ML17335A545

Rev 1 to Containment Sump Level Design Condition & Failure Effects Analysis for Potential Draindown Scenarios

ML17335A545
Person / Time
Site:	Cook
Issue date:	09/28/1999
From:	Coward R, Heinz M MPR ASSOCIATES, INC.
To:
Shared Package
ML17335A542	List: ML17335A541 ML17335A543 ML17335A544 ML17335A545 ML17335A546 ML17335A548
References
NUDOCS 9910060105
Download: ML17335A545 (56)

Text

CONTAINMENTSUMP LEVEL DESIGN CONDITIONA FAILUREEFFECTS ANALYSIS FOR POTENTIALDRAINDOWNSCENARIOS REVISION 1 Prepared by:

Michelle i z Reviewed by:

z zgA Robert ow d

Approved by:

~ ~/n Robert N. Coward QUALITYASSURANCE DOCUMENT This document has been prepared, reviewed, and approved in accordance with the Quality Assurance requirements of IOCFR50 Appendix B, as specified in the MPR Quality Assurance Manual.

99i0060i05 99i00$,

PDR,'.ADOCK.050003i5 P

PDR

TABLEOFCONTENTS REVISION HISTORY n1

1.0 INTRODUCTION

1.1 Purpose 1.2 Overview 2.0,CONCLUSIONS 8t, RECOMMENDATIONS 2-1 2.1 Conclusions 2.2 Recommendations 2.3

. Open Issues 3.0 EVALUATION 3-1 3.1 3.2 3.3 3.4 3.5 3.6 3.7 Approach Accident Scenario Key Assumptions Design Conditions Postulated Failures Operator Actions Modeling Methods

4.0 REFERENCES

4 APPENDIX A 4-1 A-1 Containment Sump Level Design Condition &Failure Effects Analysis For Potential Draindown Scenarios u

Revision I

REVISION

SUMMARY

Revision 0

Date 7/16/99 InitialDraft Descri tion 9/27/99 U dated to reflect final anal sis assum tions Containment Sump Level Design Condition &Failure sects Analysis For Potential Draindown Scenarios'l Revision /

Section 1 INTRODUCTION 1.1 Purpose The purpose of this evaluation is to identify and evaluate plant design conditions and postulated equipment failures that could impact the resulting water level in the Cook containment Emergency Core Cooling System (ECCS) recirculation sump following a Loss of Coolant Accident (LOCA) or Main Steam Line Break (MSLB).

The results of this evaluation willbe used to verify that analyses performed to predict sump performance following a LOCA or MSLB are boun'ding and that all applicable equipment failure modes have been considered.

In addition, Appendix A is a similar evaluation of the plant design conditions and postulated equipment failures that could impact the resulting containment subcompartment hydrogen concentratio'ns in the containment following a LOCA.

1.2 Overview The Cook contai nment design includes a recirculation sump in the lower portion of containment.

Following an accident, the contents of the Reactor Water Storage Tank (RWST) are pumped into the containment using the containment spray system (CTS) and ECCS. The water injected into the containment and the water discharged from the pipe break drains to the low points in containment.

These include the reactor cavity, the recirculation sump, and the pipe annulus (outside the crane wall).

After the RWST is emptied, the CTS and ECCS pumps are switched into the recirculation mode of operation.

In this mode, CTS and RHR pump suction is taken from the recirculation sump.

The flow is passed through heat exchangers and injected back into containment (via CTS sprays or RHR sprays) or into the Reactor Coolant System (via ECCS). This process continues as necessary to remove heat from containment.

In order to ensure satisfactory sump operation in the recirculation mode, testing was performed for the Cook sump configuration to verify that vortexing or similar degradation mechanisms will not occur (Reference 4.1). This testing determined that a sump level at or above 602'10" is satisfactory to avoid vortex concerns.

Reviews of the containment design features and the details of previous analyses of containment response following a LOCA determined the analyses included potentially nonconservative assumptions and that the recirculation sump could drain below the minimum required level under certain postulated scenarios (Reference 4.2). The primary reason for the sump level draindown Containment Sump Level Design Condition &Failure Effects Analysis For Potential Draindoivn Scenarios 1-1 Revision 1

during the recirculation mode is that the containment spray system may pump water into areas of the containment that do not completely drain to the sump (e.g., the pipe annulus).

Physical modifications willbe made to the Cook units to preclude sump draindown below the minimum level. Transient analyses of the containment response willalso be performed to verify the adequacy of the containment/ECCS design.

The purpose of this evaluation is to first review the containment, CTS, and ECCS designs and responses following an accident.

The initial design conditions and postulated single failures that correspond to the bounding case for potentially draining the sump are then determined.

For example, the size of the postulated pipe break and the CTS actuation set point (based on containment pressure) are design conditions that affect the amount and rate of ice melt (and thus, the resulting sump water level). The potential failure of a CTS pump or other equipment that reduces the spray rate also affect the amount and rate of ice melt.

Containment Sump Level Design Condition &Failure Effects Analysis For Potential Draindown Scenarios 1-2 Revision I

Section 2 CONCLUSIONS &RECOMMENDATIONS

2.1 CONCLUSION

S The assessments described in this evaluation have shown that a large number of plant parameters, operator actions, and postulated equipment failures can impact the recirculation sump water level following a LOCA. Although the influence of most of these parameters is clear (i.e., changes tend to increase or decrease water level), there are a number of parameters that either interact or whose influence is not clear. For this reason, it is not practical to determine a single most limitingcase without performing sensitivity analyses.

The approach used in this evaluation is to list the parameters, conditions or failures considered to be limiting(i.e., those that should be common for all worst case possibilities) and then list the additional parameters that should be varied to assess the potential limitingcases.

The parameters considered to be bounding are listed in Table 2-1. This table lists the parameter and the bounding value(s). The bases for these conclusions are included in the discussion and tables in Section 3.

The parameters for which there is uncertainty regarding the bounding or limitingvalues are listed in Table 2-2. The bases for these conclusions are also included in the discussion and tables in Section 3. In order to verify that the limitingcase(s) have been considered with regard to these parameters, additional analyses are required to determine the limitingvalue (see following section).

2.2 RECOMMENDATIONS The results of this evaluation show that several initial condition configurations could potentially represent the limitingcase(s) for sump level following a LOCA. As shown below, a number of analysis cases willbe required to confidently bound the analysis.

The following recommendations are based on the conclusions presented in Tables 2-1 and 2-2 and are intended to identify the most limitingcase(s) for evaluation of potential sump draindown.

1.

Complete the necessary evaluations to confirm the key assumptions listed in section 3.3 or include appropriate variability in the final analyses.

The appropriateness of each assumption must be verified as part of the final analyses of sump level.

2. Allanalyses should be performed using the limitingparameters included in Table 2-1. These parameters are limiting values.

3.

A series of cases is required to determine the most limitingcase (or cases) and to verify that design criteria are satisfied. The approach shown below is based on the parameters listed in Table 2-2 and the analysis assumptions in section 3.3.

Containment Sump Level Design Condition d'c Failure Effects Analysis For Potential Draindoivn Scenarios 2-1 Revision l

~

Use a postulated small (e.g., 2" or less pipe break) to determine the minimum sump level for each of the postulated failures listed in Table 2-2.

This willdetermine the bounding failure case.

~

Use the following inputs to determine the minimum sump level for variable size pipe breaks:

1) the bounding failure case determined above 2) variable modes of operation (e.g., Mode 1/Mode 3) h These cases willdetermine the limitingpipe break size.

The minimum sump level determined from the cases listed above represents the worst case conditions for the Cook sump.

/

Containment Sump Level Design Condition &Failure Effects Analysis For Potential Draindown Scenarios 2-2 Revision I

.Table 2-1

. LimitingParameters Parameter Boundin Value Desi n Conditions Comment Break Location Ice Condenser Mass RWST Usable Volume RCS piping in Reactor Cavit 2.20xl0 lb 280.000 al Maximum diversion from sump The revised Tech S ec minimum ice mass.

Minimum available volume at initiation of recirculation.

Accumulator Volume In'ected RCS Conditions ECCS Leaka e No in'ection as ion as ressurizer level is controlled 350'F / Mode 3 Results in minimum energy release.

Note that licensing

.basis only requires Mode 1. Mode 3 analysis performed to su ort EOP develo ment.

1.0 m

ESW Temperature &Flow CCW Temperature &Flow RWST Tem erature Containment Temperature Containment Pressure CTS Flow ECCS Flow Safety System Actuation Uncertainty CE Fan Flow 32'F 4,500 m

45'F 9,900 m

70OF 60'F 0.3 psig 3,600 m

Two trains, maximum ca abilit Lower Containment Pressure - 0.6 psig Pressurizer Prcssure

+115 si 39,000 cfm Maximizes effectiveness ofthe CTS heat exchangers Maximizes effectiveness of the RHR heat exchangers Minimum tern erature increases CTS effectiveness Minimum temperature maximizes heat transfer to structures Maximum pressure actuates safety systems sooner followin the accident Maximizes ener removal Increases RWST draindown.

This approach results in the minimal delay between LOCAand safety system actuation.

Since the operation of the containment sprays is considered to have the greatest impact on ice melt, this approach results in minimal ice melt.

Minimizes forced flowthrou h ice condenser 0 erator Actions RCS Cooldown RHR Containmcnt Sprays Switch RHR/CTS Suction from RWST to Recirculation Sump Switch SI and CC suction from RWST to RHR pump discharge Containment Spray Restart Pressurizer Level Control 100'F Initiated 50 minutes after CTS initiation.

, Always on when CI'S o eratin Alltrains switch when RWST 205o level reached Alltrains switch when RWST 11%

level reached CTS system remains in operation after one restart Maximizes heat removal and RCS makeu r

uirements.

Maximizes RHR spray operation, consistent with the expected EOP's Minimizes volume flowout of RWST Minimizes volume flowout of RWST The CTS system actuates automatically at 2.9 psig 2 0.6 psig uncertainty. The operators are instructed to secure the system when the pressure decreases to 1.5 psig, and after the system has run for eight hours. This approach assumes the operator leaves thc system in operation after one restart, even ifthe ressure dccrcases below 1.5 si Consistent with EOPs, but controlled in a manner that results in maximum rcssurizer level.

Containment Sump Level Design Condition &Failure Effects Analysis For Potential Draindown Scenarios 2-3 Revision I

Parameter RCP Operation Inlet Door Response Containment Structures Heat Transfer Ice Condenser Performance Boundin Value Modelin USAR Upper Bound Curve Maximum Heat Transfer Bounding Gas Outlet Tem erature Comment Consistent with EOPs, but controlled in a manner that results in minimum ener release.

Methods Minimizes steam flowthrough the ice condenser.

Minimizes ice melt Minimizes ice melt Note:

1.

The values included in this table were based on availa6le references.

The intent of this evaluation is to determine the directions ofconservatism, not necessarily the specific limitingvalues for the various input parameters.

As a result, AEP should review all existing design" documentation to determine the specific limiting values.

Containment Sump Level Design Condition &Failure Effects Analysis For Potential Draindown Scenarios 2-4 Revision l

Table 2-2 Potentially LimitingParameters Parameter Potentially Boundin Values Desi n Conditions Comment Break Size Postulated Failure Variable Postulated Loss of one CEQ Fan EDG or AC Bus Failure The limitingbreak size results in CTS actuation, but doesn't actuate the accumulators and minimizes energy discharge.

This break size is considered to be between 1" and 3".

Failures Results in minimal air flowthrough containment, with associated reduced ice melt. The basic configuration for this case is onc RHR train in spray mode, one RHR train in ECCS mode, and one CE fan.

Results in loss of one train in followingsystems: CC, SI, RHR, CTS, ESW, CCW, and onc CEQ fan.

Depending on the relative effects of loss of a train in each system and the break size, could increase or decrease icc melt.

Containment Sump Level Design Condition &Failure Effects Analysis For Potential Draindotvn Scenarios 2-5 Revision I

Section 3 EVALUATlON 3.1 APPROACH The purpose of this evaluation is to deterrtiine and assess the plant design conditions and postulated equipment failures that could impact the water level in the recirculation sump followinga LOCA or MSLB. The objective is to determine the effect of each parameter or failure and use these results to develop the likely'bounding cases for potential sump draindown.

For the purpose of this evaluation, the various plant parameters and postulated failures are separated into four groups. The evaluation of each group differs slightly based on the parameters in the group. The four groups are:

~

Design Conditions Plant parameters associated with equipment design that can vary over a predefined range.

For example, the CTS system actuates automatically on a hi-hi ~

containment pressure signal. The nominal setpoint for this signal is 2.9 psig. However, the signal has an uncertainty of&.6 psig, so the signal may actually be received between 2.3 and 3.5 psig. For design conditions, the range of expected values is determined and an assessment is performed to determine the bounding value for potential sump draindown.

~

Postulated Failures Postulated single equipment failures, either active or passive, may occur during the injection or recirculation modes of ECCS and CTS operation. For example, failure of an EDG to start on a LOCA/LOOP would result in a single set of ECCS trains and a single CTS train in operation instead of the normally expected two trains of each.

For postulated single failures, a failure modes and effects analysis is performed to determine the impact of the failure on resulting recirculation sump water level.

~

Operator Actions Following a LOCAor MSLB, particularly in the recirculation mode, the Emergency Operating Procedures (EOPs) give the operators the ability to operate safety.

system equipment as necessary to maintain the plant in the desired condition. For example, for a small break LOCA the operators willlikelycontrol RCS cooldown through steaming in the steam generators.

The cooldown rate is expected to be between 30'F/hr and 100'F/hr.

This difference can impact required RCS makeup rate and required operation of the ECCS and CTS systems.

For these operator actions, the range of expected values is determined and an assessment is performed to determine the bounding value.

~

Modeling Methods For some equipment (e.g., the ice condenser inlet doors) the exact response during a LOCA is not known. For these parameters, models are required to predict actual response and an assessment is performed to determine the bounding modeling method characteristics.

Containment Sump Level Design Condition &Failure Effects Analysis For Potential'Draindown Scenarios 3-1 Revision 1

3.2 ACCIDENTSCENARIO In order to identify critical design parameters and potential failures, it is important to define the expected response of the plant systems to a LOCAor MSLB. This section provides an overview description of the accident scenario including safety system response.

The Cook plant design includes passive and active design features to provide core cooling and containment pressure suppression in the event of a LO A or MSLB. The passive features include an ice condenser'inside containment and safety injection (SI) system accumulators that automatically discharge into the RCS when the RCS pressure reduces below the accumulator pressure.

The active features include the ECCS trains for coolant injection and the containment spray system.

The physical arrangement of the containment structures and equipment is such that the steam discharge from pipe breaks in the lower containment (reactor cavity, recirculation sump area, steam generator enclosures, etc.) willbe forced through the ice condenser to reach the upper containment.

The exception is pipe breaks in the pipe annulus (i.e., on the "other" side of the Crane Wall). The arrangement of the containment does not allow the steam discharge from those breaks to directly enter the ice condenser.

The steam'must first flow through the Crane Wall into the recirculation sump area and then into the ice condenser.

After the pipe break, the containment pressure increases (at a rate dependent on the break size) as steam continues to discharge. At lower containment pressures of about 0.007 psig the ice condenser inlet doors begin to open sufficiently for steam to enter the ice condenser.

The steam entering the ice condenser is condensed and the condensate and melted water flow to the recirculation sump.

When a low pressurizer pressure alarm (( 1815 psig) or high containment pressure alarm () 1.1 psig) is received, the safeguards systems initiate an SI signal. The SI signal initiates several automatic actions, including: reactor trip, emergency diesel generator (EDG) start, opens the boron injection tank (BIT) isolation valves and charging pump RWST suction valves, and starts the centrifugal charging (CC) pumps, SI pumps, and residual heat removal (RHR) pumps. In the modified plant design (see section 3.3) the SI signal willalso start the CEQ fans. The effect of these actions is:

~

The CC pumps are operating, attempting to deliver borated water from the RWST to the four RCS cold legs. The CC pumps are high pressure pumps that willprovide injection at pressures lower than about 2000 psig. At pressures above 2000 psig a bypass line returns the pump discharge to the pump suction to prevent deadheading.

The nominal CC flow is 150 gpm through each train.

~

The SI pumps are operating, attempting to deliver borated water from the RWST to the four RCS cold legs. The SI injection into the cold legs is through the SI accumulator injection lines. This piping is separate from the CC injection location. The SI pumps are moderately high pressure pumps that willprovide injection at pressures lower than about 1560 psig. At Containment Sump Level Design Condition &Failure Effects Analysis For Potential Draindown Scenarios 3-2 Revision I

pressures above 1560 psig a minimum flow bypass line is used to return the pump discharge to the RWST to prevent deadheading.

The nominal SI flow is 400 gpm through each train.

~

The RHR pumps are operating, attempting to deliver borated water from the RWST to the four RCS cold legs. The RHR pumps are low pressure pumps that willprovide injection at pressures lower than about 210 psig. The RHR pumps also inject through the accumulator discharge lines. At pressures above 210 psig a bypass line returns the pump discharge to the pump"suction to prevent deadheading.

In addition, the RHR system has the capability to be re-aligned to discharge a portion of the RHR flow through containment ring headers in a containment spray mode of operation.

The nominal RHR flow is 3,000 gpm through each train.

~

After a delay of approximately two minutes, the CEQ fans begin operating.

The CEQ fans force air circulation between the lower and upper containment through the ice condenser.

There are two redundant trains of ECCS, so there are two CC pumps, two SI pumps, and two RHR pumps.

Assuming no equipment failures, all six pumps willbe operating. The EDGs are started in the event that the LOCA is coincident with a loss of off-site power (LOOP). The system alignment described above is considered the injection phase of the accident.

On a hi-hi containment pressure signal (2.9 psig), the CTS system actuates.

The injection phase alignment of the CTS system draws suction from the RWST and discharges through the upper and lower containment spray ring headers.

The nominal CTS flow is 3,200 gpm through each train.

The SI accumulators are vessels filledwith borated water and pressurized with nitrogen gas.

While the majority of the equipment associated with the injection mode is initiated by a safety injection signal, the accumulators require no power source or initiation signal. When the RCS pressure falls below 600 psig, mechanically operated check valves normally isolating the accumulators from the RCS open, injecting borated water into the four RCS cold leg. There are four accumulators, one accumulator supplying each cold leg. In the event of a cold leg break, the contents of one accumulator passes through the break and spills onto the containment floor, while the remaining accumulators filla volume outside of the core barrel.

The main objectives during the injection phase are to provide immediate core cooling, replenish lost primary coolant, and suppress containment pressure.

At the end of the injection phase, the usable contents of the RWST (about 280,000 gallons) has been transferred to the containment sump and RCS and depending on the break size and RCS response, the SI accumulators may have also discharged (an additional 28,000 gallons).

When the RWST low level alarm is received, the switchover to recirculation mode begins.

Operators initiate recirculation mode by switching the suction of one RHR train to the recirculation sump inside containment, where spilled coolant, injected water, and melted ice have collected during the injection phase.

In the recirculation mode, the CC and SI pumps take suction from the RHR pump discharge.

One CC pump and one SI pump take suction from each Containment Sump Level Design Condition &Failure Effects Analysis For Potential Draindown Scenarios 3-3 Revision I

RHR pump discharge.

The switchover to recirculation mode is completed when operators transfer the suction of the second RHR train (and thus the associated CC and SI pumps) and the CTS pumps (ifthey are operating) to the recirculation sump.

During the initial recirculation period, the ECCS trains continue to inject through the RCS cold legs. Approximately 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after the accident the ECCS system is re-aligned to inject through the hot legs.

There are several other plant systems that operate along with the ECCS and CTS to accomplish the system functional objectives while in the recirculation mode. The RHR pump discharge is

" routed through the RHR heat exchangers prior to injection back into the RCS. The RHR heat exchangers are cooled by the Component Cooling Water (CCW) system.

The RHR heat

- exchangers are located between the RHR pumps and the CC and SI pump suction points, so the CC and SI injection is also cooled. The CTS pump discharge is routed through the containment spray heat exchangers prior to discharge back into containment.

The containment spray heat exchangers are cooled by the Essential Service Water (ESW) system.

'The main objectives of the recirculation mode are to keep the core flooded, suppress containment pressure, and provide long-term core cooling. As the RCS.and containment cool and de-pressurize, operators willmanually stop (or start) ECCS and CTS trains as necessary to maintain the RCS/containment in the desired condition.

Table 3-1 shows the expected response of the ECCS and CTS systems, containment and other key systems and equipment following a large break LOCA. This sequence is not necessarily the expected sequence for all LOCAscenarios, particularly small break LOCAs, but it provides a general overview of the design response of the plant.

During a main steam line break event (MSLB), low pressurizer pressure, low steam line pressures or high steam line differential pressure signals would initiate a SI signal. The sequence of events described above would be similar for a MSLB. The ice condenser doors open to reduce containment pressure and additional main steam line isolation actions occur. The ECCS pumps would start as described, but would be providing no flow to the RCS system, because there has been no loss of reactor coolant.

Containment Sump Level Design Condition ck Failure sects Analysis For Potential Draindown Scenarios 3-4 Revision I

.Table 3-1 Large Break LOCA Accident Sequence Time sec 0 sec

= O.sec Event Dc endent"'I Si nal+ 10 sec SI Si nal + 13 sec Start of CC pumps + 1.1 sec SI Si nal+ 17 sec SI Pum Start+ 1.1 sec SI Si nal+21 sec RHR Pum Start+ 0.7 sec Operator Action/ Event De endentt

~

SI si nal+2min' Event Dependent 90 sec"'perator Action Operator Action 0 erator Action

=12hr Event/ Action LOCA occurs, Potentiall coincident with LOOP Ice condenser lower door o en SI Si nalAll um s o eratin, exce t RCP's, are tri ed Diesels u to rated s eed. MOVs o en Startcentrifu alchar in um s

CC pumps'otors up to speed StartSI um s

SI um s'motorsu tos eed.

StartRHR um s

RHR um s'otors u to s eed RCP pumps trip Recirculation/H dro en Skimmer Fans Start Containment HI-HISignal (Containment Pressure > 2.9 psig)

CTS Pum s Start Containment S ra Be ins CCW um sstarted ESW um s started RWST level < 20%, RHR pumps switched to recirculation mode RWST level < 11%, CC and SI pumps switched to recirculation mode 50minafterCTS initiation, RHRS ra s Be in Switchover to Hot-Le Recirculation Reference 4.12, 4.17 Sect 9.2.1 4.2 Sect 6.2 4.2 Sect 6.2 4.2 [Table 6.2.5]

4.2 Sect 6.2]

4.2 Table 6.2.5 4.2 Sect 6.2 4.2 Table 6.2.5 44 4.16 [Sect 4.1.2]

4.3 4.16 Sect 8.2 4.17 Sect 9.2.1 4.11 4.11 4.13 4.2 [Sect. 6.2]

Notes:

1.

Low pressurizer pressure of 1815 psig OR high lower containment pressure of 1.1 psig OR steamline b,P>100 psid OR steam generator pressure < 500 psig.

2.

RCP pumps willbe operator tripped under either of followingconditions:

~

Containment Isolation Phase B (HI-HISignal) OR

~

Atleast one CCP or SI pump running AND RCS Pressure < 1250 psig 3.

This setpoint is stated in the revised EOPs. The current EOPs specify the fans start ten minutes after the hi-hi signal.

4.

Reference 4.3 lists a range of times for start of containment spray. The value listed is a nominal value for CTS start with loss of offsite power.

Containment Sutnp Level Design Condition &, Failure Effects Analysis For Potential Draindown Scenarios Revisio>>

3.3 KEYASSUMPTIONS There are an unlimited number of postulated accident scenarios that the ECCS and containment systems must adequately mitigate. For the purposes of this evaluation, several key assumptions have been made regarding the accidents that must be considered, the response of plant equipment and the response of operators.

These assumptions are listed below.

1.

The smallest break:size considered is a 1" equivalent pipe. Small breaks tend to minimize the energy released from the RCS. Since the energy release is minimized, the amount of ice melt in the ice condenser is alsa minimized. This reduces the amount of water in the recirculation sump; For this evaluation, it is assumed the operators would identify a very small break (< 1") and take appropriate actions to shut down prior to fullECCS/CTS system operation.

2.

The operator response during/following the postulated accident willbe consistent with the Cook Emergency Operating Procedures (EOPs). In some instances, the response of operators is a critical factor affecting sump level while in the recirculation mode of ECCS operation.

The Cook EOPs are being revised at the time this evaluation is prepared.

This evaluation assumes the operator response willbe consistent with the intent ofthe revised EOPs, not the existing EOPs.

The key differences between the existing and revised EOPs include:

~

RHR Sprays In the existing EOPs, the logic used to start the RHR sprays is based on containment pressure; ifthe pressure remains below 8 psig, the RHR sprays would not actuate. In the revised EOPs, the RHR sprays are actuated 50 minutes after accident initiation regardless of containment pressure ifboth trains of CTS are not operating.

~

Containment Spray Operation The revised EOPs require the containment sprays to operate for eight hours before they may be secured after the containment pressure drops to 1.5 psig.

~

RCP Operation When the RCS pressure is ) 590 psig, the revised EOPs state the operator should restart one RCP to obtain pressurizer spray flow as part of the cooldown and depressurization.

3.

Reactor coolant system piping is located throughout the lower containment.

The RCS boundary for the RCS attached piping is taken as the second isolation valve away from the main RCS pipe. Using this definition of RCS boundary, most RCS piping (and thus, postulated break locations) is located inside the Crane Wall. The only piping that travels through the Crane Wall into the pipe annulus are small lines less then 1" diameter and the RHR line for flow leaving the RCS. The RHR line in the pipe annulus is not open during Modes 1, 2 and 3. As a result, this evaluation assumes that pipe breaks in the pipe annulus are not required to be postulated.

4.

Pipe breaks could be postulated during any of the operating modes for the plant. These include normal fullpower operation, startup, shutdown, etc. Based on input from AEP Containment Sump Level Design Condition &Failure Effects Analysis For Potential Draindown Scenarios 3-6 Revtston I

It licensing personnel, this evaluation assunies that the licensing basis requires pipe breaks to be postulated during Mode 1. Breaks during Mode 2 and the portion ofmode 3 when the safety systems are in automatic are also considered to support EOP development.

Although breaks in Mode 3 are likely less severe than a fullpower break with regard to peak clad temperature or contairiment conditions, it is likelythat these breaks result in a slower ice melt rate and a lower sump level.

5.

As part of the resolution of sump drain down issues, AEP is planning to implement several physical modifications to the Cook plants. The design details of these modifications have not been developed, but the conceptual designs (and intent of the changes) are known. This evaluation assumes the planned physical modifications have been implemented.

These modifications are:

~

Open Partition Wall The Crane Wall separates the main area of the lower containment (where the recirculation sump is located) from the pipe annulus.

The lower CTS header includes spray nozzles in the pipe annulus. In recirculation mode, the CTS draws suction from the sump and discharges a portion of the flow into the pipe annulus.

The Crane Wall could potentially prevent this water in the annulus from flowing back into the sump.

In order to prevent a reduced sump level over time, a sufficient flow path between the recirculation sump and pipe annulus is necessary.

A flow path willbe created in the partition wall between the sump and pipe annulus (the partition wall is a small portion of the Crane Wall near the PRT at the location of the overflow between the recirculation sump and pipe annulus).

ModifyCEQ Fan Automatic Start Logic The CEQ fans circulate air in the containment following an accident.

The operation of the fans increases ice melt by providing a steady flow of steam/air through the ice condenser.

Currently, the CEQ fans start ten minutes after the containment hi-hi signal (2.9 psig). A greater amount of water could be available in the sump ifthe CEQ fans are started earlier. The CEQ fan actuation logic willbe modified to start the fans two minutes after the containment hi pressure sign'al (1.1 psig) rather than ten minutes after the containment hi-hi signal (2.9 psig).

~

Reroute Stairwell and CEQ Fan Room Drains Presently, fluid in the stairwell and CEQ fan room drains to the pipe annulus. This could result in a slow draindown of the sump while in recirculation mode. To preclude this draindown, the drains willbe rerouted to the sump.

~

ModifyIce Condenser Ice Mass The melting of ice in the ice condenser helps control containment pressure following an accident.

In 1997 the ice condenser mass was increased.

It has since been determined that maintaining the new ice mass value would be difficult.The ice mass willbe reduced to the value of 2.20 million pounds.

~

ModifyRWST Overflow Line The current RWST overflow line configuration consists of an elbow turned upward offthe RWST nozzle. This configuration limits the available Contaimnent Sump Level Design Condition dc Failure Effects Analysis For Potential Draindown Scenarios 3-7 Revision 1

RWST volume. The piping elbow offthe RWST nozzle willbe inverted to increase the RWST water level by preven'ting drainage through the overflow piping.

6. It is likely that there willbe leakage out of.the ECCS systems while in recirculation mode (e.g., pump seals, valve packing, etc.). Although this leakage is expected to be small, it is not zero. AnyECCS leakageoutsidecontainmenthas thepotential to reducesump level. This evaluation assumes a worst case leakage ofI gpm. This leakage could be greater under certain postulated failure cases, but those cases are bounded by the failures considered in Section 3.5.

7.

The instruments used to trigger safety system actuation (e.g., containment pressure) have uncertainties.

Plant safety analyses are based on values that represent the nominal plus the maximum expected uncertainty. For the Cook safety analysis, AEP used input values into the safety analysis that were based on the nominal value plus an uncertainty that included additional margin. For example, the safety analysis used a containment hi-hi setpoint of 2.9 (nominal value) + 0.6 (uncertainty) = 3.5 psig. The uncertainty of the pressure instrument loop (as calculated by AEP) was only 0.46 psig; the 0.14 psig difference represents additional margin. For this evaluation, the "additional margin" uncertainties, as calculated by AEP, are used.

8.

The operators willnot begin the switchover from the RWST to the containment recirculation sump until the RWST has drained to the 20% level prescribed by the revised EOP's.

9.

The worst case condition is a pipe break discharging into the reactor cavity. This is because the break flowwillflood the cavity prior to fillingthe sump. For this evaluation, itis assumed that all breaks discharge. into the cavity, regardless of the actual pipe sizes in the cavity.

10. The effective CEQ fan flow is assumed to be 39,000 cfm.

3.4 DESIGN CONDITIONS 3.4.1 Parameters Considered The followingplant parameters, or design conditions, are considered to impact the plant response following a LOCA and may affect the resulting water level in the recirculation sump. The followingparagraphs provide a description of the impact of each parameter.

Table 4-1 prov'ides a summary of this information along with the range of design conditions. The parameters listed below are separated into two groups: parameters considered to have a primary impact on sump water level and those considered to have a secondary, or lesser, impact on sump water level. The breakdown is shown in Table 4-1.

Containment Sump Level Design Condition &Failure Effects Analysis For Potential Draindown Scenarios 3-8 Revision I

LOCA Break Size The Cook containment is arranged such that the steam discharge from a LOCA in the reactor cavity or a steam generator enclosure (i.e., a break in the lower containment) is directed into the lower inlet doors of the ice condenser.

The steam is condensed and energy is removed from the discharge through the melting ice. The condensing of the steam tends to minimize containment pressure (and is one of the advantages of the ice containment system). The melted ice, in the form of condensate, flows out of the ice condenser into the recirculation sump.

Once in the recirculation sump, the ice condenser condensate is available for use during recirculation mode ECCS and CTS operation.

The rate at which the ice melts is a function of several parameters, including break size. Large energy releases associated with large diameter pipe breaks tend to melt the ice more rapidly than small diameter breaks.

The rate at which the ice melt is entering the sump affects the sump level.

The postulated pipe break size also impacts the operation of other systems that affect sump water level. For example, the break size is a contributing factor in determining ifthe SI accumulators discharge or retain their contents.

Also, the break size affects the operation of the CTS system, which can affect redistribution of water within the containment and the rate of ice melt.

For evaluation ofpotential sump drain down scenarios, it is expected that small break LOCAs willbe bounding since the smaller energy release associated with a small break willresult in slower ice melt.

=

Location of Pi e Break

'I The large diameter RCS piping is essentially confined to the reactor cavity, steam generator enclosures, and other a'reas of the lower containment inside the Crane Wall. Smaller diameter piping is also located in these areas and travels through the Crane Wall to the pipe annulus.

The location of postulated breaks can have a direct impact on recirculation sump level response.

For example, postulated breaks in the reactor cavity must fillthe reactor cavity before RCS discharge contributes to increasing the recirculation sump level. In addition, postulated breaks in the outer pipe annulus would discharge reactor coolant to an area that may notfullydrain to the recirculation sump (i.e., some water may be "lost").

As an additional consideration, the analysis of postulated breaks must be consistent with the actual plant design. That is, ifa 2" pipe break is considered to be limiting (as an example), that break should not be postulated in locations where there is no 2" diameter piping. Put another way; breaks should only be postulated where the piping is actually installed.

Containment Sump Level Design Condition ck Failure Effects Analysis For Potential Draindown Scenarios 3-9 Revision I

e 0

The approach used in this evaluation to identify postulated break locations is as follows:

~

Breaks are postulated in the reactor cavity and the inner lower containment area (the sump area).

Breaks are not postulated in the pipe annulus outside the Crane Wall (see section 3.3, Key Assumptions).,

~

A break in the RCS piping within the biological shield wall (at the nozzle) willresult in flow into the reactor ca'vity and into the sump area.

Thus, the full range of breaks is postulated to occur in the reactor cavity and the sump area.

It should be noted that the limitingcase is to postulate the break in the reactor cavity since the break flow willfillthe cavity prior to fillingthe sump. As a result, an RCS LOCA is bounding

-when compared to a MSLB. Ifthe postulated accident is a MSLB, the entire usable contents of the RWST willbe used to flood the sump and the cavity willnot flood until the sump level reaches the overflow at 610'. Thus, with regards to sump level, MSLBs are not considered..

7 Core Thermal Power The reactor power level is a measure of the energy available to discharge into containment in the event of a LOCA. Typical severe accident analyses assume the maximum core thermal power since that level represents the maximum energy release.

However, for recirculation sump draindown scenarios, it is possible that lower power levels could be more limiting,since a lower energy release could result in less ice melt.

~CCS I k

During recirculation mode of operation, water is taken from the recirculation sump, passed through the RHR pumps and RHR heat exchangers and injected back into the RCS through the CC, SI or RHR systems.

The pumps and heat exchangers are located outside containment. Ifa leak developed out of the ECCS systems followingthe accident (e.g., pump seal leakage), the water would be removed from the sump and then "lost" outside containment.

The long-term net impact would be to decrease sump level.

Ice Condenser Mass Assuming the entire ice condenser eventually melts following a LOCA, the condensate from the ice melt willdrain to the recirculation sump. The total mass of ice in the condenser affects the total water available to flow to the sump (based strictly on conservation of mass).

r Containment Sump Level Design Condition &Failure Effects Analysis For Potential Draindown Scenarios 3-(0 Revision I

RWST Usable Volume Immediately following a LOCA, the contents of the RWST are pumped into containment or the RCS (an/ out the break to the containment).

The ECCS and CTS systems are used to move the water from the RWST to the recirculation sump. In fact, the RWST volume represents the main source of water available to flood the recirculation sump for a small break LOCA.

The. usable volume of the RWST depends on several parameters, including level instrumentation (both at the high end and the low end) and the point at which operators complete the switchover to recirculation operation. The available RWST usable volume directly impacts the amount of water in the recirculation sump followingthe LOCA.

Containment S ra Actuation Pressure Operation of the containment spray system can dramatically impact ice melt in the ice condenser, particularly for small break LOCAs. On a containment hi-hi pressure signal the CTS starts automatically. This setpoint is 2.9 psig+ 0.6 psig. The system remains in operation until it has been on for at least eight hours and the containment pressure has reduced to 1.5 psig.

The actual point at which the CTS system actuates (between 2.3 and 3.5 psig) willaffect the amount of ice melt, particularly for small pipe break cases.

Actuation near the lower end of the range willlimitice melt, while actuation near the upper end of the range willincrease ice melt.

The amount of ice melt impacts recirculation sump water level.

ECCS Flow Following a LOCA, the containment pressure willincrease as steam is discharged into the containment atmosphere.

When the containment hi pressure setpoint of 1.1 psig is reached, an SI signal willbe generated automatically and the ECCS systems willstart. The CC, SI, and RHR pumps willall start, attempting to inject RWST water into the RCS. The total ECCS flow can impact containment response from two perspectives.

First, the greater the total volume of ECCS injection, the greater the potential to absorb energy and reduce ice melt. However, the second effect can potentially offset the first effect. Depending on the postulated break size, the amount of ECCS flow could actually increase the rate that reactor coolant is forced out the pipe break, increasing ice melt.

Containment S ra Flow Previous analyses have shown that CTS operation has a significant effect on ice melt; especially for small break cases.

The spray flow condenses steam and absorbs energy. This reduces the energy removed through ice melt, and thus slows the rate condensate is generated in the ice condenser.

Conversely, lower spray flow rates. (or no flow at all ifthe sprays are off), increases the rate of ice melt and condensate generation.

Containment Sump Level Design Condition ck Failure Effects Analysis For Potential Draindown Scenarios 3-II Revision !

ESW/CCW Tem erature and Flow The containment spray heat exchangers that remove heat from the CTS flow from the recirculation sump during recirculation mode operation are cooled by Essential Service Water (ESW). The CTS flow removed from the recirculation sump is coo!ed prior to discharge back into the containment.

In addition, ECCS flow from the recirculation sump is cooled by Component Cooling Water (CCW) in the RHR heat exchangers prior to injection back into the RCS.

These heat exchangers remove energy from the containment and discharge the energy to the ultimate heat sink. As the amount of energy removed by these heat exchangers increases, the amount of energy that must be removed through ice melt decreases.

The ESW and CCW flow and temperature affect the heat exchanger performance and willaffect the temperature of the water returned to containment as ECCS flow or containment spray and thereby affect how much heat load must be absorbed by ice melt. Lower ESW and CCW temperature, and maximum ESW and CCW flow willreduce the rate of ice melt RWST Tem erature The temperature of the water in the RWST willcontribute to the cooling effectiveness of water pumped into the containment building during injection mode ECCS operation and containment spray. The more effective the ECCS and containment spray cooling, the less ice melt and the less water available in the containment sump.

CE Fan 0 eration Recirculation/hydrogen skimmer fans start about two minutes following a containment hi signal (containment pressure of 1.1 psig). The fans move air from the upper to lower containment compartments.

This is done to keep the containment atmosphere well mixed and to promote flowof steam through the ice condenser for condensation.

The fans also move low volumes of air from the pressurizer and steam generator enclosures and the containment dome to prevent hydrogen gas buildup.

Aircirculation within containment following an accident affects the rate of ice melt in the ice condenser.

Increases in air flow through the ice condenser increase the rate of ice melt.

Accumulator Actuation There are four SI accumulators installed inside containment.

The accumulators each contain approximately 7,000 gallons of water, pressurized by nitrogen to approximately 600 psig. One accumulator is connected to each RCS cold leg. Depending on the RCS response following the postulated pipe break, the accumulators may or may not actuate and discharge into the RCS. For

'mall break LOCAs for which the operators can maintain RCS level control in the pressurizer, the accumulators willbe locked out to prevent discharge. Ifthe accumulators actuate, the volume of the four accumulators may be available in the recirculation sump.

Containment Sump Level Design Condition dc Failure Effects Analysis For Potential Draindown Scenarios 3-12 Revtston I

Initial Containment Tem erature Following a postulated pipe break inside containment, the containment atmosphere and the equipment, structures, etc:, inside containment willbe heated by the high energy steam released to containment.

The energy absorbed by the containment atmosphere is not available to melt ice in the ice condenser (at least not early in the accident sequence).

Thus, a lower initial containment temperature would result in less ice melt than a maximum temperature.

Initial Containment Pressure The initial containment pressure can affect the delay before safety systems actuate following a LOCA. Since safety system performance affects ice melt, a shorter delay would minimize ice melt.

0 eration of Non-Safet Related E ui ment The operation, or non-operation, of non-safety related plant equipment during the accident sequence could impact the conditions inside containment and the resulting ice melt. The most important equipment is the normal containment cooling. Ifthis equipment continues to operate during initial phases of a small break LOCA, the resulting amount of ice melt willbe decreased.

Continued operation of this equipment could also tend to prevent actuation of the containment spray system.

3.4.2 Bounding Values Table 3-2 outlines the expected bounding values for the design parameters.

Containment Sump Level Design Condition dc Failure Effects Analysis For Potential Draindown Scenarios 3-13 Revision I

Table 3-2 Design Condition Evaluation by Parameter Parameter/

Condition Design Range Reference(s)

Bounding Value(s)

Prim ParametersAffectin Sum Level Effect LOCA Break Size 3g>

]II 3I~

Small breaks are limitingfor the sump draindown analysis since the accumulators are not expected to discharge and the energy release (and associated ice melt) is low. Most previous analyses for Cook have assumed a 2" pipe break is limitingsince the CTS system actuated, but the accumulators did not discharge.

However, smaller breaks may actually result in less ice melt and be more conservative.

Core Thermal Power/

RCS Conditions 0-3250 Mwt/

100'F - -600'F Mode 3 /350'F The break size affects RCS response followingthe LOCA, so it is possible that the smallest pipe size (1") is not the most limiting. A range ofbreak sizes is considered to identif the limitin case.

The energy release on a LOCA is dependent on the core thermal power level and RCS conditions at the time of the break and subsequent to the break. The amount of energy release affects the amount ofice melt and resulting volume in the recirculation sump'.

Cook is not required to postulate general pipe breaks in Mode 4 or below (for those conditions, the WOG approach is used, see section 3.3). Thus, the limitingconditions for energy release and subsequent ice melt would be a LOCAin Mode 3 near Mode 4.

These conditions are expected to be more limitingthan a LOCAat full power since the energy release is reduced and with a lower RCS pressure, the ECCS flowinto the RCS willbe reater.

Ice Condenser Mass 2.20 x 10 lb (min)

Per discussion with AEP ersonnel 2.20x10 lb The less ice available prior to the accident, the less water is available to the sump followingthe accident.

RWST Usable Volume 280,000- 310,000 gal Per discussion with AEP ersonnel 280,000 gal Allofthe usable volume in the RWST willbe pumped into the containment building followinga LOCA. This value represents the minimum usable volume when uncertainties and mar ins are considered.

Containment Sump Level Design Condition &Failure Effects Analysis For Potential Draindown Scenarios 3-14 Revision 1

Parameter/

Condition Safety System Actuation Uncertainty Design Range Containment pressure 2 0.6 ps'ressurizerPressure 2115 psig Reference(s) 4.19 Bounding Value(s)

Containment prcssure - 0.6 psig Pressurizer Pressure

+ 115 psig Effect A lower containment pressure of 1.1 psig, or a pressurizer pressure of 1815 psig, actuates the ECCS system. The instrument measuring the containment pressure has an uncertainty ofk 0.6 psig. The pressurizer pressure uncertainty is 115 psig.

The containment spray system is activated automatically on the containment hi-hi-signal of 2.9 psig. An instrument w'ith an uncertainty ofk 0.6 psig is used to measure containment pressure.

Prior to the start ofcontainment spray, all heat energy is removed by ice'melt. When the CTS system is in operation, the rate ofice melt is reduced because the sprays also condense steam and remove energy.

Hence;the sooner the hi-hi signal is actuated, the earlier CTS flowreaches containment and the less icc melt occurs.

Pipe Brcak Location RCS Piping in Lower Containment Areas MSLB in Upper Containment Areas RCS Break in Reactor Cavity A lower containment pressure of I.I psig actuates the CEQ fans. The same instrument measures containment pressure with the same uncertainty. The shorter the delay of the CEQ fans, the more steam is circulated throughout containment, and hence more ice melt occurs.

However, this effect is considered to be small compared to the reduction in ice melt associated with CTS operation.

I The flowout ofa break in the reactor cavity willflood the reactor cavity. The cavity must filland overflow to the sump area for the break effluent to be available to the sump (i.e., the cavity does not drain to the sump). Assuming a break in the cavity maximizes the flowdiverted away from the sump.

Accumulator Volume Injected 0- 29,050 gal 4.9 Accumulators connected to the RCS cold legs willdump into the RCS on a low pressure signal. Afterentering the RCS, the water is available to flood the sump when it flows out the break. In addition, accumulator injection minimizes the make-up requirements from the RWST to address RCS shrinkage.

No accumulator actuation willresult in a decreased available volume to the containment sump. For small breaks in which the pressurizer level can be controlled, the operators willlock out the accumulators and prevent injection.

ECCS Leakage 0 gpm-1.0 gpm 1.0 gpm Leakage from the ECCS system outside containment while in recirculation mode reduces the amount ofwater in the recirculation sump.

These bounding values are based on the planned AEP approach for estimating ECCS leakage.

Containment Sttmp Level Design Condition &Failure Effects

Inal~sis For Potential Draindown Scenarios 3-15 Revision I

Parameter/

Condition Design Range

~ Reference(s)

Bounding Value(s)

Second Parameters Affectin Sum Level Effect Containment Spray Flow (per train)

ECCS Flow (per train)

',200 gpm nominal 3,600 gpm max 3,550 gpm nominal-5,750 gpm max 4.1 [Sect. 6.3, Table 6.1.1]

4.2 [Table 6.2-5]

3,600 gpm Maximum flow capability per train, both trains Containment spray flowis drawn directly from the sump during recirculation. The more water injected into the containment building during the LOCA, theless heat must be removed from the containment atmosphere by the ice condenser.

Lower ice melt willdecrease the water available to the sum ECCS flowis drawn directly from the sump during recirculation. The more water injected into the RCS/coritainment building during the LOCA, the less heat must be removed from the containment atmosphere by the ice condenser.

Lower ice melt will decrease the water available to the sump.

Nominal and maximum flowrates are based on following:

Pump Nominal Maximum CC 150 gpm 550 gpm SI 400 gpm 700 gpm RHR 3000 gpm 4500 gpm CTS HX Shell Side Temperature 8r, Flow (ESW)

RWST Temperature Initial Containment Pressure CEQ Fan Flow Initial Containment Temperature 32'F - 87.5'F 2,000-4 500t i m/train 70' 100'F

-1.5 psig -0.3 psig 39,000- 45,000 cfm/train 60- 120'F 4.7 [Sect. 3.9.1.3]

4.7 [Tables 2-1 and 3-1, Fig 6-1]

4.2 [Table 6.2-4]

4.10 4.5 [Sect.

3.4.8.3.8, Figure 4-1 4.10 32OF 4,500 gpm 70OF 0.3 psig 41,800 cfm 60'F Using maximum pump capability (i.e., degraded pump curves are not used) and both trains maximizes ECCS flow.

ESW flowcools the containment spray recirculation heat exchanger.

The cooler the water returning to containment as spray, the less heat load must be removed by the ice condenser (resulting in less ice melt and lower sump levels).

The temperature ofthe water sprayed into the containment building from the RWST affects the amount of ice melt. Lower RWST temperature willdecrease the amount of ice melt. Further, lower ECCS temperature willalso reduce the heat load on the ice.

condenser.

The maximum containment pressure minimizes the time delay prior to safety system actuation.

The CEQ fans circulate the containment atmosphere through the ice condenser during LOCA conditions. Increased air circulation willincrease the heat transfer rate and the rate ofice melt.

Lower temperatures inside containment at the beginning of ~ LOCA result in more heat being absorbed by containment equipment, structures, etc., during and followingthc LOCA.

Containment Sump Level Design Condition &Failure Effects Analysis For Potential Draindown Scenarios 3-16 Revision 1

Parameter/

Condition RHR HX Shell Side Temperature &

Flow (CCW)

Design Range 45'F' 120'F 3,000- 9,900 gpm/train Reference(s) 4.8 [Sect. 2.8.1.1, Table 1-2]

Bounding Value(s) 45oF 9,900 gpm Effect CCW flowcools the RHR heat exchanger.

The cooler the water that returns from the RHR HX (and is directed to RHR spray or to the suction cf:he Sl.and charging pumps), the more heat load is absorbed by the ECCS systems and the less ice melt.

Containment Cooler Operation Fail - Trip offon CfS signal Trip offon CTS signal The CCW heat exchangers are cooled by ESW. The minimum ESW temperature is 32'F (the minimum lake temperature).

The Cook plant does not have a design minimum CCW temperature.

There is a CCW low temperature alarm set at 60'F, but it is only an alarm. Ifthe lake temperature and CCW heat loads are low enough, the CCW temperature could drop below 60'F. For this evaluation, a nominal temperature difference across the ESW/CCW heat exchanger is assumed and the minimum CCW, tern rature is selected as 45'F.

During normal plant operation the containment coolers function to remove heat from containment and maintain the containment temperature in the desired range. Following a LOCA the coolers may, or may not, continue operating until the CTS actuation signal.

Assuming the coolers do not trip offduring the LOCA, the coolers would continue to remove energy from the containment environment, particularly for a small break case.

This would minimize ice melt.

I Notes:

I.

This is not a true "design" value.

See discussion in table.

Containment Sump Level Design Condition &Failure Effects Analysis For Potential Draindotvn Scenarios 3-17 Revision I

3.5 POSTULATED K<'AILURES 3.5.1 Design Requirements Although the Cook design was initiated prior to the publication of 10CFR50 and the General Design Criteria (GD ), Chapter 1 of the Cook UFSAR states that the Cook design complies with the intent of the GDC, as published for comment in July, 1967.

GDC 35 (Emergency Core Cooling) requires that the ECCS systems be designed in accordance

'ith single failure criteria. Proper operation of the recirculation sump is key to successful operation of the ECCS systems in ECCS recirculation mode operation.

As a result, the design aspects of the sump must also be designed against the effects of single failures.

The sump structure is essentially a passive "component". The sump serves as a collection volume for water leaving the RCS (through a break) and the containment spray, flow. The ECCS and CTS draw suction from the sump in recirculation mode. As such, there are no specific design requirements for the sump structure necessary to"satisfy single failure criteria. The critical design aspect of sump operation is the water level during recirculation mode operation. A sufficient level is required to provide adequate NPSH and to prevent vortexing (with the associated air intrusion) for the ECCS and CTS pumps. Thus, single failure analysis requires that the design of the ECCS systems and the overall plant response following an accident be such that postulated single failures do not reduce the water level below the minimum value required for sump operation.

A definition of single failure is provided in 10CFR50, Appendix A:

"Asingle failure means an occurrence which results in the loss ofcapability of a component to perform its intended safety functions. Multiplefailures resulting from a single occurrence are considered to be a single failure. Fluid and electric systems are considered to be designed against an assumed single failure ifneither (1) a single failure of any active component (assuming passive components function properly) nor, (2) a single failure of a passive component (assuming active components function properly), results in a loss of the capability of the system to perform its safety functions."

The implementation of single failure analysis for Cook is established in Policy 800000-POL-2300-04 (Reference 6.21) and Directive 227000-DE-2400-04 (Reference 6.22). For Cook, the followingdefinition of single failure is used:

"An occurrence that results in the loss ofcapability of a component to perform its intended safety functions. Multiple failures resulting from a single occurrence are considered to be a single failure. Fluid and electric systems are considered to be designed against an assumed single failure ifneither a single failure of any active component (assuming passive components function'properly) nor a single failure of a passive component (assuming active components function properly) results in Containment Sump Level Design Condition &Failure Effects Analysis For Potential Draindown Scenarios 3-18

'"Revision I

the. loss of the capability of the system to perform its safety functions. A single failure could occur prior to, at the initiation of, or at any time following the design basis event for which the safety system is required to function."

The Attachment 2 to the directive provides additional clarification on the implementation of single failure analysis for Cook. In particular, it clarifies "when" single failures are postulated.

"During the injection phase, any single active failure willnot prevent the accomplishment of the ECCS objectives. During the recirculation phase, the ECCS is capable of accepting one active or passive failure, but not in addition to a single active failure during the injection phase.

One active or passive failure in the systems required for long-term ECCS operation willnot prevent the accomplishment of the ECCS objectives."

Thus, based on these definitions, the sump design and response must be designed in accordance with the followingcriteria:

~

The sump water level during recirculation phase must remain above the specified minimum level. This level is 602'10" as determined in Reference 4.1.

~

During the injection phase, only active failures are postulated.

~

During the recirculation phase, active or passive failures are postulated, but not in addition to a previous active failure during the injection phase.

3.5.2 Definitions

~

Active Failure "... the inabilityof a single dynamic component or instrument to perform its design function.,when called upon to do so by the proper actuation signal. Such functions include change of position of a valve or electrical breaker, operation of a pump, fan or diesel generator, action of a relay contact, etc."

~

Passive Failure "... a failure affecting a device involved with the transport of fluid which limits its effectiveness in carrying out its design function. Most passive failures involve the development of abnormal leakage in valve stem packings, pump seals, etc., although passive failures concerned with abnormal flow restriction in lines are also considered."

3.5.3 Failures Considered Normally, a failure modes and effects analysis (FMEA) considers each of the components or support systems and determines the postulated failure modes for each component or system.

However, for this evaluation a simplified approach is used.

The purpose of this evaluation is not to perform a failure analysis for specific ECCS or safeguards systems.

These single failure evaluations have already been performed for the Cook design and are described in the Cook Containment Sump Level Design Condition &Failure sects Analysis For Potential Draindoivn Scenarios 3-19 Revision I

e

UFSAR. For example, Tables 6.2-6 and 6.2-7 in the UFSAR describe the single failure analysis for the ECCS system and Table 6.3-4. provides the same information for the CTS system.

These tables show that postulated single failures willnot prevent those systems from performing their design function. Further, the safety analyses performed to show that the critical plant parameters following an accident (containment pressure, fuel temperature, etc.) are determined using assumptions consistent with the minimal amount of safety system equipment in operation.

For evaluation of the potential for recirculation sump draindown, failures of specific components is not a concern.

Instead, the failure analysis must consider the potential for failure of systems or subsystems and the associated impact on sump level. For example, it is not critical ifa train of SI is unavailable due to a failure of an SI pump to start, failure of a valve to move to the necessary position, or failure of an AC power bus. With regards to the recirculation sump level, the critical information is that a train of SI is not functioning.

For this evaluation of the potential for sump draindown, the failures listed in Table 3-3 are considered.

These failures are divided into two groups. The first group are the failures of'a single train of flow through one of the ECCS systems (CC, SI, RHR) or CTS. These scenarios are assumed to have occurred as a result of individual equipment failures in the train. Table 3-3 also includes an assessment of the impact of the loss of each equipment train.

The second group of failures in Table 3-3 are those that impact more than one ECCS system train of equipment.

For example, failure of a diesel generator to start under conditions of loss of offsite power would result in the loss of essentially one-half the safety system equipment (i.e.,

loss of all equipment powered by that EDG). Table 3-3 also includes an assessment of the impact of the postulated failure. For this evaluation, it is assumed that all equipment functions properly except for the equipment affected by a single failure.

ANSVANS 58.9 provides the present industry criteria and approach for evaluating postulated single failures in light water reactor power plants. The Cook design is not fullyconsiste'nt with this standard.

For example, ANSI/ANS 58.9 categorizes the failure of a check valve to open as an active failure. ANSI/ANS 58.9 would require that failure of a check valve to open be postulated during the injection phase following an accident.

However, the Cook design is not consistent with this approach.

There is a single check valve in the common suction header from the RWST to the redundant Safety Injection (SI) pumps. In addition, there is one check valve in the common suction header from the RWST to the redundant charging pumps.

Since the RWST inventory is supplied to each system via a common header (i.e., one line) through a single check valve, a failure of the check valve to open would result in the loss of the flow path from the RWST to the entire system.

Similarly each ECCS accumulator connects to its associated RCS loop through two check valves in series.

The failure of either valve to open prevents the accumulator from discharging following a LOCA scenario.

Thus, failure of check valves to open are not considered in the evaluation.

Other differences between the Cook design and industry standards are not addressed in this evaluation.

Instead, a bounding approach is used.

Since the evaluation focuses on loss of function (loss of trains) instead of equipment failures, there are a number of failures that could

'I Containment Sump Level Design Condition &Failure Effects Analysis For Potential Draindown Scenarios 3-20 Revision I

affect each train. These failures could be active or passive.. Thus, for this evaluation, the limiting case of loss of function due to an active failure is assumed during the injection phase and the loss of function due to an active or passive failure is assumed in the recirculation phase, independent of what l;quipment may have failed.

Finally, consistent with the Key Assumptions described in section 3.3, this evaluation only considers failures associated with LOCAevents in Modes 1, 2 or 3. Failures that could impact plant response to a Mode 4 (or lower) LOCA are not co ssidered.

3.5.4 Bounding Failures As shown in Table 3-3, essentially all of the postulated failure modes result in decreased ECCS/CTS capability. This decrease in injection or spray flow is expected to have a corresponding increase in ice melt. This increase in ice.melt results from the ice condenser having to "make up the difference" and remove the energy that the ECCS/CTS systems are not removing. Thus,'all of the failures that result in increased ice melt are not limitingfor the sump draindown evaluation.

There are, however, several postulated failures that may result in less ice melt. These are summarized below.

~

Failure of a single CEQ fan to operate.

The CEQ fans tend to circulate the containment atmosphere and force increased flow through the ice condenser.

Thus, operation of both fans would increase ice melt and operation of a single fan would result in reduced ice melt.

~

Failure of a Power Bus Failure of a power bus would impact each of the ECCS systems, the CEQ fans, and the CTS system.

Only one train would be operating in each system.

Considering the small break LOCA described above, loss ofSI and CC trains and a CEQ fan could reduce ice melt, but loss of a CTS train and RHR train would likely increase ice melt.

Thus, the overall impact of this case is difficultto determine without analysis.

These are the only two postulated failures considered to potentially decrease ice melt from the nominal case.

Containment Sump Level Design Condition dc Failure Effects Analysis For Potential Draindown Scenarios 3-21 Revisio t I

Table 3-3 Failure Effects Analysis S stem Desi nBasis.

Failure Mode "Sin le Train" Failure Modes Effect Charging (CC) System As part ofthe ECCS system, the CC system delivers cooling/flooding water to the reactor core in the event of a LOCA. This limits the fuel clad temperature and thereby ensures that the core willremain substantially intact and in place, with its essential heat transfer geometry preserved.

The design flowis 550 gpm per train. The CC system begins to inject at high reactor coolant pressures (about 2000 psig).

Loss ofone train The Cook design includes two redundant, independent CC trains.

One train is still functional on failure of the other.

Depending on break size, loss ofa CC train can have different effects. For a large break LOCA, loss ofone train likelyresults in more energy removal through ice melt (although the difference iq expected to be small). For a small break, in which the ECCS pumps are contributing to maintaining RCS pressure, loss ofone train ofCC may actually reduce the discharge through the break and decrease ice melt.

SI System As part ofthe ECCS system, the SI system delivers cooling/flooding water to the reactor core in the event of a LOCA. This limits the fuel clad temperature and thereby ensures that the core willremain substantially intact and in place, with its essential heat transfer geometry preserved.

The design flowis 700 gpm per train. The SI system begins to inject at moderately high reactor coolant pressures (about 1750 psig).

Loss ofone train In summary, the effect ofloss of a train likelydepends on the ostulated break size.

The Cook design includes two redundant, independent Sl trains.

~

One train is still functional on failure of-:he other.

Depending on break size, loss of an SI train can have different

~

effects. For a large break LOCA, loss ofone train likelyresults in more energy removal through ice melt (although the difference is expected to be small). For a small break, in which the ECCS pumps are contributing to maintaining RCS pressure, loss ofone, train ofSI may actually reduce the discharge through the break and decrease ice melt.

In summary, the effect ofloss ofa train flke!ydepends pn the ostulated break size.

Containment Sump Level Design Condition Ck Failure Effects Analysis For Potential Draindown Scenarios 3-22 Revision 1

S stem RHR System Desi n Basis As part ofthe ECCS system, the RHR system delivers cooling water to the reactor core in the event of a LOCA.

This limits the fuel clad temperature and thereby ensures that the core willremain substantially intact and in place, with its essential heat transfer geometry preserved.

Failure Mode Loss ofone train Effect The Cook design includes two redundant, independent RHR trains. One train is still functional on loss ofthe other. In

. recirculation mode, the CC and SI pumps take suction offthe RHR pump discharge, so loss ofan RHR train also results in loss ofone CC and one Sl train.

Similar to the scenario described above for the CC and SI pumps, loss ofCC and SI trains could, for certain small break LOCAs, actually decrease ice melt. Since failure of a RHR train also affects the SI and CC systems, this case is likelymore limiting than loss ofa single CC or Sl train.

CTS System CCW System The CTS System sprays cool water into the containment atmosphere in the event ofa LOCA to prevent containment pressure from exceeding the design value.

The heat removal function ofthe CTS system is to remove the reactor residual heat during cool down after a LOCA (via the recirculation sump).

The CCW System cools the RHR heat exchangers (and additional equipment not impacted by this evaluation).

Loss ofone train Loss ofone CCW train In summary, the effect of loss of a train likelydepends on the ostulated break size.

The Cook design includes two separate CTS trains. One train is still functional upon failure ofthe other..

Failure ofa CTS train reduces the amount of water sprayed in the containment environment.

Since the CTS spray absorbs energy,.

less energy is removed for the one train case than the two train case. This additional energy must be removed by the ice condenser through ice melt. Thus, a single train ofoperation would increase ice melt.

The Cook tlesign includes two redundant CCW trains. Each train cools one ofthe two RHR heat exchangers.

Loss ofa CCW train would eliminate cooling capability in one of the RHR heat cxchangers.

Both trains.ofRHR would continue to function, but only one would be cooled.

Since only one train ofRHR flowis being cooled, the energy removed from containment would decrease, resulting in increased tce melt.

Containtnent Sump Level Design Condition &Failure Effects Analysis For Potential Draindown Scenarios 3-23 Revision 1

0 e

S stem ESW System Desi n Basis The ESW System cools the CfS heat exchangers (and additional equipment not impacted by this evaluation).

Failure Mode Loss ofone ESW train Effect The Cook design includes two redundant ESW trains. Each train cools one ofthe CTS heat exchangers.

Loss of an ESW train would eliminate cooling capability in one ofthe CTS heat exchangers.

Both trains ofCTS would continue to function, but only one would be cooled.

Circulation/Hydrogen Skimmer Fans (CEQ Fans)

The fans move air from the upper to lower containment compartments and through the ice condenser.

The fans also move low volumes ofair from the pressurizer and steam generator enclosures and the containment dome to prevent hydrogen gas buildup.

Failure ofa single CEQ fan Since only one train ofCTS flowis being cooled, the energy removed from containment would decrease, resulting in increased ice melt.

The Cook design includes two redundant CEQ fan subsystems.

Failure ofa CEQ fan willresult in less flowof air through containment and through the ice condenser.

Lower air flowthrough the ice condenser willreduce the heat transfer rate in the ice condenser and reduce the rate of ice melt.

Containtnent Sump Level Design Condition &Failure Effects Analysis For Potential Draindown Scenarios 3-24 Revision 1

S stem Desi n Basis Failure Modet "Multi le Train" Failure Modes Effect 600 VACPower The 600 VACelectrical system provides power to all MOV's in the ECCS, the battery chargers ofthe 250 VDC electrical system, and the plant air compressor and back-up air compressor.

Loss ofone 600 VACBus Allaffected MOV's fail as is (Reference 4.17, Sect. 3.1) upon loss ofpower to the valves.

The Cook design includes two redundant 600 VACpower busses.

The ECCS and CTS systems are designed such that separate power buses provide power to the two redundant trains ofECCS or CTS equipment. Thus, failure ofa 600 VACpower bus could render one train in each ECCS/CTS system inoperable ifvalves are not positioned correctly. However, the remaintng trains will

'till function as designed.

Loss ofall ECCS/CTS trains supplied by a single power bus would reduce the rate water was injected to the RCS and containment, likelyincreasing the rate ofice melt. However;as described above for the SI and CC systems, under certain postulated scenarios forsmall break cases, loss ofan ECCS train may decrease ice melt. Thus, both must be considered.

EDG The EDG's provide emergency AC power in the event of a loss ofoff-site AC power.

Loss ofone EDG Loss ofone 600 VACbus should have no effect on the 250 VDC system or the plant air compressors, and hence should not affect'he sump water level via these systems. Ifone 600 VACbus is lost, the battery may be used to supply power to the 250 VDC electrical system. Also, only one air compressor is needed to supply the necessary'air to both units. The air compressor and back-up air compressor are powered from separate 600 VAC busses.

Should power be lost to the main compressor, the back-up corn tessor willsu I the necess air.

The Cook design includes two redundant EDGs to provide

~

emergency power. Loss ofone EDG willresult in loss ofall electrical equipment in one train ofeach ofECCS/CTS systems Since the ECCS/CFS trains are powered by separate power busses, the remaining train in each system would continue to function.

Although more equipment wou!d be inoperable in addition to MOVs, this event would be functionally equivalent to the loss of 600 VACpower described above (i.e., loss of a single train in each s stem).

Containment Sump Level Design Condition &Failure Effects Analysis For Potential Draindown Scenarios 3-25 Revision l

S stem Instrument AirSystem Desi n Basis Provides air to the air operated valves in the ECCS and Crs systems.

Failure Mode'oss of Instrument Air Effect A standby control air compressor capable of supplying the control and instrument air for its unit is installed as a backup for the normal control-instrument air supply, i.e., the plant air compressors.

The standby control air compressor is designed to start automatically upon detection oflow air pressure in the plant air header.

Therefore, a LOIAshould have no effect on the rate of ice melt and the amount ofwater available in the sump.

4 kv AC Power 250 VDC Power The 4 kV power bus provides AC power to the followingequipment in the ECCS/CTS systems:

~

SI pumps

~

Crs pumps

~

RHR pumps

~

CC pumps

~

ESW pump

~

CCW pump

~

CEQ fan

~

Solenoids ofair operated valves The 4 kv AC s stem also owers the 600 VAC buses.

The 250 VDCelectrical system provides power supply to the 4 kV switchgear control for the ECCS pump motors, and the ECCS annunciator panel.

The system also provides power for closing and tripping circuits of 600 VACbreakers.

Loss ofone 4 kV AC bus Loss ofone 250 VDCbus The Cook design includes two redundant 4 kv AC power busses.

Loss ofone bus willresult in loss ofequipment in one train of each ofECCS/CTS systems Since the ECCS/Crs trains are powered by separate power busses, the remaining train in each system would continue to function. Although more equipment would be inoperable in addition to MOVs, this event would be functionally equivalent to the. loss of600 VACpower described above (i.e., loss ofa single train in each system).

The Cook design includes two redundant 250 VDCbusses.

Loss ofone bus.will result in loss ofequipment in one train ofeach of ECCS/Crs systems Since the ECCS/CTS trains are powered by separate power busses, the remaining train in each system would continue to function.'his event would be functionally equivalent to the loss of600 VACpower described above (i.e., loss of a single train in each system).

Notes:

1.

Specific failure modes are not addressed in this evaluation. As described in the evaluation discussion, any failure (passive or failure) that could affect an ECCS or CTS train is assumed.

Containment Sump Level Design Condition &Failure Egects Analysis For Potential Draindown Scenarios 3-26 Revisio/t 1

3.6 OPERATOR ACTIONS 3.6.1 Actions Considered The Cook Emergency Operating Procedures (EOPs) allow/expect the plant operators to operate equipment (inservice, out of service, throttle, etc.) and systems to maintain the plant in the safe and desired configuration. This is especially true during the recirculation mode of operation.

Since analyses of the recirculation sump operation are expected to consider up to several days of simulated duration for small break LOCA cases, it is important that these operator actions be properly modeled in the sump analysis.

The important operator actions included in the EOPs that can impact sump level are described below and listed in Table 3-4.

The Cook EOPs are being revised at the time of preparation of this evaluation. The following discussion is based on the intent of the new EOPs as described by engineers involved in EOP preparation.

RCS Cooldown Followin Accident The operators willshutdown the plant in a controlled manner for all postulated pipe breaks except for a large break LOCA(for the large break LOCA, the RCS is assumed to depressurize quickly and be cooled by the ECCS and CTS). During the shutdown, the RCS temperature will be reduced by steaming in the steam generators until the RHR cut in temperature is reached.

The operators have latitude to cooldown at rates up to 100'F/hr (Reference 4.2, Table 4.1-13), with the minimum expected rate to be about 30'F/hr. This difference in cooldown rate can impact RCS and sump response since it affects the conditions of the break discharge and subsequent ice melt.

It should be noted that preliminary analyses performed by FAI(Reference 4.20) investigated the impact on sump level of assuming cooldown rates of 30, 50 and 100'F/hr..Although the resulting minimum sump levels were generally comparable, the response of most other reported plant parameters varied considerably, even for the 30 and 50'F/hr cases.

These differences require detailed evaluation to verify that the analysis model is correct and that the limitingcase is one of the range extremes and not somewhere between 30 and 100'F/hr.

Switchover to Recirculation Mode Switchover to cold leg recirculation mode begins when the RWST reaches the 20% level (Reference 4.12). The exact points at which cold leg recirculation is started and completed are dependent on the operator actions (e.g., at what specific RWST level the operator begins the switchover procedure).

For example, ifan operator allows the RWST to drain to a lower level,

'he sump level at the beginning of cold leg recirculation may be adequate.

However, ifhe begins switchover earlier, additional procedures to accommodate loss of recirculation capability may be necessary such as adding RWST makeup water, valve alignment checks, etc. (Reference 4.13).

Containment Sump Level Design Condition dc Failure Effects Analysis For Potential Draindown Scenarios 3-27 Revision I

The operator actions to switch over to recirculation mode impact the available RWST volume for injection into the containment.

Containment S ra Secure/Restart After initiation of containment spray (on a Phase B, or HI-HIisolation signal), the revised EOPs state that containment spray must run for eight hours after the containment pressure is reduced to less than 1.5 psig before they may be secured. Ifthe pressure increases to the setpoint, the containment spray system is re-activated and the procedure is repeated.

Operator response will determine at what time and how often the CTS iS activated during a LOCA event. It is expected that some operators would not re-secure the CTS after having restarted the system for the second time.

Whether the CTS system is left in operation "full-time"or secured can have a significant impact on ice melt, particularly for the small break cases.

RHR Used in Containment S ra Mode The RHR system design includes the capability to operate the RHR system in a containment spray mode. The revised EOPs direct the operators to place an RHR train in containment spray mode within 50 minutes after CTS initiation. The RHR sprays are not required to be in service if the CTS system re-actuates after having been secured.

This additional containment spray would reduce ice melt.

The operators have latitude in the operation of RHR sprays.

This can impact ice melt.

Pressurizer Level Following a LOCA, the RCS depressurizes and cools down. Depending on the size of the LOCA

'nd the RCS response, the operators may, or may not, attempt to control RCS level in the pressurizer during the subsequent shutdown.

The EOPs provide a range of allowable pressurizer level. Any water in the pressurizer is unavailable to fiood the recirculation sump.

C After the beginning of safety injection, the operators are instructed to secure the reactor coolant pumps and all flow through the reactor system is via the ECCS. The amount of fluid that is pumped into containment following a LOCA willaffect both the temperature of the reactor and the amount of fluid that exits through. the pipe break. The operators have some latitude in when the pumps are secured.

Containment Sump Level Design Condition &Failure Effects Analysis For Potential Draindown Scenarios 3-28 Revision 1

3.6.2 Bounding Approaches Table 3-4 includes an evaluation of each parameter to determine the bounding approach that will minimize recirculation sump level. In general, the operator actions that minimize recirculation sump level are divided into three groups:

~

Minimize RWST volume transferred to the recirculation sump

~

Maximize RCS volume required to be filled

~

Maximize CTS and RHR spray operation to reduce ice melt Containment Sump Level Design Condition &Failure Effects Analysis For Potential Draindown Scenarios 3-29 Revision I

Table 3-4 Operator Action Evaluation Action RHR used in Containment Spray Mode Switch the RHR/CTS Systems to Recirculation Mode Establish RHR Flow to the SI and CC Pumps RCS Cooldown and Depressurization Affected S stems RHR RHR/CTS ECCS "Options" Operators are to place an RHR train in spray mode followingthe first time CTS actuates.

The RHR sprays are initiated after a minimum 50 minute time dela Operator should switch the RHR/CTS systems from SI mode to RHR mode when the RWST level falls below 20%.

Operator should establish RHR flowto the SI arid CC pumps when the RWST level falls below 11%. This will automatically occur when the lo-lo/RHR um alarmtri s.

Any cooldown rate 5 100OF/hr.

RCS cooldown continues until the RCS pressure is below the RHR pump shutoff head.

, Bounding Approach Operator initiates RHR containment spray mode as soon as possible after CTS actuates and recirculation starts.

The highest RWST level at which the operator may switch the RHR/CTS systems to recirculation mode (20%).

The highest RWST level at.

which the operator may switch the SVCC systems to RHR pump discharge (11%).

100OF/hr RCS cooldown continues beyond the RHR shutoff head (steam generator steaming continues as long as possible).

Impact/Discussion The sooner RHR containment spray mode is activated, the more water is transferred to the containment to transfer energy from the steam.

Less ice melt occurs, leaving less water available in the sump for recirculation.

The RWST water represents the bulk of the water transferred to the recirculation sump.

Minimizingthe water removed from the RWST minimizes the amount of water in the sum The RWST water represents the bulk ofthe water transferred to the recirculation sump.

Minimizingthe water removed from the RWST minimizes the amount of water in the sump.

'Ihe cooldown rate affects the rate ofRCS shrinkage (and required makeup from the RW~. In addition, the cooldown rate for the RCS affects the energy ofthe discharge from the postulated brcak.

The amount ofcooling via steam generator steaming impacts the amount ofheat removal from containment by the ice condenser.

Reference 4.13 4.11, 4.16 [Sect 6.4.2]

4.11, 4.16 [Sect 6.4.2]

4.18 Containment Sump Level Design Condition &Failure Effects Analysis For Potential Draindotvn Scenarios 3-30 Revision I

Action Containment Spray Stan/Secure Pressurizer Level Control RCP Operation Affected S stem(s)

"Options" The CTS system actuates automatically each time the containment hi-hi pressure (2.9 psig) is reached. Ihe system is secured by operators ifit has been operating for at least eight hours and the containment pressure is less than 1.5 psig. Operators have latitude to leave system in operation ifdesired and the pressure is greater than 1.5 si Level should be maintained between 32% and 64% during adverse containment conditions.

Operator should stop all RCP's ifcontainment pressure

>2.9 psig or one ECCS pump is running and RCS pressure <

1250 psig.

Bounding Approach CTS not secured after one restart ofsystem (i.e., the operators leave system in operation after it has been shut down once).

Maximum pressurizer level obtainable.

Impact/Discussion Procedures dictate that the CTS be secured when containment pressure drops below 1.5 psig. Should pressure exceed 1.5 psig after the CTS has been secured, restarting and leaving active the CTS (independent of containment pressure) would increase the sump flow requirements and would result in the greatest volume ofwater being pumped into the inactive sump. Operation ofthe CTS willalso result in decreased ice melt.

The RCS level in the pressurizer determines the volume ofRCS that must be filledin addition to the recirculation sump.

Operation of the RCPs followmg an accident affects the amount ofenergy release through the pipe break.

Reference 4.16 [Sec. 6.1.2]

4.18 4.18 4A

~

RHR Pump Operation ECCS When RCS pressure is > 590 psig, operators should restart one RCP to obtain pressurizer spray flowfor cooldown and de ressurization.

Operators should stop RHR pumps (and place in neutral) ifRCS pressure is greater than 590 psig and must be manually restarted when RCS pressure decreases to less than 590 si In recirculation mode, the RHR pumps provide the suction source for the ECCS pumps. Ifthe RHR pumps are not operating, the CC and Sl pumps also can not operate.

4.18 Containment Sump Level Design Condition &Failure Effects Analysis For Potential Draindown Scenarios 3-31 Revision I

3.7 MODELINGMETHODS 3.7.1 Items Considered Several parameters that irhpact the analysis of the. recirculation sump level following an accident are not specific design conditions for plant systems or equipment, failure issues, or operator actions.

Instead, there are several factors that are related to predicting the response of equipment using appropriate modeling methods.

Th'ese are described below and in Table 3-5.

Ice Condenser Door Res onse C

The ice condenser inlet doors must open to allow steam to enter the ice condenser following a LOCA. The behavior of the doors has been predicted using models described in the USAR. The USAR includes models for door response ranging from best estimate to upper bound. Analyses have shown that small variations in assumed door response model have little impact on ice condenser response.

However, ifit is assumed that the doors remain open after the first time they open (and do not close), the analysis predicts considerably more ice melt.

The response of the intermediate and upper doors do not have a significant impact since the ice condenser can function properly for a small break case even ifthose doors do not open.

1 Containment Structure Heat'Transfer

'I The structures and equipment inside containment represent a large heat sink followingan accident. This material must be heated to essentially the containment temperature.

In typical containment analyses, this energy absorption is neglected, since it would lessen the demand on the containment safety systems.

However, for potential sump draindown, it is nonconservative to neglect this heat sink. The heat transferred to containment structures represents heat that does not contribute to ice melt. The method used to model heat transfer to containment structures must conservatively account for this effect.

Ice Condenser Performance Model r

The performance of the ice condenser is a key factor affecting the amount of ice melt. The most important parameter affecting ice condenser performance is the gas outlet temperature.

The outlet temperature is a direct measure of the heat removed in the condenser, and thus, the amount of ice melt.

3.7.2 Bounding Approaches Table 3-5 outlines the bounding modeling methods for analysis of the minimum active sump water level.

Containment Sump Level Design Condition &Failure Effects Analysis For Potential Draindown Scenarios 3-32 Revision l

Table 3-5 Modeling Method Evaluation Item Ice Condenser Door

Response

Containment Structure Heat Transfer Ice Condenser Performance Model Affected S stems Ice Condenser ECCS/Ice Condenser Ice Condenser Range Figure 6.9-1

[Reference 4.2, App. M]

Insulated Surfaces to Constant Temperature Various Bounding Approach Door response curve indicating greatest necessary differential pressure to open door (upper curve on Fi re 6.9-1 Constant temperature between atmosphere and structures Modeling method for heat transfer that underpredicts ice melt.

Impact/Discussion The pressure at which the lower inlet doors open as well as the opening response ofthe doors willaffect the rate of ice melt. The higher the inlet door opening pressure and the slower the door o enin res onse,thelessicemelt.

The mass ofstructures and equipment inside the containment are at essentially the containment temperature prior to the accident.

As the containment temperature increases, these masses willabsorb heat.

'ny heat absorbed by the structures represents heat that does not contribute to ice melt.

The performance ofthe ice condenser directly affects the amount of ice melt followingan accident.

'ontaintnent Sump Level Design Condition &Failure Effects

. it <<.;.~i.t:;>r P;;r tt.':.t. Dt'aimi;>>vtt Scenarios 3-33 Revision 1

Section 4 REFERENCES 4.1 Alden Research Lab, Report 108-78/M178PF 4.2 DC Cook UFSAR 4.3 DB-12-CTS, "Containment Spray System Design Basis Document" 4.4 02-OHP 4023 FOLDOUT 4.5 DB-12-CNTS, "Containment Systems Design Basis Document" 4.6 ECP 1-2-00-14, "Emergency Operation Procedure Setpoints",Section II, Calc. 11.

4.7 DB-12-ESW, "Essential Service Water Design Basis Document" 4.8 DB-12-CCW, "Component Cooling Water Design Basis Document" 4.9 Cook Technical Specifications Section 3/4.5 4.10 Cook Technical Specifications Section 3/4.6-7 4.11 02-OHP 4023.ES-1.3, "Transfer to Cold Leg Recirculation", Rev. 5 4.12 01-OHP 4023.E-O, "Reactor Trip or Safety Injection", Rev. 14 4.13 01-OHP 4023.FR-Z.1, "Response to High-High Containment Pressure", Rev. 4 4.14 SECY-77-439, "Information Notice to the Commissioners from Edson G. Case, Acting NRC Director, Regarding the Single Failure Criterion" 4.15.

ANSI/ANS-51.7-1976, "Single Failure Criteria for Pressurized Water Reactor Systems" 4.16 SD-DCC-NEMH111, "Emergency Core Cooling System (Safety Injection System)",

System Description, Rev. 16, 5/04M 1 4.17 SD-AEP/AMP-200/D, "Safety Injection System", System Description, Rev. 0, November, 1970 4.18 EOP 02-OHP 4023.ES-1.2, "Post LOCA Cooldown 8c Depressurization", Rev. 4 4.19 WCPAP 13055, "Westinghouse Setpoint Methodology for Protection Systems", D.C.

Cook Unit 1,.Westinghouse Electric Corp., September, 1991 Containment Sutnp Level Design Condition &Failure Egects Analysis For Potential Draindown Scenarios 4-2 Revision /

4.20 FAV99-7, "Results of Sensitivity Analyses for the D.C. Cook Containment Sump Evaluations", Rev. 0, Fauske'and Associates, January, 1999 4.21 AEPNO Policy 800000-POL-2300-04 4.22 AEPNO Directive 227000-DIR-2400-04 Containment Sump Level Design Condition &Failure Effects Analysis For Potential Draindown Scenarios 4-?

Revis't, t!

ATTACHMENT9 TO C1099-08

. MPR ASSOCIATES, INCORPORATED "EVALUATIONOF COOK RECIRCULATIONSUMP LEVEL FOR REDUCED PUMP FLOW RATES"