injection.

ECCS Leakage 0 gpm- 1.0 gpm 1.0 gpm Leakage from the ECCS system outside containment while in recirculation mode reduces the amount of water in the recirculation sump.

These bounding values are based on the planned AEP approach for estimating ECCS leakage.

Containment Sttmp Level Design Condition & Failure Effects 3-15

Inal~sis For Potential Draindown Scenarios Revision I

Parameter/ Design Range ~ Reference(s) Bounding Value(s) Effect Condition Parameters Affectin Sum Level

',200 Second Containment Spray gpm nominal 4.1 [Sect. 6.3, 3,600 gpm Containment spray flow is drawn directly from the sump during recirculation. The Flow (per train) 3,600 gpm max Table 6.1.1] more water injected into the containment building during the LOCA, theless heat must be removed from the containment atmosphere by the ice condenser. Lower ice melt will decrease the water available to the sum .

ECCS Flow (per 3,550 gpm nominal- 4.2 [Table 6.2-5] Maximum flow ECCS flow is drawn directly from the sump during recirculation. The more water train) 5,750 gpm max capability per train, injected into the RCS/coritainment building during the LOCA, the less heat must be both trains removed from the containment atmosphere by the ice condenser. Lower ice melt will decrease the water available to the sump.

Nominal and maximum flow rates are based on following:

Pump Nominal Maximum CC 150 gpm 550 gpm SI 400 gpm 700 gpm RHR 3000 gpm 4500 gpm Using maximum pump capability (i.e., degraded pump curves are not used) and both trains maximizes ECCS flow.

CTS HX Shell Side 32'F - 87.5'F 4.7 [Sect. 3.9.1.3] 32OF ESW flow cools the containment spray recirculation heat exchanger. The cooler the Temperature 8r, 2,000-4 500t i 4.7 [Tables 2-1 4,500 gpm water returning to containment as spray, the less heat load must be removed by the ice Flow (ESW) m/train and 3-1, Fig 6-1] condenser (resulting in less ice melt and lower sump levels).

RWST Temperature 70' 100'F 4.2 [Table 6.2-4] 70OF The temperature of the water sprayed into the containment building from the RWST affects the amount of ice melt. Lower RWST temperature will decrease the amount of ice melt. Further, lower ECCS temperature will also reduce the heat load on the ice .

condenser.

Initial Containment -1.5 psig -0.3 psig 4.10 0.3 psig The maximum containment pressure minimizes the time delay prior to safety system Pressure actuation.

CEQ Fan Flow 39,000- 45,000 4.5 [Sect. 41,800 cfm The CEQ fans circulate the containment atmosphere through the ice condenser during cfm/train 3.4.8.3.8, Figure LOCA conditions. Increased air circulation will increase the heat transfer rate and the 4-1 rate of ice melt.

Initial Containment 60- 120'F 4.10 60'F Lower temperatures inside containment at the beginning of ~ LOCA result in more heat Temperature being absorbed by containment equipment, structures, etc., during and following thc LOCA.

Containment Sump Level Design Condition & Failure Effects 3-16 Analysis For Potential Draindown Scenarios Revision 1

Parameter/ Design Range Reference(s) Bounding Value(s) Effect Condition RHR HX Shell Side 45'F' 120'F 4.8 [Sect. 2.8.1.1, 45oF CCW flow cools the RHR heat exchanger. The cooler the water that returns from the Temperature & 3,000- 9,900 Table 1-2] 9,900 gpm RHR HX (and is directed to RHR spray or to the suction cf:he Sl.and charging Flow (CCW) gpm/train pumps), the more heat load is absorbed by the ECCS systems and the less ice melt.

The CCW heat exchangers are cooled by ESW. The minimum ESW temperature is 32'F (the minimum lake temperature). The Cook plant does not have a design minimum CCW temperature. There is a CCW low temperature alarm set at 60'F, but it is only an alarm. Ifthe lake temperature and CCW heat loads are low enough, the CCW temperature could drop below 60'F. For this evaluation, a nominal temperature difference across the ESW/CCW heat exchanger is assumed and the minimum CCW, tern rature is selected as 45'F.

Containment Cooler Fail - Trip offon CfS Trip offon CTS During normal plant operation the containment coolers function to remove heat from Operation signal signal containment and maintain the containment temperature in the desired range. Following a LOCA the coolers may, or may not, continue operating until the CTS actuation signal.

Assuming the coolers do not trip offduring the LOCA, the coolers would continue to remove energy from the containment environment, particularly for a small break case.

I This would minimize ice melt.

Notes:

I. This is not a true "design" value. See discussion in table.

Containment Sump Level Design Condition & Failure Effects 3-17 Analysis For Potential Draindotvn Scenarios Revision I

3.5 POSTULATED K<'AILURES 3.5.1 Design Requirements Although the Cook design was initiated prior to the publication of 10CFR50 and the General Design Criteria (GD ), Chapter 1 of the Cook UFSAR states that the Cook design complies with the intent of the GDC, as published for comment in July, 1967.

GDC 35 (Emergency Core Cooling) requires that the ECCS systems be designed in accordance single failure criteria. Proper operation of the recirculation sump is key to successful

'ith operation of the ECCS systems in ECCS recirculation mode operation. As a result, the design aspects of the sump must also be designed against the effects of single failures.

The sump structure is essentially a passive "component". The sump serves as a collection volume for water leaving the RCS (through a break) and the containment spray, flow. The ECCS and CTS draw suction from the sump in recirculation mode. As such, there are no specific design requirements for the sump structure necessary to"satisfy single failure criteria. The critical design aspect of sump operation is the water level during recirculation mode operation. A sufficient level is required to provide adequate NPSH and to prevent vortexing (with the associated air intrusion) for the ECCS and CTS pumps. Thus, single failure analysis requires that the design of the ECCS systems and the overall plant response following an accident be such that postulated single failures do not reduce the water level below the minimum value required for sump operation.

A definition of single failure is provided in 10CFR50, Appendix A:

"A single failure means an occurrence which results in the loss of capability of a component to perform its intended safety functions. Multiple failures resulting from a single occurrence are considered to be a single failure. Fluid and electric systems are considered to be designed against an assumed single failure if neither (1) a single failure of any active component (assuming passive components function properly) nor, (2) a single failure of a passive component (assuming active components function properly), results in a loss of the capability of the system to perform its safety functions."

The implementation of single failure analysis for Cook is established in Policy 800000-POL-2300-04 (Reference 6.21) and Directive 227000-DE-2400-04 (Reference 6.22). For Cook, the following definition of single failure is used:

"An occurrence that results in the loss of capability of a component to perform its intended safety functions. Multiple failures resulting from a single occurrence are considered to be a single failure. Fluid and electric systems are considered to be designed against an assumed single failure if neither a single failure of any active component (assuming passive components function'properly) nor a single failure of a passive component (assuming active components function properly) results in Containment Sump Level Design Condition & Failure Effects 3-18 Analysis For Potential Draindown Scenarios '"Revision I

the. loss of the capability of the system to perform its safety functions. A single failure could occur prior to, at the initiation of, or at any time following the design basis event for which the safety system is required to function."

The Attachment 2 to the directive provides additional clarification on the implementation of single failure analysis for Cook. In particular, it clarifies "when" single failures are postulated.

"During the injection phase, any single active failure will not prevent the accomplishment of the ECCS objectives. During the recirculation phase, the ECCS is capable of accepting one active or passive failure, but not in addition to a single active failure during the injection phase. One active or passive failure in the systems required for long-term ECCS operation will not prevent the accomplishment of the ECCS objectives."

Thus, based on these definitions, the sump design and response must be designed in accordance with the following criteria:

~ The sump water level during recirculation phase must remain above the specified minimum level. This level is 602'10" as determined in Reference 4.1.

~ During the injection phase, only active failures are postulated.

~ During the recirculation phase, active or passive failures are postulated, but not in addition to a previous active failure during the injection phase.

3.5.2 Definitions

~ Active Failure "... the inability of a single dynamic component or instrument to perform its design function.,when called upon to do so by the proper actuation signal. Such functions include change of position of a valve or electrical breaker, operation of a pump, fan or diesel generator, action of a relay contact, etc."

~ Passive Failure "... a failure affecting a device involved with the transport of fluid which limits its effectiveness in carrying out its design function. Most passive failures involve the development of abnormal leakage in valve stem packings, pump seals, etc., although passive failures concerned with abnormal flow restriction in lines are also considered."

3.5.3 Failures Considered Normally, a failure modes and effects analysis (FMEA) considers each of the components or support systems and determines the postulated failure modes for each component or system.

However, for this evaluation a simplified approach is used. The purpose of this evaluation is not to perform a failure analysis for specific ECCS or safeguards systems. These single failure evaluations have already been performed for the Cook design and are described in the Cook Containment Sump Level Design Condition & Failure sects 3-19 Analysis For Potential Draindoivn Scenarios Revision I

e UFSAR. For example, Tables 6.2-6 and 6.2-7 in the UFSAR describe the single failure analysis for the ECCS system and Table 6.3-4. provides the same information for the CTS system. These tables show that postulated single failures will not prevent those systems from performing their design function. Further, the safety analyses performed to show that the critical plant parameters following an accident (containment pressure, fuel temperature, etc.) are determined using assumptions consistent with the minimal amount of safety system equipment in operation.

For evaluation of the potential for recirculation sump draindown, failures of specific components is not a concern. Instead, the failure analysis must consider the potential for failure of systems or subsystems and the associated impact on sump level. For example, it is not critical if a train of SI is unavailable due to a failure of an SI pump to start, failure of a valve to move to the necessary position, or failure of an AC power bus. With regards to the recirculation sump level, the critical information is that a train of SI is not functioning.

For this evaluation of the potential for sump draindown, the failures listed in Table 3-3 are considered. These failures are divided into two groups. The first group are the failures of'a single train of flow through one of the ECCS systems (CC, SI, RHR) or CTS. These scenarios are assumed to have occurred as a result of individual equipment failures in the train. Table 3-3 also includes an assessment of the impact of the loss of each equipment train.

The second group of failures in Table 3-3 are those that impact more than one ECCS system train of equipment. For example, failure of a diesel generator to start under conditions of loss of offsite power would result in the loss of essentially one-half the safety system equipment (i.e.,

loss of all equipment powered by that EDG). Table 3-3 also includes an assessment of the impact of the postulated failure. For this evaluation, it is assumed that all equipment functions properly except for the equipment affected by a single failure.

ANSVANS 58.9 provides the present industry criteria and approach for evaluating postulated single failures in light water reactor power plants. The Cook design is not fully consiste'nt with this standard. For example, ANSI/ANS 58.9 categorizes the failure of a check valve to open as an active failure. ANSI/ANS 58.9 would require that failure of a check valve to open be postulated during the injection phase following an accident. However, the Cook design is not consistent with this approach. There is a single check valve in the common suction header from the RWST to the redundant Safety Injection (SI) pumps. In addition, there is one check valve in the common suction header from the RWST to the redundant charging pumps. Since the RWST inventory is supplied to each system via a common header (i.e., one line) through a single check valve, a failure of the check valve to open would result in the loss of the flow path from the RWST to the entire system. Similarly each ECCS accumulator connects to its associated RCS loop through two check valves in series. The failure of either valve to open prevents the accumulator from discharging following a LOCA scenario. Thus, failure of check valves to open are not considered in the evaluation.

Other differences between the Cook design and industry standards are not addressed in this evaluation. Instead, a bounding approach is used. Since the evaluation focuses on loss of function (loss of trains) instead of equipment failures, there are a number of failures that could

'I Containment Sump Level Design Condition & Failure Effects 3-20 Analysis For Potential Draindown Scenarios Revision I

affect each train. These failures could be active or passive.. Thus, for this evaluation, the limiting case of loss of function due to an active failure is assumed during the injection phase and the loss of function due to an active or passive failure is assumed in the recirculation phase, independent of what l;quipment may have failed.

Finally, consistent with the Key Assumptions described in section 3.3, this evaluation only considers failures associated with LOCA events in Modes 1, 2 or 3. Failures that could impact plant response to a Mode 4 (or lower) LOCA are not co ssidered.

3.5.4 Bounding Failures As shown in Table 3-3, essentially all of the postulated failure modes result in decreased ECCS/CTS capability. This decrease in injection or spray flow is expected to have a corresponding increase in ice melt. This increase in ice.melt results from the ice condenser having to "make up the difference" and remove the energy that the ECCS/CTS systems are not removing. Thus,'all of the failures that result in increased ice melt are not limiting for the sump draindown evaluation.

There are, however, several postulated failures that may result in less ice melt. These are summarized below.

~ Failure of a single CEQ fan to operate. The CEQ fans tend to circulate the containment atmosphere and force increased flow through the ice condenser. Thus, operation of both fans would increase ice melt and operation of a single fan would result in reduced ice melt.

~ Failure of a Power Bus Failure of a power bus would impact each of the ECCS systems, the CEQ fans, and the CTS system. Only one train would be operating in each system.

Considering the small break LOCA described above, loss of SI and CC trains and a CEQ fan could reduce ice melt, but loss of a CTS train and RHR train would likely increase ice melt.

Thus, the overall impact of this case is difficult to determine without analysis.

These are the only two postulated failures considered to potentially decrease ice melt from the nominal case.

Containment Sump Level Design Condition dc Failure Effects 3-21 Analysis For Potential Draindown Scenarios Revisio t I

Table 3-3 Failure Effects Analysis S stem Desi nBasis. Failure Mode Effect "Sin le Train" Failure Modes Charging (CC) System As part of the ECCS system, the CC system delivers Loss of one train The Cook design includes two redundant, independent CC trains.

cooling/flooding water to the reactor core in the event of One train is still functional on failure of the other.

a LOCA. This limits the fuel clad temperature and thereby ensures that the core will remain substantially Depending on break size, loss of a CC train can have different intact and in place, with its essential heat transfer effects. For a large break LOCA, loss of one train likely results in geometry preserved. more energy removal through ice melt (although the difference iq expected to be small). For a small break, in which the ECCS The design flow is 550 gpm per train. The CC system pumps are contributing to maintaining RCS pressure, loss of one begins to inject at high reactor coolant pressures (about train of CC may actually reduce the discharge through the break 2000 psig). and decrease ice melt.

In summary, the effect of loss of a train likely depends on the ostulated break size.

SI System As part of the ECCS system, the SI system delivers Loss of one train The Cook design includes two redundant, independent Sl trains. ~

cooling/flooding water to the reactor core in the event of One train is still functional on failure of-:he other.

a LOCA. This limits the fuel clad temperature and thereby ensures that the core will remain substantially Depending on break size, loss of an SI train can have different ~

intact and in place, with its essential heat transfer effects. For a large break LOCA, loss of one train likely results in geometry preserved. more energy removal through ice melt (although the difference is expected to be small). For a small break, in which the ECCS The design flow is 700 gpm per train. The SI system pumps are contributing to maintaining RCS pressure, loss of one, begins to inject at moderately high reactor coolant train of SI may actually reduce the discharge through the break pressures (about 1750 psig). and decrease ice melt.

In summary, the effect of loss of a train flke!y depends pn the ostulated break size.

Containment Sump Level Design Condition Ck Failure Effects 3-22 Analysis For Potential Draindown Scenarios Revision 1

S stem Desi n Basis Failure Mode Effect RHR System As part of the ECCS system, the RHR system delivers Loss of one train The Cook design includes two redundant, independent RHR cooling water to the reactor core in the event of a LOCA. trains. One train is still functional on loss of the other. In This limits the fuel clad temperature and thereby ensures . recirculation mode, the CC and SI pumps take suction off the that the core will remain substantially intact and in place, RHR pump discharge, so loss of an RHR train also results in loss with its essential heat transfer geometry preserved. of one CC and one Sl train.

Similar to the scenario described above for the CC and SI pumps, loss of CC and SI trains could, for certain small break LOCAs, actually decrease ice melt. Since failure of a RHR train also affects the SI and CC systems, this case is likely more limiting than loss of a single CC or Sl train.

In summary, the effect of loss of a train likely depends on the ostulated break size.

CTS System The CTS System sprays cool water into the containment Loss of one train The Cook design includes two separate CTS trains. One train is atmosphere in the event of a LOCA to prevent still functional upon failure of the other..

containment pressure from exceeding the design value.

The heat removal function of the CTS system is to Failure of a CTS train reduces the amount of water sprayed in the remove the reactor residual heat during cool down after a containment environment. Since the CTS spray absorbs energy,.

LOCA (via the recirculation sump). less energy is removed for the one train case than the two train case. This additional energy must be removed by the ice condenser through ice melt. Thus, a single train of operation would increase ice melt.

CCW System The CCW System cools the RHR heat exchangers (and Loss of one CCW The Cook tlesign includes two redundant CCW trains. Each train additional equipment not impacted by this evaluation). train cools one of the two RHR heat exchangers. Loss of a CCW train would eliminate cooling capability in one of the RHR heat cxchangers. Both trains. of RHR would continue to function, but only one would be cooled.

Since only one train of RHR flow is being cooled, the energy removed from containment would decrease, resulting in increased tce melt.

Containtnent Sump Level Design Condition & Failure Effects 3-23 Analysis For Potential Draindown Scenarios . Revision 1

0 e

S stem Desi n Basis Failure Mode Effect ESW System The ESW System cools the CfS heat exchangers (and Loss of one ESW The Cook design includes two redundant ESW trains. Each train additional equipment not impacted by this evaluation). train cools one of the CTS heat exchangers. Loss of an ESW train would eliminate cooling capability in one of the CTS heat exchangers. Both trains of CTS would continue to function, but only one would be cooled.

Since only one train of CTS flow is being cooled, the energy removed from containment would decrease, resulting in increased ice melt.

Circulation/Hydrogen The fans move air from the upper to lower containment Failure of a single The Cook design includes two redundant CEQ fan subsystems.

Skimmer Fans (CEQ Fans) compartments and through the ice condenser. The fans CEQ fan Failure of a CEQ fan will result in less flow of air through also move low volumes of air from the pressurizer and containment and through the ice condenser.

steam generator enclosures and the containment dome to prevent hydrogen gas buildup. Lower air flow through the ice condenser will reduce the heat transfer rate in the ice condenser and reduce the rate of ice melt.

Containtnent Sump Level Design Condition & Failure Effects 3-24 Analysis For Potential Draindown Scenarios Revision 1

S stem Desi n Basis Failure Modet Effect "Multi le Train" Failure Modes 600 VAC Power The 600 VAC electrical system provides power to all Loss of one 600 All affected MOV's fail as is (Reference 4.17, Sect. 3.1) upon loss MOV's in the ECCS, the battery chargers of the 250 VAC Bus of power to the valves.

VDC electrical system, and the plant air compressor and back-up air compressor. The Cook design includes two redundant 600 VAC power busses.

The ECCS and CTS systems are designed such that separate power buses provide power to the two redundant trains of ECCS or CTS equipment. Thus, failure of a 600 VAC power bus could render one train in each ECCS/CTS system inoperable ifvalves are not positioned correctly. However, the remaintng trains will function as designed. 'till Loss of all ECCS/CTS trains supplied by a single power bus would reduce the rate water was injected to the RCS and containment, likely increasing the rate of ice melt. However;as described above for the SI and CC systems, under certain postulated scenarios for small break cases, loss of an ECCS train may decrease ice melt. Thus, both must be considered.

Loss of one 600 VAC bus should have no effect on the 250 VDC system or the plant air compressors, and hence should not affect'he sump water level via these systems. Ifone 600 VAC bus is lost, the battery may be used to supply power to the 250 VDC electrical system. Also, only one air compressor is needed to supply the necessary'air to both units. The air compressor and back-up air compressor are powered from separate 600 VAC busses. Should power be lost to the main compressor, the back-up corn tessor will su I the necess air.

EDG The EDG's provide emergency AC power in the event Loss of one EDG The Cook design includes two redundant EDGs to provide ~

of a loss of off-site AC power. emergency power. Loss of one EDG will result in loss of all electrical equipment in one train of each of ECCS/CTS systems Since the ECCS/CFS trains are powered by separate power busses, the remaining train in each system would continue to function.

Although more equipment wou!d be inoperable in addition to MOVs, this event would be functionally equivalent to the loss of 600 VAC power described above (i.e., loss of a single train in each s stem).

Containment Sump Level Design Condition & Failure Effects 3-25 Analysis For Potential Draindown Scenarios Revision l

S stem Desi n Basis Failure Mode'oss Effect Instrument Air System Provides air to the air operated valves in the ECCS and of A standby control air compressor capable of supplying the control Crs systems. Instrument Air and instrument air for its unit is installed as a backup for the normal control-instrument air supply, i.e., the plant air compressors. The standby control air compressor is designed to start automatically upon detection of low air pressure in the plant air header. Therefore, a LOIAshould have no effect on the rate of ice melt and the amount of water available in the sump.

4 kv AC Power The 4 kV power bus provides AC power to the Loss of one 4 kV The Cook design includes two redundant 4 kv AC power busses.

following equipment in the ECCS/CTS systems: AC bus Loss of one bus will result in loss of equipment in one train of each of ECCS/CTS systems Since the ECCS/Crs trains are

~ SI pumps powered by separate power busses, the remaining train in each

~ Crs pumps system would continue to function. Although more equipment

~ RHR pumps would be inoperable in addition to MOVs, this event would be

~ CC pumps functionally equivalent to the. loss of 600 VAC power described above (i.e., loss of a single train in each system).

~ ESW pump

~ CCW pump

~ CEQ fan

~ Solenoids of air operated valves The 4 kv AC s stem also owers the 600 V AC buses.

250 VDC Power The 250 VDC electrical system provides power supply Loss of one 250 The Cook design includes two redundant 250 VDC busses. Loss to the 4 kV switchgear control for the ECCS pump VDC bus of one bus.will result in loss of equipment in one train of each of motors, and the ECCS annunciator panel. The system ECCS/Crs systems Since the ECCS/CTS trains are powered by also provides power for closing and tripping circuits of separate power busses, the remaining train in each system would 600 VAC breakers. continue to function.'his event would be functionally equivalent to the loss of 600 VAC power described above (i.e., loss of a single train in each system).

Notes:

1. Specific failure modes are not addressed in this evaluation. As described in the evaluation discussion, any failure (passive or failure) that could affect an ECCS or CTS train is assumed.

Containment Sump Level Design Condition & Failure Egects 3-26 Analysis For Potential Draindown Scenarios Revisio/t 1

3.6 OPERATOR ACTIONS 3.6.1 Actions Considered The Cook Emergency Operating Procedures (EOPs) allow/expect the plant operators to operate equipment (inservice, out of service, throttle, etc.) and systems to maintain the plant in the safe and desired configuration. This is especially true during the recirculation mode of operation.

Since analyses of the recirculation sump operation are expected to consider up to several days of simulated duration for small break LOCA cases, it is important that these operator actions be properly modeled in the sump analysis. The important operator actions included in the EOPs that can impact sump level are described below and listed in Table 3-4.

The Cook EOPs are being revised at the time of preparation of this evaluation. The following discussion is based on the intent of the new EOPs as described by engineers involved in EOP preparation.

RCS Cooldown Followin Accident The operators will shutdown the plant in a controlled manner for all postulated pipe breaks except for a large break LOCA (for the large break LOCA, the RCS is assumed to depressurize quickly and be cooled by the ECCS and CTS). During the shutdown, the RCS temperature will be reduced by steaming in the steam generators until the RHR cut in temperature is reached. The operators have latitude to cooldown at rates up to 100'F/hr (Reference 4.2, Table 4.1-13), with the minimum expected rate to be about 30'F/hr. This difference in cooldown rate can impact RCS and sump response since it affects the conditions of the break discharge and subsequent ice melt.

It should be noted that preliminary analyses performed by FAI (Reference 4.20) investigated the impact on sump level of assuming cooldown rates of 30, 50 and 100'F/hr..Although the resulting minimum sump levels were generally comparable, the response of most other reported plant parameters varied considerably, even for the 30 and 50'F/hr cases. These differences require detailed evaluation to verify that the analysis model is correct and that the limiting case is one of the range extremes and not somewhere between 30 and 100'F/hr.

Switchover to Recirculation Mode Switchover to cold leg recirculation mode begins when the RWST reaches the 20% level (Reference 4.12). The exact points at which cold leg recirculation is started and completed are dependent on the operator actions (e.g., at what specific RWST level the operator begins the switchover procedure). For example, if an operator allows the RWST to drain to a lower level,

'he sump level at the beginning of cold leg recirculation may be adequate. However, if he begins switchover earlier, additional procedures to accommodate loss of recirculation capability may be necessary such as adding RWST makeup water, valve alignment checks, etc. (Reference 4.13).

Containment Sump Level Design Condition dc Failure Effects 3-27 Analysis For Potential Draindown Scenarios Revision I

The operator actions to switch over to recirculation mode impact the available RWST volume for injection into the containment.

Containment S ra Secure/Restart After initiation of containment spray (on a Phase B, or HI-HIisolation signal), the revised EOPs state that containment spray must run for eight hours after the containment pressure is reduced to less than 1.5 psig before they may be secured. Ifthe pressure increases to the setpoint, the containment spray system is re-activated and the procedure is repeated. Operator response will determine at what time and how often the CTS iS activated during a LOCA event. It is expected that some operators would not re-secure the CTS after having restarted the system for the second time.

Whether the CTS system is left in operation "full-time"or secured can have a significant impact on ice melt, particularly for the small break cases.

RHR Used in Containment S ra Mode The RHR system design includes the capability to operate the RHR system in a containment spray mode. The revised EOPs direct the operators to place an RHR train in containment spray mode within 50 minutes after CTS initiation. The RHR sprays are not required to be in service if the CTS system re-actuates after having been secured. This additional containment spray would reduce ice melt.

The operators have latitude in the operation of RHR sprays. This can impact ice melt.

Pressurizer Level Following a LOCA, the RCS depressurizes and cools down. Depending on the size of the LOCA

'nd the RCS response, the operators may, or may not, attempt to control RCS level in the pressurizer during the subsequent shutdown. The EOPs provide a range of allowable pressurizer level. Any water in the pressurizer is unavailable to fiood the recirculation sump.

C After the beginning of safety injection, the operators are instructed to secure the reactor coolant pumps and all flow through the reactor system is via the ECCS. The amount of fluid that is pumped into containment following a LOCA will affect both the temperature of the reactor and the amount of fluid that exits through. the pipe break. The operators have some latitude in when the pumps are secured.

Containment Sump Level Design Condition & Failure Effects 3-28 Analysis For Potential Draindown Scenarios Revision 1

3.6.2 Bounding Approaches Table 3-4 includes an evaluation of each parameter to determine the bounding approach that will minimize recirculation sump level. In general, the operator actions that minimize recirculation sump level are divided into three groups:

~ Minimize RWST volume transferred to the recirculation sump

~ Maximize RCS volume required to be filled

~ Maximize CTS and RHR spray operation to reduce ice melt Containment Sump Level Design Condition & Failure Effects 3-29 Analysis For Potential Draindown Scenarios Revision I

Table 3-4 Operator Action Evaluation Action Affected "Options" , Bounding Approach Impact/Discussion Reference S stems RHR used in RHR Operators are to place an Operator initiates RHR The sooner RHR containment spray mode is 4.13 Containment Spray RHR train in spray mode containment spray mode as activated, the more water is transferred to Mode following the first time CTS soon as possible after CTS the containment to transfer energy from the actuates. The RHR sprays are actuates and recirculation steam. Less ice melt occurs, leaving less initiated after a minimum 50 starts. water available in the sump for minute time dela . recirculation.

Switch the RHR/CTS RHR/CTS Operator should switch the The highest RWST level at The RWST water represents the bulk of the 4.11, 4.16 [Sect Systems to RHR/CTS systems from SI which the operator may switch water transferred to the recirculation sump. 6.4.2]

Recirculation Mode mode to RHR mode when the the RHR/CTS systems to Minimizing the water removed from the RWST level falls below 20%. recirculation mode (20%). RWST minimizes the amount of water in the sum .

Establish RHR Flow to ECCS Operator should establish The highest RWST level at. The RWST water represents the bulk of the 4.11, 4.16 [Sect the SI and CC Pumps RHR flow to the SI arid CC which the operator may switch water transferred to the recirculation sump. 6.4.2]

pumps when the RWST level the SVCC systems to RHR Minimizing the water removed from the falls below 11%. This will pump discharge (11%). RWST minimizes the amount of water in automatically occur when the the sump.

lo-lo/RHR um alarmtri s.

RCS Cooldown and Any cooldown rate 100OF/hr 'Ihe cooldown rate affects the rate of RCS 4.18 Depressurization 5 100OF/hr. shrinkage (and required makeup from the RW~. In addition, the cooldown rate for RCS cooldown continues RCS cooldown continues the RCS affects the energy of the discharge until the RCS pressure is beyond the RHR shutoff head from the postulated brcak.

below the RHR pump shutoff (steam generator steaming head. continues as long as possible). The amount of cooling via steam generator steaming impacts the amount of heat removal from containment by the ice condenser.

Containment Sump Level Design Condition & Failure Effects 3-30 Analysis For Potential Draindotvn Scenarios Revision I

Affected "Options" Bounding Approach Impact/Discussion Reference Action S stem(s)

Containment Spray The CTS system actuates CTS not secured after one Procedures dictate that the CTS be secured 4.16 [Sec. 6.1.2]

Stan/Secure automatically each time the restart of system (i.e., the when containment pressure drops below 1.5 4.18 containment hi-hi pressure operators leave system in psig. Should pressure exceed 1.5 psig after (2.9 psig) is reached. Ihe operation after it has been shut the CTS has been secured, restarting and system is secured by operators down once). leaving active the CTS (independent of ifit has been operating for at containment pressure) would increase the least eight hours and the sump flow requirements and would result in containment pressure is less the greatest volume of water being pumped than 1.5 psig. Operators have into the inactive sump. Operation of the latitude to leave system in CTS will also result in decreased ice melt.

operation ifdesired and the pressure is greater than 1.5 si Pressurizer Level Level should be maintained Maximum pressurizer level The RCS level in the pressurizer determines 4.18 Control between 32% and 64% during obtainable. the volume of RCS that must be filled in adverse containment addition to the recirculation sump.

conditions.

RCP Operation Operator should stop all Operation of the RCPs followmg an 4A ~

RCP's ifcontainment pressure accident affects the amount of energy

>2.9 psig or one ECCS pump release through the pipe break.

is running and RCS pressure <

1250 psig.

When RCS pressure is > 590 psig, operators should restart one RCP to obtain pressurizer spray flow for cooldown and de ressurization.

RHR Pump Operation ECCS Operators should stop RHR In recirculation mode, the RHR pumps 4.18 pumps (and place in neutral) provide the suction source for the ECCS ifRCS pressure is greater than pumps. Ifthe RHR pumps are not 590 psig and must be operating, the CC and Sl pumps also can manually restarted when RCS not operate.

pressure decreases to less than 590 si .

Containment Sump Level Design Condition & Failure Effects 3-31 Analysis For Potential Draindown Scenarios Revision I

3.7 MODELING METHODS 3.7.1 Items Considered Several parameters that irhpact the analysis of the. recirculation sump level following an accident are not specific design conditions for plant systems or equipment, failure issues, or operator actions. Instead, there are several factors that are related to predicting the response of equipment using appropriate modeling methods. Th'ese are described below and in Table 3-5.

Ice Condenser Door Res onse C

The ice condenser inlet doors must open to allow steam to enter the ice condenser following a LOCA. The behavior of the doors has been predicted using models described in the USAR. The USAR includes models for door response ranging from best estimate to upper bound. Analyses have shown that small variations in assumed door response model have little impact on ice condenser response. However, if it is assumed that the doors remain open after the first time they open (and do not close), the analysis predicts considerably more ice melt.

The response of the intermediate and upper doors do not have a significant impact since the ice condenser can function properly for a small break case even if those doors do not open.

1 Containment Structure Heat'Transfer

'I The structures and equipment inside containment represent a large heat sink following an accident. This material must be heated to essentially the containment temperature. In typical containment analyses, this energy absorption is neglected, since it would lessen the demand on the containment safety systems. However, for potential sump draindown, it is nonconservative to neglect this heat sink. The heat transferred to containment structures represents heat that does not contribute to ice melt. The method used to model heat transfer to containment structures must conservatively account for this effect.

Ice Condenser Performance Model r

The performance of the ice condenser is a key factor affecting the amount of ice melt. The most important parameter affecting ice condenser performance is the gas outlet temperature. The outlet temperature is a direct measure of the heat removed in the condenser, and thus, the amount of ice melt.

3.7.2 Bounding Approaches Table 3-5 outlines the bounding modeling methods for analysis of the minimum active sump water level.

Containment Sump Level Design Condition & Failure Effects 3-32 Analysis For Potential Draindown Scenarios Revision l

Table 3-5 Modeling Method Evaluation Item Affected Range Bounding Approach Impact/Discussion S stems Ice Condenser Door Ice Condenser Figure 6.9-1 Door response curve indicating The pressure at which the lower inlet doors open as well as the Response [Reference 4.2, App. M] greatest necessary differential opening response of the doors will affect the rate of ice melt. The pressure to open door (upper higher the inlet door opening pressure and the slower the door curve on Fi re 6.9-1 . o enin res onse,thelessicemelt.

Containment Structure ECCS/Ice Insulated Surfaces to Constant temperature between The mass of structures and equipment inside the containment are at Heat Transfer Condenser Constant Temperature atmosphere and structures essentially the containment temperature prior to the accident. As the containment temperature increases, these masses will absorb heat.

heat absorbed by the structures represents heat that does not

'ny contribute to ice melt.

Ice Condenser Ice Condenser Various Modeling method for heat The performance of the ice condenser directly affects the amount of Performance Model transfer that underpredicts ice ice melt following an accident.

melt.

'ontaintnent Sump Level Design Condition & Failure Effects 3-33

. it <<.;.~i.t:;>r P;;r tt.':.t. Dt'aimi;>>vtt Scenarios Revision 1

Section 4 REFERENCES 4.1 Alden Research Lab, Report 108-78/M178PF 4.2 DC Cook UFSAR 4.3 DB-12-CTS, "Containment Spray System Design Basis Document" 4.4 02-OHP 4023 FOLDOUT 4.5 DB-12-CNTS, "Containment Systems Design Basis Document" 4.6 ECP 1-2-00-14, "Emergency Operation Procedure Setpoints",Section II, Calc. 11.

4.7 DB-12-ESW, "Essential Service Water Design Basis Document" 4.8 DB-12-CCW, "Component Cooling Water Design Basis Document" 4.9 Cook Technical Specifications Section 3/4.5 4.10 Cook Technical Specifications Section 3/4.6-7 4.11 02-OHP 4023.ES-1.3, "Transfer to Cold Leg Recirculation", Rev. 5 4.12 01-OHP 4023.E-O, "Reactor Trip or Safety Injection", Rev. 14 4.13 01-OHP 4023.FR-Z.1, "Response to High-High Containment Pressure", Rev. 4 4.14 SECY-77-439, "Information Notice to the Commissioners from Edson G. Case, Acting NRC Director, Regarding the Single Failure Criterion" 4.15. ANSI/ANS-51.7-1976, "Single Failure Criteria for Pressurized Water Reactor Systems" 4.16 SD-DCC-NEMH111, "Emergency Core Cooling System (Safety Injection System)",

System Description, Rev. 16, 5/04M 1 4.17 SD-AEP/AMP-200/D, "Safety Injection System", System Description, Rev. 0, November, 1970 4.18 EOP 02-OHP 4023.ES-1.2, "Post LOCA Cooldown 8c Depressurization", Rev. 4 4.19 WCPAP 13055, "Westinghouse Setpoint Methodology for Protection Systems", D.C.

Cook Unit 1,.Westinghouse Electric Corp., September, 1991 Containment Sutnp Level Design Condition & Failure Egects 4-2 Analysis For Potential Draindown Scenarios Revision /

4.20 FAV99-7, "Results of Sensitivity Analyses for the D.C. Cook Containment Sump Evaluations", Rev. 0, Fauske'and Associates, January, 1999 4.21 AEPNO Policy 800000-POL-2300-04 4.22 AEPNO Directive 227000-DIR-2400-04 Containment Sump Level Design Condition & Failure Effects 4-?

Analysis For Potential Draindown Scenarios Revis't, t!

ATTACHMENT9 TO C1099-08

. MPR ASSOCIATES, INCORPORATED "EVALUATIONOF COOK RECIRCULATION SUMP LEVEL FOR REDUCED PUMP FLOW RATES"