ML21125A581
Text
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: i of iii 14.2 STANDBY SAFEGUARDS ANALYSIS ............................................. 1 14.2.1 Radiological Consequences of Fuel Handling Accident ....... 1 14.2.2 Postulated Radioactive Releases Due to Liquid-Containing Tank Failures ............................................................................ 1 14.2.2.1 Waste Evaporator Condensate and Monitor Tanks ........................ 1 14.2.2.2 Condensate Storage Tank, Primary Water Storage Tank, and Refueling Water Storage Tank ........................................................ 2 14.2.2.3 Auxiliary Building Liquid Waste Storage Tanks ............................... 3 14.2.2.4 Piping .............................................................................................. 3 14.2.3 Accidental Waste Gas Release ................................................ 4 14.2.4 Steam Generator Tube Rupture............................................... 4 14.2.4.1 General ............................................................................................ 4 14.2.4.2 Description of Accident.................................................................... 5 14.2.4.3 Recovery Procedure........................................................................ 6 14.2.4.4 Analysis and Results ....................................................................... 8 Effect of the RTD Bypass Elimination ................................................................... 9 14.2.4.5 Radiological Consequence Analysis ............................................... 9 14.2.4.6 Conclusion ....................................................................................... 9 14.2.4.7 References for Section 14.2.4 ......................................................... 9 14.2.5 Rupture of a Steamline (Steamline Break)............................ 10 14.2.5.1 Identification of Causes and Accident Description ........................ 10 14.2.5.2 Analysis of Effects and Consequences ......................................... 12 14.2.5.2.1 Method of Analysis ............................................................................ 12 14.2.5.2.2 Results .............................................................................................. 15 14.2.5.3 Radiological Consequence Analysis ............................................. 17 14.2.5.4 Conclusions ................................................................................... 17 14.2.5.5 References for Section 14.2.5 ....................................................... 17 14.2.6 Rupture of Control Rod Drive Mechanism (CRDM) Housing (RCCA Ejection) ...................................................................... 18 14.2.6.1 Identification of Causes and Accident Description ........................ 18 Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: ii of iii 14.2.6.1.1 Design Precautions and Protection ................................................... 18 14.2.6.1.1.1 Mechanical Design ........................................................................ 18 14.2.6.1.1.2 Nuclear Design.............................................................................. 19 14.2.6.1.1.3 Reactor Protection ........................................................................ 19 14.2.6.1.1.4 Effects on Adjacent Housings ....................................................... 19 14.2.6.1.1.5 Effects of Rod Travel Housing Longitudinal Failures..................... 20 14.2.6.1.1.6 Effect of Rod Travel Housing Circumferential Failures.................. 20 14.2.6.1.1.7 Possible Consequences................................................................ 21 14.2.6.1.1.8 Summary ....................................................................................... 21 14.2.6.1.2 Limiting Criteria ................................................................................. 21 14.2.6.2 Analysis of Effects and Consequences ......................................... 22 14.2.6.2.1 Method of Analysis ............................................................................ 22 14.2.6.2.2 Average Core Analysis ...................................................................... 22 14.2.6.2.3 Hot Spot Analysis .............................................................................. 23 14.2.6.2.4 System Overpressure Analysis ......................................................... 23 14.2.6.2.5 Ejected Rod Worths and Hot Channel Factors .................................. 24 14.2.6.2.6 Reactivity Feedback Weighting Factors ............................................ 24 14.2.6.2.7 Moderator and Doppler Coefficient.................................................... 25 14.2.6.2.8 Delayed Neutron Fraction, eff ........................................................... 25 14.2.6.2.9 Trip Reactivity Insertion ..................................................................... 25 14.2.6.2.10 Results .............................................................................................. 26 14.2.6.2.11 Pressure Surge ................................................................................. 27 14.2.6.2.12 Lattice Deformations ......................................................................... 28 14.2.6.3 Radiological Consequence Analysis ............................................. 28 14.2.6.4 Conclusions ................................................................................... 28 14.2.6.5 References for Section 14.2.6 ....................................................... 29 14.2.7 Secondary Systems Accident Environmental Consequences
................................................................................................. 30 14.2.8 Major Rupture of Main Feedwater Pipe (Feedline Break) .... 30 14.2.8.1 Identification of Causes and Accident Description ........................ 30 14.2.8.2 Analysis of Effects and Consequences ......................................... 31 14.2.8.2.1 Method of Analysis ............................................................................ 31 Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: iii of iii 14.2.8.2.2 Results .............................................................................................. 33 14.2.8.3 Conclusions ................................................................................... 34 14.2.8.4 References for Section 14.2.8 ....................................................... 34 Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 1 of 34 14.2 STANDBY SAFEGUARDS ANALYSIS The analyses presented in this section demonstrate that adequate provisions are included in the design of the plant and its engineered safeguards which restrict potential exposures to below the appropriate regulatory limits for the fault conditions resulting in the fission product release to the environment listed as follows:
- 1. Fuel handling accident.
- 2. Waste liquid release.
- 3. Waste gas release.
- 4. Steam generator tube rupture.
- 5. Rupture of a steam line.
- 6. Rupture of control rod drive mechanism housing (rod cluster control assembly ejection).
- 7. Environmental consequences following secondary system accidents.
- 8. Rupture of a feedline.
14.2.1 Radiological Consequences of Fuel Handling Accident See Unit 1 FSAR Section 14.2.1.
14.2.2 Postulated Radioactive Releases Due to Liquid-Containing Tank Failures The inadvertent release of radioactive liquid to the environment is not considered a credible accident. Any radioactive liquids must ultimately be diverted to the monitor tanks and any tritium from the CVCS to the monitor tanks also, prior to discharge. (Liquids from these tanks are sampled and monitored for acceptable radioactive levels before being released to the lake.) Erroneous sampling and malfunction of the radiation monitor would have to occur sequentially to discharge radioactive liquid inadvertently, and this series of events is not considered credible.
14.2.2.1 Waste Evaporator Condensate and Monitor Tanks Any spillage of radioactive fluid due to equipment leaks or ruptures would drain directly to either the sump tank or waste holdup tanks, or would accumulate in the area sumps prior to being pumped Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 2 of 34 to the waste holdup tanks. Radioactive liquids to be processed by the waste disposal system are ultimately stored in the waste holdup tanks.
Periodically the contents of the waste holdup tanks and the laundry tanks are analyzed and if the radioactive level is within discharge limits, the liquid is transferred to the waste evaporator condensate tanks and then to the monitor tanks for release.
Effluents from the waste disposal system and monitor tanks 3 and 4 are released, not recycled.
Distillate from the CVCS boric acid evaporator is discharged to monitor tanks. The contents of monitor tanks 1 and 2 are analyzed before being pumped to the primary water storage tanks.
Occasionally it may be necessary to dispose of some of the boric acid distillate for tritium control.
(If analysis of the contents of the monitor tank is within prescribed limits for discharge to the environment, the liquid is pumped directly to the waste liquid discharge line after the normally locked or sealed closed valve in this line is opened.) The radiation monitor downstream prevents discharge of fluids above prescribed levels as explained in the preceding paragraph.
A representative sample is obtained from the monitor tank to determine appropriate release setpoints. Administrative clearance must be granted to open a locked or sealed closed valve. In the highly unlikely event that the locked or sealed closed valve is opened and the tank contents are inadvertently pumped to the discharge tunnel for release to the lake without being previously analyzed for activity, the radiation monitors setpoint is set such that the release will not exceed release limits. If it did, the radiation monitor would trip the second valve downstream of the monitor and terminate the release. Therefore, a pumping accident having radiological consequences is not considered credible.
14.2.2.2 Condensate Storage Tank, Primary Water Storage Tank, and Refueling Water Storage Tank The condensate storage tank and the primary water storage tank are essentially free from radionuclides. The refueling water storage tank contains a relatively low level of radioactivity.
These tanks are not connected to the radwaste system. In the unlikely event of loss of water from any of these tanks the water will percolate down the underground water table, which is estimated to be at elevation 590', that is, about 20 feet below ground level. The hydraulic gradient of the ground is very low; less than 4%. Our studies show a minimum of 50 years would be required for the water to reach the nearest ground water well. The spilled water would preferentially follow the very small natural ground gradient toward the lake and would be eventually diluted in the lake water. By the time any radioactive materials reach the nearest drinking water intake from the lake, Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 3 of 34 which is Lake Township 0.6 miles away from the plant discharge, the resultant dilution, dispersion, and radioactive decay will have reduced the radiological consequences to an insignificant level.
14.2.2.3 Auxiliary Building Liquid Waste Storage Tanks The inadvertent release of radioactive liquid waste to the environment is not considered a credible accident. Any spillage of radioactive fluid due to equipment leaks or ruptures would drain directly to either sumps or waste holdup tanks. Radioactive liquid wastes are diverted to tanks to be processed for release. Tanks are sampled and analyzed to determine that the concentration of radioactive nuclides can be released within discharge limits. The release must pass through a normally locked or sealed closed valve, a radiation monitor and another valve in series prior to reaching the discharge tunnels for release to the lake. Administrative clearance must be granted to open the locked or sealed closed valve. In the highly unlikely event that the locked or sealed closed valve is opened and the tank contents are inadvertently pumped to the discharge tunnel for release to the lake without being previously analyzed for activity, the radiation monitors setpoint is set such that the release will not exceed release limits. If it did, the radiation monitor would trip the second valve downstream of the monitor and terminate the release. Therefore, a pumping accident involving radioactive waste releases having radiological consequences is not considered credible.
14.2.2.4 Piping The pipes running from the refueling water storage tank, the primary water storage tank, and the condensate tank to the auxiliary building are installed in a pipe tunnel. In case of a break in any of these pipes, the water will enter the auxiliary building sump, from where it will be processed as described in the Auxiliary Building liquid waste tanks. No pipes from these tanks are directed toward the containment building.
The information presented here refers to the original Unit 1 studies. Later results of studies on this subject are included in Section 14.2 of the Unit 2 Updated FSAR.
Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 4 of 34 14.2.3 Accidental Waste Gas Release Refer to Section 14.2.3, Unit 1.
14.2.4 Steam Generator Tube Rupture 14.2.4.1 General The accident examined is the complete severance of a single steam generator tube (SGTR). The accident is assumed to take place with the reactor coolant contaminated with fission products corresponding to continuous operation with a limited amount of defective fuel rods. The accident leads to an increase in contamination of the secondary system due to leakage of radioactive coolant from the reactor coolant system. In the event of a coincident loss of offsite power, or failure of the condenser steam dump system, discharge of activity to the atmosphere takes place via the steam generator power operated relief valves (and safety valves if their setpoint is reached).
The steam generator tube material is Inconel 690 and as the material is highly ductile, it is considered that the assumption of a complete severance is somewhat conservative. The more probable mode of tube failure would be one or more minor leaks of undetermined origin. Activity in the steam and power conversion system is subject to continual surveillance and an accumulation of minor leaks which exceed the Technical Specification limits is not permitted during unit operation.
The operator is expected to determine that a steam generator tube rupture (SGTR) has occurred, to identify and isolate the ruptured steam generator, and to complete the required recovery actions to stabilize the plant and terminate the primary to secondary break flow. These actions should be performed on a restricted time scale in order to minimize the contamination of the secondary system and ensure termination of radioactive release to the atmosphere from the ruptured steam generator. Consideration of the indications provided at the control board, together with the magnitude of the break flow, leads to the conclusion that the recovery procedure can be carried out on a time scale that ensures that break flow to the ruptured steam generator is terminated before the water level in the affected steam generator rises into the main steam pipe. Sufficient indications and controls are provided to enable the operator to carry out these functions satisfactorily.
Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 5 of 34 14.2.4.2 Description of Accident Assuming normal operation of the various plant control systems, the following sequence of events is initiated by a tube rupture:
- 1. Pressurizer low pressure and low level alarms are actuated, and prior to plant trip, charging pump flow increases in an attempt to maintain pressurizer level. On the secondary side there is a steam flow/feedwater flow mismatch before trip, as feedwater flow to the affected steam generator is reduced due to the additional break flow which is now being supplied to that steam generator.
- 2. Loss of reactor coolant inventory leads to falling pressure and level in the pressurizer until a reactor trip signal is generated by low pressurizer pressure or overtemperature T. A safety injection signal, initiated by low pressurizer pressure follows soon after the reactor trip. The safety injection signal automatically terminates normal feedwater supply and initiates auxiliary feedwater addition.
- 3. The steam generator blowdown liquid monitor and/or the steam jet air ejector radiation monitor will alarm, indicating a sharp increase in radioactivity in the secondary system.
- 4. The reactor trip automatically trips the turbine, and if outside power is available, the steam dump valves open, permitting steam dump to the condenser. In the event of a coincident loss of offsite power, the steam dump valves would automatically close to protect the condenser. The steam generator pressure would rapidly increase, resulting in steam discharge to the atmosphere through the steam generator power operated relief valves (and the steam generator safety valves if their setpoint is reached).
- 5. Following reactor trip and safety injection actuation, the continued action of auxiliary feedwater supply and borated safety injection flow [supplied from the refueling water storage tank (RWST)] provide a heat sink. Thus, steam bypass to the condenser, or in the case of loss of outside power, steam relief to atmosphere, is attenuated during the time in which the recovery procedure leading to isolation is being carried out.
- 6. Safety injection flow results in restoration of pressurizer water level.
Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 6 of 34 14.2.4.3 Recovery Procedure In the event of an SGTR, the plant operators must diagnose the SGTR and perform the required recovery actions to stabilize the plant and terminate the primary to secondary leakage. The operator actions for SGTR recovery are provided in the Emergency Operating Procedures (EOPs).
The EOPs are based on guidance in the Westinghouse Owner's Group Emergency Response Guidelines (Reference 1) which addresses the recovery from a SGTR with and without offsite power available.
The major operator actions include identification and isolation of the ruptured steam generator, cooldown and depressurization of the RCS to restore inventory, and termination of SI to stop primary to secondary leakage. These operator actions are described below.
- 1. Identify the ruptured steam generator.
High secondary side activity, as indicated by the secondary side radiation monitors will typically provide the initial indication of an SGTR event. The ruptured steam generator can be identified by an unexpected increase in steam generator level, in conjunction with a high radiation indication on the main air ejector monitor, or from the steam generator blowdown liquid monitor. For an SGTR that results in a reactor trip at high power, the steam generator water level will decrease off-scale on the narrow range for all of the steam generators. The auxiliary feedwater flow will begin to refill the steam generators, distributing approximately equal flow to each of the steam generators. Since primary to secondary leakage adds additional liquid inventory to the ruptured steam generator, the water level will return to the narrow range earlier in that steam generator and will continue to increase more rapidly.
This response, as indicated by the steam generator water level instrumentation, provides confirmation of an SGTR event and also identifies the ruptured steam generator.
- 2. Isolate the ruptured steam generator from the intact steam generators and isolate feedwater to the ruptured steam generator.
Once a tube rupture has been identified, recovery actions begin by isolating steam flow from and stopping feedwater flow to the ruptured steam generator. In addition to minimizing radiological releases, this also reduces the possibility of overfilling the ruptured steam generator with water by 1) minimizing the accumulation of feedwater flow and 2) enabling the operator to establish a pressure differential Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 7 of 34 between the ruptured and intact steam generators as a necessary step toward terminating primary to secondary leakage.
- 3. Cool down the RCS using the intact steam generators.
After isolation of the ruptured steam generator, the RCS is cooled as rapidly as possible to less than the saturation temperature corresponding to the ruptured steam generator pressure by dumping steam from only the intact steam generators. This ensures adequate subcooling in the RCS after depressurization to the ruptured steam generator pressure in subsequent actions. If offsite power is available, the normal steam dump system to the condenser can be used to perform this cooldown.
However, if offsite power is lost, the RCS is cooled using the power-operated relief valves (PORVs) on the intact steam generators. Nitrogen is available to support Steam Generator PORV operation in the event that control air is unavailable.
- 4. Depressurize the RCS to restore reactor coolant inventory.
When the cooldown is completed, SI flow will increase RCS pressure until break flow matches SI flow. Consequently, SI flow must be terminated to stop primary to secondary leakage. However, adequate reactor coolant inventory must first be assured. This includes both sufficient reactor coolant subcooling and pressurizer inventory to maintain a reliable pressurizer level indication after SI flow is stopped.
The RCS depressurization is performed using normal pressurizer spray if the reactor coolant pumps (RCPs) are running. However, if offsite power is lost or the RCPs are not running, normal pressurizer spray is not available. In this event, RCS depressurization can be performed using a pressurizer PORV or auxiliary pressurizer spray.
- 5. Terminate SI to stop primary to secondary leakage.
The previous actions will have established adequate RCS subcooling, a secondary side heat sink, and sufficient reactor coolant inventory to ensure that SI flow is no longer needed. When these actions have been completed, SI flow must be stopped to terminate primary to secondary leakage. Primary to secondary leakage will continue after SI flow is stopped until the RCS and ruptured steam generator pressures equalize. Charging flow, letdown, and pressurizer heaters will then be controlled to prevent repressurization of the RCS and reinitiation of leakage into the ruptured steam generator.
Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 8 of 34 Following SI termination, the plant conditions will be stabilized, the primary to secondary break flow will be terminated and all immediate safety concerns will have been addressed. At this time a series of operator actions are performed to prepare the plant for cooldown to cold shutdown conditions. Subsequently, actions are performed to cooldown and depressurize the RCS to cold shutdown conditions and to depressurize the ruptured steam generator.
14.2.4.4 Analysis and Results In estimating the mass transfer from the reactor coolant system through the broken tube, the following assumptions were made:
- a. Plant trip occurs automatically as a result of low pressurizer pressure.
- b. Following the initiation of the safety injection signal, both centrifugal charging pumps are actuated and continue to deliver flow.
- c. After reactor trip the break flow equilibrates to the point where incoming safety injection flow is balanced by outgoing break flow. In the accident analysis to determine the steam releases for dose considerations, the equilibrium break flow is assumed to persist for the first 30 minutes after the accident initiation.
- d. The termination of break flow occurs before the steam generator would overfill into the main steam piping. A specific overfill calculation was not included in the original analysis; however, a more recent analysis described below confirms the continued validity of this assumption.
The above assumptions lead to a conservative upper bound of 162,000 pounds for the total amount of reactor coolant transferred to the ruptured steam generator and 73,000 pounds for the total amount of steam released to the atmosphere via the ruptured steam generator as a result of the steam generator tube rupture accident.
Demonstration that the ruptured steam generator does not overfill during the accident has more recently been performed by utilizing an NRC-approved thermal hydraulic analysis code.
Reference 2 includes the NRCs approval of the break flow model contained within the LOFTTR2 computer code that has been used for the Cook unit-specific supplemental overfill analysis. The approved code simulates the plant response, and models specific operator actions. Thus, a more realistic representation of the break flow during the accident is obtained. The supplemental analysis demonstrates that break flow following the complete severance of a steam generator tube is terminated approximately 50 minutes after initiation of the tube rupture and overfill of the steam generator does not occur. The resultant mass release data from this recent overfill analysis has Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 9 of 34 been confirmed to remain bounded by the mass release data calculated with the current licensing basis analysis methodology, which assumes break flow persisting for 30 minutes from the initiation of the accident. The current mass release and consequent dose analysis were not revised as a result of the supplemental analysis.
Effect of the RTD Bypass Elimination Evaluation performed to support RTD Bypass Elimination demonstrates that the conclusions of the accident analysis remain valid.
14.2.4.5 Radiological Consequence Analysis See Unit 1 Section 14.2.4.5.
14.2.4.6 Conclusion A steam generator tube rupture will cause no subsequent damage to the RCS or the reactor core.
An orderly recovery from the accident can be completed, even assuming a simultaneous loss of offsite power such that liquid does not enter the steam piping space.
14.2.4.7 References for Section 14.2.4
- 1. Westinghouse Owners Group; Emergency Response Guidelines; Published by Westinghouse Electric Corporation for the Westinghouse Owners Group.
- 2. Charles E. Rossi, NRC, to Alan E. Ladieu, WOG SGTR Subgroup Chairman, Acceptance for Referencing of Licensing Topical Report WCAP-10698 SGTR Analysis Methodology to Determine the Margin to Steam Generator Overfill, December 1984, March 30, 1987.
Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 10 of 34 14.2.5 Rupture of a Steamline (Steamline Break) 14.2.5.1 Identification of Causes and Accident Description A rupture of a steam pipe results in an uncontrolled steam release from a steam generator. The steam release results in an initial increase in steam flow, which decreases during the accident as the steam pressure falls. The energy removal from the reactor coolant system causes a reduction of coolant temperature and pressure. In the presence of a negative coolant temperature coefficient, the cooldown results in a reduction of core shutdown margin. If the most reactive RCCA is assumed stuck in its fully withdrawn position, there is an increased possibility that the core will become critical and return to power. A return to power following a steam pipe rupture is a potential concern mainly because of the high hot channel factors which exist when the most reactive RCCA is assumed stuck in its fully withdrawn position. The core is ultimately shut down by boric acid delivered by the emergency core cooling system.
The analysis of a steam pipe rupture is performed to demonstrate that:
A. Assuming a stuck RCCA, with or without offsite power, and assuming a single failure in the engineered safety features, there is no consequential damage to the core and the core remains in place and intact.
B. Although DNB and possible clad perforation following a steam pipe rupture are not necessarily unacceptable, the following analysis, in fact, shows that no DNB occurs for any rupture assuming the most reactive RCCA stuck in its fully withdrawn position.
Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 11 of 34 The following systems provide the necessary protection against a steam line rupture:
- 1. Emergency core cooling system actuation via the safety injection system logic from any of the following:
- a. Two out of three low pressurizer pressure signals.
- b. Two out of three differential pressure signals between a steam line and the remaining steam lines.
- c. Low steam line pressure (two out of four lines).
- d. Two out of three high containment pressure signals.
- 2. The overpower reactor trips (neutron flux and T) and the reactor trip occurring in conjunction with receipt of the safety injection signal.
- 3. Redundant isolation of the main feedwater lines: Sustained high flow would cause additional cooldown. Therefore, in addition to the normal control action which will close the main feedwater valves, a safety injection signal will rapidly close all feedwater control valves and feedwater isolation valves, and trip the main feedwater pumps. The trip of the main feed pumps initiates the closure of the feed pump discharge valves.
- 4. Trip of the fast acting steam line stop valves on:
- a. Hi-hi containment pressure (two out of four pressure signals)
- b. High steam flow in any two lines coincident with low-low reactor coolant system average temperature
- c. Low steamline pressure (two out of four lines)
Each steam line has a fast-closing stop valve capable of stopping flow in either direction. These four valves prevent blowdown of more than one steam generator for any break location even if one valve fails to close. For example, in the case of a break upstream of the stop valve in one line, closure of any three stop valves will prevent blowdown of the other steam generators. In particular, the arrangement precludes blowdown of more than one steam generator inside the containment and thus prevents structural damage to the containment. In addition, each main steam line incorporates a 16 inch diameter venturi type flow restrictor which is located inside the containment. The components serve to limit the rate of release of steam for an outside break.
Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 12 of 34 Steamline isolation is complete 11 seconds after the setpoint is reached. The isolation time allows 8 seconds for valve closure plus three seconds for electronic delays and signal processing.
In addition, backflow resistance orifices are installed in steam lines outside containment. These orifices limit the flow back to containment from the intact steam generators in the event of a steam line break.
14.2.5.2 Analysis of Effects and Consequences 14.2.5.2.1 Method of Analysis The analysis of the steam pipe rupture has been performed to determine:
A. The core heat flux and RCS temperature and pressure resulting from the cooldown following the steam line break. The LOFTRAN Code (Reference 1) has been used.
B. The thermal and hydraulic behavior of the core following a steam line break. A detailed thermal and hydraulic digital computer code, THINC (References 2, 3 and 5), has been used to determine if DNB occurs for the limiting core conditions computed in item A above.
The following conditions were assumed to exist at the time of a main steam line break accident:
A. End-of-life shutdown margin (1.3% k/k) at no load, equilibrium xenon conditions, and the most reactive RCCA stuck in its fully withdrawn position.
B. A negative moderator temperature coefficient corresponding to the end-of-life rodded core with the most reactive RCCA in the fully withdrawn position; the variation of the coefficient with temperature and pressure has been included. The keff versus temperature at 1050 psia corresponding to the negative moderator temperature coefficient used plus the Doppler temperature effect is shown in Figure 14.2.5-1. The Doppler power feedback assumed for this analysis is presented in Figure 14.2.5-2.
The core properties associated with the sector nearest the affected steam generator and those associated with the remaining sector were conservatively combined to obtain average core properties for reactivity feedback calculation. Further, it was conservatively assumed that the core power distribution was uniform. These two conditions cause underprediction of the reactivity feedback in the high power region near the stuck rod. To verify the conservatism of this method, the reactivity as well as the power distribution was checked for the limiting conditions for the cases analyzed. This core analysis considered the Doppler reactivity from the high fuel temperature near Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 13 of 34 the stuck RCCA, moderator feedback from the high enthalpy water near the stuck RCCA, power redistribution and non-uniform core inlet temperature effects. For cases in which steam generation occurs in the high flux regions of the core, the effect of void formation was also included. It was determined that the reactivity employed in the kinetics analysis was always larger than the reactivity calculated including the above local effects for the statepoints. These results verify conservatism; i.e., underprediction of negative reactivity feedback from power generation.
C. Minimum capability for injection of boric acid (2400 ppm) solution from the RWST corresponding to the most restrictive single failure in the safety injection system. The emergency core cooling system (ECCS) consists of the following systems:
- 1. the passive accumulators,
- 2. the low head safety injection (residual heat removal) system,
- 3. the intermediate head safety injection system, and
- 4. the high head safety injection (charging) system. Only the high head safety injection (charging) system and the passive accumulators are modeled for the steam line break accident analysis. The modeling of the safety injection system in LOFTRAN is described in Reference 1. Figure 14.2.5-3 presents the safety injection flow rates as a function of RCS pressure assumed in the analysis. The flow corresponds to that delivered by one charging pump delivering its full flow to the cold leg header. No credit has been taken for the low concentration borated water, which must be swept from the lines downstream of the RWST isolation valves prior to the delivery of boric acid to the reactor coolant loops. For this analysis, a boron concentration of 0 ppm for the boron injection tank is assumed.
For the cases where offsite power is assumed, the sequence of events in the safety injection system is the following. After the generation of the safety injection signal (appropriate delays for instrumentation, logic, and signal transport included), the appropriate valves begin to operate and the high head safety injection pump starts. In 27 seconds, the valves are assumed to be in their final position and the pump is assumed to be at full speed and to draw suction from the RWST. The volume containing the low concentration borated water is swept into core before the 2400 ppm borated Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 14 of 34 water reaches the core. This delay, described above, is inherently included in the modeling.
In cases where offsite power is not available, an additional 10 second delay is assumed to start the diesel generators and to commence loading the necessary safety injection equipment onto them.
D. Design value of the steam generator heat transfer coefficient.
E. Four combinations of break sizes and initial plant conditions have been considered in determining the core power transient which can result from large area pipe breaks.
- a. Complete severance of a pipe downstream of the steam flow restrictor with the plant initially at no load conditions and all reactor coolant pumps running.
- b. Complete severance of a pipe inside the containment at the outlet of the steam generator (upstream of the steam flow restrictor) with the same plant conditions as above.
- c. Case (a) above with loss of off-site power simultaneous with the generation of the safety injection signal (loss of AC power results in reactor coolant pump coastdown).
- d. Case (b) above with the loss of offsite power simultaneous with the safety injection signal.
A fifth case was analyzed to show that the DNBR remains above the limit value in the event of the spurious opening of a steam dump or relief valve.
- e. A break equivalent to a steam flow of 265 lbs per second at 1100 psia from one steam generator with offsite power available.
F. Power peaking factors corresponding to one stuck RCCA are determined at end of core life assuming non-uniform core inlet coolant temperatures. The coldest core inlet temperatures are assumed to occur in the sector with the stuck rod. The power peaking factors account for the effect of the local void in the region of the stuck control assembly during the return to power phase following the steam line break.
This void in conjunction with the large negative moderator coefficient partially offsets the effect of the stuck assembly. The power peaking factors depend upon Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 15 of 34 the core power, temperature, pressure, and flow, and are thus different for each case studied.
The analyses assumed initial hot shutdown conditions at time zero since this represents the most pessimistic initial condition. Should the reactor be just critical or operating at power at the time of a steam line break, the reactor will be tripped by the normal overpower protection system when power level reaches a trip point.
Following a trip at power the reactor coolant system contains more stored energy than at no-load, the average coolant temperature is higher than at no-load and there is appreciable energy stored in the fuel. Thus, the additional stored energy is removed via the cooldown caused by the steam line break before the no-load conditions of RCS temperature and shutdown margin assumed in the analyses are reached. After the additional stored energy has been removed, the cooldown and reactivity insertions proceed in the same manner as in the analysis which assumes no-load conditions at time zero.
In addition, since the initial steam generator water inventory is greatest at no-load, the magnitude and duration of RCS cooldown are more severe than for steam line breaks occurring at power.
G. In computing the steam flow during a steam line break, the Moody Curve (Reference 4) for fL/D = 0 is used.
H. The total delay time assumed for the steamline isolation is 11 seconds from receipt of actuation signal. The 11 second steamline isolation time includes valve closure time, and electronics and sensor delay. For breaks downstream of the isolation valves, closure of all valves would completely terminate the blowdown. For any break, in any location following steamline isolation, no more than one steam generator would experience an uncontrolled blowdown even if one of the isolation valves fails to close.
Plant characteristics and initial conditions are shown in Table 14.1.0-2.
14.2.5.2.2 Results The limiting case for Cases a through e was shown to be the double-ended rupture located upstream of the flow restrictor with offsite power available (case b). Table 14.2.5-1 lists the limiting statepoints for this worst case. The results presented are a conservative indication of the events, which would occur assuming a steam line rupture.
Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 16 of 34 Figures 14.2.5-4 through 14.2.5-6 show the RCS transient and core heat flux following a main steam line rupture (complete severance of a pipe) upstream of the flow restrictor at initial no-load conditions.
Offsite power is assumed available so that full reactor coolant flow exists. The transient shown assumes an uncontrolled steam release from only one steam generator. Should the core be critical at near zero power when the rupture occurs the initiation of safety injection by high differential pressure between any steamline and the remaining steamlines or by low steam line pressure or low pressurizer pressure or high containment pressure will trip the reactor. Steam release from more than one steam generator will be prevented by automatic trip of the fast acting isolation valves in the steam lines by high-high containment pressure signals or low steamline pressure or high steam flow coincident with low-low T-avg. Even with the failure of one valve, release from the other steam generators is terminated by steamline isolation while the one generator blows down. The steam line stop valves are assumed to be fully closed in less than 11 seconds from receipt of a closure signal.
As shown in Figure 14.2.5-6, the core attains criticality with the RCCAs inserted (with the design shutdown margin assuming one stuck RCCA) before boron solution (2400 ppm from RWST) enters the RCS. A peak core power less than the nominal full power value is attained.
The calculation assumes the boric acid is mixed with, and diluted by, the water flowing in the RCS prior to entering the reactor core. The concentration after mixing depends upon the relative flow rates in the RCS and in the safety injection system. The variation of mass flow rate in the RCS due to water density changes is included in the calculation as is the variation of flow rate in the safety injection system due to changes in the RCS pressure. The safety injection system flow calculation includes the line losses in the system as well as the pump head curve.
The assumed steam release for an accidental depressurization of the main steam system (case e) is the maximum capacity of any single steam dump, relief, or safety valve. Safety injection is initiated automatically by low pressurizer pressure. Operation of one centrifugal charging pump is assumed. Boron solution at 2400 ppm enters the RCS providing sufficient negative reactivity to prevent core damage. The transient is quite conservative with respect to cooldown, since no credit is taken for the energy stored in the system metal other than that of the fuel elements or the energy stored in the other steam generators. Since the transient occurs over a period of about 5 minutes, the neglected stored energy is likely for this event to have a significant effect in slowing the cooldown. The DNB transient is bounded by the limiting case for a steamline rupture.
Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 17 of 34 The DNB analysis for the limiting case (double-ended rupture located upstream of the flow restrictor) showed that the minimum DNBR remained above the limit value. The DNBR correlation limit for the hypothetical steamline break event is 1.45 for the W-3 DNB correlation.
The calculated sequence of events for the limiting case (double-ended rupture located upstream of the flow restrictor) are shown in Table 14.2.5-2.
14.2.5.3 Radiological Consequence Analysis See Unit 1 Section 14.2.5.3.
14.2.5.4 Conclusions The analysis has shown that the criteria stated earlier are satisfied.
Although DNB and possible clad perforation following a steam pipe rupture can be acceptable and is not precluded by the criteria, the above analysis, in fact, shows that no DNB occurs for the rupture (including an accidental depressurization of the main steam system) assuming the most reactive RCCA stuck in its fully withdrawn position.
14.2.5.5 References for Section 14.2.5
- 1. Burnett, T, W. T., et al., "LOFTRAN Code Description, "WCAP-7907-A, April 1984.
- 2. Hochreiter, L. E., "Application of the THINC-IV Program to PWR Design, "WCAP- 8054-P-A, February 1989.
- 3. Hochreiter, L. E., Chelemer, H., Chu, P. T, "THINC-IV An Improved Program for Thermal-Hydraulic Analysis of Rod Bundle Cores," WCAP-7956-A, February 1989.
- 4. Moody, F. S., "Transactions of the ASME, Journal of Heat Transfer, "Figure 3, Page 134, February 1965.
- 5. Friedland, A. J. and Ray, S. Improved THINC-IV Modeling for PWR Core Design, WCAP-12330-P, August 1989.
- 6. Good, B. P. , Allen, J. J., and Szweda, N. A., "Reactor Internals Upflow Conversion Program Engineering Report Par Donald C. Cook Generation Station Unit 2," WCAP-18282-P, Rev 2, March 2018 (Proprietary).
Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 18 of 34 14.2.6 Rupture of Control Rod Drive Mechanism (CRDM) Housing (RCCA Ejection) 14.2.6.1 Identification of Causes and Accident Description This accident is defined as the mechanical failure of a control rod mechanism pressure housing resulting in the ejection of a RCCA and drive shaft. The consequence of this mechanical failure, in addition to being a minor loss-of-coolant accident, is a rapid positive reactivity insertion together with an adverse core power distribution, possibly leading to localized fuel rod damage. The resultant core thermal power excursion is limited by the Doppler reactivity effect of the increased fuel temperature and terminated by reactor trip actuated by high neutron flux signals.
14.2.6.1.1 Design Precautions and Protection Certain features in Westinghouse Pressurized Water Reactors are intended to preclude the possibility of a rod ejection accident, or to limit the consequences if the accident were to occur.
These include a sound conservative mechanical design of the rod housing, together with a thorough quality control (testing) program during assembly, and a nuclear design which lessens the potential ejection worth of RCCAs and minimizes the number of assemblies inserted at high power levels.
14.2.6.1.1.1 Mechanical Design The mechanical design is discussed in Section 3.2. Mechanical design and quality control procedures are intended to preclude the possibility of a RCCA drive mechanism housing failure are listed below:
- 1. Each full length control rod drive mechanism housing is completely assembled and shop tested at 3110 psi.
- 2. The pressure housings are individually hydro tested. The lower latch housing to nozzle connection is hydro tested with the replacement RVCH.
- 3. Stress levels in the mechanism are not affected by anticipated system transients at power, or by the thermal movement of the coolant loops. Moments induced by the design earthquake can be accepted within the allowable primary working stress range specified by the ASME Code,Section III, for Class 1 components.
- 4. The latch mechanism housing and rod travel housing are each a single length of stainless steel. This material exhibits excellent notch toughness at all temperatures which will be encountered.
Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 19 of 34 A significant margin of strength in the elastic range together with the large energy absorption capability in the plastic range gives additional assurance that gross failure of the housing will not occur. The joints between the latch mechanism housing and head adapter, and between the latch mechanism housing and rod travel housing, are threaded joints reinforced by canopy type rod welds. Administrative regulations require periodic inspection of these (and other) welds.
14.2.6.1.1.2 Nuclear Design Even if a rupture of a RCCA drive mechanism housing is postulated, the operation of a plant utilizing chemical shim is such that the severity of an ejected RCCA is inherently limited. In general, the reactor is operated with the RCCAs inserted only far enough to permit load follow.
Reactivity changes caused by core depletion and xenon transients are compensated by boron changes. Further, the location and grouping of RCCA control banks are selected during the nuclear design to lessen the severity of a RCCA ejection accident. Therefore, should a RCCA be ejected from its normal position during full power operation, only a minor reactivity excursion, at worst, could be expected to occur.
However, it may be occasionally desirable to operate with larger than normal insertions. For this reason, a rod insertion limit is defined as a function of power level. Operation with the RCCAs above this limit guarantees adequate shutdown capability and acceptable power distribution. The position of all RCCAs is continuously indicated in the control room. An alarm will occur if a bank of RCCAs approaches its insertion limit or if one RCCA deviates from its bank. There are low and low-low level insertion monitors with visual and audio signals. Operating instructions require boration at low level alarm and emergency boration at the low-low alarm. The RCCA position monitoring and alarm systems have been described in detail in Chapter 7.
14.2.6.1.1.3 Reactor Protection The reactor protection in the event of a rod ejection accident has been described in Reference (1).
The protection for this accident is provided by high neutron flux trip (high and low setting) and high rate of neutron flux increase trip. These protection functions are described in detail in Chapter 7.
14.2.6.1.1.4 Effects on Adjacent Housings Disregarding the remote possibility of the occurrence of a RCCA mechanism housing failure, investigations have shown that failure of a housing due to either longitudinal or circumferential cracking would not cause damage to adjacent housings leading to an increase in severity of the initial accident.
Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 20 of 34 The operating coil stack assembly of this mechanism has a 10.718 inch by 10.718 inch cross section and a 39.875 inch length. The position indicator coil stack assembly (not shown) is located above the operating coil stack assembly. It surrounds the rod travel housing over nearly its entire 163.24 inch length. The rod travel housing outside diameter is 3.75 inches and the position indicator stack assembly inside and outside diameters are 3.75 inches and 7.0 inches, respectively.
This assembly consists of a steel tube surrounded by a continuous stack of copper wire coils. The assembly is held together by two end plates, an outer sleeve, and four axial tie rods.
14.2.6.1.1.5 Effects of Rod Travel Housing Longitudinal Failures If a longitudinal failure of the rod travel housing should occur, the region of the position indicator assembly opposite the break would be stressed by the reactor coolant pressure. The most probable leakage path would be provided by the radial deformation of the position indicator coil assembly, resulting in the growth of axial flow passages between the rod travel housing and the steel tube.
If failure of the position indicator coil assembly should occur, the resulting free radial jet from the failed housing could cause it to bend and contact adjacent rod housings. If the adjacent housings were on the periphery, they might bend outward from their bases. The housing material is quite ductile; plastic hinging without cracking would be expected. Housings adjacent to a failed housing, in locations other than the periphery, would not be bent because of the rigidity of multiple adjacent housings.
14.2.6.1.1.6 Effect of Rod Travel Housing Circumferential Failures If circumferential failure of a rod travel housing should occur, the broken-off section of the housing would be ejected vertically because the driving force is vertical and the position indicator coil stack assembly and the drive shaft would tend to guide the broken-off piece upwards during its travel.
Travel is limited by the missile shield, thereby limiting the projectile acceleration. When the projectile reaches the missile shield it would partially penetrate the shield and dissipate its kinetic energy. The water jet from the break would continue to push the broken-off piece against the missile shield.
If the broken-off piece of the rod travel housing were short enough to clear the break when fully ejected, it would rebound after impact with the missile shield. The top end plates of the position indicator coil stack assemblies would prevent the broken piece from directly hitting the rod travel housing of a second drive mechanism. Even if a direct hit by the rebounding piece were to occur, the low kinetic energy of the rebounding projectile would not be expected to cause significant damage.
Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 21 of 34 14.2.6.1.1.7 Possible Consequences From the above discussion, the probability of damage to an adjacent housing must be considered remote. However, even if damage is postulated, it would not be expected to lead to a more severe transient since RCCAs are inserted in the core in symmetric patterns, and control rods immediately adjacent to worst ejected rods are not in the core when the reactor is critical. Damage to an adjacent housing could, at worst, cause that RCCA not to fall on receiving a trip signal, however this is already taken into account in the analysis by assuming a stuck rod adjacent to the ejected rod.
14.2.6.1.1.8 Summary The considerations given above to the conclusion that failure of a control rod housing, due either to longitudinal or circumferential cracking, would not cause damage to adjacent housings that would increase severity of the initial accident.
14.2.6.1.2 Limiting Criteria Due to the extremely low probability of a RCCA ejection accident, some fuel damage could be considered an acceptable consequence, provided there is no possibility of the off-site or control room consequences exceeding the limits specified in Regulatory Guide 1.183 and 10CFR50.67 .
Although severe fuel damage to a portion of the core may in fact be acceptable, it is difficult to treat this type of accident on a sound theoretical basis. For this reason, criteria for the threshold of fuel failure are established, and it is demonstrated that this limit will not be exceeded.
Comprehensive studies of the threshold of fuel failure and of the threshold of significant conversion of the fuel thermal energy to mechanical energy, have been carried out as part of the SPERT project by the Idaho Nuclear Corporation (Reference 2). Extensive tests of zirconium clad UO2 fuel rods representative of those in pressurized water reactor type cores have demonstrated failure thresholds in the range of 240 to 257 cal/gm. However, other rods of a slightly different design have exhibited failures as low as 225 cal/gm. These results differ significantly from the TREAT (Reference 3) results, which indicated a failure threshold of 280 cal/gm. Limited results have indicated that this threshold decreases by about 10 percent with fuel burnup. The clad failure mechanism appears to be melting for zero burnup rods and brittle fracture for irradiated rods. Also important is the conversion ratio of thermal to mechanical energy. This ratio becomes marginally detectable about 300 cal/gm for unirradiated rods and 200 cal/gm for irradiated rods; catastrophic failures, (large fuel dispersal, large pressure rise) even for irradiated rods, did not occur below 300 cal/gm.
Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 22 of 34 In view of the above experimental results, criteria are applied to ensure that there is little or no possibility of fuel dispersal in the coolant, gross lattice distortion, or severe shock waves. These criteria are as follows and are further described in References 4 and 5:
A. Average fuel pellet enthalpy at hot spot below 200 cal/g for irradiated or unirradiated fuel.
B. Peak reactor coolant pressure less than that which could cause stresses to exceed the faulted condition stress limits.
C. Fuel melting will be limited to less than ten percent 10% of the fuel volume at the hot spot even if the average fuel pellet enthalpy is below the limits of criterion A above.
It should be noted that the original FSAR (Reference 6) includes an additional criterion that the average clad temperature at the hot spot must remain below 2700°F. The elimination of the clad temperature criterion for RCCA ejection accident is consistent with the revised Westinghouse acceptance criteria for this event, as discussed in Reference (5).
14.2.6.2 Analysis of Effects and Consequences 14.2.6.2.1 Method of Analysis The calculation of the RCCA ejection transient is performed in two stages, first an average core channel calculation and then a hot region calculation. The average core calculation is performed using spatial neutron kinetics methods to determine the average power generation with time including the various total core feedback effects, i.e., Doppler reactivity and moderator reactivity.
Enthalpy and temperature transients in the hot spot are then determined by multiplying the average core energy generation by the hot channel factor and performing a fuel rod transient heat transfer calculation. The power distribution calculated without feedback is pessimistically assumed to persist throughout the transient. A detailed discussion of the method of analysis can be found in Reference (4).
14.2.6.2.2 Average Core Analysis The spatial kinetics computer code, TWINKLE (Reference 7), is used for the average core transient analysis. This code solves the two group neutron diffusion theory kinetic equation in one, two or three spatial dimensions (rectangular coordinates) for six delayed neutron groups and up to 2000 spatial points. The computer code includes a detailed multi-region, transient fuel-clad-coolant heat transfer model for calculation of point-wise Doppler and moderator feedback effects. In this analysis, the code is used as a one dimensional axial kinetics code since it allows a more realistic Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 23 of 34 representation of the spatial effects of axial moderator feedback and RCCA movement. However, since the radial dimension is missing, it is still necessary to employ very conservative methods (described below) of calculating the ejected rod worth and hot channel factor. Further description of TWINKLE appears in Section 14.1.0.10.
14.2.6.2.3 Hot Spot Analysis In the hot spot analysis, the initial heat flux is equal to the nominal times the design hot channel factor. During the transient, the heat flux hot channel factor is linearly increased to the transient value in 0.1 second, the time for full ejection of the rod. Therefore, the assumption is made that the hot spot before and after ejection are coincident. This is very conservative since the peak after ejection will occur in or adjacent to the assembly with the ejected rod, and prior to ejection the power in this region will necessarily be depressed.
The hot spot analysis is performed using the detailed fuel and clad transient heat transfer computer code, FACTRAN (Reference 8). This computer code calculates the transient temperature distribution in a cross section of a metal clad UO2 fuel rod, and the heat flux at the surface of the rod, using as input the nuclear power versus time and the local coolant conditions. The zirconium-water reaction is explicitly represented, and all material properties are represented as functions of temperature. A conservative radial power distribution is used within the fuel rod.
FACTRAN uses the Dittus-Boelter or Jens-Lottes correlation to determine the film heat transfer before DNB, and the Bishop-Sandberg-Tong correlation (Reference 9) to determine the film boiling coefficient after DNB. The Bishop-Sandberg-Tong correlation is conservatively used assuming zero bulk fluid quality. The DNB ratio is not calculated, instead the code is forced into DNB by specifying a conservative DNB heat flux. The gap heat transfer coefficient can be calculated by the code; however, it is adjusted in order to force the full power steady-state temperature distribution to agree with the fuel heat transfer design codes. Further description of FACTRAN appears in Section 14.1.0.10.
14.2.6.2.4 System Overpressure Analysis Because safety limits for fuel damage specified earlier are not exceeded, there is little likelihood of fuel dispersal into the coolant. The pressure surge may therefore be calculated on the basis of conventional heat transfer from the fuel and prompt heat generation in the coolant.
The pressure surge is calculated by first performing the fuel heat transfer calculation to determine the average and hot spot heat flux versus time. Using this heat flux data, a THINC (References 10, 11 and 13) calculation is conducted to determine the volume surge. Finally, the volume surge is simulated in the LOFTRAN computer code (Reference 12). This code calculates the pressure Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 24 of 34 transient taking into account fluid transport in the RCS and heat transfer to the steam generators.
No credit is taken for the possible pressure reduction caused by the assumed failure of the control rod pressure housing.
Input parameters for the analysis are conservatively selected on the basis of values calculated for this type of core. The more important parameters are discussed below. Table 14.2.6-1 presents the parameters used in this analysis.
14.2.6.2.5 Ejected Rod Worths and Hot Channel Factors The values for ejected rod worths and hot channel factors are calculated using either three dimensional static methods or by a synthesis method employing one dimensional and two dimensional calculations. Standard nuclear design codes are used in the analysis. No credit is taken for the flux flattening effects of reactivity feedback. The calculation is performed for the maximum allowed bank insertion at a given power level, as determined by the rod insertion limits.
Adverse xenon distributions are considered in the calculation to provide worst case results.
Appropriate margins are added to the ejected rod worth and hot channel factors to account for any calculational uncertainties, including an allowance for nuclear power peaking due to densification.
Power distribution before and after ejection for a worst case can be found in Reference (4). Startup physics testing validates the analytical models used in the design and analysis, which inherently validates the ejected rod worths and power peaking factors used in the analysis. Experience has shown that the ejected rod worth and power peaking factors are consistently overpredicted in the analysis.
14.2.6.2.6 Reactivity Feedback Weighting Factors The largest temperature rises, and hence the largest reactivity feedbacks occur in channels where the power is higher than average. Since the weight of a region is dependent on flux, these regions have high weights. This means that the reactivity feedback is larger than that indicated by a simple channel analysis. Physics calculations have been carried out for temperature changes with a flat temperature distribution, and with a large number of axial and radial temperature distributions.
Reactivity changes were compared and effective weighting factors determined. These weighting factors take the form of multipliers which, when applied to single channel feedbacks, correct them to effective whole core feedbacks for the appropriate flux shape. In this analysis, since a one dimensional (axial) spatial kinetics method is employed, axial weighting is not necessary if the initial condition is made to match the ejected rod configuration. In addition, no weighting is applied to the moderator feedback. A conservative radial weighting factor is applied to the transient fuel temperature to obtain an effective fuel temperature as a function of time accounting Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 25 of 34 for the missing spatial dimension. These weighting factors have also been shown to be conservative compared to three dimensional analysis Reference (4).
14.2.6.2.7 Moderator and Doppler Coefficient The critical boron concentrations at the beginning of life and end of life are adjusted in the nuclear code in order to obtain moderator density coefficient curves which are conservative compared to actual design conditions for the plant. As discussed above, no weighting factor is applied to these results. The resulting moderator temperature coefficient is at least +5 pcm/oF at the appropriate zero or full power nominal average temperature, and becomes less positive for higher temperatures. This is necessary since the TWINKLE computer code utilized in the analyses is a diffusion-theory code rather than a point-kinetics approximation and the moderator temperature feedback cannot be artificially held constant with temperature.
The Doppler reactivity defect is determined as a function of power level using a one dimensional steady-state computer code with a Doppler weighting factor of 1.0. The Doppler weighting factor will increase under accident conditions, as discussed above.
14.2.6.2.8 Delayed Neutron Fraction, eff Calculations of the effective delayed neutron fraction (eff) typically yield values no less than 0.70% at beginning of life and 0.50% at end of life. The accident is sensitive to eff if the ejected rod worth is equal to or greater than eff as in zero power transients. In order to allow for future cycles, pessimistic estimates of eff of 0.50% at beginning of a cycle and 0.40% at end of a cycle were used in the analysis.
14.2.6.2.9 Trip Reactivity Insertion The trip reactivity insertion assumed is given in Table 14.2.6-1 and includes the effect of one stuck RCCA adjacent to the ejected rod. These values are reduced by the ejected rod reactivity. The shutdown reactivity was simulated by dropping a rod of the required worth into the core. The start of rod motion occurred 0.5 second after the high neutron flux trip point is reached. The curve of trip rod insertion versus time is shown in Figure 14.1.0-2 which assumed that insertion to dashpot does not occur until 2.7 seconds after the start of fall. The choice of such a conservative insertion rate means that there is over one second after the trip point is reached before significant shutdown reactivity is inserted into the core. This is particularly important conservatism for hot full power accidents.
The minimum design shutdown margin available for this plant at hot zero power (HZP) may be reached only at end of life in the equilibrium cycle. This value includes an allowance for the worst Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 26 of 34 stuck rod, an adverse xenon distribution, conservative Doppler and moderator defects, and an allowance for calculational uncertainties. Physics calculations have shown that the effect of two stuck RCCAs (one of which is the worst ejected rod) is to reduce the shutdown by about an additional 1 %k/k. Therefore, following a reactor trip resulting from an RCCA ejection accident, the reactor will be subcritical when the core returns to HZP.
Depressurization calculations have been performed assuming the maximum possible size break (2.75 inch diameter) located in the reactor pressure vessel head. The results show a rapid pressure drop and a decrease in system water mass due to the break. The emergency core cooling system (ECCS) is actuated on low pressurizer pressure within one minute after the break. The RCS pressure continues to drop and reaches saturation (1100 to 1300 psi depending on the system temperature) in about two to three minutes. Due to the large thermal inertia of the primary and secondary system, there has been no significant decrease in the RCS temperature below no-load by this time, and the depressurization itself has caused an increase in shutdown margin by about 0.2 %k/k due to the pressure coefficient. The cooldown transient could not absorb the available shutdown margin until more than 10 minutes after the break. The addition of borated safety injection flow (supplied from the RWST) starting one minute after the break is much more than sufficient to ensure that the core remains subcritical during the cooldown.
The only reactor trip function assumed in the analysis for this event is power range high neutron flux, both high and low setting.
14.2.6.2.10 Results Table 14.2.6-1 summarizes the results. Cases are presented for both beginning and end of life at zero and full power.
A. Beginning of Cycle, Full Power Control Bank D was assumed to be inserted to its insertion limit. The worst ejected rod worth and hot channel factor were conservatively calculated to be 0.15 %k/k and 7.0 respectively. The peak spot fuel center temperature reached melting, conservatively assumed at 4900°F. However, melting was restricted to less than 10% of the pellet.
B. Beginning of Cycle, Zero Power Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 27 of 34 For this condition, Control Bank D was assumed to be fully inserted and banks B and C were at their insertion limits. The worst ejected rod is located in Control Bank D and has a worth of 0.75 %k/k and a hot channel factor of 12.0. The fuel center temperature was 3922°F.
C. End of Cycle, Full Power Control Bank D was assumed to be inserted to its insertion limit. The ejected rod worth and hot channel factors were conservatively calculated to be 0.19 %k/k and 7.3 respectively. The peak hot spot fuel center temperature reached melting at 4800°F. However, melting was restricted to less than 10% of the pellet.
D. End of Cycle, Zero Power The ejected rod worth and hot channel factor for this case were obtained assuming Control Bank D to be fully inserted and banks B and C at their insertion limits. The results were 0.89 %k/k and 25.0 respectively. The fuel center temperature was 4009°F. The Doppler weighting factor for this case is significantly higher than for the other cases due to the very large transient hot channel factor.
For all the cases analyzed, average fuel pellet enthalpy at the hot spot remains below 200 cal/g.
The nuclear power and hot spot fuel and clad temperature transients for two cases (BOL full power and BOL zero power) are presented in Figures 14.2.6-1 and 14.2.6-2.
The ejection of an RCCA constitutes a break in the RCS, located in the reactor pressure vessel head. Following the RCCA ejection, the operator would follow the same emergency instructions as for any other LOCA to recover from the event.
14.2.6.2.11 Pressure Surge A detailed calculation of the pressure surge for an ejection worth of one dollar at beginning of life, hot full power, indicates that the peak pressure does not exceed that which would cause stress to exceed the faulted condition stress limits (Reference 4). Since the severity of the present analysis does not exceed the "worst case" analysis, the accident for this plant will not result in an excessive pressure rise or further adverse effects to the RCS.
Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 28 of 34 14.2.6.2.12 Lattice Deformations A large temperature gradient will exist in the region of the hot spot. Since the fuel rods are free to move in the vertical direction, differential expansion between separate rods cannot produce distortion. However, the temperature gradients across individual rods may produce a differential expansion tending to bow the midpoint of the rods toward the hotter side of the rod. Calculations have indicated that this bowing would result in a negative reactivity effect at the hot spot since Westinghouse cores are under-moderated, and bowing will tend to increase the under-moderation at the hot spot. In practice, no significant bowing is anticipated, since the structural rigidity of the core is more than sufficient to withstand the forces produced. Boiling in the hot spot region would produce a net flow away from that region. However, the heat from the fuel is released to the water relatively slowly, and it is considered inconceivable that cross flow will be sufficient to produce significant lattice forces. Even if massive and rapid boiling, sufficient to distort the lattice, is hypothetically postulated, the large void fraction in the hot spot region would produce a reduction in the total core moderator to fuel ratio, and a large reduction in this ratio at the hot spot. The net effect would therefore be a negative feedback. It can be concluded that no conceivable mechanism exists for a net positive feedback resulting from lattice deformation. In fact, a small negative feedback may result. The effect is conservatively ignored in the analysis.
14.2.6.3 Radiological Consequence Analysis See Unit 1 Section 14.2.6.21.
14.2.6.4 Conclusions Even on a pessimistic basis, the analyses indicate that the described fuel and clad limits are not exceeded. It is concluded that there is no likelihood of sudden fuel dispersal into the coolant.
Since the peak pressure does not exceed that which would cause stresses to exceed the faulted condition stress limits, it is concluded that there is no likelihood of further consequence to the RCS. The analyses have demonstrated the fission product release as a result of fuel rods entering DNB is limited to less than 10% of the fuel rods in the core.
Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 29 of 34 14.2.6.5 References for Section 14.2.6
- 1. Burnett, T. W. T., "Reactor Protection System Diversity in Westinghouse Pressurized Water Reactors," WCAP-7306, April 1969.
- 2. Taxelius, T. G. (Ed), "Annual Report - SPERT Project, October 1968, September 1969,"
Idaho Nuclear Corporation IN-1370, June 1970.
- 3. Liimataninen, R. C. and Testa, F. J., "Studies in TREAT of Zircaloy-2 Clad, UO Core Simulated Fuel Elements," ANL-7225, January-June 1966, p. 177, November 1966.
- 4. Risher, D. H., Jr., "An Evaluation of the Rod Ejection Accident of Westinghouse Pressurized Water Reactors Using Spatial Kinetics Methods," WCAP-7588, Revision 1A, January 1975.
- 5. NS-NRC-89-3466, "Use of 2700°F PCT Acceptance Limit in Non-LOCA Accidents",
Letter from W. J. Johnson (Westinghouse) to Mr. Robert C. Jones (NRC), October 23, 1989.
- 6. Donald C. Cook Nuclear Plant Unit 2 Final Safety Analysis Report, USNRC Docket No.
50-316, Amendment 75, April 1977.
- 7. Risher, D. H., Jr., and Barry, R. F., "TWINKLE - a Multi-Dimensional Neutron Kinetics Computer Code," WCAP-8028-A, January 1975.
- 8. Hargrove, H.G., "FACTRAN - A FORTRAN-IV Code for Thermal Transients in a UO2 Fuel Rod," WCAP-7908, June 1972.
- 9. Bishop, A. A., Sandberg, R. O., and Tong, L. S., "Forced Convection Heat Transfer at High Pressure After the Critical Heat Flux," ASME 65-HT-31, August 1965.
- 10. Hochreiter, L. E., "Application of the THINC-IV Program to PWR Design," WCAP-8054-P-A, February 1989.
- 11. Hochreiter, L.E., Chelemer, H., Chu, P. T., "THINC-IV An Improved Program for Thermal-Hydraulic Analysis of Rod Bundle Cores," WCAP-7956-A, February 1989.
- 12. Burnett, T. W. T., et al., "LOFTRAN Code Description, "WCAP-7907-A, April 1984.
- 13. Friedland, A.J. and Ray, S., Improved THINC IV Modeling for PWR Core Design, WCAP-12330-P, August 1989.
Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 30 of 34 14.2.7 Secondary Systems Accident Environmental Consequences Refer to Section 14.2.7 for Unit 1.
14.2.8 Major Rupture of Main Feedwater Pipe (Feedline Break) 14.2.8.1 Identification of Causes and Accident Description A major feedwater line rupture is defined as a break in a feedwater line large enough to prevent the addition of sufficient feedwater to the steam generators to maintain shell side fluid inventory in the steam generators. If the break is postulated in a feedwater line between the check valve and the steam generator, fluid from the steam generator may also be discharged through the break.
Further, a break in this location could preclude the subsequent addition of emergency feedwater to the affected steam generator. (A break upstream of the feedwater line check valve would affect the nuclear steam supply system only as a loss of normal feedwater, considered in Section 14.1.9).
Depending upon the size of the break and the plant operating conditions at the time of the break, the break could cause either a RCS cooldown (by excessive energy discharge through the break) or a RCS heatup. Potential RCS cooldown resulting from a secondary pipe rupture is evaluated in the steamline break event. Therefore, only the RCS heatup effects are evaluated for a feedwater line rupture.
A feedwater line rupture reduces the ability to remove heat generated by the core from the RCS for the following reasons:
- a. Feedwater flow to the steam generators is reduced. Since feedwater is subcooled, its loss may cause reactor coolant temperatures to increase prior to reactor trip.
- b. Fluid in the steam generator may be discharged through the break, and would then not be available for decay heat removal after trip.
- c. The break may be large enough to prevent the addition of any main feedwater after trip.
An auxiliary feedwater system is provided to assure that adequate feedwater will be available such that:
- a. No substantial overpressurization of the RCS shall occur.
- b. Sufficient liquid in the RCS shall be maintained so that the core remains in place and geometrically intact with no loss of core cooling capability.
Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 31 of 34 The severity of the feedwater line rupture transient depends on a number of system parameters including break size, initial reactor power, and credit taken for the functioning of various control and safety systems. Sensitivity studies have shown that the most limiting feedwater line rupture is a double-ended rupture of the largest feedwater line. Analyses have been performed at full power with and without loss of offsite power.
The following provides the protection for a main feedwater line rupture:
- a. A reactor trip on any of the following conditions:
- 1. High pressurizer pressure
- 2. Overtemperature T
- 3. Low-low steam generator water level in any steam generator
- 4. Safety injection signals from any of the following:
- i. Low steam line pressure ii. High containment pressure (Hi-1) iii. High steam line differential pressure.
- b. An auxiliary feedwater system to provide an assured source of feedwater to the steam generators for decay heat removal.
- c. A safety injection signal can also be generated upon reaching a low pressurizer pressure setpoint.
14.2.8.2 Analysis of Effects and Consequences 14.2.8.2.1 Method of Analysis A detailed analysis using the LOFTRAN Code (Reference 1) is performed in order to determine the plant transient following a feedwater line rupture. The code describes the plant thermal kinetics, RCS including natural circulation, pressurizer, steam generators and feedwater system, and computes pertinent variables including the pressurizer pressure, pressurizer water level, and reactor coolant average temperature. The code also calculates pump coastdown flow and natural circulation flow during a feedline rupture.
The cases analyzed assume a double-ended rupture of the largest feedwater pipe at full power.
Major assumptions used in the analysis are as follows:
Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 32 of 34 A. The plant is initially operating at 102 percent of the Cook Nuclear Plant Unit 2 future rerating power level of 3608 Mwt (including pump heat).
B. The initial reactor coolant average temperature is 4.1°F higher than the nominal value of 581.3°F, and initial pressurizer pressure is 62.6 psi higher than the nominal pressure of 2250 psia. These nominal conditions bound the range of conditions possible for the potential future rerating of Cook Nuclear Plant Unit 2.
C. No credit is taken for rod control or pressurizer spray.
D. Credit is taken for the pressurizer relief valves and safety valves.
E. No credit is taken for the high pressurizer pressure reactor trip.
F. Initial pressurizer level is assumed to be at the maximum nominal setpoint (61.1%
span) plus uncertainties (5% span). Initial steam generator water level is at the nominal value plus 5% in the faulted steam generator, and at the nominal value minus 5% in the intact steam generators.
G. Reactor trip is assumed to be initiated when the low-low steam generator level trip setpoint in the ruptured steam generator is reached.
H. Main feedwater to all steam generators is assumed to stop at the time the break occurs (all main feedwater spills out through the break).
I. Saturated liquid discharge only (no steam) is assumed from the affected steam generator throughout the feedline rupture up until the time of feedring uncovery.
After the feedring is uncovered, a steam/liquid mixture discharge is assumed.
J. The worst break area of 0.717 ft2 is assumed to minimize the RCS subcooling margin.
K. The auxiliary feedwater system is actuated by operator action 10 minutes after the break occurs. A total of 600 gpm was assumed, evenly split between the 3 intact steam generators. An evaluation has been performed to justify an increase in the as-found tolerance of the main steam safety valves (MSSVs) from +/-1% to +/-3%.
The evaluation took credit for the staggered actuation of the MSSVs. The evaluation assumed that the MSSVs opened at 3% above the nominal lift pressure for each valve. The evaluation demonstrated that the secondary side pressure (assuming the staggered actuation of the MSSVs) would not exceed 1133 psia during the time when AFW is being supplied. At 1133 psia, the AFW flow split to Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 33 of 34 the three intact steam generators is 335 gpm/175 gpm/175 gpm for a total AFW flow rate of 685 gpm. Although the AFW flow split (200 gpm/200 gpm/200 gpm) assumed in the analysis is not met, the total AFW flow rate of 685 (with the splits described above) is considered to be more than sufficient to accommodate the shortfall of 25 gpm per loop for two of the three intact loops. This flow is less than any combination that 2 out of 3 pumps would normally supply.
L. No credit is taken for heat energy deposited in reactor coolant system metal during the reactor coolant system heatup.
M. No credit is taken for charging or letdown.
N. Safety injection is assumed available.
O. For the case without offsite power, there will be a flow coastdown (when the reactor trips) until flow in the loops reaches the natural circulation value.
P. Steam generator heat transfer is assumed to decrease as the shell-side liquid inventory decreases.
Q. Conservative core residual heat generation is assumed based upon long term operation at the initial power level preceding the trip. The 1979 ANS decay heat model plus two sigma uncertainty was assumed.
R. Credit is taken for operator action for the actuation of auxiliary feedwater system 10 minutes after the break occurs.
Plant characteristics and initial conditions are shown in Table 14.1.0-2 14.2.8.2.2 Results Calculated plant parameters following a major feedwater line rupture are shown in Figures 14.2.8-1 through 14.2.8-8. Results for the case with offsite power available are presented in Figures 14.2.8-1 through 14.2.8-4. Results for the case where offsite power is lost are presented in Figures 14.2.8-5 through 14.2.8-8.
The plot of pressurizer water volume clearly shows that the pressurizer does not fill. For comparison purposes, the pressurizer fills at 1899 ft3 (which includes the pressurizer surge line volume both of which accounted for a 3% increase due to thermal expansion).
The calculated sequence of events for this accident is shown in Table 14.2.8-1.
Unit 2
UFSAR Revision 30.0 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.2 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 34 of 34 14.2.8.3 Conclusions Results of the analysis show that for the postulated main feedwater line rupture, the assumed auxiliary feedwater system capacity is adequate to remove decay heat, to prevent overpressurizing the RCS, and to prevent uncovering the reactor core. Thus, all applicable acceptance criteria are met.
14.2.8.4 References for Section 14.2.8
- 1. Burnett, T. W. T., et al., "LOFTRAN Code Description," WCAP-7907-A, April 1984.
Unit 2