ML22340A150
Text
UFSAR Revision 31.0 Revised: 31.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.0, §1.1, §1.2, UPDATED FINAL SAFETY ANALYSIS REPORT & §1.3 .
Page: i of ii
1.0 INTRODUCTION
AND
SUMMARY
...................................... 1 1.0.1 Background Information: ........................................................ 2 Version vs. Revision ............................................................................................. 2 Approved Changes to the UFSAR ........................................................................ 2 FSAR Appendices ................................................................................................ 3 Historical Information ............................................................................................ 3 References .................................................................................................... 3 1.1 PLANT SITE
SUMMARY
............................................................... 5 1.1.1 Site Description ........................................................................ 5 1.1.2 Meteorology .............................................................................. 5 1.1.3 Geology and Hydrology ........................................................... 5 1.1.4 Seismology ............................................................................... 6 1.1.5 Limnology ................................................................................. 7 1.1.6 Environmental Radiation Monitoring ...................................... 7 1.2 DESIGN HIGHLIGHTS .................................................................. 8 1.2.1 Power Level .............................................................................. 8 1.2.2 Reactor Coolant Loops ............................................................ 8 1.2.3 Peak Specific Power................................................................. 8 1.2.4 Fuel Assembly Design ............................................................. 8 1.2.5 Ice Condenser Containment Structure ................................... 9 1.2.6 Other Engineered Safety Features .......................................... 9 1.2.7 Emergency Power .................................................................... 9 1.2.8 Use of Solid-State Logic Protection System ........................ 10 1.2.9 References for Section 1.2..................................................... 10 1.3
SUMMARY
PLANT DESCRIPTION ............................................... 11 1.3.1 Structures and Equipment ..................................................... 11
UFSAR Revision 31.0 Revised: 31.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.0, §1.1, §1.2, UPDATED FINAL SAFETY ANALYSIS REPORT & §1.3 .
Page: ii of ii 1.3.2 Nuclear Steam Supply System .............................................. 12 1.3.3 Reactor and Plant Control .....................................................13 1.3.4 Waste Disposal System ......................................................... 13 1.3.5 Fuel Handling System ............................................................ 13 1.3.6 Turbine and Auxiliaries .......................................................... 14 1.3.7 Electrical System .................................................................... 14 1.3.8 Safety Features....................................................................... 14 1.3.9 Shared Facilities and Equipment ..........................................15 1.3.9.a Chemical and Volume Control System ......................................... 16 1.3.9.b Spent Fuel Pit Cooling System...................................................... 16 1.3.9.c Fuel Handling System ................................................................... 17 1.3.9.d Service Water Systems ................................................................. 17 1.3.9.e Auxiliary Steam System ................................................................ 17 1.3.9.f Waste Disposal System ................................................................ 17 1.3.9.g Radiation Monitoring System ........................................................ 17 1.3.9.h Structures, Buildings And Miscellaneous ...................................... 18 1.3.9.i Component Cooling Water System ............................................... 18
UFSAR Revision 31.0 Revised: 31.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.0, §1.1, §1.2, UPDATED FINAL SAFETY ANALYSIS REPORT & §1.3 .
Page: 1 of 18
1.0 INTRODUCTION
AND
SUMMARY
This Updated Final Safety Analysis Report is submitted in accordance with the requirements of 10 CFR 50.71(e). It is based on the original FSAR, including 84 amendments, which was submitted in support of an application by Indiana & Michigan Electric Company (I&M), whose name is now Indiana Michigan Power Company (the acronym I&M is still used however) for licenses to operate two nuclear power units at its Donald C. Cook Nuclear Plant.
This submittal contains update information for the period up to six months prior to the most recent revision of this document. The update information is of a similar level of detail as that presented in the original FSAR. It includes changes necessary to reflect information and analysis submitted to the NRC or prepared pursuant to Commission requirements, and it includes changes describing physical modifications to the plant.
I&M and Westinghouse Electric Corporation have jointly participated in the design and construction of each unit. In 2000, the Unit 1 Westinghouse Model 51 lower steam generator assembly and upper internals and feedrings were replaced with Babcock and Wilcox (BWI) replacement steam generators Model 51R. Installation was performed by Bechtel. The plant is operated by I&M. Each unit employs a pressurized water reactor nuclear steam supply system furnished by Westinghouse Electric Corporation which is similar in design concept to the majority of the nuclear power plants licensed by the Nuclear Regulatory Commission. Certain components of the auxiliary systems are shared between the two units, but in no case does such sharing result in compromising or impairing the safe and continued operation of either unit. Those systems and components, which are shared, are identified herein and the effects of the sharing analyzed.
The Unit 1 reactor is currently designed for a power output of 3304 MWt and the Unit 2 reactor is designed for a power output of 3468 MWt, which are their licensed ratings. The approximate gross and net electrical outputs of Unit 1 are 1149 MWe gross and 1114 MWe net and of Unit 2 are 1255 MWe and 1220 MWe, respectively.
The remainder of Chapter 1 of this report summarizes the principal design features and safety criteria of the nuclear units, pointing out the similarities and differences with respect to other pressurized water nuclear power plants employing the same technology and basic engineering features as the Cook Nuclear Plant.
The research and development program is discussed in Section 1.6. The quality assurance program is referenced in Sub-Chapter 1.7 and is described in a separate document entitled Quality Assurance Program Description.
UFSAR Revision 31.0 Revised: 31.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.0, §1.1, §1.2, UPDATED FINAL SAFETY ANALYSIS REPORT & §1.3 .
Page: 2 of 18 Chapter 2 contains a description and evaluation of the site and environs, supporting the suitability of that site for a nuclear plant of the size and type described. Chapters 3 and 4 describe the reactors and the reactor coolant systems, Chapter 5 the containment and related systems, and Chapters 6 through 11 the emergency and other auxiliary systems.
Chapter 12 describes I&M's program for organization and training of plant personnel. Chapter 13 contains an outline and description of the initial tests and operations associated with plant startup.
Chapter 14 is a safety evaluation summarizing the analyses, which demonstrate the adequacy of the reactor protection system, and the engineered safety features systems. The consequences of various postulated accidents are within the guidelines set forth in Regulatory Guide 1.183 and 10 CFR 50.67.
The Technical Specifications for the Cook Nuclear Plant are appendices to the Operating License, and are contained in separate volumes. The Technical Specifications designate safety limits, limiting safety system settings, limiting conditions for operation, and surveillance requirements for the safe operation of the plant. Additionally, the Technical Specifications contain certain plant design features and certain administrative controls.
1.0.1 Background Information:
The following was added to the UFSAR during the Revision 17 update. The purpose of the following is to provide a synopsis of the UFSAR. This information is not considered part of the UFSAR and may be revised without initiation of a UFSAR Change Request.
Version vs. Revision Effective with the 1999 UFSAR update, the UFSAR update submittals to the NRC are given a Revision number (e.g., Revision 16.0). Periodically, interim updates are made to the UFSAR, which are distributed to plant personnel to support day-to-day activities. The interim updates are considered a version update and numbered accordingly (e.g., Version 16.6). Table 1.0-1 provides the relationship between the UFSAR Revision numbers and submittal dates to the NRC.
Approved Changes to the UFSAR The approved UFSAR Change Requests (UCRs) are considered part of the UFSAR. The approved UCRs that require a change to the facility are considered Pending changes and are not considered part of UFSAR until the change to the facility has been implemented.
UFSAR Revision 31.0 Revised: 31.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.0, §1.1, §1.2, UPDATED FINAL SAFETY ANALYSIS REPORT & §1.3 .
Page: 3 of 18 FSAR Appendices The UFSAR is controlled per the requirements of 10 CFR 50.71(e), the FSAR update rule. The original FSAR included Appendices that were not included in the UFSAR when the FSAR was converted to the Updated FSAR (UFSAR) in 1982, as such, the FSAR appendices are not part of UFSAR. During the 2001 UFSAR update, the pertinent information from Appendices M and J was incorporated into the body of the UFSAR.
Historical Information Historical Information contained in the UFSAR is information that was provided in the original FSAR to meet the requirements of 10 CFR 50.34(b) and meets one or more of the following criteria:
- a. Information that was accurate at the time the plant was originally licensed, but is not intended or expected to be updated for the life of the plant.
- b. Information that is not affected by changes to the plant or its operation.
- c. Information that does not change over time. This historical information is not normally updated. However, in some instances, such as a major change in population, the UFSAR would require a change.
Historical Information in the DC Cook UFSAR is marked using the word Historical.
References General
References:
General references are not considered part of the UFSAR, but are intended to provide background information or additional detail that the reader may refer to in order to learn more about particular material presented in the UFSAR. References to such information may be located at specific points in the UFSAR, or they may be listed at the end of UFSAR Chapters/Sections or in introductory sections. All UFSAR references are considered General References with the exception of those that are incorporated by reference as identified below.
Incorporation by
Reference:
Incorporation by reference refers to a method by which all or part of a separate source document can be made part of the UFSAR without duplicating the desired information in the UFSAR. Information that is appropriate to include in the UFSAR that is also part of a separate licensee-controlled document or technical report may be incorporated in the UFSAR by appropriate reference to that information.
UFSAR Revision 31.0 Revised: 31.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.0, §1.1, §1.2, UPDATED FINAL SAFETY ANALYSIS REPORT & §1.3 .
Page: 4 of 18 The following documents are incorporated into the UFSAR by reference:
- 1. NFPA 805 Fire Protection Program Manual (NFPPM)
- 2. Fire Safety Analysis (FSA)
- 3. Safe Shutdown Capability Assessment (R1900-0024-001)
- 4. Technical Requirements Manual (TRM)
The following documents are considered incorporated by reference, but are controlled and are updated by regulation:
- 1. Updated Quality Assurance Program Description (QAPD)
- 3. Security Plan
- 4. Environmental Protection Plan
UFSAR Revision 31.0 Revised: 31.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.0, §1.1, §1.2, UPDATED FINAL SAFETY ANALYSIS REPORT & §1.3 .
Page: 5 of 18 1.1 PLANT SITE
SUMMARY
1.1.1 Site Description The approximately 650 acre site is located along the eastern shore of Lake Michigan in Lake Township, Berrien County, Michigan about 11 miles south-southwest of Benton Harbor. The population density of the area surrounding the site is relatively low. The minimum distance from the reactor containment structures to the exclusion area is about 2000 feet, with the nearest continuously occupied resident located about 2160 feet north of the reactors. The population center distance is about eight miles. The area is primarily devoted to agricultural pursuits with some manufacturing in the Benton Harbor-St. Joseph and Niles areas.
1.1.2 Meteorology In order to obtain meteorological data for the determination of diffusion and dispersion at the site, a meteorological recording station was established on the site during the fall of 1966, and the analysis of three years data from this station is included in this report. The original meteorological system has been replaced, and the analysis of five years data from 2001 to 2005 is included in this report to supplement the original analysis.
The site is extremely well ventilated with an extremely high percentage of strong winds and a very low occurrence of thermal inversions. There is no strong preference for any particular wind direction.
1.1.3 Geology and Hydrology An investigation of site geology and hydrology was completed in 1966. The geology of the region is regular with no faults within about 50 miles of the site. The subsurface soils are adequate to support the structures, and drainage of surface and ground waters is toward the lake over almost the entire site area.
UFSAR Revision 31.0 Revised: 31.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.0, §1.1, §1.2, UPDATED FINAL SAFETY ANALYSIS REPORT & §1.3 .
Page: 6 of 18 1.1.4 Seismology The area is relatively inactive seismically with no major earthquake epicenters located within about 400 miles of the site. There has been some minor activity closer to the site but no shocks within 50 miles have been large enough to cause significant structural damage.
For design purposes, a horizontal ground acceleration of 0.10g is used. All equipment and structures necessary for plant safety have been designed to withstand the effects of a horizontal ground acceleration of 0.20g.
- 1. The Seismic Instrumentation System (SIS) performs the functions necessary to support the licensing basis requirements for seismic monitoring instrumentation at the station. The SIS consists of a computer, HMI, an uninterruptible power supply, six digital recorders, six triaxial accelerometers and associated electronic equipment. The computer and electronics are located in the Unit 1 main control room and is connected to annunciators in the Unit 1 and Unit 2 main control rooms, which illuminate when the system detects seismic motion. The SIS is a shared-unit system. The accelerometers are oriented such that both axes are pointed in the same direction and aligned along one axis. The locations of which are as follows:
- a. The 34.5kV Loop Feed Block House
- b. The top of the primary shield wall
- c. The bottom of the reactor pit
- d. The top of the crane wall
- e. The Auxiliary Building Foundation, EL. 587
- f. The Auxiliary Building, EL 633
- 2. The 34.5kV Loop Feed block House was chosen as a site free from influences of the other structures such that in the event of seismic excitation the accelerometer will effectively measure actual ground acceleration.
- 3. The top of primary shield wall and the bottom of the reactor pit were chosen, as they represent a rigid part of the containment and will, by considerations of geometry, be used to determine the rigid body rotation of the containment foundation.
- 4. The Auxiliary Building was chosen as an independent Seismic Category I structure whose seismic response is different than that of containment.
UFSAR Revision 31.0 Revised: 31.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.0, §1.1, §1.2, UPDATED FINAL SAFETY ANALYSIS REPORT & §1.3 .
Page: 7 of 18
- 5. Recording is activated automatically at 0.02g acceleration and annunciators in the control rooms are illuminated. Actions taken subsequent to a seismic event are in accordance with the surveillance requirements of the Technical Requirements Manual.
- 6. In addition to the above instrumentation, a number of peak acceleration or peak displacement recorders similar to scratch plates are placed on selected Class I structures and the 34.5kV Loop Feed Block House. These instruments may be used to provide supplementary information following a seismic event.
- 7. The rocking motion of the containment structure can be determined by the use of two (2) sets of accelerometers, one each placed at the top of the primary shield wall and on the containment foundation and oriented along the north-south axis of the plant. These accelerometers are connected to transmit signals simultaneously to a central recording device.
1.1.5 Limnology Limnology studies of Lake Michigan show that the lake provides adequate dilution and dispersion of plant effluents. The plant is designed to withstand the effects of the maximum seiche or the maximum wind whipped wave for the site.
1.1.6 Environmental Radiation Monitoring An environmental radiation-monitoring program formulated for the site and the surrounding area has been initiated and data collection started prior to plant operation.
UFSAR Revision 31.0 Revised: 31.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.0, §1.1, §1.2, UPDATED FINAL SAFETY ANALYSIS REPORT & §1.3 .
Page: 8 of 18 1.2 DESIGN HIGHLIGHTS The design of each unit was based upon proven concepts, which had been developed and successfully applied in the construction of pressurized water reactor systems. In subsequent paragraphs, a few of the design features are listed which represent slight variations or extrapolations from other units.
1.2.1 Power Level The Donald C. Cook licensed power level or rated thermal power (RTP) is 3304 MWt for Unit 1 and 3468 MWt for Unit 2. These power levels are comparable with power levels of pressurized water reactors, which are now operating and are justified by the engineering and safety analyses reported in this document.
1.2.2 Reactor Coolant Loops The reactor coolant system for each unit consists of four loops.
1.2.3 Peak Specific Power Based on the maximum permitted hot channel factors, operation at a thermal heat output of 3304 MWt corresponds to a peak specific power of 15.85 kW/ft (FQ = 2.32) for Unit 1 and at a thermal heat output of 3468 MWt for Unit 2 corresponds to a peak specific power of 12.9 kW/ft (FQ =
2.335).
1.2.4 Fuel Assembly Design The fuel assembly design incorporates the rod cluster control assembly concept in a canless assembly utilizing spring clip grids to provide support for the 15 x 15 (Unit 1) and 17 x 17 (Unit
- 2) arrays of fuel rods.
Another aspect of the fuel design is internally pressurized fuel rods. This does not result in any change in fuel rod design criteria. Internal pressurization represents no significant change in plant safety margins during accident transients. Further discussion of fuel rod design is contained in Chapter 3 and Reference 2.
UFSAR Revision 31.0 Revised: 31.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.0, §1.1, §1.2, UPDATED FINAL SAFETY ANALYSIS REPORT & §1.3 .
Page: 9 of 18 1.2.5 Ice Condenser Containment Structure The ice condenser reactor containment involves the very rapid absorption of the energy released in the improbable event of a loss-of-coolant accident by condensing the steam in a low temperature heat sink. This heat sink, located inside the containment, consists of a suitable quantity of borated ice in a cold storage compartment. The containment is a reinforced concrete structure with a steel liner capable of withstanding a design pressure of 12 psig. The overall integrated leak rate limit is 0.18% by weight of the containment air volume per day. The structure is designed to resist wind and seismic loads and is fully protected from electrical storms and fire. Access to the containment structure is provided by means of personnel air locks and an equipment hatch. Such access is limited during periods of operation.
1.2.6 Other Engineered Safety Features In addition to the ice condenser system and the containment structure, other engineered safety features provided are similar to those provided in other PWR plants. There is an emergency core cooling system that can be powered from emergency on-site diesel generators.
The system design is such that it can be tested while the plant is at power. A containment spray system provides cool water spray into the containment atmosphere for heat removal. The spray system reduces the concentration of airborne halogen fission products in the containment atmosphere, and contains sodium hydroxide for keeping the halogens in solution.
1.2.7 Emergency Power In addition to the multiple ties to outside sources for emergency power, emergency diesel generator (EDG) units are provided as backup power supplies for the case of loss of all outside power. The EDGs are capable of operating sufficient core cooling and containment cooling equipment to ensure an acceptable post-accident pressure transient in the affected unit, and safe shutdown of the other unit, even if one EDG fails to operate in each unit.
UFSAR Revision 31.0 Revised: 31.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.0, §1.1, §1.2, UPDATED FINAL SAFETY ANALYSIS REPORT & §1.3 .
Page: 10 of 18 1.2.8 Use of Solid-State Logic Protection System By applying solid state techniques to the design of the Reactor Protection System and the Engineered Safety Features Actuation System, significant improvements have been made over the previous designs, which utilized relays in the logic. The solid state system has improved system reliability, reduced test time, reduced the number of field wires, reduced equipment size, and increased system flexibility.
Designated the "Solid State Logic Protection System", the design includes both reactor protection and engineered safety features actuation. The design uses integrated circuit NAND gates as the basic logic element. These elements are assembled on printed circuit cards to form the building blocks for the system. The IEEE criteria for nuclear power plant protection systems (IEEE-279)
(Reference 3) has been used as a guide in the design of the system. Further information on the system is contained in Chapter 7.
1.2.9 References for Section 1.2
- 1. WCAP-7407-L, R. F. Barry, et. al., "Power Maldistributions". (WNES Proprietary Class 2).
- 2. WCAP-9002, "Use of Internally Pressurized Fuel Rods in Westinghouse Pressurized Water Reactors," H. M. Ferrari, et al., February 1969 (WNES Proprietary Class 2).
- 3. IEEE No. 279, "Proposed IEEE Criteria for Nuclear Power Plant Protection Systems, (Effective August 30, 1968)."
UFSAR Revision 31.0 Revised: 31.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.0, §1.1, §1.2, UPDATED FINAL SAFETY ANALYSIS REPORT & §1.3 .
Page: 11 of 18 1.3
SUMMARY
PLANT DESCRIPTION The inherent design of the pressurized water, closed-cycle reactor minimizes the quantities of fission products released to the atmosphere. Four barriers exist between the fission product accumulation and the environment. These are the uranium dioxide fuel matrix, the fuel cladding, the reactor vessel and coolant loops, and the reactor containment. The consequences of a breach of the fuel cladding are greatly reduced by the ability of the uranium dioxide lattice to retain fission products. Escape of fission products through a fuel-cladding defect would be contained within the pressure vessel, loops and auxiliary systems. Breach of these systems or equipment would release the fission products to the reactor containment where they would be retained. The reactor containment is designed to retain adequately these fission products under the most severe accident conditions, as analyzed in Chapter 14.
Several engineered safety features have been incorporated into the plant design to reduce the consequences of a loss-of-coolant accident. These safety features include an Emergency Core Cooling System (ECCS). This system automatically delivers borated water to the reactor vessel for cooling the core under high and low reactor coolant pressure conditions. The ECCS also serves to insert negative reactivity into the core in the form of borated water during plant cooldown, following a steam line break or an accidental steam release. Other safety features, which have been included in the reactor containment design, are an Ice Condenser System containing sodium tetraborate impregnated ice and which acts to effect a depressurization of the containment following a loss-of-coolant or steam line break accident, and a Containment Spray System which acts to depressurize the containment and to remove iodine from the atmosphere by washing action.
1.3.1 Structures and Equipment The major structures are the two ice condenser reactor containments, auxiliary building, turbine building, service building, and fuel handling facility, which makes up a portion of the auxiliary building. General layouts of the containment, auxiliary building, turbine building and interior component arrangements are shown on Figures 1.3-1, 1.3-1A, and 1.3-2 through 1.3-10.
The ice condenser reactor containment is a domed, steel lined, reinforced concrete cylinder anchored to a reinforced concrete foundation slab. The containment is designed to withstand the internal pressure accompanying a loss-of-coolant accident. It is virtually leaktight and provides adequate radiation shielding for both normal operation and accident conditions.
UFSAR Revision 31.0 Revised: 31.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.0, §1.1, §1.2, UPDATED FINAL SAFETY ANALYSIS REPORT & §1.3 .
Page: 12 of 18 The seismic criteria used to design the structures and equipment in the plant are described in Sub-Chapter 2.9. The maximum horizontal ground acceleration for the Operating Basis Earthquake (OBE) is 0.10g acting coincidentally with a maximum vertical ground acceleration of 0.067g.
However, the design ensures that no undue risk to public health and safety results from a horizontal ground acceleration of 0.20g acting coincidentally with a vertical ground acceleration of 0.134g (Design Basis Earthquake - DBE).
1.3.2 Nuclear Steam Supply System For each unit, the Nuclear Steam Supply System consists of a pressurized water reactor, Reactor Coolant System, and associated auxiliary fluid systems. The Reactor Coolant System is arranged as four closed reactor coolant loops connected in parallel to the reactor vessel, each loop containing a reactor coolant pump and steam generator. An electrically heated pressurizer is connected to the hot leg of one reactor coolant loop.
The reactor core is composed of uranium dioxide pellets enclosed in Zircaloy tubes with welded end plugs. The tubes are supported in assemblies by a spring clip grid structure. The mechanical control rods consist of clusters of stainless steel clad silver-indium-cadmium absorber rods and Zircaloy guide tubes located within the fuel assemblies.
The reactor vessel and reactor internals contain and support the fuel and control rods. The reactor vessel is cylindrical with hemispherical heads and is clad internally with stainless steel.
The pressurizer is a vertical cylindrical pressure vessel with hemispherical heads and is equipped with electrical heaters and spray nozzles for system pressure control.
The steam generators are vertical U-tube type heat exchangers utilizing Inconel tubes. Integral separating equipment reduces the moisture content of the steam at the turbine throttle to 1/4 percent or less.
The reactor coolant pumps are vertical, single stage, centrifugal pumps equipped with controlled leakage shaft seals.
Auxiliary systems are provided to charge the Reactor Coolant System and to add makeup water, purify reactor coolant water, provide chemicals for corrosion inhibition and reactor control, cool system components, remove residual heat when the reactor is shutdown, cool the spent fuel storage pool, sample reactor coolant water, provide for emergency safety injection, and vent and drain the Reactor Coolant System.
UFSAR Revision 31.0 Revised: 31.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.0, §1.1, §1.2, UPDATED FINAL SAFETY ANALYSIS REPORT & §1.3 .
Page: 13 of 18 1.3.3 Reactor and Plant Control The reactor is controlled by a coordinated combination of soluble neutron absorbers and mechanical control rods. The control system allows the plant to accept step load changes of 10%,
and ramp load changes of 5% per minute, over the load range of 15 to 95% power, under normal operating conditions. Supervision of both the reactor and turbine-generator is accomplished from the control room in each unit.
1.3.4 Waste Disposal System The shared waste disposal system provides all equipment necessary to collect, process, and prepare for disposal, the radioactive liquid, and gaseous and solid wastes produced as a result of reactor operation.
All liquid wastes are collected and held for monitoring. Equipment is provided for evaporating or demineralizing the liquid. The treated water from the demineralizers or the evaporator distillate may be recycled for use in the plant or may be discharged via the condenser discharge at concentrations well within the limits of 10 CFR 20. The evaporator concentrates are solidified and shipped from the site for ultimate disposal in an authorized location. Spent demineralizer resins are de-watered and shipped in a high integrity container from the site for ultimate disposal in an authorized location. A steam generator blowdown treatment system is provided to permit continued plant operation with limited fuel clad defects concurrent with steam generator tube leaks.
Gaseous wastes are collected and held for radioactive decay. Discharge to the environment is controlled to keep the off-site dose well within the limits of 10 CFR 20.
1.3.5 Fuel Handling System Each reactor is refueled with equipment designed to handle spent fuel under water from the time it leaves the reactor vessel until it is placed in a cask for onsite storage or shipment off the site.
Underwater transfer of spent fuel provides an optically transparent radiation shield as well as a reliable source of coolant for removal of decay heat.
The fuel handling system also provides capability for receiving, handling and storage of new fuel.
Both the new fuel storage facility and the spent fuel storage facility are shared by the two units.
UFSAR Revision 31.0 Revised: 31.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.0, §1.1, §1.2, UPDATED FINAL SAFETY ANALYSIS REPORT & §1.3 .
Page: 14 of 18 1.3.6 Turbine and Auxiliaries Each turbine is a tandem compound, four element, 1,800 rpm unit, having one high pressure and three functionally identical low pressure elements. Combination moisture separator-reheaters are employed to dry and superheat the steam between the high and low-pressure turbines. The auxiliaries include deaerating surface condensers, steam jet air ejectors, turbine driven main feed pumps, motor driven condensate pumps, and six stages of feedwater heating.
1.3.7 Electrical System The main generators are 1800 rpm, 3 phase, 60 cycle, hydrogen and water cooled units. The main transformers deliver generator power to the 345 kV and 765 kV switchyards. The station auxiliary power system consists of auxiliary transformers, 4160 v and 600 v switchgear, 600 v motor control centers, 120 v a-c vital instrument buses and 250 v d-c buses.
Two diesel generators are provided for each unit as on-site sources of power in the event of a complete loss of normal and reserve a-c power. In addition, two storage batteries are provided for each unit as on-site sources of power in the event of a complete loss of normal d-c power. Each diesel generator and battery has sufficient capacity to operate the equipment necessary for one unit to prevent undue risk to public health and safety should a loss-of-coolant accident occur.
1.3.8 Safety Features The engineered safety features provided for this plant have sufficient redundancy of components and power sources such that under the conditions of a loss-of-coolant accident they can maintain the integrity of the containment and keep the exposure of the public below the limits of Regulatory Guide 1.183 and 10 CFR 50.67, even when operating with partial effectiveness. The safety features incorporated in the design of this plant and the functions they serve are summarized below.
- a. The Emergency Core Cooling System (ECCS) injects borated water into the Reactor Coolant System. The ECCS limits damage to the core and limits the energy and fission products released into the containment following a loss-of-coolant accident.
UFSAR Revision 31.0 Revised: 31.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.0, §1.1, §1.2, UPDATED FINAL SAFETY ANALYSIS REPORT & §1.3 .
Page: 15 of 18
- b. A steel-lined, domed, reinforced concrete containment vessel is anchored to a reinforced concrete foundation slab. The containment is designed to remain virtually leaktight during the pressure transient following a loss-of-coolant accident.
- c. An Ice Condenser System reduces containment pressure and removes iodine radioactivity following a loss-of-coolant accident.
- d. A Containment Spray System is used to reduce containment pressure and to remove iodine from the containment atmosphere following a loss-of-coolant accident.
- e. The Containment Isolation System incorporates valves and controls on piping systems penetrating the containment structure. The valves are arranged to provide two barriers between the Reactor Coolant System or containment atmosphere and the environment. System design is such that failure of one valve to close will not prevent isolation, and no manual operation is required for immediate isolation.
Automatic Phase "A" isolation is initiated by a containment isolation signal derived from the safety injection automatic activation logic and Phase "B" isolation from a containment pressure high-high signal.
- f. Reliable on-site diesel-generator power is provided for the engineered safeguards loads in the event of failure of station auxiliary power. In addition, even if external auxiliary power to the station is lost concurrent with an accident, power is available for the engineered safeguards from on-site diesel-generator power to assure protection of the public health and safety for any loss-of-coolant accident.
- g. The active components necessary for the proper operation of the engineered safety features are operable from the control room.
The Engineered Safety Features in this plant are the ECCS, the containment structure, the Ice Condenser System, and the Containment Spray System (items a, b, c, d above).
1.3.9 Shared Facilities and Equipment Separate and similar systems and equipment are provided for each unit except as noted below. In those instances where components of a system are shared by both units, those components, which are shared, are either shown in the following listing or discussed in the applicable Sub-Chapter.
UFSAR Revision 31.0 Revised: 31.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.0, §1.1, §1.2, UPDATED FINAL SAFETY ANALYSIS REPORT & §1.3 .
Page: 16 of 18 1.3.9.a Chemical and Volume Control System Item Number Shared Boric Acid Tanks 3 Batching Tank 1 Hold-up Tanks 3 Boric Acid Reserve Tank 1 Recirculation Pump 1 Boric Acid Evaporator Feed Pumps 3 Evaporator Feed Ion Exchangers 4 Boric Acid Evaporator 2
(Converted to a radioactive waste evaporator) (See Section 11.1)
Monitor Tanks 4 Monitor Tank Pumps 2 Evaporator Condensate Demineralizers 2 1.3.9.b Spent Fuel Pit Cooling System Item Number Shared Spent Fuel Pool Pumps 2 Spent Fuel Pool Demineralizer 1 Spent Fuel Pool Filter 1 Spent Fuel Pool Heat Exchangers 2 Refueling Water Purification Pump 1
UFSAR Revision 31.0 Revised: 31.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.0, §1.1, §1.2, UPDATED FINAL SAFETY ANALYSIS REPORT & §1.3 .
Page: 17 of 18 1.3.9.c Fuel Handling System Item Number Shared Spent Fuel Storage Pool 1 New Fuel Storage Area 1 Decontamination Area 1 Spent Fuel Pool Bridge Crane 1 1.3.9.d Service Water Systems Item Number Shared Essential Service Water Pumps 4 Non-Essential Service Water Pumps 4 1.3.9.e Auxiliary Steam System 1.3.9.f Waste Disposal System 1.3.9.g Radiation Monitoring System
UFSAR Revision 31.0 Revised: 31.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.0, §1.1, §1.2, UPDATED FINAL SAFETY ANALYSIS REPORT & §1.3 .
Page: 18 of 18 1.3.9.h Structures, Buildings And Miscellaneous Item Auxiliary Building Fuel Handling Area Service Building Lake Intake Structures Compressed Air Services Plant Heating Steam System Make-up Water Supply and Treatment System Non-Essential Service Water System Seismic Monitoring System Post-Accident Sampling System 1.3.9.i Component Cooling Water System Item Number Shared Component Cooling Water Pumps 1
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: i of iv
1.0 INTRODUCTION
AND
SUMMARY
...................................... 1 1.4 PLANT SPECIFIC DESIGN CRITERIA (PSDC) ................................ 1 1.4.1 Overall Plant Design Criteria (PSDC 1 - PSDC 5) .................. 2 CRITERION 1 Quality Standards ...................................................................... 2 CRITERION 2 Performance Standards ............................................................. 3 CRITERION 3 Fire Protection ........................................................................... 3 CRITERION 4 Sharing of Systems .................................................................... 4 CRITERION 5 Records Requirements .............................................................. 5 1.4.2 Protection by Multiple Fission Product Barriers (PSDC 6 -
PSDC 10) ................................................................................... 5 CRITERION 6 Reactor Core Design ................................................................. 6 CRITERION 7 Suppression of Power Oscillations ............................................ 6 CRITERION 9 Reactor Coolant Pressure Boundary ......................................... 7 CRITERION 10 Reactor Containment ................................................................. 7 1.4.3 Nuclear and Radiation Controls (PSDC 11- PSDC 18) ........... 8 CRITERION 11 Control Room............................................................................. 9 CRITERION 12 Instrumentation and Control Systems ...................................... 10 CRITERION 13 Fission Process Monitors and Controls.................................... 11 CRITERION 14 Protection Systems .................................................................. 11 CRITERION 15 Engineered Safety Features Protection Systems .................... 11 CRITERION 16 Monitoring Reactor Coolant Leakage ...................................... 11 CRITERION 17 Monitoring Radiation Releases ................................................ 12 CRITERION 18 Monitoring Fuel and Waste Storage......................................... 12 1.4.4 Reliability and Testability of Protective Systems (PSDC 19 -
PSDC 26) ................................................................................. 12 CRITERION 19 Protection Systems Reliability.................................................. 16 CRITERION 20 Protection Systems Redundancy and Independence .............. 16 CRITERION 23 Protection Against Multiple Disability for Protection Systems .. 16
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: ii of iv CRITERION 25 Demonstration of Functional Operability of Protection Systems 17 CRITERION 26 Protection System Failure Analysis Design ............................. 17 1.4.5 Reactivity Control (PSDC 27- PSDC 32) ................................ 17 CRITERION 27 Redundancy of Reactivity Control............................................ 18 CRITERION 28 Reactivity Hot Shutdown Capability ......................................... 18 CRITERION 29 Reactivity Shutdown Capability................................................ 18 CRITERION 30 Reactivity Holddown Capability................................................ 19 CRITERION 31 Reactivity Control Systems Malfunction ................................... 19 CRITERION 32 Maximum Reactivity Worth of Control Rods ............................ 20 1.4.6 Reactor Coolant Pressure Boundary (PSDC 33 - PSDC 36) 20 CRITERION 33 Reactor Coolant Pressure Boundary Capability....................... 20 CRITERION 34 Reactor Coolant Pressure Boundary Rapid Propagation Failure Prevention................................................................................. 21 CRITERION 36 Reactor Coolant Pressure Boundary Surveillance ................... 21 1.4.7 Engineered Safety Features (PSDC 37- PSDC 65) ............... 22 CRITERION 37 Engineered Safety Features Basis for Design ......................... 23 CRITERION 38 Reliability and Testability of Engineered Safety Features ........ 23 CRITERION 39 Emergency Power ................................................................... 23 CRITERION 40 Missile Protection ..................................................................... 24 Potential Missiles ................................................................................................ 25 Missile Protection Methods ................................................................................. 28 Probabilistic Methodology for Determining Risk from Tornado Generated Missiles
.................................................................................................. 28 TORMIS Description........................................................................................... 31 Probability Analysis of Missile Generation Occurrence ...................................... 32 CRITERION 41 Engineered Safety Features Performance Capability .............. 32 CRITERION 42 Engineered Safety Features Components Capability .............. 32 CRITERION 43 Accident Aggravation Prevention ............................................. 33 CRITERION 44 Emergency Core Cooling System Capability ........................... 33
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: iii of iv CRITERION 45 Inspection of Emergency Core Cooling System....................... 34 CRITERION 46 Testing of Emergency Core Cooling System Components ...... 34 CRITERION 47 Testing of Emergency Core Cooling System ........................... 34 CRITERION 48 Testing of Operational Sequence of Emergency Core Cooling System ...................................................................................... 35 CRITERION 49 Reactor Containment Design Basis ......................................... 35 CRITERION 50 NDT Temperature Requirement for Containment Materials..... 35 CRITERION 52 Containment Heat Removal Systems ...................................... 36 CRITERION 53 Containment Isolation Valves .................................................. 36 CRITERION 54 Initial Leak Rate Testing for Containment ................................ 36 CRITERION 55 Periodic Containment Leakage Rate Testing........................... 37 CRITERION 56 Provisions for Testing of Penetrations ..................................... 37 CRITERION 57 Provisions for Testing of Isolation Valves ................................ 37 CRITERION 58 Inspection of Containment Pressure-Reducing Systems ......... 38 CRITERION 59 Testing of Containment Pressure-Reducing Systems Components ............................................................................. 38 CRITERION 60 Testing of Containment Spray Systems ................................... 38 CRITERION 61 Testing of Operational Sequence of Containment Pressure-Reducing Systems .................................................................... 39 1.4.8 Fuel and Waste Storage Systems (PSDC 66 - PSDC 69) ..... 39 CRITERION 66 Prevention of Fuel Storage Criticality ....................................... 40 CRITERION 67 Fuel and Waste Storage Decay Heat ...................................... 41 CRITERION 68 Fuel and Waste Storage Radiation Shielding .......................... 41 CRITERION 69 Protection Against Radioactivity Release from Spent Fuel and Waste Storage .......................................................................... 41 1.4.9 Effluents (PSDC 70) ................................................................ 42 CRITERION 70 Control of Releases of Radioactivity to the Environment ......... 42 1.4.10 Applicable Appendix A GDCs ................................................ 43
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: iv of iv 1.4.10.1 Appendix A GDC Applicability to the Reactor Coolant System Vents
................................................................................................... 43 1.4.10.2 Appendix A GDC 19 Applicability .................................................. 43 1.4.10.3 Appendix A GDC 4 Applicability to Reactor Coolant System Piping .
................................................................................................... 44 1.4.11 References for Section 1.4..................................................... 44
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 1 of 45
1.0 INTRODUCTION
AND
SUMMARY
1.4 PLANT SPECIFIC DESIGN CRITERIA (PSDC)
The criteria followed in the design of the Donald C. Cook Nuclear Plant have been developed as performance criteria which define or describe safety objectives and procedures, and they provide a guide to the type of plant design information which is included in this UFSAR. These plant specific design criteria define the principal criteria and safety objectives for the design of the Cook Plant. A complete set of these criteria is stated explicitly in the following Sections. The safety objectives and procedures are then more fully described in other sections of the UFSAR.
The Atomic Energy Commission (AEC) published proposed GDCs for public comment in 1967.
The Atomic Industrial Forum (AIF) reviewed these proposed criteria and recommended changes.
The Cook plant was designed and constructed to meet the intent of the Proposed General Design Criteria, published July 11, 1967 (Reference 1). The Final Safety Analysis Report had been filed with the Commission when revisions of the General Design Criteria were published in February 1971 and July 7, 1971. In 1973, the AEC reviewed the plant design against the most recent General Design Criteria and concluded that the design meets these criteria. The application of the AEC proposed General Design Criteria to the Donald C. Cook Nuclear Plant was discussed in the original FSAR, Appendix H. Appendix H was subsequently removed from the FSAR when the UFSAR was developed.
Appendix A of 10 CFR Part 50 contains a different set of GDCs, which were published in 1971 (after Cook Plant construction permits were issued). Note that the GDCs found in 10 CFR Part 50 Appendix A differ both in numbering and content from the PSDCs adopted herein for Cook Plant and should not be interchanged.
Certain obligations and commitments have become effective since initial licensing that cause aspects of the 10 CFR 50 Appendix A GDCs to be applicable to the Donald C. Cook Nuclear Plant.
This is discussed in Section 1.4.10, "Applicable Appendix A GDCs."
The parenthetical numbers following the section headings indicate the numbers of the Cook Plant Specific Design Criteria (PSDCs). These numbers have been selected to correspond with their related proposed AEC criteria. Since there are additional AEC criteria, which are not included in, the Cook Plant Licensing Bases, the numbering scheme is not continuous. Therefore, Criteria 8, 21, 22, 24, 35, 51, 62, 63, 64, and 65 do not appear in the listing. These Criteria were not included
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 2 of 45 as part of PSDC; however, as indicated above, the AEC reviewed the most recent criteria and concluded that AEP meets those criteria, where applicable.
1.4.1 Overall Plant Design Criteria (PSDC 1 - PSDC 5)
CRITERION 1 Quality Standards Those structures, systems and components of reactor facilities which are essential to the prevention, or the mitigation of the consequences, of nuclear accidents which could cause undue risk to the health and safety of the public shall be identified and then designed, fabricated, and erected to quality standards that reflect the importance of the safety function to be performed. Where generally recognized codes and standards pertaining to design, materials, fabrication, and inspection are used, they shall be identified. Where adherence to such codes or standards does not suffice to assure a quality product in keeping with the safety function, they shall be supplemented or modified as necessary. Quality assurance programs, test procedures, and inspection acceptance criteria to be used shall be identified.
An indication of the applicability of codes, standards, quality assurance programs, test procedures, and inspection acceptance criteria used is required. Where such items are not covered by applicable codes and standards, a showing of adequacy is required.
Those features of the reactor facility which are essential to the prevention of nuclear accidents which could cause undue risk to the public health and safety or to the mitigation of their consequences were designed, fabricated, and erected to quality standards that reflect the importance of the safety function to be performed. The quality assurance program is referenced in Sub-Chapter 1.7 and is described in a separate document entitled Quality Assurance Program Description. Recognized codes and standards were used when appropriate to the application.
Features of the reactor facility essential to accident prevention and mitigation of consequence are:
the fuel pellet cladding and reactor coolant system pressure boundary and containment structure fission product barriers; the protective and control systems and emergency core cooling system (ECCS), whose function is to maintain the integrity of these barriers; systems which depressurize and reduce the temperature and the contamination level of the containment; power supplies and essential services to the above features; and the components employed to safely convey and store radioactive wastes and spent reactor fuel. Quality standards for material selection, design, fabrication, and inspection governing the above features conform to the applicable provisions of recognized codes and good nuclear practice.
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 3 of 45 CRITERION 2 Performance Standards Those structures, systems and components of reactor facilities which are essential to the prevention, or to the mitigation of the consequences, of nuclear accidents which could cause undue risk to the health and safety of the public shall be designed, fabricated, and erected to performance standards that enable such structures, systems and components to withstand, without undue risk to the health and safety of the public, the forces that might reasonably be imposed by the occurrence of an extraordinary natural phenomenon such as earthquake, tornado, flooding condition, high wind or heavy ice. The design bases so established shall reflect: (a) appropriate consideration of the most severe of these natural phenomena that have been officially recorded at the site and the surrounding area and (b) an appropriate margin for withstanding forces greater than those recorded to reflect uncertainties about the historical data and their suitability as a basis for design.
Those features of the reactor facility which are essential to the prevention of nuclear accidents which could cause undue risk to the public health and safety or to the mitigation of their consequences were designed, fabricated, and erected to performance standards that enable the facility to withstand, without loss of the capability to protect the public, the additional forces imposed by the most severe earthquakes, flooding conditions, winds, ice, or other natural phenomena characteristic to the Donald C. Cook Nuclear Plant site. Piping, components and supporting structures of the reactor and safety related systems were designed to withstand any seismic disturbance predictable for the site. The dynamic response of the structures to ground acceleration, based on appropriate spectral characteristics of the site foundation and on the damping of the foundation and the structures, was included in the design analysis. Structures, equipment, and piping materials, in both the containment and auxiliary buildings, have been selected for their compatibility with the expected normal and accident environments. For those components located inside the containment which are required for controlling the Design Bases Accidents (DBA), the effect of the spray chemical additive (NaOH) has been considered as well as radiation levels, pressure and temperature. Material compatibility has been discussed in detail in the Indian Point Unit 2 FSAR (reference document 50-247).
CRITERION 3 Fire Protection A reactor facility shall be designed to ensure that the probability of events such as fires and explosions and the potential consequences of such events will not result in undue risk to
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 4 of 45 the health and safety of the public. Non-combustible and fire resistant materials shall be used throughout the facility wherever necessary to preclude such risk, particularly in areas containing critical portions of the facility such as containment, control room, and components of engineered safety features.
Primary emphasis is directed at minimizing the risk of fire by use of thermal insulation and adhesives which do not support combustion, flame retardant wiring, adequate overload and short circuit protection, and the elimination of combustible trim and furnishings. The facility is equipped with protection systems for controlling fires, which might originate in plant equipment.
See Sub-Chapter 9.8 for a description of the fire protection system. The containment and auxiliary building ventilation systems can be operated from the control room of the corresponding unit as required to limit the potential consequences of fire. Critical areas of the containment, the control room and the areas containing components of engineered safety features, have detectors to alert the control room to the possibility of fire so that prompt action may be taken to prevent significant damage.
CRITERION 4 Sharing of Systems Reactor facilities may share systems or components if it can be shown that such sharing will not result in undue risk to the health and safety of the public.
Two types of sharing were considered: a) sharing of systems and components between the two units and b) sharing of components among systems within a unit. For such shared systems and components, analyses confirm that there is no interference with basic function and operability of these systems due to sharing, and hence no undue risk to the health and safety of the public results.
Sub-Chapter 1.3-9 identifies the shared systems and components in the plant.
The CNP licenses were amended in 2001 (Amendment No. 253 to DPR-58 and Amendment No.
235 to DPR-74; ML011910127) to acknowledge that the Essential Service Water system cannot meet Criterion 4 with the opposite unit cross-tie valves open. Closure of the cross-tie valves preserves the ability of an ESW train to meet Criterion 4 if the cross-connected train is lost.
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 5 of 45 CRITERION 5 Records Requirements The reactor licensee shall be responsible for assuring the maintenance, throughout the life of the reactor, of records of the design, fabrication, and construction of major components of the plant essential to avoid undue risk to the health and safety of the public.
The Indiana and Michigan Electric Company or its authorized representative and Westinghouse Electric Corporation have retained documentation of the design, fabrication and construction of essential plant components. These records verify the high quality and performance standards applicable to essential plant components.
A complete set of as-built facility plant and system diagrams, including arrangement plans and structural plans, and records of initial tests and operation are maintained throughout the life of the plant. A set of all the quality assurance data generated during fabrication and erection of the essential components of the plant, as defined by the quality assurance program, is retained.
1.4.2 Protection by Multiple Fission Product Barriers (PSDC 6 -
PSDC 10)
Physical barriers are provided by the fuel pellet and cladding, reactor coolant system pressure boundary and containment structure to protect the public from the release of fission products produced within the fuel assemblies. The specific details and design basis for each one of the three barriers are identified and discussed in Chapters 3, 4, and 5. The design of the fuel pellet and cladding, core-related structural equipment, and control and protective systems ensures that fuel damage in excess of acceptable limits is not likely, or can be readily suppressed in the unlikely event of its inception.
The reactor coolant system, including the reactor pressure vessel, was designed to accommodate the system pressure and temperatures attained under expected modes of plant operation, and to maintain material stress within applicable code stress limits. Its materials of construction are protected by control of coolant chemistry from corrosion phenomena. It is protected from overpressure by means of relieving devices.
High-pressure equipment in the reactor coolant system is surrounded by barriers to prevent a missile generated from the reactor coolant system in a loss-of-coolant accident (LOCA), from reaching either the containment liner or the containment cooling equipment, and from impairing the function of the engineered safety features. The principal missile barriers are the reinforced concrete operating floor and the reinforced concrete shield wall enclosing the reactor coolant
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 6 of 45 loops. A steel and concrete structure was also provided over the control rod drive mechanisms to block a missile generated from a fracture of the mechanism housing.
The reactor coolant system piping and reactor vessel are completely enclosed within the containment structure. The containment structure itself was designed to withstand the temperature and pressure conditions associated with the complete severance of a reactor coolant pipe coincident with a seismic occurrence. Essentially no leakage of radioactive materials to the environment will result under these conditions.
CRITERION 6 Reactor Core Design The reactor core with its related controls and protection systems shall be designed to function throughout its design lifetime without exceeding acceptable fuel damage limits which have been stipulated and justified. The core and related auxiliary system designs shall provide this integrity under all expected conditions of normal operation with appropriate margins for uncertainties and for specified transient situations which can be anticipated.
The reactor core, with its related control and protection systems, is designed to function throughout its design lifetime without exceeding acceptable fuel damage limits. The core design, together with reliable process and decay heat removal systems, provides for this capability under all expected conditions of normal operation with appropriate margins for uncertainties and anticipated transient situations. This includes the effects of the loss of reactor coolant flow, trip of the turbine generator, and loss of normal feedwater and loss of all off-site power.
The ability of fuel designed and operated to these criteria to withstand postulated normal and abnormal service conditions is shown by analyses described in Chapter 14 to satisfy the demands of plant operation well within applicable regulatory limits.
CRITERION 7 Suppression of Power Oscillations The design of the reactor core with its related controls and protection systems shall ensure that power oscillations the magnitude of which could cause damage in excess of acceptable fuel damage limits, are not possible or can be readily suppressed.
The potential for possible spatial oscillations of power distribution for this core has been reviewed.
It is concluded that low frequency xenon oscillations may occur in the axial dimension, and control rods can be used to suppress these oscillations. The core is expected to be stable to xenon oscillations in the X-Y dimension. Out-of-core instrumentation is provided to obtain necessary
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 7 of 45 information concerning power distribution. This instrumentation is adequate to enable the operator to monitor and control xenon induced oscillations. (In-core instrumentation is used to periodically calibrate and verify the information provided by the out-of-core instrumentation.) The analysis, detection and control of these oscillations is discussed in Reference 2 of Unit 1, Section 3.3 and Reference 6 of Unit 2 Section 3.3.
CRITERION 9 Reactor Coolant Pressure Boundary The reactor coolant pressure boundary shall be designed, fabricated and constructed so as to have an exceedingly low probability of gross rupture or significant uncontrolled leakage throughout its design lifetime.
The Reactor Coolant System in conjunction with its control and protective provisions was designed to accommodate the system pressures and temperature attained under the expected modes of plant operation or anticipated system interactions, and to maintain the stresses within applicable code stress limits Fabrication of the components, which constitute the pressure-retaining boundary of the Reactor Coolant System, was carried out in strict accordance with applicable codes. In addition, there are areas where equipment specifications for Reactor Coolant System components go beyond the applicable codes. Details are given in Sub-Chapter 4.5.
The materials of construction of the pressure retaining boundary of the Reactor Coolant System are protected by control of coolant chemistry from corrosion phenomena which might otherwise reduce the system structural integrity during its service lifetime, as discussed in Chapter 9. System conditions resulting from anticipated transients or malfunctions are monitored and appropriate action is automatically initiated to maintain the required cooling capability and to limit system conditions so that continued safe operation is possible, as discussed in Chapter 7. The system is protected from overpressure by means of pressure relieving devices, as required by Section III of the ASME Boiler and Pressure Vessel Code.
Sections of the system, which can be isolated, are provided with overpressure relieving devices, discharging to closed systems such that the system code allowable relief pressure, within the protected section, is not exceeded.
CRITERION 10 Reactor Containment The containment structure shall be designed (a) to sustain without undue risk to the health and safety of the public the initial effects of gross equipment failures, such as a large reactor
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 8 of 45 coolant pipe break, without loss of required integrity, and (b) together with other engineered safety features as may be necessary, to retain for as long as the situation requires the functional capability of the containment to the extent necessary to avoid undue risk to the health and safety of the public.
The reactor containment is a reinforced concrete structure consisting of a vertical cylinder, a hemispherical dome and a flat base. The interior is divided into three volumes, a lower volume which houses the reactor and Reactor Coolant System, an intermediate volume housing the energy absorbing ice bed in which steam is condensed and an upper volume which accommodates the air displaced from the other two volumes during a loss-of-coolant accident.
The condensation of steam in the ice bed limits the containment pressure to values substantially below those for a comparable dry-type containment under the same conditions. The ice condenser containment, together with the containment spray system, provides the functional capability of containment for as long as necessary following an accident. The design pressure of the containment exceeds the peak pressure occurring as the result of the complete blowdown of the reactor coolant through any rupture of the Reactor Coolant System up to and including the hypothetical double-ended severance of a reactor coolant pipe. The design pressure is not exceeded during subsequent long-term pressure transients resulting from the combined effects of heat sources such as residual heat and metal-water reaction with operation of one train of the emergency core cooling and containment spray systems.
All piping systems which penetrate the containment are anchored at the containment wall. The penetrations for the main steam, feedwater, blowdown and samples lines are designed so that the containment is not breached due to a hypothesized pipe rupture.
1.4.3 Nuclear and Radiation Controls (PSDC 11- PSDC 18)
Monitoring potentially radioactive areas and operation of the reactor protection and control systems, and the turbine-generator is accomplished in the control room from where actions required to maintain the safe operational status of the plant are centered.
Radiation protection has been provided to permit access to equipment in the control room, even under accident conditions, as necessary, to shut down and maintain safe control of the facility without radiation exposures to personnel in excess of the Code of Federal Regulations limits. The control room is equipped with the controls necessary for monitoring and maintaining control over the fission process (Section 7.4.1) and for conditions that could reasonably be expected to cause variations in core reactivity. In addition to instrumentation and controls which are required to
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 9 of 45 maintain plant variables within prescribed operating ranges, means are provided to monitor fuel and waste storage handling areas, reactor coolant pressure boundary leakage, containment atmosphere and potentially contaminated facility effluent discharge paths.
Reactor protection systems (Section 7.2) automatically sense accident situations and initiate operation of the safety systems that prevent or suppress conditions that could result in exceeding fuel damage limits. This combination of monitoring and reactor protection systems provides assurance that radioactive releases are maintained well below established federal regulatory limits for normal operations, anticipated transients and possible accident conditions. Positive indications in the control room of leakage of coolant from the reactor coolant pressure boundary to the containment are provided by equipment which permits continuous monitoring of the containment atmosphere activity (see Sub-Chapter 11.3) and humidity. The basic design criterion is the detection of deviations from normal containment environmental conditions including air particulate activity, noble gas activity, humidity, and in the case of gross leakage, the liquid inventory in the process systems and containment sump.
The containment atmosphere, unit vents, gland steam condenser vent, the condenser steam jet air ejector exhaust, steam generator power operated relief valve, and the waste disposal system liquid effluent are monitored for radioactivity (See Sub-Chapter 11.3).
For the case of leakage from the containment structure under accident conditions, the plant area radiation monitoring system supplemented by portable survey equipment, provides adequate monitoring of releases during an accident (See Sub-Chapter 11.3).
Monitoring and alarm instrumentation have been provided for fuel and waste storage and handling areas to detect inadequate cooling and to detect excessive radiation levels. Radiation monitors have been provided to maintain surveillance over the release of radioactive gases and liquids (See Sub-Chapter 11.3).
A controlled ventilation system removes gaseous radioactivity from the atmosphere of the spent fuel storage pool and waste treatment areas of the auxiliary building and discharges it to the atmosphere via the plant vent. Radiation monitors are in continuous service in these areas to actuate high-activity alarms on the control board annunciator, as described in Chapter 11.
CRITERION 11 Control Room The facility shall be provided with a control room from which actions to maintain safe operational status of the plant can be controlled. Adequate radiation protection shall be provided to permit continuous occupancy of the control room under any credible post-
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 10 of 45 accident condition or as an alternative, access to other areas of the facility as necessary to shutdown and maintain safe control of the facility without excessive radiation exposures of personnel.
Each unit of the plant is equipped with a separate control room, which contains those controls and instrumentation necessary for operation of that unit under normal, and accident conditions. The control room is continuously occupied by the operating personnel under all operating and accident conditions, unless the control room should become uninhabitable. This case is discussed in Section 7.7.10.
Sufficient shielding, distance, and containment integrity are provided to assure that control room personnel shall not be subject to doses under postulated accident conditions during occupancy of the control room which would exceed the limits in Regulatory Guide 1.183 and 10 CFR 50.67.
The control room ventilation system is discussed in Chapter 9.
CRITERION 12 Instrumentation and Control Systems Instrumentation and controls shall be provided as required to monitor and maintain within prescribed operating ranges essential reactor facility operating variables.
Instrumentation and controls are provided to monitor and maintain all operationally important reactor operating parameters such as neutron flux, system pressures, flow rates, temperatures, levels and control rod positions within prescribed operating ranges. The quality and types of instrumentation provided are adequate for safe and orderly operation of all systems and processes over the full operating range of the plant.
Process variables, which are required on a continuous basis for the startup, power operation and shutdown of the plant, are indicated in, recorded in, and controlled as necessary from the control room, which is a controlled area. The operating staff is cognizant and in control of all test, maintenance and calibration work and can fully assess all abnormal plant conditions knowing the extent to which specific and related operating tasks are in progress.
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 11 of 45 CRITERION 13 Fission Process Monitors and Controls Means shall be provided for monitoring or otherwise measuring and maintaining control over the fission process throughout core life under all conditions that can reasonably be anticipated to cause variations in reactivity of the core.
The primary function of nuclear instrumentation is to safeguard the reactor by monitoring the neutron flux and generating appropriate trips and alarms for various phases of reactor operating and shutdown conditions. It also provides a secondary control function and indicates reactor status during startup and power operation.
CRITERION 14 Protection Systems Core protection systems, together with associated equipment shall be designed to prevent or to suppress conditions that could result in exceeding acceptable fuel damage limits.
If the reactor protection system receives signals, which are indicative of an approach to unsafe operating conditions, the system actuates alarms, prevents control rod withdrawal, initiates load runback, and/or opens the reactor trip breakers.
CRITERION 15 Engineered Safety Features Protection Systems Protection systems shall be provided for sensing accident situations and initiating the operation of necessary engineered safety features.
The engineered safety features instrumentation monitors parameters to detect failures in the Reactor Coolant System and to initiate engineered safety features equipment operation.
CRITERION 16 Monitoring Reactor Coolant Leakage Means shall be provided to detect significant uncontrolled leakage from the reactor coolant pressure boundary.
Positive indications, in the control room, of leakage of coolant from the Reactor Coolant System to the lower containment compartment are provided by equipment, which permits continuous monitoring of the lower containment compartment air activity and humidity. This equipment provides indication of normal background, which is indicative of a basic level of leakage from primary systems and components. Any deviation in the observed parameters will be an indication of change within the lower containment compartment; the equipment provided is capable of monitoring this change. The basic design criterion is the detection of deviations from normal
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 12 of 45 containment environmental conditions including air particulate activity, noble gas activity, humidity and in addition, in the case of gross leakage, the liquid inventory in the process systems and containment sump.
CRITERION 17 Monitoring Radiation Releases Means shall be provided for monitoring the containment atmosphere and the facility effluent discharge paths for radioactivity released from normal operations, from anticipated transients, and from accident conditions. An environmental monitoring program shall be maintained to confirm that radioactivity releases to the environs of the plant have not been excessive.
The containment atmosphere, the unit vent, SJAE vent, turbine gland seal exhaust, steam generator blowdown, essential service water discharge and the waste disposal system liquid effluents are monitored for radioactivity concentration during operation. The design objective is for annual average releases of radioactivity (gases and liquids) for both dose and dose rates at the critical site boundary to meet the requirements of 10 CFR Part 20.
CRITERION 18 Monitoring Fuel and Waste Storage Monitoring and alarm instrumentation shall be provided for fuel and waste storage and associated handling areas for conditions that might result in loss of capability to remove decay heat and to detect excessive radiation levels.
Monitoring and alarm instrumentation are provided for fuel and waste storage and handling areas to detect excessive radiation levels. Radiation monitors are provided to maintain surveillance over the release operation, but the permanent record of activity releases is provided by radiochemical analysis of known quantities of waste.
1.4.4 Reliability and Testability of Protective Systems (PSDC 19 -
PSDC 26)
Protective systems were designed with a degree of functional reliability and in-service testability, which is commensurate with the safety functions to be performed. System design incorporates such features as emergency power availability, preferred failure mode design, redundancy and isolation between control systems and protective systems. In addition, the protective systems were designed such that no single failure would prevent proper system action when required. For design
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 13 of 45 purposes, multiple failures, which result from a single event, were considered single failures. The proposed criteria of the Institute of Electrical and Electronic Engineers for nuclear power plant protection (IEEE-279) have been utilized in the design of protective systems.
The plant variables monitored and the sensors utilized are identified and discussed at length in Westinghouse proprietary reports submitted in support of the application for an operating license for Donald C. Cook Nuclear Plant and referenced in Chapter 7.
The coincident trip philosophy is carried out to provide a safe and reliable reactor protection system since a single failure will not defeat its function nor cause a spurious reactor trip. Channel independence originates at the process sensor and continues back through the field wiring and containment penetrations to the reactor protection system racks. The power supplies to the protection sets are fed from instrumentation buses.
Two reactor trip breakers are provided to interrupt power to the control rod drive mechanisms.
The breakers main contacts are connected in series. Opening either breaker will interrupt power to all control rod drive mechanisms causing all rods to fall by gravity into the core. Each reactor trip breaker has an undervoltage trip attachment and a shunt trip attachment. Either attachment trips the breaker. Automatic or manual trip initiation activates both the undervoltage and shunt trip attachments. Each protection channel feeds two logic matrices, one for each undervoltage trip circuit.
Each reactor trip channel is designed so that it will go into a trip mode when the channel is de-energized. An open channel or loss of channel power therefore would cause the affected channel to go into a trip mode. Reliability and independence are obtained by redundancy within each channel, except for back-up reactor trips such as the reactor coolant pump breaker position trip.
Reactor trip is implemented by interrupting power to the mechanism on each control rod drive mechanism allowing the rod cluster control assemblies (RCCAs) to be inserted by gravity. The protection system is thus inherently safe in the event of a loss of control rod power.
The components of the protective system are designed and laid out so that the mechanical and thermal environment accompanying any emergency situation in which the components are required to function will not interfere with that function.
The actuation of the engineered safety features provided for loss-of-coolant accidents (LOCA),
e.g., emergency core cooling system and containment spray system, is accomplished from redundant signals derived from reactor coolant system, steam flow, and containment instrumentation. Channel independence originates at the process sensor and is carried through to
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 14 of 45 the reactor protection system racks. De-energizing a channel will cause that channel to go into its trip mode (See Sub-Chapter 7.5).
A comprehensive program of plant testing is executed for equipment vital to the functioning of engineered safety features. The program consists of performance tests of individual pieces of equipment, and integrated tests of the engineered safety features as a whole, and periodic tests of the actuation circuitry and the performance of mechanical components to assure reliable performance upon demand throughout the plant lifetime.
The following series of periodic tests and checks are conducted to assure that the systems can perform their design functions should they be called on during the plant lifetime.
- a. Integrated Test Actuation Circuits and Motor-Operated Valves - The automatic actuation circuitry, valves and pump breakers are checked during integrated system tests performed during each planned cooldown of the reactor coolant system for refueling.
- b. Accumulators - The pressure and level of the accumulators are continuously monitored during plant operation.
- c. Safety Injection, Residual Heat Removal, Containment Spray and Centrifugal Charging Pumps - The safety injection, residual heat removal, containment spray and centrifugal charging pumps are periodically tested during plant operation in accordance with the applicable edition of the ASME Operation and Maintenance (OM) Code. Remotely operated valves in these systems are tested periodically in accordance with the applicable edition of the ASME Boiler and Pressure Vessel
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 15 of 45 Code Section XI. Actuation circuits are tested periodically during plant operation or during plant shutdowns.
- d. Boric Acid Concentration in the Accumulators - The accumulators are supplied with borated water at a refueling water concentration of at least 2400 ppm while the plant is in operation. This concentration is checked periodically by sampling.
- e. Chemical Concentration in the Containment Spray Additive Tank - The concentration of chemical solution in this tank is maintained at approximately 30 wt% NaOH.
- f. Emergency Power Sources - The starting of the emergency diesel generator sets can be tested from the control room. The ability of the sets to start within the prescribed time and to carry intended loads is checked.
- g. Containment Penetration and Weld Channel Pressurization - Penetrations are designed with double seals and containment liner welds are backed by a steel channel. The large access openings such as the equipment hatch and personnel air locks are equipped with double gasket seals, and provisions are made for testing.
- h. Instrumented Protection Channels - All reactor protection channels, with the exception of back-up reactor trips, are supplied in sets, which provide the capability for channel calibration and test.
Reactor protection system protection channels in service at power are capable of being tested to verify operation. This includes a checking through to the final relay, which forms the logic. Thus, the operability of a reactor trip channel can be determined conveniently and without ambiguity. A complete channel test can be performed through and including the final trip breakers, excluding the transmitter.
Actuation of the engineered safety features including containment isolation also employs coincidence channels, which allow checking of the operability of one channel at a time. Removal of one signal channel places that channel in the tripped mode.
During testing, the reactor protection channels (process control) have the hardware capability of being tripped, or in a number of the channels, they also have the capability of being bypassed downstream of the on-off controller. In case of the Nuclear Instrumentation System (NIS) Power Range, it can superimpose the test signal on the transmittal signal. In the process control equipment, the transmitted signal is disconnected and a simulated signal is injected. The trip points are then checked against this test signal.
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 16 of 45 In the NIS power range equipment, a signal can be superimposed on the existing input signal. The trip point would then be checked against the combined signal.
Transmitters and detectors are checked by comparing their outputs to each other.
CRITERION 19 Protection Systems Reliability Protection systems shall be designed for high functional reliability and in-service testability necessary to avoid undue risk to the health and safety of the public.
Protection channels required for full power operation are designed with sufficient redundancy to allow individual channel calibration and test to be made during power operation without negating the reactor protection. Testing will not cause a trip unless a trip condition exists in a concurrent channel.
CRITERION 20 Protection Systems Redundancy and Independence Redundancy and independence designed into protection systems shall be sufficient to assure that no single failure or removal from service of any component or channel of such a system will result in loss of the protection function. The redundancy provided shall include, as a minimum, two channels of protection for each protection function to be served.
The reactor protection system is designed so that loss of voltage, the most probable mode of failure, in each channel results in a signal calling for a trip. The protection system design combines redundant sensors and channel independence with coincident trip philosophy so that a safe and reliable system is provided in which a single failure will not violate reactor protection criteria.
CRITERION 23 Protection Against Multiple Disability for Protection Systems The effects of adverse conditions, to which redundant channels or protection systems might be exposed in common, either under normal conditions or those of an accident, do not result in loss of the protection function or shall be tolerable on some other basis.
Separation of redundant analog protection channels originates at the process sensors and continues through the wiring route and containment penetrations to the analog protection racks. Physical separation is used to the maximum practical extent to achieve separation of redundant transmitters.
Separation of wiring route is achieved using separate wireways, cable trays, conduit runs and containment penetrations for each redundant channel. Redundant analog equipment is separated
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 17 of 45 by locating modules in different protection rack sets. Each redundant protection channel set is energized from a separate instrument bus.
CRITERION 25 Demonstration of Functional Operability of Protection Systems Means shall be included for suitable testing of the active components of protection systems while the reactor is in operation to determine if failure or loss of redundancy has occurred.
The signal conditioning equipment of each protection channel in service at power is capable of being calibrated and tested independently by simulated analog input signals to verify its operation without tripping the reactor. The testing scheme includes checking through the trip logic to the trip breakers. Thus, the operability of each trip channel can be determined conveniently and without ambiguity. Functional operation of the power sources for the protection system is discussed in Chapter 8.
CRITERION 26 Protection System Failure Analysis Design The protection systems shall be designed to fail into a safe state or into a state established as tolerable on a defined basis if conditions such as disconnection of the system, loss of energy (e.g., electrical power, instrument air), or adverse environments (e.g., extreme heat or cold, fire, steam, or water) are experienced.
Each reactor trip channel is designed on the "de-energize to operate" principle; a loss of power causes that channel to go into its trip mode. All safety related air operated valves are designed to move to the preferred position on loss of instrument air.
Reactor trip is implemented by simultaneously interrupting power to the magnetic latch mechanisms on all drives allowing the full-length rods to insert by free fall. The entire protection system is thus inherently safe in the event of a loss of power. Equipment is selected to withstand the most adverse environmental conditions, to which it will be subjected including post-accident conditions within the containment, if the equipment is required to operate in the post-accident environment.
1.4.5 Reactivity Control (PSDC 27- PSDC 32)
Two independent reactivity control systems, of different design principles, are provided in the reactor system design. These are neutron absorbing control rods and chemical poisoning of the reactor coolant with boron. The reactivity worth of the highest worth control rod is less than that
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 18 of 45 required to achieve criticality with that rod out of the core and all the remaining control rods fully inserted in the core.
D.C. Cook is a safe (hot) shutdown plant. The plant can be maintained in safe hot shutdown conditions for an extended period of time (see References 7 through 10).
CRITERION 27 Redundancy of Reactivity Control Two independent reactivity control systems, preferably of different principles, shall be provided.
Two independent reactivity control systems are provided, one involving RCCAs and the other involving chemical shimming.
CRITERION 28 Reactivity Hot Shutdown Capability The reactivity control systems provided shall be capable of making and holding the core subcritical from any hot standby or hot operating condition.
The reactivity control systems provided are capable of making and holding the core subcritical from any hot standby or hot operating condition, including those resulting from power changes.
The maximum excess reactivity expected for the core occurs for the cold, clean condition at the beginning of life of the initial core.
The RCCAs are divided into two categories comprised of control banks and shutdown banks. The control banks used in combination with chemical shim control provide control of the reactivity changes of the core throughout the life of the core during power operation. These banks of RCCA assemblies are used to compensate for short term reactivity changes at power that might be produced due to variations in reactor power level or in coolant temperature. The chemical shim control is used to compensate for the more slowly occurring changes in reactivity throughout core life, such as those due to fuel depletion and fission product buildup.
CRITERION 29 Reactivity Shutdown Capability One of the reactivity control systems provided shall be capable of making the core subcritical under any anticipated operating condition (including anticipated operational transients) sufficiently fast enough to prevent exceeding acceptable fuel damage limits.
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 19 of 45 Shutdown margin should assure subcriticality with the most reactive RCCA fully withdrawn.
The reactor core, together with the reactor control and protection system is designed so that the applicable minimum allowable DNBR value is satisfied and there is no fuel melting during normal operation, including anticipated transients.
The shutdown groups are provided to supplement the control groups of RCCAs to make the core at least 1.3 percent subcritical at the hot zero power condition (keff = 0.987) following trip from any credible operating condition, assuming the most reactive RCC assembly is in the fully withdrawn position.
CRITERION 30 Reactivity Holddown Capability The reactivity control systems provided shall be capable of making the core subcritical under credible accident conditions with appropriate margins for contingencies, and shall be capable of limiting any subsequent return to power such that there will be no undue risk to the health and safety of the public.
Currently, normal reactivity shutdown capability following a trip signal is provided within 2.4 seconds (Unit 1) and 2.7 seconds (Unit 2) by insertion of the RCCAs, with boric acid injection used for the long term xenon decay transient and for plant cooldown. As discussed in response to the previous criteria, the shutdown capability prevents exceeding the minimum DNBR and acceptable fuel damage limits as a result of the cooldown associated with a safety valve stuck fully open.
CRITERION 31 Reactivity Control Systems Malfunction The reactor protection systems shall be capable of protecting against any single malfunction of the reactivity control system, such as unplanned continuous withdrawal (not ejection or dropout) of a control rod, by limiting reactivity transients to avoid exceeding acceptable fuel damage limits.
The reactor protection systems are capable of protecting against any single credible malfunction of the reactivity control system, by limiting reactivity transients to avoid exceeding acceptable fuel damage limits.
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 20 of 45 Reactor shutdown with rods is completely independent of the normal rod control functions since the trip breakers completely interrupt the power to the rod mechanisms regardless of existing control signals.
Details of the effects of continuous withdrawal of a control rod and continuous deboration are described in Chapters 14 and 9 respectively.
CRITERION 32 Maximum Reactivity Worth of Control Rods Limits, which include reasonable margin, shall be placed on the maximum reactivity worth of RCCAs and on rates at which reactivity can be increased to ensure that the potential effects of a sudden or large change of reactivity cannot (a) rupture the reactor coolant pressure boundary or (b) disrupt the core, its support structures, or other vessel internals sufficiently to lose capability of cooling the core.
Limits, which include considerable margin, are placed on the maximum reactivity worth of RCCAs and on rates at which reactivity can be increased to ensure that the potential effects of a sudden or large change of reactivity cannot (a) rupture the reactor coolant pressure boundary or (b) disrupt the core, its support structures, or other vessel internals so as to lose capability to cool the core.
1.4.6 Reactor Coolant Pressure Boundary (PSDC 33 - PSDC 36)
The reactor coolant system has been designed so that static and dynamic loads imposed on boundary components as a result of any inadvertent and sudden release of energy to the coolant will not cause rupture of the pressure boundary. In order to continually guard against any weakness developing, the reactor coolant pressure boundary has provisions for inspection and testing to assess the structural and leak-tight integrity of the boundary components during their service lifetime.
CRITERION 33 Reactor Coolant Pressure Boundary Capability The reactor coolant pressure boundary shall be capable of accommodating without rupture the static and dynamic loads imposed on any boundary component as a result of an inadvertent and sudden release of energy to the coolant. As a design reference, this sudden release shall be taken as that which would result from a sudden reactivity insertion such as
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 21 of 45 rod ejection (unless prevented by positive mechanical means), rod dropout, or cold water addition.
The reactor coolant pressure boundary is designed to be capable of accommodating, without rupture, the static and dynamic loads imposed as a result of a sudden reactivity insertion such as a rod ejection. Details of this analysis are provided in Chapter 14.
CRITERION 34 Reactor Coolant Pressure Boundary Rapid Propagation Failure Prevention The reactor coolant pressure boundary shall be designed and operated to reduce to an acceptable level the probability of rapidly propagating type failure. Consideration is given (a) to the provisions for control over service temperature and irradiation effects which may require operational restrictions, (b) to the design and construction of the reactor pressure vessel in accordance with applicable codes, including those which establish requirements for absorption of energy within the elastic strain energy range and for absorption of energy by plastic deformation and (c) to the design and construction of reactor coolant pressure boundary piping and equipment in accordance with applicable codes.
Protection against non-ductile failure has been provided by conformance with Section III of the ASME Boiler and Pressure Vessel Code fracture toughness rules as implemented by Code Case 1514, wherever possible. Conservative estimates of the pertinent material toughness properties were made in cases where it was not possible to run the prescribed tests.
Pressure containing components of the Reactor Coolant System are designed, fabricated, inspected and tested in conformance with the applicable codes. Further details are given in Section 4.1.6.
CRITERION 36 Reactor Coolant Pressure Boundary Surveillance Reactor coolant pressure boundary components shall have provisions for inspection, testing, and surveillance of critical areas by appropriate means to assess the structural and leaktight integrity of the boundary components during their service lifetime. For the reactor vessel, a material surveillance program conforming with current applicable codes shall be provided.
The design of the reactor vessel and its arrangement in the system provides the capability for accessibility during service life to the entire internal surfaces of the vessel and certain external zones of the vessel including the nozzle to reactor coolant piping welds and the top and bottom heads. The reactor arrangement within the containment provides sufficient space for inspection of
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 22 of 45 the external surfaces of the reactor coolant piping, except pipe embedded in the primary shielding concrete.
Monitoring of the Nil Ductility Transition Reference Temperature (RTNDT) properties of the core region plates, forgings, weldments and associated heat treated zones is done, to the extent practical, in accordance with ASTM E-185-73 (Standard Recommended Practice for Surveillance Tests for Nuclear Reactor Vessels). Samples of reactor vessel plate materials have been retained and catalogued in case future engineering development shows the need for further testing.
The material properties surveillance program includes not only the conventional tensile and impact tests, but also fracture mechanics specimens. The fracture mechanics specimens are the Wedge Opening Loading (WOL) type specimens. The observed shifts in RTNDT of the core region materials with irradiation will be used to confirm the calculated limits to startup and shutdown transients. Further details are given in Sub-Section 4.5.1.3.
1.4.7 Engineered Safety Features (PSDC 37- PSDC 65)
The engineered safety features provided in this plant have sufficient redundancy of components and power sources so that under the conditions of the design basis accident (DBA), the engineered safety features can, even when operating with partial effectiveness, maintain the required integrity of the three fission product barriers to keep exposure of the public well within the guidelines of Regulatory Guide 1.183 and 10 CFR 50.67.
A general explanation of each of the engineered safety features is given below. Specific details on engineered safety features design and operation are covered in Chapter 6.
- 1. A steel lined concrete containment structure provides an extremely reliable final barrier against the escape of fission products.
- 2. An emergency core cooling system is provided to deliver borated water to the core, in the event of a loss-of-coolant accident (LOCA), in three modes: passive accumulator injection, active safety injection, and residual heat removal recirculation. The design provides for periodic testing of active components for operability and required functional performance as well as incorporating provisions to facilitate physical inspection of critical components.
- 3. Heat removal systems are provided within the containment to cool the containment atmosphere under design basis accident conditions. Two systems of different
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 23 of 45 design principles are provided, the containment spray system and the ice condenser system.
These systems have the capacity to adequately cool and reduce the pressure of the containment atmosphere as well as reduce the concentration of halogen fission products.
CRITERION 37 Engineered Safety Features Basis for Design Engineered Safety Features shall be provided in the facility to back up the safety provided by the core design, the reactor coolant pressure boundary, and their protection systems.
Such Engineered Safety Features shall be designed to cope with any size reactor coolant piping break up to and including the equivalent of a circumferential rupture of any pipe in that boundary, assuming unobstructed discharge from both ends.
The design, fabrication, testing and inspection of the core, reactor coolant pressure boundary and their protection systems give assurance of safe and reliable operation under anticipated normal, transient, and accident conditions. However, Engineered Safety Features are provided in the facility to back up the safety provided by those systems. These Engineered Safety Features have been designed to cope with any size pipe break up to and including the largest double-ended guillotine break of reactor coolant piping assuming unobstructed discharge from both ends, and to cope with any steam or feedwater line break.
CRITERION 38 Reliability and Testability of Engineered Safety Features All Engineered Safety Features shall be designed to provide such functional reliability and ready testability as is necessary to avoid undue risk to the health and safety of the public.
A comprehensive program of plant testing has been developed for equipment systems and system control vital to the functioning of Engineered Safety Features. The program consists of initial performance tests of individual components, integrated tests of the system as a whole, and periodic tests of the actuation circuitry and mechanical components to assure reliable performance, upon demand, throughout the plant lifetime.
CRITERION 39 Emergency Power An emergency power source shall be provided and designed with adequate independency, redundancy, capacity, and testability to permit the functioning of the engineered safety features and protection systems required to avoid undue risk to the health and safety of the
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 24 of 45 public. This power source shall provide this capacity assuming a failure of a single active component.
Each unit has two 3500 kW emergency diesel generators which are individually capable of supplying sufficient power to operate the engineered safety features and protection systems required to avoid undue risk to public health and safety. The diesel generators start automatically and accept load within 10 seconds after the loss of normal and Preferred Off-site Power Sources to the buses, which supply vital loads. The diesel generator capacity is established on the basis of the operation of engineered safety features during a maximum hypothetical incident concurrent with a loss of (off-site) power and is adequate for safe and orderly shutdown of the unit.
All necessary safety features are duplicated and power supplies so arranged that failure of any one of the applicable buses to energize or failure of one diesel generator to start, does not prevent operation of a sufficient amount of equipment to ensure protection of the public.
CRITERION 40 Missile Protection Adequate protection for the engineered safety features, the failure of which would result in undue risk to the health and safety of the public, shall be provided against dynamic effects and missiles that might result from plant equipment failures.
This section discusses in general terms the missile protection criteria, missile sources, and methods of missile protection for the Donald C. Cook Nuclear Plant. A more comprehensive discussion of missiles arising in the event of a failure of the main turbine-generator can be found in Unit 1 UFSAR Section 14.1.13.
The original mechanistic missile analyses for turbine generated missile have been replaced by probability analyses. The probability analyses were performed using USNRC Regulatory Guide 1.115. The analyses concluded the probability of turbine missile generation was less than the NRC threshold. Thus, potential missile generation energies using mechanistic analysis are not required for the Alstom main turbine retrofits that were completed for Unit 1 and Unit 2. The original
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 25 of 45 turbine missile sources and energies are retained as these analyses are included in structural design criteria as shown in Table 5.1-1.
The Donald C. Cook Nuclear Plant is designed so that missiles from external or internal sources:
- 1. Will not cause or increase the severity of a loss-of coolant accident (LOCA).
- 2. Will not damage engineered safety features such that the minimum required safety functions are jeopardized.
- 3. Will not cause a break in the Seismic Class I portion of a steam or feedwater pipe.
- 4. Will not prevent safe shutdown and isolation of the reactor.
- 5. Will not damage fuel stored in the Spent Fuel Pit.
When utilizing probabilistic risk techniques as the missile protection method, the above criteria were considered to be satisfied when the overall risk of exceeding the off-site dose guidelines of Regulatory Guide 1.183 and 10 CFR 50.67 resulting from tornado generated missiles was below the acceptance limit stated in section 1.4.1.5.5.
When utilizing probability analysis as the missile protection method (for determining the probability of occurrence of generated missiles) the above criteria are considered to be satisfied when the risk of occurrence is below the NRC limit discussed later in this section.
Potential Missiles Credible missiles, from sources considered capable of generating potential missiles, are defined as follows:
1a. Tornadoes (Non-Probabilistic Protection Methods)
- a. Bolted Wood Decking - 12 ft x 12 ft x 4 in, 450 lbs. traveling at 200 mph.
- b. Corrugated Sheet Siding - 4 ft x 4 ft, 100 lbs. traveling at 225 mph.
- c. Passenger Car - 4000 lbs. traveling along the ground at 50 mph.
- d. Small Diameter Pipe - 2 1/2 in, schedule 40, steel pipe 8 ft length.
1b. Tornadoes (Probabilistic Protection Method)
The population of missiles used in the analysis was based on a physical walk down of non-safety-related buildings, trailers, fencing, trees and parking lots within a 2000 feet radius of the plant. Also included were missiles from plant buildings with
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 26 of 45 siding not designed for tornado winds. This walk down resulted in a potential missile population in excess of 55,000 objects.
2a. Main Turbine Failure (Unit 1)
In 2006, all three Unit 1 low pressure turbines (manufactured by General Electric) were replaced with turbines manufactured by the Siemens Westinghouse Power Corporation. The Unit 1 turbine generator was damaged during a loss of blade event on September 20, 2008. The unit was returned to service in a short term design configuration following repairs and modifications. In 2011, the Siemens low pressure turbines were retro-fitted with turbines manufactured by Alstom Power, Inc. Probability analysis indicates that for the Alstom Unit 1 turbines, the probability of the generation of a turbine missile (including turbine overspeed conditions) is less than the NRC limit which would require missile analysis.
Therefore, no additional missile analysis is provided for the Unit 1 Alstom low pressure turbines. This is a different approach than the General Electric missile analysis. However, the following missile information is still provided below for the (removed) General Electric low pressure turbines, as they are used in the analysis that bounds other Unit 1 rotating elements.
- a. Vane from last stage bucket - 54 lbs. traveling at 1170 ft per sec (casing exit velocity).
- b. 120° segment of last stage wheel - 8264 lbs. traveling at 409 ft per sec (casing exit velocity).
2b. Main Turbine Failure (Unit 2)
In 2016, the Brown-Boveri turbines were retro-fitted with turbines manufactured by Alstom Power, Inc. Probability analysis (Reference 1.4.11.17) for the Alstom Unit 2 turbines determined the probability of generation of a turbine missile (including overspeed conditions) is less than the NRC limit. Therefore, no additional missile analysis is required for the Unit 2 Alstom turbines. However, the following missile information is still provided below for the (removed) Brown-
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 27 of 45 Boveri turbines, as these analyses are used in structural design criteria analysis that bounds other Unit 2 rotating elements as shown in Table 5.1-1.
- a. Vane from last stage bucket - 168 lbs. traveling at 1135 ft per sec (casing exit velocity).
- b. 120° segment of next-to-last disc - 8360 lbs. traveling at 551 ft per sec (casing exit velocity).
- 3. Structures and overhead cranes which are not of Seismic Class I design.
- 4. Dynamic equipment failures encompassing pumps, diesel engines, and turbine drives.
- 5. Valve stems and bonnets of significant size, having the potential to violate any of the missile protection criteria.
- 6. Control rod drive mechanisms or parts thereof.
- 7. Pipe rupture whip, including steam/water jet forces following a pipe rupture of an adjacent pipe.
- 8. Miscellaneous
- a. Reactor Vessel Nozzle Inspection Hatch Covers
- b. Instrument wells and thimbles with mounted components With reference to Item 7, above, to determine the dynamic impact and erosive effects of high temperature pressurized water and of steam jets from ruptured pipe lines, Westinghouse conducted a series of tests with subcooled water at 2250 psia/500°F and with saturated steam at 1030 psia, released through nozzles of 3 different diameters, impinging on reinforced concrete structures, at various angles. Evaluation of the results (Reference 2) indicates that erosion of concrete by a primary coolant or steam line break definitely does not impose a design consideration.
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 28 of 45 Missile Protection Methods Protection of safety-related equipment from missiles has been accomplished by one or more of the following methods:
- 1. Compartmentalization: Enclosing equipment in missile protected compartments.
- 2. Barriers: Erecting barriers to stop potential missiles either at the source or at the location of the equipment to be protected.
- 3. Separation: Sufficient separation of redundant systems so that a potential missile cannot impair both systems.
- 4. Restraints: Limiting generation of potential missiles by means of restraints.
- 5. Equipment Design: Designing the structure or component to withstand a missile, without loss of function.
- 6. Strategic Orientation: Orienting equipment, or parts of equipment, in a direction that directs the potential missile paths away from safety-related equipment.
- 7. Distance: Locating equipment beyond range of potential missiles.
- 8. Probabilistic Risk Consideration: Utilization of probabilistic risk based techniques that demonstrate the overall risk resulting from exposed or partially protected targets is below a minimum criterion for exceeding the off-site dose guidelines of Regulatory Guide 1.183 and 10 CFR 50.67.
- 9. Probability Analysis: Utilization of probability analysis that demonstrates the probability of missile generation occurrence is below the established NRC limits for requiring additional missile generation analysis.
In cases where concrete or steel is used as missile protection, the calculation of the missile shield thickness required was based on the modified Petry formula, as set forth in the U. S. Navy Bureau of Yards and Docks publication, "Design of Protective Structures", Navy Docks P-51, or the Stanford Steel Penetration formula presented in Nuclear Engineering and Design, "The Design of Barricades for Hazardous Pressure Systems", C. V. Moore, 1967.
Probabilistic Methodology for Determining Risk from Tornado Generated Missiles A limited number of systems, structures and components located near openings/penetrations in Seismic Category I structures or located outside of such structures have been evaluated and do not require additional physical tornado missile protection features. These structures, systems and components have been evaluated with respect to the overall risk resulting from tornado generated
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 29 of 45 missiles upon potential off-site dose consequences exceeding the guidelines of Regulatory Guide 1.183 and 10 CFR 50.67. The following structures, systems or components have been evaluated using the probabilistic risk assessment methodology and it has been established that additional physical protection was not necessary:
Emergency diesel generator appurtenances located outside Seismic Category I structures including ventilation intake air, combustion intake air and combustion exhaust.
Exposed portion of the Fuel Oil Storage Tank through the manhole 1 Intake hoods associated with switchgear room heating, ventilation, and air-conditioning (hood for 4kV switchgear room AB ventilation supply, hood for 4kV switchgear room CD ventilation supply, and hood for CRID inverter room and CRD equipment room ventilation supply).
6" precast concrete walls and 7" concrete slab roof enclosing the east end of the Fuel Handling Building.
Three openings in roof slab at east end of the Fuel Handling Building.
Eight openings in roof slab at west end of the Auxiliary Building.
Auxiliary Building ventilation fuel handling area exhaust fan #1, Auxiliary Building ventilation fuel handling area exhaust fan #2 and the associated duct work on the Auxiliary Building roof at el. 650', ductwork from el. 650' to el. 677'-6" and the ductwork above roof el. 677'-6".
Unit 1 and Unit 2 exhaust for the Turbine Driven Auxiliary Feed Pump (TDAFP) that is located in the roof of the Heater Bay area.
Portion of the Unit 1 and Unit 2 Auxiliary Feed Water pipes that are attached to the Condensate Storage Tank (CST) in the Refueling Water Storage Tank (RWST) yard.
Two louvers on both north and south wall of the control room air conditioning room above elevation 650'.
Single door on the west side of Auxiliary Building at elevation 650'.
Double door on the north wall of Unit 1 West Main Steam Enclosure at elevation 637'-6".
1 Evaluated for a postulated concern of the manhole cover being uplifted / displaced during a tornado event.
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 30 of 45 Double door on the south wall of Unit 2 West Main Steam Enclosure at elevation 637'-6".
Steam Generator power operated relief valve vents, Steam Generator safety valve vents and Steam Generator stop valve steam cylinder dump valve vents in Unit 1 and Unit 2 West Main Steam Enclosure roof.
Louvers on the north wall of Unit 1 Main Steam Enclosure.
Louvers on the south wall of Unit 2 Main Steam Enclosure.
Steam Generator power operated relief valve vents, Steam Generator safety valve vents and Steam Generator stop valve steam cylinder dump valve vents in Unit 1 and Unit 2 East Main Steam Enclosure roof.
Blow out panels and louvers in Unit 1 and Unit 2 East Main Steam Enclosure.
Containment Penetrations 1-CPN-30, 1-CPN-62, 2-CPN-30 and 2-CPN-62.
Electrical cable attached to 1-PPP-301 Lower Containment channel III pressure protection transmitter.
Electrical cable attached to 1-FMO-201 Steam Generator 1 Feed Water shutoff valve.
Electrical cable attached to 1-FMO-204 Steam Generator 4 Feed Water shutoff valve.
Electrical cable attached to 2-PPP-301 Lower Containment channel III pressure protection transmitter.
Electrical cable attached to 2-FMO-201 Steam Generator 1 Feed Water shutoff valve.
Electrical cable attached to 2-FMO-204 Steam Generator 4 Feed Water shutoff valve.
The CNP specific acceptance criteria is that the total probability of tornado missiles striking a target multiplied by a factor relating striking the target to the probability of off-site dose consequences exceeding the guidelines of Regulatory Guide 1.183 and 10 CFR 50.67 must be shown by analysis to be less than 1E-06 per reactor per year. In addition, the evaluation must
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 31 of 45 include additional qualitative arguments that demonstrate the risk is actually lower than 1E-06 per reactor per year. Examples of such qualitative arguments include
- 1. consideration that a missile simply striking a target may not result in its inability to perform its safety function in all cases,
- 2. consideration of redundant capability, and
- 3. consideration that striking a penetration in a Seismic Category I structure may not result in striking a target beyond the barrier in all cases, etc.
The analysis that determines tornado generated missile impact probabilities uses a NRC-approved methodology (Reference 1.4.11.5) developed by the Electric Power Research Institute (EPRI)
(Reference 1.4.11.6). The methodology is implemented using the computer program, TORMIS, which is described below.
TORMIS Description TORMIS implements a methodology developed by the Electric Power Research Institute.
TORMIS determines the probability of tornado generated missiles striking targets. These targets may include, but are not limited to, walls and roofs of buildings, penetrations of Seismic Category I structures, and exposed portions of systems/components. The probability is calculated by simulating a large number of tornado strike events at the site for each tornado wind speed intensity scale. This results in a calculated probability per unit area of striking any target. After the probability of striking a target is calculated, the exposed surface area of the particular component is factored in to determine the probability of striking a particular item.
The TORMIS analysis for CNP is in accordance with the TORMIS program, as described in Reference 1.4.11.6, using site specific parameters as described below:
- 1. The probability of a tornado strike used at CNP is based on the broad region values, as this is more conservative than the local strike probability.
- 2. The Fujita (F-scale) wind speeds are used in lieu of the TORMIS wind speeds (F'-
scale).
- 3. A more conservative near-ground profile was used than the base case in TORMIS, resulting in a higher tornado ground wind speed. The profile has a ground wind speed equal to 82% of the wind speed at 33 feet. (i.e., V0/V33 = 0.82).
- 4. The number of missiles used in the TORMIS analysis is a conservative value for CNP-specific sources. The population of missiles used in the analysis was based
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 32 of 45 on a physical walk down of non-safety-related buildings, trailers, fencing, trees and parking lots within a 2000 feet radius of the plant. Also included were missiles from plant buildings with siding not designed for tornado winds. This walk down resulted in a potential missile population in excess of 55,000 objects.
Probability Analysis of Missile Generation Occurrence The results of the Alstom turbine missile probability analyses (Reference 1.4.11.15 and 1.4.11.17) for the Donald C. Cook Unit 1 and Unit 2 turbines determined that the overspeed turbine missile probability remains well below the NRC limits for an "unfavorably oriented" unit. "Unfavorable oriented" refers to a turbine rotor oriented tangentially to the containment building. The missile probability analysis considered 100,000 operating hours and quarterly turbine overspeed protection system testing of the main turbine stop and control valves. The runaway turbine missile probability for a turbine missile due to a control system failure was previously calculated by the Siemens missile probability analysis (Reference 1.4.11.14). The control system was not modified for Alstom turbine configurations, thus the runaway turbine missile probability due a control system failure remains unchanged. The sum of the overspeed and runaway missile probabilities for Unit 1 and Unit 2 remains well below the NRC limits for an "unfavorably oriented" unit.
Based on the above, no additional missile analysis is required for the Unit 1 and Unit 2 turbines.
CRITERION 41 Engineered Safety Features Performance Capability Engineered Safety Features, such as the Emergency Core Cooling System and the Containment Spray System, shall provide sufficient performance capability to accommodate the failure of any single active component without resulting in undue risk to the health and safety of the public.
Each one of the engineered safety features provides sufficient performance capability to accommodate any single failure of an active component in the ESF and still function in a manner to avoid undue risk to the health and safety of the public.
CRITERION 42 Engineered Safety Features Components Capability Engineered Safety Features shall be designed so that the capability of these features to perform their required function is not impaired by the effects of a loss-of-coolant accident (LOCA) to the extent of causing undue risk to the health and safety of the public.
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 33 of 45 The majority of the active components of the Emergency Core Cooling System and the Containment Spray System whose failure would affect the health and safety of the public are located outside the containment and not subject to containment accident conditions.
Instrumentation, motors, cables, and penetrations located inside the containment which are required to function are selected to meet the most adverse accident conditions to which they may be subjected. These items are either protected from containment accident conditions or are designed to withstand without failure, the effects of radiation, temperature, pressure, and humidity expected during the required operational period for individual specific accident conditions.
CRITERION 43 Accident Aggravation Prevention Protection against any action of the Engineered Safety Features, which would accentuate significantly the adverse after-effects of a LOCA, shall be provided.
The reactor is maintained subcritical following a loss-of-coolant accident. Introduction of borated cooling water into the core results in a net negative reactivity addition. The control rods insert and remain inserted. The delivery of cold safety injection water to the reactor vessel following accidental expulsion of reactor coolant does not cause further loss of integrity of the reactor coolant system boundary.
CRITERION 44 Emergency Core Cooling System Capability An emergency core cooling system with the capability for accomplishing adequate emergency core cooling shall be provided. This core cooling system and the core shall be designed to prevent fuel and clad damage that would interfere with the emergency core cooling function and to limit the clad metal-water reaction to acceptable amounts for all sizes of breaks in the reactor coolant piping up to the equivalent of a double-ended rupture of the largest pipe. The performance of such emergency core cooling system shall be evaluated conservatively in each area of uncertainty.
Adequate emergency core cooling is provided by the emergency core cooling system (ECCS) whose components operate in three modes: passive accumulator injection, active safety injection and residual heat removal recirculation. The primary purpose of the ECCS is to automatically deliver cooling water to the reactor core in the event of a loss-of-coolant accident. This limits the fuel-clad temperature and thereby ensures that the core will remain substantially intact and in place, with its essential heat transfer geometry preserved. Subsequent operation of residual heat
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 34 of 45 removal in the recirculation mode following ECCS injection, even in the presence of debris-laden water, continues to provide long term core cooling.
CRITERION 45 Inspection of Emergency Core Cooling System Design provisions shall, where practical, be made to facilitate inspection of physical parts of the Emergency Core Cooling System including reactor vessel internals and water injection nozzles.
Design provisions are made to the extent practical to facilitate access to the critical parts of the ECCS including, pipes, valves, tanks, recirculation sump strainers, recirculation flow paths, and pumps for visual and non-destructive test inspection where such techniques are desirable and appropriate.
CRITERION 46 Testing of Emergency Core Cooling System Components Design provisions shall be made so that components of the Emergency Core Cooling System can be tested periodically for operability and functional performance.
The design provides for periodic testing of active components of the Emergency Core Cooling System for operability and functional performance as detailed in Section 6.2.5, Tests and Inspection. Power sources are arranged to permit individual actuation of each active component of the Emergency Core Cooling System.
CRITERION 47 Testing of Emergency Core Cooling System Capability shall be provided to test periodically the operability of the Emergency Core Cooling System up to a location as close to the core as is practical.
An integrated system test can be performed when the plant is cooled down and the residual heat removal loop is in operation. This test would not introduce flow into the Reactor Coolant System but would demonstrate the operation of the valves, pump circuit breakers, and automatic circuitry upon initiation of safety injection.
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 35 of 45 CRITERION 48 Testing of Operational Sequence of Emergency Core Cooling System Capability shall be provided to test initially, under conditions as close as practical to design, the full operational sequence that would bring the Emergency Core Cooling System into action, including the transfer to alternate power sources.
The design provides for capability to test initially, to the extent practical the full operational sequence up to the design conditions for the Emergency Core Cooling System to demonstrate the state of readiness and capability of the system. Details of the operational sequence testing are presented in Section 6.2.5, Test and Inspections.
CRITERION 49 Reactor Containment Design Basis The reactor containment structure, including openings and penetrations, and any necessary containment heat removal systems, shall be designed so that the leakage of radioactive materials from the containment structure under conditions of pressure and temperature resulting from the largest credible energy release following a loss-of-coolant accident, including the calculated energy from metal-water or other chemical reactions that could occur as a consequence of failure of any single active component in the emergency core cooling system will not result in undue risk to the health and safety of the public.
The reactor containment structure and penetrations, with the aid of containment heat removal systems including the ice bed, are designed to limit below Regulatory Guide 1.183 and 10 CFR 50.67 values the leakage of radioactive fission products from the containment under those conditions that would result from the largest credible energy release following a loss-of-coolant accident, including a margin to cover the effects of metal-water reaction or other undefined energy sources.
CRITERION 50 NDT Temperature Requirement for Containment Materials The selection and use of containment materials shall be in accordance with applicable engineering codes.
The selection and use of containment materials comply with the applicable codes and standards listed in Section 5.2.2. The concrete containment structure is not susceptible to a low temperature brittle fracture.
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 36 of 45 CRITERION 52 Containment Heat Removal Systems Where active heat removal systems are needed under accident conditions to prevent exceeding containment pressure, at least two systems, each with full capacity, shall be provided.
Adequate heat removal capability for the Ice Condenser Containment is provided by two separate Containment Spray Systems and two (redundant) portions of the Residual Heat Removal System.
The sequential modes of operation are given in Section 6.3.2. The primary purpose of the Containment Spray System is to spray cool water into the containment atmosphere in the event of a loss-of-coolant accident to prevent containment pressure from exceeding the design value. The design of the Containment Spray System is based on the conservative assumption that the core residual heat is released to the containment as steam. The heat removal capability of each Containment Spray System is sized to remove the reactor residual heat during cool down from operation at a calculated power level of 3481 MWt (102% of 3413 MWt), after a loss-of-coolant accident.
CRITERION 53 Containment Isolation Valves Penetrations that require closure for the containment function shall be protected by redundant valving and associated apparatus.
Redundant valving is provided for piping that is open to the atmosphere and connects to the Reactor Coolant System or is open to the containment atmosphere. Details of this and other requirements for valving are given in Sub-Chapter 5.4.
CRITERION 54 Initial Leak Rate Testing for Containment The containment shall be designed so that integrated leakage rate testing can be conducted at the peak pressure calculated to result from the design basis accident after completion and installation of all penetrations and the leakage rate shall be measured over a sufficient period of time to verify its conformance with required performance.
The containment was designed so that its maximum integrated leakage under accident conditions meets the site exposure criteria set forth in Regulatory Guide 1.183 and 10 CFR 50.67 guidelines.
The ice condenser and the spray systems provide assurance that with a containment leak rate of 0.18 per cent by weight per day, the exposure at the minimum exclusion distance is less than Regulatory Guide 1.183 and 10 CFR 50.67.
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 37 of 45 CRITERION 55 Periodic Containment Leakage Rate Testing The containment shall be designed so that an integrated leakage rate can be periodically determined by tests during the plant lifetime.
The containment is designed to permit full-integrated leak rate tests.
CRITERION 56 Provisions for Testing of Penetrations Provisions shall be made, to the extent practical, for periodically testing penetrations which have resilient seals or expansion bellows to permit leak tightness to be demonstrated at the peak pressure calculated to result from occurrence of the design basis accident.
Where resilient seals are used to maintain containment integrity, provisions have been made (to the extent practical) to facilitate periodic leak tightness testing in accordance with this criterion.
Expansion bellows are not used to maintain containment integrity. Their original function was to facilitate local leak testing of penetrations. This testing is redundant to the containment integrated leakage rate testing.
CRITERION 57 Provisions for Testing of Isolation Valves Capability shall be provided to the extent practical for testing functional operability of valves and associated apparatus essential to the containment function for establishing that no failure has occurred and for determining that valve leakage does not exceed acceptable limits.
Capability is provided to the extent practical for testing the functional operability of valves and associated apparatus and the leakage during periods of reactor shutdown. Initiation of the containment isolation employs coincidence circuits, which allow checking of the operability and calibration of one channel at a time. Removal or bypass of one signal channel places that channel in the tripped mode.
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 38 of 45 CRITERION 58 Inspection of Containment Pressure-Reducing Systems Design provisions shall be made, to the extent practical, to facilitate the periodic physical inspection of all important components of the containment pressure-reducing systems such as pumps, valves, spray nozzles and sumps.
Where practicable, active and passive components of the Containment Spray Systems are inspected periodically to demonstrate system readiness. The pressure containing components are inspected to detect leaks from pump seals, valve packing, flanged joints and safety valves. During operational testing of the Containment Spray Pumps, the portions of the system containing pump pressure are inspected to detect leaks. Design provisions for inspection of portions of the Emergency Core Cooling System which functions as part of the Containment Spray System are described in Section 6.2.5.
CRITERION 59 Testing of Containment Pressure-Reducing Systems Components The containment pressure-reducing systems shall be designed, to the extent practical, so that active components can be tested periodically for operability and required functional performance.
Consideration was given in the system design for provisions to permit periodic testing of active components. Periodic tests are performed to verify proper component functioning in accordance with the requirements of the applicable edition of the ASME Operation and Maintenance (OM)
Code. Testing of those components of Emergency Core Cooling System which are used for containment spray purposes is described in Section 6.2.5.
CRITERION 60 Testing of Containment Spray Systems A capability shall be provided, to the extent practical, to periodically test the delivery capability of the Containment Spray Systems as close to the spray nozzles as possible.
Design provisions are made to the extent practical to facilitate access for periodic visual inspection of important components of the containment spray systems. The containment pressure reducing systems are designed to the extent practical so that the spray pumps, spray injection valves, spray nozzles, and additive injection valves can be tested periodically and after any component maintenance for operability and functional performance. Permanent test lines for all the containment spray loops are provided.
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 39 of 45 CRITERION 61 Testing of Operational Sequence of Containment Pressure-Reducing Systems Capability shall be provided to initially test the containment pressure-reducing systems under conditions as close as practical to the design and full operational sequence that would bring such systems into action, including transfer to alternate power sources.
The design of the Containment Spray System provides, to the fullest practical extent, the capability to perform an initial test of the full operational sequence to demonstrate the state of readiness of those sections of the system which do not function during normal plant operation. This testing included a full-flow test through special test connections, which, for test purposes, replaced the check valves before the nozzles. Transfer to emergency power source was also demonstrated during this test. Airflow tests through each of the nozzles was used for verification of unobstructed flow. The transfer to emergency power source test is performed periodically. The air flow test is performed following maintenance that could result in nozzle blockage.
1.4.8 Fuel and Waste Storage Systems (PSDC 66 - PSDC 69)
Fuel storage and waste handling facilities are designed such that accidental releases of radioactivity will not exceed the guidelines of Regulatory Guide 1.183 and 10 CFR 50.67.
During refueling of the reactor, operations are conducted with the spent fuel under water. This provides visual control of the operation at all times and also maintains low radiation levels. The borated refueling water assures subcriticality and also provides adequate cooling for the spent fuel during transfer. Spent fuel is taken from the reactor core, transferred to the refueling cavity, and placed in the fuel transfer canal. Rod cluster control assembly transfer from a spent fuel assembly to another fuel assembly can be accomplished prior to transferring the spent fuel to the spent fuel storage pool or inside the spent fuel storage pool. The spent fuel storage pool is supplied with a cooling system for the removal of the decay heat of the spent fuel. Racks are provided to accommodate the storage of a total of 3613 fuel assemblies. The storage pool is filled with borated water at a concentration to match that used in the reactor cavity during refueling operations. The spent fuel is stored in a vertical array with sufficient center-to-center distance between assemblies to assure subcriticality (keff 0.95) even if unborated water were introduced into the pool.
(References 3 and 4) The water level maintained in the pool provides sufficient shielding to permit normal occupancy of the area by operating personnel. The spent fuel pool is also provided with
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 40 of 45 systems to maintain water cleanliness and to indicate pool water level. Radiation is continuously monitored and a high radiation level is annunciated in the control room.
Water removed from the spent fuel pool must be pumped out, as there are no gravity drains.
Spillage or leakage of any liquids from waste handling facilities within the auxiliary building goes to waste drain system floor drains. These floor drains are connected to separate "contaminated" sumps in the auxiliary building.
Postulated accidents involving the release of radioactivity from the fuel and waste storage and handling facilities are shown in Chapter 14 to result in exposures within the limits of Regulatory Guide 1.183 and 10 CFR 50.67.The refueling cavity, the refueling canal, the fuel transfer canal, and the spent fuel storage pool are reinforced concrete structures with a corrosion resistant liner.
These structures have been designed to withstand loads due to postulated earthquakes. The fuel transfer tube, which connects the refueling canal and the fuel transfer canal which forms part of the reactor containment, is provided with a valve and a blind flange which closes off the fuel transfer tube when not in use.
CRITERION 66 Prevention of Fuel Storage Criticality Criticality in the new fuel storage room and the spent fuel storage pool shall be prevented by physical systems or processes. Such means as geometrically safe configurations shall be emphasized over procedural controls.
The new and spent fuel storage racks are designed so it is impossible to insert assemblies other than in the storage cells, thereby maintaining separation. The spent fuel storage racks are designed with multiple regions that accept assemblies based on their reactivity values. Borated water is used to fill the spent fuel storage pool at a concentration to match that used in the reactor cavity and refueling canal during refueling operations. Minimum boron requirements for the Spent Fuel Pool and the Reactor Cavity during refueling operations are described in the Technical Specifications.
The fuel is stored vertically in an array with sufficient center-to-center distance between assemblies to assure keff 0.95 even if unborated water were used to fill the pool. During reactor vessel head removal, and while loading and unloading fuel from the reactor, the boron concentration is maintained at not less than that required to shut down the core to a Keff = 0.95.
The design of the fuel handling equipment incorporated built-in interlocks and safety features, the use of detailed refueling instructions, and the observance of minimum operating conditions provide
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 41 of 45 assurance that no incident could occur during the refueling operations that would result in a hazard to public health and safety.
CRITERION 67 Fuel and Waste Storage Decay Heat Reliable decay heat removal systems shall be designed to prevent damage to the fuel in storage facilities and to waste storage tanks that could result in radioactivity release which results in undue risk to the health and safety of the public.
The refueling water provides a reliable and adequate cooling medium for spent fuel transfer. The spent fuel storage pool is provided with a Spent Fuel Pool Cooling System, which is discussed in Sub-Chapter 9.4.
CRITERION 68 Fuel and Waste Storage Radiation Shielding Adequate shielding for radiation protection shall be provided in the design of spent fuel and waste storage facilities.
Adequate shielding for radiation is provided during reactor refueling by conducting all spent fuel transfer and storage operations under water. This permits visual control of the operation at all times while maintaining low radiation levels, less than 2.5 mr/hr, for periodic occupancy of the area by operating personnel. At least 23 feet of water is maintained over the top of irradiated fuel assemblies seated in the storage racks. The water level in the pool is determined to be not less than the minimum required depth at least once per 7 days. Two instruments are used to detect any significant changes in water level. Water removed from the pool has to be pumped out since there are no gravity drains.
CRITERION 69 Protection Against Radioactivity Release from Spent Fuel and Waste Storage Provisions shall be made in the design of fuel and waste storage facilities such that no undue risk to the health and safety of the public could result from an accidental release of radioactivity.
The fuel and waste storage facilities are contained, and equipment designed, so that accidental releases of radioactivity directly to the atmosphere are monitored and will not exceed the guidelines of 10 CFR 100 and 10 CFR 50.67; refer to Chapters 11 and 14.
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 42 of 45 1.4.9 Effluents (PSDC 70)
Gaseous, liquid and solid waste disposal facilities have been designed so that the discharge of effluents and off-site shipments are in accordance with applicable governmental regulations.
Process and discharge streams are appropriately monitored and safety features are incorporated to preclude releases in excess of the limits of 10 CFR 20. Weather conditions do not place any restrictions on the normal release of operational radioactive effluents to the atmosphere.
Radioactive fluids entering the Waste Disposal System are collected in tanks until the course of subsequent treatment is determined.
Radioactive gases are pumped by compressors through a manifold to one of the waste gas storage tanks where they are held a suitable period of time for decay. Tanks are provided for the normal operations of filling, holdup for decay, and discharge. During normal operation gases are discharged intermittently at a controlled rate from these tanks through the monitored unit vent. All solid wastes are placed in suitable containers and stored on-site until shipment off-site for disposal.
Liquid wastes are processed to remove most of the radioactive material. The spent resins from the demineralizers, the filter cartridges and the concentrates from the evaporators are packaged and stored on-site until shipment off-site for disposal. The processed water, from which most of the radioactive material has been removed, is recycled for reuse within the plant or is discharged through a monitored line into the condenser discharge.
CRITERION 70 Control of Releases of Radioactivity to the Environment The facility design shall include those means necessary to maintain control over the plant radioactive effluents, whether gaseous, liquid, or solid. Appropriate holdup capacity shall be provided for retention of gaseous, liquid, or solid effluents, particularly where unfavorable environmental conditions can be expected to require operational limitations upon the release of radioactive effluents to the environment. In all cases, the design for radioactivity control must be justified (a) on the basis of 10 CFR 50 Appendix I requirements, for both normal operations and for any transient situation that might reasonably be anticipated to occur and (b) on the basis of Regulatory Guide 1.183 and 10 CFR 50.67 dosage level guidelines for potential reactor accidents of exceedingly low probability of occurrence.
Radioactive fluids entering the Waste Disposal System are collected in tanks until determination of subsequent treatment can be made. Provisions have been made for waste segregation and recycling to permit selective operation of the processing equipment to maintain radioactivity in the
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 43 of 45 effluents as low as practicable. Fluids are sampled and analyzed to determine the quantity of radioactivity, with an isotopic breakdown if necessary. Liquid wastes are processed as required and then either recycled or released under controlled conditions. The system design and operation are directed toward minimizing releases to unrestricted areas. Discharge streams are appropriately monitored and safety features are incorporated to preclude releases in excess of the limits of 10 CFR 50 Appendix I.
1.4.10 Applicable Appendix A GDCs Since initial licensing to the PSDCs discussed in Sections 1.4.1-1.4.9, aspects of the 10 CFR 50 Appendix A GDCs have become obligations or commitments applicable to the Donald C. Cook Nuclear Plant. These aspects of the 10 CFR 50 Appendix A GDCs are presented below.
1.4.10.1 Appendix A GDC Applicability to the Reactor Coolant System Vents NUREG-0737 (Reference 11) Task II.B.1, Reactor Coolant System Vents obligated that . . .
the design of the events [sic] shall conform to the requirements of Appendix A to 10 CFR 50, General Design Criteria. The Donald C. Cook Nuclear Plant implementation of this requirement was evaluated (Reference 12) to meet the applicable portions of Criteria 1 (Quality Standards and Records), 2 (Design Bases for Protection Against Natural Phenomena), 4 (Environmental and Dynamic Effects Design Bases), 14 (Reactor Coolant Pressure Boundary), 30 (Quality of Reactor Coolant Pressure Boundary), and 31 (Fracture Prevention of Reactor Coolant Pressure Boundary).
The reactor coolant system vents are described in UFSAR Section 4.2.2.6.
1.4.10.2 Appendix A GDC 19 Applicability NUREG-0737 (Reference 11) Task III.D.3.4, Control-Room Habitability Requirements obligated conformance with requirements of Criterion 19, Control Room, of 10 CFR 50 Appendix A. The Donald C. Cook Nuclear Plant implementation of this requirement was
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 44 of 45 evaluated to fulfill this obligation (Reference 13). Conformance with Criterion 19 of 10 CFR 50 Appendix A is described in Unit 1 UFSAR Section 14.3.5.
1.4.10.3 Appendix A GDC 4 Applicability to Reactor Coolant System Piping Criterion 4, Environmental and Dynamic Effects Design Bases of 10 CFR 50 Appendix A has a provision to exclude from a plants design basis the dynamic effects associated with postulated pipe rupture if analysis is approved by the Commission demonstrating that the probability of pipe rupture is extremely low (i.e., a leak-before-break analysis). The Donald C. Cook Nuclear Plant has applied this provision of GDC-4 to the primary coolant loop piping and pressurizer surge line as described in UFSAR Section 5.2.2.7 and in Unit 1 UFSAR Section 14.3.3.1.
1.4.11 References for Section 1.4
- 1. Atomic Energy Commission, Proposed General Design Criteria, Federal Register, July 11, 1967.
- 2. WCAP-7391, Pressurized Water and Steam Jet Effects on Concrete, (WNES Proprietary Class 2).
- 3. ANSI 57.2-1983, "Design Objectives for LWR Spent Fuel Storage Facility at Nuclear Power Stations."
- 4. Nuclear Regulatory Commission, Letter to all power reactor licensees, from B. K.
Grimes, "OT Position for Review and Acceptance of Spent Fuel Storage and Handling Applications," April 14, 1978.
- 5. Letter, Rubenstein (NRC) to Miraglia (NRC) entitled, "Safety Evaluation Report -
Electric Power Research Institute (EPRI) Topical Reports Concerning Tornado Missile Probabilistic Risk Assessment (PRAP Methodology)," dated October 26, 1983.
- 6. Twisdale, L.A. and Dunn, W.L., EPRI NP-2005, Tornado Missile Simulation and Design Methodology, Volumes I and II, Final Report Dated August 1981.
- 7. Correspondence from AEP to NRC; AEP:NRC 0356D, IE Bulletin 79-01B -
Environmental Qualification of 1E Equipment, dated 02/03/81.
- 8. Correspondence from AEP to NRC; AEP NRC 0356C, IE Bulletin 79-01B -
Environmental Qualification of 1E Equipment, dated 10/31/80.
UFSAR Revision 31.0 INDIANA MICHIGAN POWER Revised: 31.0 D. C. COOK NUCLEAR PLANT Chapter: 1 Section 1.4 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 45 of 45
- 9. NRC Safety Evaluation for Amendment Nos. 31 to License DPR-58 and 12 to License DPR-74, dated 07/31/79.
- 10. PSAR Question 10.2.
- 11. "Clarification of TMI Action Plan Requirements," NUREG-0737, November 1980.
- 12. Letter, Varga (NRC) to Dolan (I&M) entitled "NUREG-0737, Item II.B.1, Reactor Coolant System Vents - Donald C. Cook Nuclear Plant, Unit Nos. 1 and 2," dated August 31, 1983.
- 13. Letter, Varga (NRC) to Dolan (I&M) entitled "Safety Evaluation Report Regarding Control Room Habitability Requirements (NUREG-0737)," dated February 11, 1982.
- 14. Siemens Technical report, Missile Probability Analysis Short Term Solution, CT-27456, Revision 0, April 16, 2009.
- 15. D.C. Cook 1 LP Retrofit- Missile Analysis, Alstom Report STD0013760, dated January 13, 2011.
- 16. Letter, Stang (NRC) to Powers (I&M) entitled "Donald C. Cook Nuclear Plant, Units 1 and 2 - Issuance of Amendments (TAC Nos. MA9839 and MA9840),"
dated August 3, 2001 (ML011910127)
- 17. D.C. Cook Unit 2 Retrofit - Missile Analysis, Alstom Report HTCZ591309, dated April 22, 2014.
- 18. Letter, Dietrich (NRC) to Gebbie (I&M) entitled Donald C. Cook Nuclear Plant, Units 1 and 2 - Issuance of Amendments (CAC Nos. MF5184 and MF5185), dated October 20, 2016.
UFSAR Revision 31.0 Revised: 26.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.5, §1.6, §1.7, UPDATED FINAL SAFETY ANALYSIS REPORT §1.8 &§1.9 .
Page: i of ii
1.0 INTRODUCTION
AND
SUMMARY
...................................... 1 1.5 PLANT OPERATION ..................................................................... 1 1.6 RESEARCH AND DEVELOPMENT REQUIREMENTS ......................... 2 1.6.0 [Historical] Research And Development Requirements (From Original FSAR) ................................................................ 2 1.6.1 [Historical] Programs Required For Plant Operation ............. 2 1.6.1.1 [Historical] Development Of The Design Of The Emergency Core Cooling System (ECCS) .................................................................. 2 1.6.1.2 [Historical] Development Of The Final Core Thermal-Hydraulic Nuclear And Mechanical Design Parameters ................................. 4 1.6.1.3 [Historical] Further Evaluation Of Core Stability .............................. 4 1.6.1.4 [Historical] Development Of The Design Details Of The Containment Spray System............................................................. 5
[Historical] Containment Spray Research And Development ............................... 6
[Historical] Applicability To The Donald C. Cook Plant ......................................... 8 1.6.1.5 [Historical] Development Of The Ice Condenser System ................ 8
[Historical] Small-Scale Ice Bed Performance Tests ............................................ 9
[Historical] Full-Scale Ice Bed Performance Tests................................................ 9
[Historical] Ice Handling And Ice Basket Loading Tests (Reference 2)................. 9
[Historical] Ice Storage Test ............................................................................... 10
[Historical] Ice Condenser Door Gasket Tests (Reference 1) ............................. 10
[Historical] Ice Condenser Inlet Door Tests (Reference 1) ................................. 11
[Historical] Ice Condenser Floor Drains(Reference 14) ...................................... 11
[Historical] Iodine Removal In The Ice Condenser(Reference 15) ...................... 11
[Historical] Hydrogen Control Program ............................................................... 12 1.6.2 [Historical] Other Areas Of Research and Development Not Required For Plant Operation ................................................ 12
- 1. [Historical] Burnable Poison Program (Item 7 in Reference 1) ...... 12
UFSAR Revision 31.0 Revised: 26.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.5, §1.6, §1.7, UPDATED FINAL SAFETY ANALYSIS REPORT §1.8 &§1.9 .
Page: ii of ii
- 2. [Historical] Fuel Development Program For Operation At High Power Densities (Item 8 in Reference 1) ...................................... 12
- 3. [Historical] In-Core Detector Program (Item 9 in Reference 1) ...... 13
- 5. [Historical] FLECHT (Full Length Emergency Core Cooling Heat Transfer Test) (Item 12 in Reference 1) ........................................ 14
- 6. [Historical] Flashing Heat Transfer Program (Item 13 in Reference
- 1) ................................................................................................... 14
- 7. [Historical] Loss-of-Coolant Analysis Program (Item 14 in Reference 1) ................................................................................. 14
- 8. [Historical] Blowdown Forces Program (Item 15 in Reference 1) .. 14
- 9. [Historical] Gross Failed Fuel Detector Program ........................... 15
- 10. [Historical] Reactor Vessel Thermal Shock (Item 16 in Reference 1)
...................................................................................................... 15
- 11. [Historical] BART Program ............................................................ 16 1.6.3 [Historical] 17 X 17 Fuel Assembly Verification ................... 16 1.6.4 [Historical] References For Section 1.6................................. 17 1.7 QUALITY ASSURANCE ............................................................... 20 1.8 IDENTIFICATION OF CONTRACTORS ........................................... 21 1.9 FACILITY SAFETY CONCLUSIONS ............................................... 22
UFSAR Revision 31.0 Revised: 26.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.5, §1.6, §1.7, UPDATED FINAL SAFETY ANALYSIS REPORT §1.8 &§1.9 .
Page: 1 of 22
1.0 INTRODUCTION
AND
SUMMARY
1.5 PLANT OPERATION The Facility Operating License and Plant Technical Specifications define administrative, environmental and technical operating limits in the interest of the health and safety of the public.
Procedures have been developed to ensure operation is in conformity with the Technical Specifications and the facility Operating License.
UFSAR Revision 31.0 Revised: 26.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.5, §1.6, §1.7, UPDATED FINAL SAFETY ANALYSIS REPORT §1.8 &§1.9 .
Page: 2 of 22 1.6 RESEARCH AND DEVELOPMENT REQUIREMENTS A number of Research and Development programs germane to the Operating License review were summarized in Sub-Chapter 1.6 of the original FSAR. For historical record purposes, major portions of Sub-Chapter 1.6 from the Original FSAR are attached without modification.
An updated list of references in the areas of Emergency Core Cooling System, Ice Condenser, and Nuclear, Thermal-Hydraulic and Mechanical Design Parameters is contained in Table 1.6-1.
1.6.0 [Historical] Research And Development Requirements (From Original FSAR)
Each Research and Development program is briefly summarized for identification and its relationship to the Donald C. Cook Nuclear Plant is discussed. Detailed discussions of each R&D program are available in a more expanded summary form in Westinghouse reports (WCAPs) which have been submitted to the AEC (NRC) staff (see References 1, 2, 3 and 28).
Refer to Section 1.6.3 for a discussion of the 17 x 17 test programs for Unit 2.
1.6.1 [Historical] Programs Required For Plant Operation In the PSAR, five programs were identified as required for plant design and operation.
- 1. Development of the design of the Emergency Core Cooling System.
- 2. Development of the final core thermal-hydraulic, nuclear and mechanical design parameters.
- 3. Further evaluation of core stability.
- 4. Development of the design details of the Containment Spray System.
- 5. Development of the Ice Condenser System.
A discussion of these programs and the applicability of the results to the Donald C. Cook Nuclear Plant follows.
1.6.1.1 [Historical] Development Of The Design Of The Emergency Core Cooling System (ECCS)
A detail design of the ECCS has been developed, and details of the design are presented in Chapter 6. As discussed in Section 1.2.9 (Original FSAR) above, the design of the ECCS has been substantially modified to improve its ability to meet single active failure during the injection phase or single active or passive failure during recirculation phase and to deliver
UFSAR Revision 31.0 Revised: 26.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.5, §1.6, §1.7, UPDATED FINAL SAFETY ANALYSIS REPORT §1.8 &§1.9 .
Page: 3 of 22 dissolved chemical poison more rapidly to the reactor. The ECCS has been designed to prevent clad melting. The basic design criteria for loss-of-coolant accident (LOCA) evaluations are given in Section 14.3. Satisfaction of these criteria ensures that the core remains in place and substantially intact to such an extent that effective cooling of the core is not impaired.
The effect of rod bursting, swelling or shattering has been considered in the LOCA evaluations.
In the blowdown phase of the accident, core geometry distortion may be due to clad bursting or swelling. The clad temperature may get sufficiently high (1200 to 2000°F) so that bursting or swelling of the clad would occur by virtue of the internal gas pressure and a significant reduction of clad strength. Clad bursting or swelling is of concern because of the potential of blocking the flow channel to the extent that core-cooling flow would be insufficient to meet the LOCA design criteria.
To demonstrate that effective core cooling will not be impaired during the reflooding phase of a loss-of-coolant accident, Westinghouse undertook a rod burst research and development program. (Item 2 in Reference 1.) The program to investigate the performance of fuel rods during a simulated LOCA has been completed. It has supplied empirical data on the above safety related problems from which the amount and kinds of geometry distortion on the ability of the ECCS to meet the LOCA design criteria has been determined using present analytical design techniques.
- a. Single Rod Burst Tests (SRBT)
The performance of the fuel rods during a simulated loss-of-coolant accident has been evaluated in a test program, which is described in Reference 4.
Volume I of the reference describes burst, quench and eutectic formation tests with unirradiated tubes and an evaluation of the data from both Volume I and II.
An interpretation with regard to the postulated sequence during the loss-of-coolant accident is given.
Volume II reports the results of work under AEC Contract AT-(30-1)-3017 and describes burst and quench tests on irradiated tubes.
The single rod tests indicated that rod-to-rod interference might occur following rod burst and must be considered. The quantitative evaluation of the influence of adjacent rods in a fuel assembly would be difficult, if not impossible, to determine analytically. Therefore, the rod burst program was extended to include multi-rod burst tests. Multi-rod burst tests (MRBT) were performed to demonstrate that the
UFSAR Revision 31.0 Revised: 26.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.5, §1.6, §1.7, UPDATED FINAL SAFETY ANALYSIS REPORT §1.8 &§1.9 .
Page: 4 of 22 rods in a PWR rod bundle burst randomly so that a minimal flow channel area, for core cooling purposes, is maintained.
- b. Multi-Rod Burst Tests (MRBT)
The results of this phase of the Rod Burst Program are reported in Reference 5.
Volume I describes test apparatus and conditions along with an evaluation of the test results. Volume II presents the application of the MRBT results to the LOCA core thermal analysis.
Results of the MRBT show that the burst locations are staggered axially along the fuel rods and that, to some degree, rod to rod contact does occur. However, the remaining flow area is always sufficient to ensure adequate core cooling.
Analytical evaluations for a typical double-ended cold leg break, considering flow redistribution due to the geometry distortion and rod-to-rod contact, have shown that the peak clad temperature increases less than 100oF over the peak temperature without geometry distortion.
The program is complete and results are satisfactory. No backup measures are considered necessary.
1.6.1.2 [Historical] Development Of The Final Core Thermal-Hydraulic Nuclear And Mechanical Design Parameters In the course of plant design, further engineering information than presented in the PSAR has been developed for those thermal-hydraulic, nuclear and mechanical design parameters for which design criteria have been established.
The engineering information demonstrates that the systems, as designed, will meet the established criteria. This demonstration consists principally of analyses, calculations, and evaluations as presented in Chapters 3 and 14. Tests will be made prior to initial startup, during initial startup, and during initial approach to power to check plant operation relative to design objectives (Refer to Chapter 13).
1.6.1.3 [Historical] Further Evaluation Of Core Stability The purpose of this program was to establish means for the detection and control of potential xenon oscillations and for the shaping of the axial power distribution for improved core performance. This program has been completed in two areas: (a) confirmation of the ability of the out-of-core detector system to indicate gross core power distribution sufficient to permit
UFSAR Revision 31.0 Revised: 26.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.5, §1.6, §1.7, UPDATED FINAL SAFETY ANALYSIS REPORT §1.8 &§1.9 .
Page: 5 of 22 control of xenon oscillation within specified operating limits; and (b) development of a control system utilizing the out-of-core detector system and control rods. The third part of this program, verification through start-up testing that the control system can control the core power distribution and that adequate margins exist to operate the plant will be evaluated on a continuing basis for Westinghouse reactors going into operation prior to D. C. Cook. Safe operation at the design power level depends upon experimental demonstration, at the time of Donald C. Cook startup, that the actual power shapes at full power are no worse than those used in the calculation of core integrity. Further, the analytical model used to predict these power shapes will have been justified by these and earlier measurements so that a calculation of margin to design limits in a transient or accident situation can be made conservatively. However, it is clear that very similar conditions will exist on earlier plants and that very little, if any, extrapolation will be required.
In the unlikely event that the development program described above does not show that margins for operation at the proposed power levels are adequate, the margins designed for Donald C.
Cook could be achieved by systems modifications or restrictions on operation.
1.6.1.4 [Historical] Development Of The Design Details Of The Containment Spray System A Containment Spray System is provided to remove post-accident decay heat and to remove iodine from the containment atmosphere. A description of the Containment Spray System is given in Chapter 6.
The spray additive that will be used for iodine removal is sodium hydroxide (NaOH). This selection was based on completed research and development work done by Westinghouse and others, notably that of Oak Ridge National Laboratory (ORNL) and the Battelle Northwest Laboratories. The areas investigated before the selection was made included studies of chemical characteristics, material compatibility and radiolysis. A report on the original research and development work is presented in the Preliminary Safety Analysis Report Section 1.6.4.
Additional research and development work on the containment spray system has been performed by AEP and above-mentioned laboratories. It is emphasized here that this additional work was not performed to prove the ability of the containment spray system to meet the requirements of 10 CFR 100 guidelines. This goal was attained even with conservative assumptions for iodine removal by the sprays.
UFSAR Revision 31.0 Revised: 26.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.5, §1.6, §1.7, UPDATED FINAL SAFETY ANALYSIS REPORT §1.8 &§1.9 .
Page: 6 of 22 The additional work was performed to justify the use of larger elemental iodine removal constant in assessing the potential off-site doses resulting from the design basis accident. The additional research and development program completed is described below.
[Historical] Containment Spray Research And Development The addition of the reactive chemical, sodium hydroxide (NaOH), to the containment sprays will be employed as a means of reducing the iodine concentration of the containment atmosphere under postulated accident conditions. Data which have already been obtained in engineering scale tests at the Nuclear Safety Pilot Plant (NSPP) and the Containment Systems Experiment (CSE) confirm the absorptive capacity of the chemically modified sprays. Further refinement has been pursued by American Electrical Power Service Corporation in order to justify additional performance of the sprays and to evaluate non-ideal factors in extrapolating to large containment structures. It has been established that in no way does the use of proposed additive jeopardize the performance or integrity of the containment or Emergency Core Cooling System.
The discussion below describes the research and development program in these areas for the Donald C. Cook units.
The following areas were investigated with regard to their effect on spray performance in order to demonstrate the full capability of the Containment Spray System:
- a. Droplet coalescence
- b. Non-uniformity of spray droplet size and coverage
- c. Liquid phase mass transfer resistance
UFSAR Revision 31.0 Revised: 26.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.5, §1.6, §1.7, UPDATED FINAL SAFETY ANALYSIS REPORT §1.8 &§1.9 .
Page: 7 of 22 The work in these three areas was performed jointly by American Electric Power Service Corporation and Battelle Memorial Institute's Columbus Laboratories. The study included an evaluation of the significance of liquid phase mass transfer resistance to iodine removal, and the development of methods to include the effects of spray drop coalescence, and of changes in the cross-sectional area of spray coverage within the containment vessel. The study concluded with construction of a digital computer program, which incorporates an analytical treatment of each of the above factors in a simultaneous multi-region model. The program therefore provides a coupled analysis of iodine cleanup in each of three connected regions which may contain both a sprayed and unsprayed volume.
A summary of the effects of these phenomena on spray performance is given on the following page.
- a. Droplet Coalescence The basic model conservatively assumes that any collision between two sprays drops results in coalescence. The containment atmosphere is divided into three spray regions, containing 17 sections in each region, with individual droplet trajectories and flux densities calculated for each region. Quantitative evaluation of this effect is presented in the original FSAR Section 14.3.5.
- b. Non-Uniformity of Spray Droplet Size and Coverage To account for the distribution of droplet sizes as verified in tests performed by Westinghouse, the spray was divided into a lognormal distribution of eleven discrete size intervals with a constant geometric standard deviation. All droplet sizes were assumed to interact as described in the previous paragraph. Non-uniform containment coverage was accounted for by isolating those areas of the containment which are not directly sprayed and by using a conservative estimate of the mass transfer rate between these areas and the sprayed regions.
- c. Liquid Phase Mass Transfer Resistance In order to account for the buildup of iodine in the spray solution and the possibility of increases resistance to mass transfer in the liquid phase, the partition coefficients are calculated continuously throughout the entire analysis.
Quantitative evaluation of this effect is presented in the original FSAR Section 14.3.5.
UFSAR Revision 31.0 Revised: 26.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.5, §1.6, §1.7, UPDATED FINAL SAFETY ANALYSIS REPORT §1.8 &§1.9 .
Page: 8 of 22
[Historical] Applicability To The Donald C. Cook Plant The results obtained from this study in addition to the experimental results from NSPP and CSE verify the ability to the spray system to perform as an extremely effective means of reducing iodine leakage from the containment in event of a loss-of-coolant accident to below the guideline limits of 10 CFR Part 100. The original FSAR Section 14.3.5 presents a quantitative evaluation of all the different parameters that influence spray performance for iodine removal.
1.6.1.5 [Historical] Development Of The Ice Condenser System The design of the Ice Condenser Reactor Containment is based on proven and tested concepts for heat removal by the ice contained in the system. Sufficient test results, along with continuing design evaluation, have proven the feasibility, practicality and advantages of this type of containment. Proprietary Westinghouse Reports (References 6, 7, 8, 9, and 10) which describe this work in detail, have been submitted to the Division of Reactor Licensing of the Atomic Energy Commission for their review of the ice condenser concept. Additional proprietary documents (References 11, and 12) submitted to the Commission describe additional full-scale section tests and present the complete analysis of the ice condenser design, performance and sensitivity to variations in important parameters specifically related to the Donald C. Cook Nuclear Plant.
Westinghouse has prepared and submitted to the Commission an additional proprietary report (Reference 13) which describes additional analyses and experimentation not covered in the previous reports. The following is an outline of the material presented in this new report.
- a. The final series of full-scale section ice condenser tests, completed in December 1968.
- b. The analytical models developed from the final series of ice condenser tests.
- c. Description of a digital computer code to calculate the transient pressures in the subcompartments of the reactor containment due to the loss-of-coolant accident.
- d. Current status and conclusions drawn from the results of long-term ice storage tests. Description of additions to the program to determine effects of long-term storage on ice having a sodium tetraborate additive, which is compatible with the containment spray solution used for iodine absorption.
As stated in Reference 13, the additional experimental information and analyses identify the degree of conservatism in the ice condenser design presented in the previous reports.
UFSAR Revision 31.0 Revised: 26.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.5, §1.6, §1.7, UPDATED FINAL SAFETY ANALYSIS REPORT §1.8 &§1.9 .
Page: 9 of 22 Westinghouse has been proceeding with the development of the Ice Condenser concept since 1965, and this development is essentially complete, with performance capabilities supported by analytical work backed up by a significant amount of experimental evidence. The development programs are described below and more fully in the reference reports.
[Historical] Small-Scale Ice Bed Performance Tests These tests consisted typically of about a 3-foot-high ice bed within a 10-foot-high by 10-inch-diameter autoclave acting as the reactor containment containing an ice condenser. It received steam blow-down from another, heated autoclave. A total of approximately 50 tests were run to search out key phenomena and develop sufficient understanding of ice condenser system performance. This understanding served to guide the design of the reactor containment and the design of the full-scale condenser section test facility.
[Historical] Full-Scale Ice Bed Performance Tests These tests were performed in the test facility located at the Westinghouse Waltz Mill Site. The facility consisted of a 104 cu. ft. boiler to simulate reactor coolant system mass and energy; a 56-foot-high by 11-foot-diameter receiver vessel to simulate the containment; an instrumentation and control building; and ice making and long-term ice storage facilities. The tests have utilized an ice condenser, approximately 40 feet high, located inside the receiver vessel. The facility is divided into compartments to nearly duplicate a section of an actual Ice Condenser System. The test arrangement was designed to provide the volume ratios and scale factors equivalent to the containment design. The ice bed was made to closely duplicate the containment design in ice loading and airflow channels through the bed, as well as entrance and exit openings for the steam and airflows. These tests were extensively instrumented so that the maximum amount of information could be obtained from each test. Results of these tests have shown that the ice condenser is relatively insensitive to changes in such parameters as blowdown rate, blowdown energy, ice heat-transfer area and flow area, and that the performance change is predictable. All testing in the Waltz Mill facility needed for the Cook Plant design has been completed, and is reported in References 11, 12 and 13.
[Historical] Ice Handling And Ice Basket Loading Tests (Reference 2)
Ice Handling Tests and Ice Basket Loading Tests were conducted at the Westinghouse Waltz Mill Site to demonstrate the adequacy of a system of pneumatic fluidized transport of chemical flake ice and methods of loading ice baskets inside the ice condenser. These trials satisfactorily demonstrated that ice can be manufactured outside of the containment and charged into ice
UFSAR Revision 31.0 Revised: 26.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.5, §1.6, §1.7, UPDATED FINAL SAFETY ANALYSIS REPORT §1.8 &§1.9 .
Page: 10 of 22 baskets in the ice condenser. The ice machine and all major pneumatic equipment is located outside the containment.
[Historical] Ice Storage Test These tests have consisted of storing ice for long periods of time under a number of different conditions (e.g., relative humidity, temperature, and mechanical loads), employing borated and non-borated and sodium tetraborate additive. Tests results indicate that the addition of boron or sodium tetraborate to the ice has no unfavorable effect on long-term storage performance. In addition, test results have demonstrated that the ice condenser design is adequate to preserve ice condenser integrity for long periods of time (at least a number of years). In particular, the use of a refrigerated ice storage arrangement with separate air compartments for the ice bed and for the cooling system will reduce sublimation and frosting effects to a negligible amount. Furthermore, the ice bed compaction rate is very small and the effect of this amount of reduction in heat transfer surface on containment design pressure is negligible. Tests of ice bed support by expanded metal screens or gratings indicate no significant amount of extrusion through horizontal or shear along vertical ice bed walls. Further, the tests indicate that the storage characteristics of borated ice are just as satisfactory as non-borated ice.
[Historical] Ice Condenser Door Gasket Tests (Reference 1)
Tests have been run to validate the sealing capability of the ice condenser inlet door gasket design. Tests consisted of two parts, (1) a leakage test and (2) a load deflection test. The leakage test was run simulating actual gasket service conditions, such as, pressure and gasket load. The load deflection test was used to determine the effect of surface irregularities on sealing.
The gasket leak tests have shown that the maximum total leakage from the ice condenser through the lower inlet doors that could be expected in service is 5 scfm compared with the design criterion of 50 scfm.
UFSAR Revision 31.0 Revised: 26.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.5, §1.6, §1.7, UPDATED FINAL SAFETY ANALYSIS REPORT §1.8 &§1.9 .
Page: 11 of 22
[Historical] Ice Condenser Inlet Door Tests (Reference 1)
Manufacture and assembly of a lower inlet door unit having two door panels have been completed and testing is in progress at the Westinghouse Research and Development Laboratories.
The test program includes evaluation of the following aspects:
Tolerance of flatness of the seal surface of door panel Spring Rate Hinge bearing friction Door position load characteristics Hinge Bearing and panel strength tests Results now being analyzed will be included in the design evaluation and test report on the doors to be submitted to the AEC.
[Historical] Ice Condenser Floor Drains(Reference 14)
Consistent with the Preliminary Safety Analysis Report, and proprietary technical submissions, floor drains have been implemented in the design of the plant.
To obviate any prolonged resistance to reopening of the lower inlet doors after a postulated design basis accident, the design basis of 15 square feet of flow area has been met by the inclusion of 20 drains each of 12-inch diameter.
It should be noted, however, that this criterion is based on there being no flow of condensate water through the doors during blowdown, and all the condensate must flow through the drain.
It has been established by analysis and tests that this is not the case, making the criterion itself very conservative.
[Historical] Iodine Removal In The Ice Condenser(Reference 15)
Tests have been conducted which illustrate the capability of the Ice Condenser System to remove fission product iodine released to a reactor containment during the Design Basis Accident (DBA). Iodine is condensed along with steam condensation by the ice and is collected in the ice melt, thus becoming unavailable for leakage from the containment to the environment. An alkaline additive in the ice, sodium tetraborate, enhances the dissolution and retention of iodine by the ice melt through hydrolysis reactions. The efficiency of iodine removal in the tests has
UFSAR Revision 31.0 Revised: 26.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.5, §1.6, §1.7, UPDATED FINAL SAFETY ANALYSIS REPORT §1.8 &§1.9 .
Page: 12 of 22 been evaluated in terms of a number of parameters and at a number of conditions relating to the Design Basis Accident. These results indicate that the Ice Condenser System serves as an additional passive safety feature for control of volatile fission products.
[Historical] Hydrogen Control Program American Electric Power Service Corporation (AEPSC) and Battelle Columbus Laboratories (BCL) initiated a program for final resolution of the hydrogen control issue (10 CFR 50.44(c)).
This program has two phases. In Phase I the AEPSC provided the following information to the NRC staff for review and approval:
MARCH-2 computer code (Reference 198 Table 1.6-1) input deck(s) applicable to the D. C. Cook containment and systems; A hydrogen combustion model inferred from available Nevada Test Site (NTS) data; and Justification of scenario selection.
Phase II would consist of actual analysis to be performed by BCL after the above submittals are approved by the NRC.
1.6.2 [Historical] Other Areas Of Research and Development Not Required For Plant Operation Other areas of research and development, as outlined below, are those, which give, added confirmation that the designs are conservative.
- 1. [Historical] Burnable Poison Program (Item 7 in Reference 1)
Burnable poison rod development is complete. The burnable poison rods are borosilicate glass encased in stainless steel tubes. The fixed rods are used in the first core only to reduce the concentration of boric acid poison in the moderator, thereby ensuring that the moderator coefficient of reactivity is always negative at operating temperature. The rods are now in use in the R. E. Ginna plant. An evaluation of these rods is expected to be available prior to operation of the Donald C. Cook Nuclear Plant.
- 2. [Historical] Fuel Development Program For Operation At High Power Densities (Item 8 in Reference 1)
As part of the program to demonstrate satisfactory operation of fuel at high burnup and power densities, fuel is being tested in both the Saxton and Zorita reactors. The Saxton loose-lattice
UFSAR Revision 31.0 Revised: 26.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.5, §1.6, §1.7, UPDATED FINAL SAFETY ANALYSIS REPORT §1.8 &§1.9 .
Page: 13 of 22 irradiation program will demonstrate fuel performance at conditions significantly in excess of current PWR design limits, and will establish power burnup limits for the fuel. The Zorita reactor is the first PWR with a Zircaloy core to operate at similar core conditions as the current design units. Because of the timely manner in which fuel can be irradiated in Zorita, four fuel assemblies are being tested there to demonstrate satisfactory operation of the fuel in a commercial PWR environment.
Sustained successful operation of special Zorita fuel rods at peak design power levels, in excess of those planned for these units, will increase assurance that the fuel has adequate performance margins to accommodate transient overpower operation. This program is further discussed in Chapter 3.
- 3. [Historical] In-Core Detector Program (Item 9 in Reference 1)
The purpose of this program is to develop fixed in-core neutron detectors suitable for continuous monitoring of power distribution in a PWR core.
Testing at San Onofre, the Western New York Research Reactor, and the Brookhaven High Flux Beam Reactor, has been completed. Tests at the Union Carbide reactor (Tuxedo) are being performed for detectors to be installed.
The present status of this program permits fixed in-core flux detectors to be installed. These detectors will serve as an operational convenience to the plant operator, and as tests to evaluate the need for and suitability of in-core detectors for power distribution monitoring and control.
The in-core detector development program will be continued in these early large plants with the principal aims of demonstrating design lifetime, in a PWR, and of optimizing detector parameters. Since out-of-core detectors, particularly long ion chambers, have been found effective for monitoring both axial and radial gross power distribution there is at present no intention of installing the incore system in this plant.
This program provides experimental rod bundle DNB data with non-uniform rod axial flux distributions. The program has been conducted at Columbia University under the direction of WNES, Pittsburgh, Pennsylvania. Reference 16 details the results of this program.
The experimental rod bundle data with non-uniform rod axial flux distributions is directly applicable to the design of this unit. The results of the program show that the W-3 DNB correlation applied in this design is conservative.
UFSAR Revision 31.0 Revised: 26.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.5, §1.6, §1.7, UPDATED FINAL SAFETY ANALYSIS REPORT §1.8 &§1.9 .
Page: 14 of 22
- 5. [Historical] FLECHT (Full Length Emergency Core Cooling Heat Transfer Test) (Item 12 in Reference 1)
The purpose of the FLECHT program is to investigate experimentally the thermal behavior of a simulated pressurized water reactor core during the core recovery period, which follows a loss-of-coolant accident. The results of the first series of tests (Group I) are reported in Reference 17.
The results of the second series of tests (Group II) are reported in Reference 20.
The loss-of-coolant evaluation presented in this application used conservative design assumptions in the heat transfer models for analyses of the reflooding phase of the accident. The FLECHT program will assist in developing new analytical models to describe the core recovery phenomena. The results to date have been favorable, and the program is essentially complete.
- 6. [Historical] Flashing Heat Transfer Program (Item 13 in Reference 1)
The program is completed, and it concluded that the present core thermal design analysis used for evaluating the loss-of-coolant accident results in a conservative prediction of the peak clad temperature. The results from the program are in the loss-of-coolant analysis presented in Chapter 14. The program and results are summarized in Reference 2.
- 7. [Historical] Loss-of-Coolant Analysis Program (Item 14 in Reference 1)
The loss-of-coolant analysis program was established to integrate, as appropriate, the more realistic heat transfer models obtained from experimental and analytical development programs into the core thermal design codes used to evaluate the loss-of-coolant accident. This program has been completed. A preliminary evaluation of the loss-of-coolant accident utilizing the results of the Flashing Heat Transfer Program in the core thermal design code has been presented in Reference 18.
- 8. [Historical] Blowdown Forces Program (Item 15 in Reference 1)
The objective of the program was to develop digital computer programs for the calculation of pressure, velocity, and force transients in the Reactor core and internals during a loss-of-coolant accident, and to utilize these codes in the calculation of blowdown forces on the fuel assemblies and reactor internals to assure that the stress and deflection criteria used in the design of these components are met.
Westinghouse has completed the development of BLODWN-2, an improved digital computer program for the calculation of local fluid pressure, flow and density transients in the Reactor Coolant System.
UFSAR Revision 31.0 Revised: 26.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.5, §1.6, §1.7, UPDATED FINAL SAFETY ANALYSIS REPORT §1.8 &§1.9 .
Page: 15 of 22 Extensive comparisons have been made between BLODWN-2 and available test data, and the results are given in Reference 19. Agreement between code predictions and data has been good.
An analysis using the BLODWN-2 Program has been applied to this plant. It was concluded from the analysis that the design of this reactor meets the established design criteria.
- 9. [Historical] Gross Failed Fuel Detector Program Since the Donald C. Cook Nuclear Plant will not use the W delay neutron failed fuel monitor, the W R & D on this monitor is no longer applicable.
Failed fuel detection at Cook Nuclear Plant is accomplished by periodic analysis of reactor coolant grab samples. This method has been found acceptable by the NRC (Reference 29 and 30).
- 10. [Historical] Reactor Vessel Thermal Shock (Item 16 in Reference 1)
The effects of safety injection water on the integrity of the reactor vessel following a postulated loss-of-coolant accident, have been analyzed using data on fracture toughness of heavy section steel both at beginning of plant life and after irradiation corresponding to approximately 40 years of equivalent plant life. The results show that under the postulated accident conditions, the integrity of the reactor vessel is maintained.
Fracture toughness data is obtained from a Westinghouse experimental program, which is associated with the Heavy Section Steel Technology (HSST) Program at ORNL and Euratom programs. Since results of the analyses are dependent on the fracture toughness of irradiated steel, efforts are continuing to obtain additional fracture toughness data. Data on two-inch thick specimens is expected in 1970 from the HSST Program. The HSST is scheduled for completion by 1973.
A detailed analysis considering the linear elastic fracture mechanism method, along with various sensitivity studies was submitted to the AEC Staff and members of the Advisory Committee for Reactor Safety (ACRS) enlisted: "The Effects of Safety Injection On A Reactor Vessel And Its Internals Following A Loss-Of-Coolant Accident" (December, 1967), (Proprietary). Revised material for this report plus additional analysis and fracture toughness data was presented at a meeting with the Containment and Component Technology Branch on August 9, 1968, and forwarded by letter for AEC review and comment on October 29, 1968.
It is not anticipated that the continuing HSST Program will lead to any new conclusions about reactor vessel integrity under LOCA conditions. Several backup positions are available if the
UFSAR Revision 31.0 Revised: 26.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.5, §1.6, §1.7, UPDATED FINAL SAFETY ANALYSIS REPORT §1.8 &§1.9 .
Page: 16 of 22 results of the HSST program do not conclusively indicate that vessel integrity could be assured for the full plant life with the operating modes presently planned. One solution would be to anneal the reactor vessel such that material properties approach the original value. This solution is already feasible, in principle, and could be performed with the vessel in place.
- 11. [Historical] BART Program Westinghouse has developed a model to calculate the fluid and heat transfer conditions in the core during reflood. This model is contained in the BART computer code (191). BART model has two-phase fluid conservation equations. The empirical constants used in BART model are determined by comparing prediction with a selected number of FLECHT Tests.
The behavior of the quench front, which is of crucial importance in determining the core heat transfer during reflood, is determined from data and the overall heat release supplied to the BART program. The thermal-hydraulic model used to determine quench front progression is a two-dimensional heat transfer equation.
The core heat transfer model is used to calculate the peak-clad temperature in the core during a postulated LOCA. A design procedure has been developed which utilizes BART in conjunction with other ECCS codes. Forced flooding tests from several different experiments are used to verify BART, while the design procedure is accomplished by comparison with several FLECHT-SET tests.
1.6.3 [Historical] 17 X 17 Fuel Assembly Verification The test program for the 17 x 17 fuel assembly has been successfully completed. The tests verified that the 17 x 17 fuel assembly meets the design criteria and requirements as specified in References 21 through 26. Plans for in-service surveillance of fuel assembly performance are given in Section 7 of Reference 27. This performance will be monitored and reported in the periodic updates of WCAP-8183 "Operational Experience with Westinghouse Cores."
UFSAR Revision 31.0 Revised: 26.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.5, §1.6, §1.7, UPDATED FINAL SAFETY ANALYSIS REPORT §1.8 &§1.9 .
Page: 17 of 22 1.6.4 [Historical] References For Section 1.6
- 1. WCAP-7498-L, R. M. Hunt (editor), "Safety Related Research and Development for Westinghouse Pressurized Water Reactors - Program Summaries, Spring, 1970", May, 1970, (WNES Proprietary Class 2).
- 2. WCAP-7396-L, R. M. Hunt (editor), "Safety Related Research and Development for Westinghouse Pressurized Water Reactors - A Program Outline, Fall, 1969",
November, 1969 (WNES Proprietary Class 2).
- 3. WCAP-7304-L, R. M. Hunt (editor), "Safety Related Research and Development for Westinghouse Pressurized Water Reactors - A Program Outline, Spring, 1969", April 1969, (WNES Proprietary Class 2).
- 4. WCAP-7379-L, Vol. I (WNES Proprietary Class 2) and Vol. II (WNES Proprietary Class 3), Topical Report, Performance on Zircaloy Clad Fuel Rods During a LOCA, J. B. Roll.
- 5. WCAP-7495-L, Vol. I and Vol. II, Topical Report, Performance of Zircaloy Clad Fuel Rods During a Simulated Loss of Coolant Accident, Multi-Rod Tests, R.
Schrieber, et al, (WNES Proprietary Class 2).
- 6. S. J. Weems, J. A. Hinds, and I. H. Mandil (Consultants, MPR Associates), "Ice Condenser Reactor Containment, "WCAP-295l, June 1966, Proprietary.
- 7. S. J. Weems, (MPR), P. B. Haga, W. G. Lyman, and J. W. Dorrycott, "Ice Condenser Reactor Containment," WCAP-7040, April 1967, Proprietary.
- 8. S. J. Weems (MPR), W. L. Bottinger, S. N. Ehrenpreis, F. P. Green, N. P. Grimm, W. G. Lyman, and J. Stevenson, "Preliminary Design and Evaluation of the Ice Condenser Reactor Containment and Associated Engineered Safeguards,"
WCAP-7079, July 1967, Proprietary.
- 9. S. J. Weems (MPR), S. N. Ehrenpreis, N. P. Grimm, and W. G. Lyman, "Supplementary Information to WCAP-7079, Preliminary Design and Evaluation of the Ice Condenser Reactor Containment and Associated Engineered Safeguards, "WCAP-7079 Supplement 1, September 1967, Proprietary.
- 10. S. J. Weems (MPR), N. P. Grimm, and W. G. Lyman, "Supplementary Information to WCAP-7079, Preliminary Design and Evaluation of the Ice
UFSAR Revision 31.0 Revised: 26.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.5, §1.6, §1.7, UPDATED FINAL SAFETY ANALYSIS REPORT §1.8 &§1.9 .
Page: 18 of 22 Condenser Reactor Containment and Associated Engineered Safeguards,"
WCAP-7079 Supplement 2, December 1967, Proprietary.
W. Dorrycott, N. P. Grimm, A. J. F. Iredale, W. G. Lyman, R. R. Oft, and J. R.
van Seuren, "Design and Performance Evaluation of the Ice Condenser Reactor Containment System for the Donald C. Cook Nuclear Plant," WCAP-7183, March 1968, Proprietary.
- 12. W. J. McCurdy (MPR), S. J. Weems (MPR), W. L. Boettinger, J. W. Dorrycott, N. P. Grimm, A. J. F. Iredale, and W. G. Lyman, "Supplementary Information to WCAP-7183, Design and Performance Evaluation of the Ice Condenser Reactor Containment System for the Donald C. Cook Nuclear Plant," WCAP-7183 Supplement 1, July 1968, Proprietary.
Kilpela, W. G. Lyman, "Topical Report - Supplementary Information to WCAP-7183, Design and Performance Evaluation of the Ice Condenser Reactor Containment System," WCAP-7183-L Supplement 2, August, 1969, Proprietary.
- 14. Atomic Safety and Licensing Board Hearing Record, Docket Number 50-327 and 50-328, Sequoyah Nuclear Plant Units 1 and 2, Chattanooga, Tennessee, April 23, 1970.
- 16. WCAP-7411-L, "Rod Bundle Axial Non-Uniform Heat Flux DNB Tests and Data", J. O. Cermak, (WNES Proprietary Class 2).
Group I Test Report".
- 18. WCAP-7422-L, "Westinghouse PWR Core Behavior Following a Loss-of-Coolant Accident," J. Dorrycott (WNES Proprietary Class 2).
- 19. WCAP-7401, "Loss-of-Coolant Accident: Comparison Between BLODWN-2 Code Results and Test Data", S. Fabic, (WNES Proprietary Class 3).
UFSAR Revision 31.0 Revised: 26.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.5, §1.6, §1.7, UPDATED FINAL SAFETY ANALYSIS REPORT §1.8 &§1.9 .
Page: 19 of 22
Group II Test Report, "F. F. Cadek, P. P. Pominicis, R. H. Legse, September 1970.
- 21. WCAP-8185, "Reference Core Report 17 x 17 Volume 1," April 1974.
- 22. WCAP-8288, "Safety Analysis of the 17 x 17 Fuel Assembly for a Combined Seismic and Loss-of-Coolant Accident," December 1973.
- 23. WCAP-8279, "Hydraulic Flow Tests of the 17 x 17 Fuel Assembly," February 1974.
- 25. WCAP-8299, "The Effect of 17 x 17 Geometry on Interchannel Thermal Mixing,"
March 1974.
Drop and Deflection," December 1974.
- 27. WCAP-8692, "Fuel Rod Bowing," December 1975.
- 28. WCAP-8768, "Safety Related Research and Development for Westinghouse Pressurized Water Reactors, Program Summaries," June, 1976.
- 29. Alexich, M. P. (I&M), letter to T. E. Murley (NRC), October 5, 1988, AEP:NRC:0773AB.
- 30. Colburn, T. G. (NRC), letter to M. P. Alexich (I&M), "Emergency Response Capability - Conformance to Regulatory Guide 1.97, Revision 3, for the D. C.
Cook Nuclear Plant, Units 1 and 2," December 14, 1990.
UFSAR Revision 31.0 Revised: 26.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.5, §1.6, §1.7, UPDATED FINAL SAFETY ANALYSIS REPORT §1.8 &§1.9 .
Page: 20 of 22 1.7 QUALITY ASSURANCE In accordance with 10 CFR 50.54, the quality assurance program for Donald C. Cook Nuclear Plant and Independent Spent Fuel Storage Installation (ISFSI) is described in a separate document entitled "Quality Assurance Program Description."
UFSAR Revision 31.0 Revised: 26.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.5, §1.6, §1.7, UPDATED FINAL SAFETY ANALYSIS REPORT §1.8 &§1.9 .
Page: 21 of 22 1.8 IDENTIFICATION OF CONTRACTORS The plant was designed and constructed by the American Electric Power Service Corporation (AEPSC) which performed the function of Architect-Engineer and Constructor for Indiana Michigan Power Company (I&M). Westinghouse Electric Corporation designed and supplied the Nuclear Steam Supply Systems including the initial fuel assemblies for both Units 1 and 2 of the Donald C. Cook Nuclear Plant. In 2000, the Unit 1 Westinghouse Model 51 lower steam generator assembly and upper internals and feedrings were replaced with Babcock and Wilcox (BWI) replacement steam generators Model 51R. Installation was performed by Bechtel.
Subsequent reload fuel assemblies for these units have been and will be procured from qualified suppliers such as Westinghouse.
In the design and construction of these units, AEPSC employed various contractors and sub-contractors; however, the ultimate responsibility for all work performed was assumed by AEPSC. AEPSC and I&M are responsible for the implementation of all functions associated with the operation, maintenance, modification and control of the Donald C. Cook Nuclear Plant.
UFSAR Revision 31.0 Revised: 26.0 INDIANA MICHIGAN POWER Chapter: 1 D. C. COOK NUCLEAR PLANT §1.5, §1.6, §1.7, UPDATED FINAL SAFETY ANALYSIS REPORT §1.8 &§1.9 .
Page: 22 of 22 1.9 FACILITY SAFETY CONCLUSIONS The safety of the public and plant operating personnel, and reliability of plant equipment and systems have been the primary considerations in the plant design. The approach taken in fulfilling the safety consideration is three-fold. First, careful attention has been given to the design so as to prevent the release of radioactivity to the environment under conditions which could be hazardous to the health and safety of the public. Second, the plant has been designed so as to provide adequate protection for plant personnel wherever a potential radiation hazard exists.
Third, Engineered Safety Features have been designed with redundancy and diversity, and to stringent quality standards.
Based on the overall design of the plant including its safety features and the analyses of the possible incidents and hypothetical accidents, it is concluded that Donald C. Cook Nuclear Plant Units No. 1 and No. 2 can be operated without undue hazard to the health and safety of the public.