ML22340A167
Text
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page:
i of v Unit 2 14.1 CORE AND COOLANT BOUNDARY PROTECTION ANALYSIS............ 1 14.1.0 Plant Characteristics and Initial Conditions Used in Safety Analyses................................................................................... 2 14.1.0.1 Plant Conditions.............................................................................. 2 14.1.0.2 Initial Conditions.............................................................................. 2 14.1.0.3 Core Thermal Power Distribution.................................................... 3 14.1.0.4 Reactivity Coefficients Assumed in the Safety Analyses................ 4 14.1.0.5 Rod Cluster Control Assembly (RCCA) Insertion Characteristics... 5 14.1.0.6 Reactor Trip Points and Time Delays to Reactor Trip Assumed in the Safety Analyses......................................................................... 5 14.1.0.6.1 Reactor Protection System (RPS) Setpoints and Time Delays........... 5 14.1.0.6.2 Engineered Safety Features (ESF) Actuation Setpoints and Time Delays................................................................................................. 8 14.1.0.7 Plant Systems and Components Available for Mitigation of Occurrence Effects.......................................................................... 8 14.1.0.8 Residual Decay Heat....................................................................... 8 14.1.0.8.1 Distribution of Residual Decay Heat Following a LOCA...................... 9 14.1.0.9 Other Assumptions.......................................................................... 9 14.1.0.10 Computer Codes Utilized................................................................ 9 14.1.0.10.1 FACTRAN......................................................................................... 10 14.1.0.10.2 LOFTRAN.......................................................................................... 10 14.1.0.10.3 TWINKLE.......................................................................................... 10 14.1.0.10.4 THINC............................................................................................... 11 14.1.0.11 References for Section 14.1.0....................................................... 12 14.1.1 Uncontrolled Rod Cluster Control Assembly (RCCA) Bank Withdrawal from AaSubcritical Condition............................ 13 14.1.1.1 Identification of Causes and Accident Description........................ 13 14.1.1.2 Analysis of Effects and Consequences......................................... 14 UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page:
ii of v Unit 2 14.1.1.2.1 Method of Analysis.................................................................... 14 14.1.1.2.2 Results.............................................................................................. 16 14.1.1.3 Conclusions................................................................................... 16 14.1.1.4 References for Section 14.1.......................................................... 17 14.1.2 Uncontrolled Rod Cluster Control Assembly (RCCA) Bank Withdrawal at Power (Full Vantage 5 Core).......................... 18 14.1.2.1 Identification of Causes and Accident Description........................ 18 14.1.2.2 Analysis of Effects and Consequences......................................... 19 14.1.2.2.1 Method of Analysis............................................................................ 19 14.1.2.2.2 Results.............................................................................................. 20 Effect of the RTD Bypass Elimination................................................................. 21 14.1.2.3 Conclusions................................................................................... 21 14.1.2.4 References for Section 14.1.2....................................................... 21 14.1.3 Rod Cluster Control Assembly (RCCA) Misalignment (Including RCCA Drop).......................................................... 22 14.1.3.1 Identification of Causes and Accident Description........................ 22 14.1.3.2 Analysis of Effect and Consequences........................................... 23 14.1.3.2.1 Method of Analysis............................................................................ 23 14.1.3.2.2 Results.............................................................................................. 24 14.1.3.3 Conclusions................................................................................... 26 14.1.3.4 References for Section 14.1.3....................................................... 26 14.1.4 Rod Cluster Control Assembly Drop.................................... 27 14.1.5 Uncontrolled Boron Dilution.................................................. 28 14.1.5.1 Identification of Causes and Accident Description........................ 28 14.1.5.2 Analysis of Effects and Consequences......................................... 29 Method of Analysis............................................................................................. 29 14.1.5.2.1 Dilution During Refueling................................................................... 29 14.1.5.2.2 Dilution During Startup...................................................................... 29 UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page:
iii of v Unit 2 14.1.5.2.3 Dilution During Power Operation....................................................... 30 14.1.5.2.4 Dilution During Shutdown.................................................................. 30 14.1.5.3 Results.......................................................................................... 31 14.1.5.3.1 Dilution During Refueling................................................................... 31 14.1.5.3.2 Dilution During Startup...................................................................... 31 14.1.5.3.3 Dilution During Power Operation....................................................... 31 Effect of the RTD Bypass Elimination................................................................. 32 14.1.5.4 Conclusions................................................................................... 32 14.1.6 Loss of Forced Reactor Coolant Flow (Including Locked Rotor)...................................................................................... 33 14.1.6.1 Loss of Reactor Coolant Flow....................................................... 33 14.1.6.1.1 Identification of Causes and Accident Description............................. 33 14.1.6.1.2 Analysis of Effects and Consequences............................................. 34 14.1.6.1.2.1 Method of Analysis........................................................................ 34 14.1.6.1.2.2 Results.......................................................................................... 35 14.1.6.1.3 Conclusions....................................................................................... 35 14.1.6.2 Locked Rotor Accident.................................................................. 36 14.1.6.2.1 Identification of Causes and Accident Description............................. 36 14.1.6.2.2 Analysis of Effects and Consequences............................................. 36 14.1.6.2.2.1 Method of Analysis........................................................................ 36 14.1.6.2.2.2 Evaluation of the Pressure Transient............................................ 37 14.1.6.2.2.3 Evaluation of the Peak Clad Temperature.................................... 37 14.1.6.2.2.4 Film Boiling Coefficient.................................................................. 37 14.1.6.2.2.5 Fuel Clad Gap Coefficient............................................................. 38 14.1.6.2.2.6 Zirconium-Steam Reaction............................................................ 38 14.1.6.2.2.7 Evaluation of Rods-in-DNB during the Locked Rotor Event.......... 38 14.1.6.2.2.8 Results.......................................................................................... 39 14.1.6.2.3 Locked Rotor Radiological Consequence Analysis........................... 39 14.1.6.2.4 Conclusions....................................................................................... 39 UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page:
iv of v Unit 2 14.1.6.3 References for Section 14.1.6....................................................... 40 14.1.7 Startup of an Inactive Reactor Coolant Loop....................... 41 14.1.8 Loss of External Electric Load or Turbine Trip (Full Vantage 5 Core)..................................................................................... 41 14.1.8.1 Identification of Causes and Accident Description........................ 41 14.1.8.2 Analysis of Effects and Consequences......................................... 42 14.1.8.2.1 Method of Analysis............................................................................ 42 14.1.8.2.2 Results.............................................................................................. 43 14.1.8.3 Conclusions................................................................................... 44 14.1.8.4 Evaluation of Lower Initial RCS Temperature............................... 44 Effect of the RTD Bypass Elimination................................................................. 45 14.1.8.5 References for Section 14.1.8....................................................... 45 14.1.9 Loss of Normal Feedwater..................................................... 46 14.1.9.1 Identification of Causes and Accident Description........................ 46 14.1.9.2 Analysis of Effects and Consequences......................................... 47 14.1.9.2.1 Method of Analysis............................................................................ 47 14.1.9.2.2 Results.............................................................................................. 49 14.1.9.3 Conclusions................................................................................... 49 14.1.9.4 References for Section 14.1.9....................................................... 50 14.1.10 Excessive Heat Removal due to Feedwater System Malfunctions (Full Vantage 5 Core)....................................... 51 14.1.10.1 Feedwater System Malfunctions Causing a Reduction in Feedwater Temperature.................................................................................. 51 14.1.10.1.1 Identification of Causes and Accident Description............................. 51 14.1.10.1.2 Analysis of Effects and Consequences............................................. 51 14.1.10.1.2.1 Method of Analysis........................................................................ 51 14.1.10.1.2.2 Results.......................................................................................... 52 14.1.10.1.3 Conclusions....................................................................................... 52 UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page:
v of v Unit 2 14.1.10.2 Feedwater System Malfunctions Causing an Increase in Feedwater Flow............................................................................................... 52 14.1.10.2.1 Identification of Causes and Accident Description............................. 52 14.1.10.2.2 Analysis Effects and Consequences................................................. 53 14.1.10.2.2.1 Method of Analysis........................................................................ 53 14.1.10.2.2.2 Results......................................................................................... 54 14.1.10.2.2.2.1 Evaluation to Support 240% Nominal Main Feedwater Flow 56 14.1.10.2.3 Conclusions.................................................................................. 56 14.1.10.2.4 References for Section 14.1.10......................................................... 56 14.1.11 Excessive Load Increase Incident (Full Vantage 5 Core).... 57 14.1.11.1 Identification of Causes and Accident Description........................ 57 14.1.11.2 Analysis of Effects and Consequences......................................... 57 14.1.11.2.1 Method of Analysis............................................................................ 57 14.1.11.2.2 Results.............................................................................................. 58 14.1.11.3 Conclusions................................................................................... 59 14.1.11.4 References for Section 14.1.11..................................................... 59 14.1.12 Loss of Offsite Power (LOOP) to the Station Auxiliaries..... 60 14.1.12.1 Identification of Causes and Accident Description........................ 60 14.1.12.2 Analysis of Effects and Consequences......................................... 61 14.1.12.2.1 Method of Analysis............................................................................ 61 14.1.12.2.2 Results.............................................................................................. 63 14.1.12.3 Conclusions................................................................................... 63 14.1.12.4 References for Section 14.1.12..................................................... 63 14.1.13 Turbine-Generator Accident.................................................. 64 UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page:
1 of 64 Unit 2 14.1 CORE AND COOLANT BOUNDARY PROTECTION ANALYSIS The reactor control and protection system is relied upon to protect the core and reactor coolant boundary against the following fault conditions:
- 1. Uncontrolled RCCA bank withdrawal from a subcritical condition.
- 2. Uncontrolled RCCA bank withdrawal at power.
- 3. RCCA misalignment (this encompasses 14.1.3 RCCA misoperation and 14.1.4 RCCA drop).
- 4. Uncontrolled boron dilution.
- 5. Loss of forced reactor coolant flow (including locked rotor).
- 6. Startup of an inactive reactor coolant loop.
- 7. Loss of external electrical load or turbine trip.
- 8. Loss of normal feedwater.
- 9. Excessive heat removal due to feedwater system malfunction.
- 10. Excessive load increase.
- 11. Loss of offsite power (LOOP) to the station auxiliaries.
- 12. Turbine-generator overspeed.
A reactor trip is defined for analytical purposes as the insertion of all full length RCCAs except the most reactive one, which is assumed to remain in the fully withdrawn position. This is to provide margin in shutdown capability against the remote possibility of a stuck RCCA condition at a time when shutdown is required.
Instrumentation is provided for continuously monitoring all individual RCCAs together with their respective bank position. This is done in the form of a deviation alarm system. Procedures are established to correct deviations. In the worst case the plant will be shutdown in an orderly manner and the condition corrected. Such occurrences are expected to be extremely rare based on operation and test experience to date. In summary, reactor protection is designed to prevent cladding damage in all fault conditions listed above.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page:
2 of 64 Unit 2 The simulation of the fault conditions listed above was based upon a number of conservative assumptions summarized in the following sections. Parameters and assumptions that are common to various safety analyses are described below to avoid repetition in subsequent sections.
This material applies to most of the safety analyses described in sections 14.1 and 14.2 and the steam mass and energy release portions of sections 14.3.4 and 14.4. There is also some information related to LOCAs. Most of the information related to LOCA and containment analyses can be found in section 14.3.
14.1.0 Plant Characteristics and Initial Conditions Used in Safety Analyses 14.1.0.1 Plant Conditions The "full window" (cases 1 through 6) of the range of plant nominal operating conditions assumed in the safety analyses are presented in Table 14.1.0-1. The Non-LOCA safety analyses and evaluations presented in the following sections (Sections 14.1 and 14.2) provide support for a "full window" (cases 3 through 6) of the range of plant nominal operating conditions when a full Westinghouse VANTAGE 5 core is in place at Cook Nuclear Plant Unit 2. Cases 1 and 2 were used for safety analyses for two fuel transition cycles, cycles 8 and 9. Brief descriptions of cases 1 through 6 follows Table 14.1.0-1.
14.1.0.2 Initial Conditions For most occurrences which are DNB limited, nominal values of initial conditions and the RCS minimum measured flow (366,400 gpm) are assumed. The allowances on core thermal power, RCS temperature, pressure and flow are determined on a statistical basis and are included in the design limit DNBR as described in WCAP-11397 (Reference 1). This procedure is known as the Revised Thermal Design Procedure (RTDP).
For occurrences that are not DNB limited or in which RTDP is not employed, the initial conditions are obtained by adding the maximum steady-state errors to nominal values. In addition, the RCS UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page:
3 of 64 Unit 2 thermal design flow (354,000 gpm) is used. The following maximum steady-state errors are considered:
A.
Core Power
+/-2% 1calorimetric error allowance B.
RCS Average Temperature
+4.1oF/-5.6oF controller and measurement error allowance C.
RCS Pressure
+/-62.6 psi steady-state fluctuations and measurement error allowance Tables 14.1.0-2 and 14.1.0-3 summarize initial conditions and computer codes used in the safety analysis of occurrences in sections 14.1.1 through 14.1.12 and sections 14.2.5, 14.2.6, and 14.2.8, and shows which occurrences employed a DNB analysis using the RTDP.
14.1.0.3 Core Thermal Power Distribution The transient response of the reactor system is dependent on the initial core thermal power distribution. The nuclear design of the reactor core minimizes adverse power distribution through the placement of RCCAs and through operation instructions. The power distribution may be characterized by the radial peaking factor, FH, and the total peaking factor, FQ. The peaking factor limits are given in the Technical Specifications.
For occurrences which may be DNB limited the radial peaking factor is of importance. The radial peaking factor increases with decreasing power level due to RCCA insertion. This increase in FH is included in the core limits illustrated in Figures 14.1.0-5 and 14.1.0-6. All occurrences that may be DNB limited are assumed to begin with a FH consistent with the initial power level defined in the Technical Specifications.
The axial power shapes used in the DNB calculation are discussed in Chapter 3.
1 MUR power uprate uses reduced calorimetric error allowance. The sum of the change in Rated Thermal Power defined in the Technical Specifications and the MUR reduced calorimetric error allowance is equal to, or less than, the original +2% value supported by the safety analyses.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page:
4 of 64 Unit 2 The radial and axial power distributions described above are input to the THINC Code as described in Chapter 3.
For occurrences which may be overpower limited the total peaking factor, FQ is of importance.
All occurrences that may be overpower limited are assumed to begin with plant conditions including power distributions which are consistent with reactor operation as defined in the Technical Specifications.
For overpower occurrences which are slow with respect to the fuel rod thermal time constant, for example the uncontrolled boron dilution occurrence which lasts many minutes, and the excessive load increase occurrence which reaches equilibrium without causing a reactor trip, fuel temperature limits are discussed in Chapter 3. For overpower occurrences which are fast with respect to the fuel rod thermal time constant, for example the uncontrolled RCCA bank withdrawal from a subcritical condition and RCCA ejection occurrences which result in a large power rise over a few seconds, a detailed fuel heat transfer calculation is performed. Although the fuel rod thermal time constant is a function of system conditions, fuel burnup and fuel rod power, a typical value at beginning-of-life (BOL) for high power fuel rods is approximately 7 seconds.
14.1.0.4 Reactivity Coefficients Assumed in the Safety Analyses The transient response of the reactor coolant system is dependent on reactivity feedback effects, in particular the moderator temperature coefficient and the Doppler power coefficient. These reactivity coefficients and their values are discussed in detail in Chapter 3.
In the safety analyses of certain occurrences, conservatism requires the use of large reactivity coefficients, whereas in the safety analyses of the other occurrences, conservatism requires the use of small reactivity coefficients. Some analyses, such as loss of reactor coolant from cracks or ruptures in the RCS, do not depend on reactivity feedback effects. The values used are given in Tables 14.1.0-2 and 14.1.0-3. Figure 14.1.0-1 shows the upper and lower Doppler power coefficients, as a function of core thermal power, used in the safety analyses. The justification for use of conservatively large versus small reactivity coefficients is treated on a case-by-case basis.
In some cases this implies that conservative parameters from both beginning and end-of-life (EOL) are used for a given occurrence to bound the effects of core life. For example, in a load increase occurrence it is conservative to use a small Doppler defect typical of end-of-life (EOL) and a small moderator coefficient typical of beginning-of-life (BOL).
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page:
5 of 64 Unit 2 14.1.0.5 Rod Cluster Control Assembly (RCCA) Insertion Characteristics The negative reactivity insertion following a reactor trip is a function of the acceleration of the RCCA and the variation in RCCA worth as a function of RCCA position.
With respect to safety analyses, the critical parameter is from the start of insertion up to the dashpot entry or approximately 85% of the RCCA travel. For safety analyses, the insertion time to dashpot entry is conservatively taken as 2.7 seconds. The RCCA position versus time assumed in the safety analyses is shown on Figure 14.1.0-2.
Figure 14.1.0-3 shows the fraction of total negative reactivity insertion versus normalized RCCA insertion for a core where the axial power distribution is skewed to the lower region of the core.
This curve is used as input to all safety analyses point kinetics core models. There is inherent conservatism in the use of this curve in that it is based on a bottom skewed axial power distribution.
For cases other than those associated with axial xenon oscillations, significant negative reactivity would have been inserted due to the more favorable axial power distribution existing prior to trip.
The normalized RCCA negative reactivity insertion versus time is shown on Figure 14.1.0-4. The curve shown in this figure was obtained by combining Figures 14.1.0-2 and 14.1.0-3. Except where specifically noted otherwise, the safety analyses assume a total negative reactivity insertion of 4.0% k/k following a reactor trip. This assumption is consistent with the core design.
The normalized RCCA negative reactivity insertion versus time curve for an axial power distribution skewed to the bottom (Figure 14.1.0-4) is used in the safety analyses.
For safety analyses requiring the use of a dimensional diffusion theory code (TWINKLE, Reference 6), the negative reactivity insertion resulting from a reactor trip is calculated directly by the code and is not separable from other reactivity feedback effects. In this case, the RCCA position versus time of Figure 14.1.0-2 is used as a code input.
14.1.0.6 Reactor Trip Points and Time Delays to Reactor Trip Assumed in the Safety Analyses 14.1.0.6.1 Reactor Protection System (RPS) Setpoints and Time Delays A reactor trip signal acts to open the two reactor trip breakers connected in series feeding power to the RCCA control drive mechanisms (CDMs). The loss of power to the mechanism coils causes the mechanisms to release the RCCAs, which then fall by gravity into the core. There are various instrumentation delays associated with each tripping function, including delays in signal actuation, in opening the reactor trip breakers, and in the release of the RCCAs by the CDMs. The total delay UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page:
6 of 64 Unit 2 to a reactor trip is defined as the time delay from the time that reactor trip conditions are reached to the time the RCCAs are free and begin to fall. Limiting reactor trip setpoints assumed in the safety analyses and the time delay assumed for each reactor trip function are given in Table 14.1.0-
- 4. It should be noted that the high pressurizer water level reactor trip was assumed in the safety analyses.
The safety analyses presented in the following sections assume that the reference average temperatures (T' and T") used in the OTDT and OPDT setpoint equations are rescaled to the full power RCS average temperature each time the cycle RCS average temperature is changed. It is also assumed that the reference pressure (P') in the OTDT equation is set equal to the appropriate nominal RCS pressure (2250 psia or 2100 psia). The safety analyses also assume recalibration of the NIS excore detectors to compensate for the changes in coolant density each time the cycle operating conditions are changed.
Reference is made in Table 14.1.0-4 to the overtemperature (OT) and overpower (OP) T reactor trips shown in Figures 14.1.0-5 and 14.1.0-6. These revised OTT and OPT setpoints were calculated based on the new core thermal safety limits using the methodology described in Reference 2. Because of the use of the W-3 correlation for ANF fuel in the transition cycles, the core thermal safety limits for transition cycles are limited by the ANF fuel. For a full VANTAGE 5 fuel, these core thermal safety limits are less restrictive. Two sets of OTT and OPT setpoints were calculated. The first set of these setpoints is calculated based on the most restrictive core thermal safety limits in the transition cycles (Cycles 8 and 9) and the second set is calculated for a full core of VANTAGE 5 fuel. The following DNB-related safety analyses are performed twice to include the variation in the core thermal safety limits and the OTT and OPT reactor trip setpoints between a mixed core and a full VANTAGE 5 core:
- a.
Uncontrolled RCCA Withdrawal at Power
- b.
Excessive Load Increase Incident
- c.
Excessive Heat Removal due to Feedwater System Malfunctions
- d.
Loss of External Electric Load or Turbine Trip Figure 14.1.0-5 presents the allowable RCS loop average temperature and vessel T as a function of RCS pressure for the transition cycles (Cycles 8 and 9). This figure presents the most limiting operating configuration (nominal core thermal power = 3588 MWt, nominal RCS T-avg = 576oF, nominal RCS pressure = 2250 psia) of the potential future rerating range of conditions described UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page:
7 of 64 Unit 2 in Table 14.1.0-1 (case 1) for the calculation of the OTT and OPT protection setpoints. A RCS flow rate of 366,400 gpm was assumed for generating these setpoints.
The OTT and OPT setpoints calculated for the transition cycles (cycles 8 and 9) are being used in cycles 10 and 11. This is conservative.
Figure 14.1.0-6 presents the allowable RCS loop average temperature and vessel T as a function of RCS pressure for the cycles (Cycle 10 and beyond) with a full VANTAGE 5 core. This figure presents the most limiting operating configuration (nominal core thermal power = 3588 Mwt, nominal RCS T-avg = 581.3oF, nominal RCS pressure = 2100 psia) of the potential rerating range of conditions described in Table 14.1.0-1 (case 4) for the calculation of the OTT and OPT protection setpoints. A RCS flow rate of 366,400 gpm was assumed for generating these setpoints.
Figure 14.1.0-6a presents revised OTdT and OPdT protection setpoints used in the Loss of External Electric Load or Turbine Trip analysis. These revised setpoints provide more operating flexibility (i.e., more margin to trip) than those depicted in Figure 14.1.0-6. The core thermal limits of Figure 14.1.0-6a are unchanged from the Figure 14.1.0-6 limits. The use of the revised setpoints result in the Loss of External Electric Load analysis yields a bounding analysis.
The boundaries of operation defined by the OPT and OTT trip setpoints are represented as "protection lines" on these diagrams. The protection lines include all adverse instrumentation and setpoint errors so that under nominal conditions a reactor trip would occur within the area bounded by these lines. The utility of these diagrams is the fact that the limit imposed by any given DNBR can be represented as a line. The DNBR lines represent the locus of conditions for which DNBR equals the safety analysis limit value. All points below and to the left of a DNB line for a given RCS pressure have a DNBR greater than the safety analysis limit value. These diagrams show that DNB is prevented for all cases if the area enclosed within the maximum protection lines is not traversed by the applicable DNBR limit line at any point for a given pressurizer pressure.
The area of permissible operation (power, pressure, and temperature) is bounded by a combination of reactor trips: high neutron flux (fixed setpoint); high pressurizer pressure (fixed setpoint); low pressurizer pressure (fixed setpoint); Overpower and Overtemperature T (variable setpoints).
The differences between the limiting trip setpoint assumed for the safety analyses and the nominal reactor trip setpoint in Table 14.1-4 represents an allowance for instrumentation channel error and setpoint error. Instrument Response Time Determination values are listed in Table 7.2-6. The reactor protection system (RPS) channels are calibrated and instrument response times determined periodically in accordance with the Technical Specifications.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page:
8 of 64 Unit 2 14.1.0.6.2 Engineered Safety Features (ESF) Actuation Setpoints and Time Delays Table 14.1.0-5 presents the limiting ESF setpoints assumed in the safety analyses and the time delay assumed for each ESF actuation function. The nominal value of the low steamline pressure setpoint assumed was 500 psig. The revised low steamline pressure setpoint value provides operating margin for the potential reduced temperature operating conditions of Table 14.1.0-1 (cases 2, 5, and 6). The difference between the limiting ESF actuation setpoint assumed for the safety analyses and the nominal ESF actuation setpoint represents an allowance for instrumentation channel error and setpoint error. Instrument Response Time Determination values are listed in table 7.2-7.
14.1.0.7 Plant Systems and Components Available for Mitigation of Occurrence Effects Table 14.1.0-6 is a summary of reactor trip functions, engineered safety features actuation functions, and other equipment available for mitigation of accident effects. The trips and actuations in the Table 14.1.0-6 include some that are anticipatory and/or backup functions. These trips and actuations are not necessarily taken credit for the safety analyses.
In the safety analyses of the Chapter 14.1 occurrences, control system action is considered only if that action results in more severe occurrence results. No credit is taken for control system operations if that operation mitigates the results of an occurrence. For some occurrences, the analysis is performed both with and without control system operation to determine the worst case.
14.1.0.8 Residual Decay Heat For the non-LOCA safety analyses, conservative core residual decay heat generation based on long-term operation at the initial power level preceding the reactor trip is assumed. The 1979 ANS residual decay heat standard (Reference 3) plus uncertainty was used for calculation of residual decay heat levels. Figure 14.1.0-7 presents this curve as a function of time after shutdown.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page:
9 of 64 Unit 2 14.1.0.8.1 Distribution of Residual Decay Heat Following a LOCA During a LOCA, the core is rapidly shutdown by void formation or RCCAinsertion, or both, and a large fraction of the heat generation to be considered comes from fission product decay gamma rays. This heat is not distributed in the same manner as steady state fission power. Local peaking effects which are important for the neutron dependent part of the heat generation do not apply to the gamma ray contribution. The steady state factor of 97.4% which represents the fraction of heat generated within the clad and pellet drops to 95% for the hot fuel rod in a LOCA.
For example, 0.5 seconds after the initiation of a postulated double-ended large break LOCA (LBLOCA) about 30% of the energy generated in the fuel rods results from gamma ray absorption.
Part of the gamma ray from the hot fuel rod is absorbed in the fuel rods surrounding the hot fuel rod. A conservative estimate of this effect is that 10% of the gamma ray (or 3% of the total energy) from the hot fuel rod is deposited in the fuel rod surrounding the hot fuel rod. Since the water density is considerably lower at this time, an average of 98% of the available energy is deposited in the fuel rods. The remaining 2% energy is absorbed by water, thimbles, sleeves, and grids. The net effect is that a factor of 0.95 (98% - 3%) rather than 0.974 should be applied to the residual decay heat production in the hot fuel rod.
14.1.0.9 Other Assumptions Those analyses that model the mitigative effects of Protection and/or Engineer Safeguards Features have used the response times provided in Tables 7.2-6 and 7.2-7.
14.1.0.10 Computer Codes Utilized Summaries of some of the principal computer codes used in the safety analyses are given below.
Other codes, in particular, very specialized codes in which the modeling has been developed to simulate one given occurrence, such as those used in the analysis of the reactor coolant system pipe rupture (Section 14.3.1), are summarized in their respective safety analyses sections. The codes used in the analysis of each occurrence have been listed in Tables 14.1.0-2 and 14.1.0-3.
Credit is not taken for RCCA insertion for the large break LOCA peak cladding temperature analysis, or criticality control during cold leg recirculation. However, RCCA insertion credit is assumed to maintain subcriticality at the time of hot leg switchover following a cold leg LOCA.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 10 of 64 Unit 2 14.1.0.10.1 FACTRAN FACTRAN calculates the transient temperature distribution in a cross-section of a metal clad UO2 fuel rod and the transient heat flux at the surface of the clad using as input the nuclear power and the time-dependent coolant parameters (pressure, flow, temperature, density). The code uses a fuel model, which simultaneously exhibits the following features:
- a.
A sufficiently large number of radial space increments to handle fast transients such as a rod ejection accident.
- b.
Material properties which are functions of temperature and a sophisticated fuel-to-clad gap heat transfer calculation.
- c.
The necessary calculations to handle post-departure from nucleate boiling (DNB) transients: film boiling heat transfer correlations, Zircaloy-water reaction, and partial melting of the fuel.
FACTRAN is further discussed in Reference 4.
14.1.0.10.2 LOFTRAN The LOFTRAN program is used for transient response studies of a pressurized water reactor (PWR) system to specified perturbations in process parameters. All 4 (four) reactor coolant loops are modeled in LOFTRAN program. This code simulates a multiloop system by a model containing the reactor vessel, hot and cold leg piping, steam generators (tube and shell sides), and the pressurizer. The pressurizer heaters, spray, relief valves, and safety valves are also considered in the program. Point model neutron kinetics and reactivity effects of the moderator, fuel, boron, and RCCAs are included. The secondary side of the steam generator utilizes a homogeneous, saturated mixture for the thermal transients. The reactor protection system (RPS) is simulated to include reactor trips on high neutron flux, overtemperature T, overpower T, high and low RCS pressure, low RCS flow, and high pressurizer level. Control systems are also simulated including RCCA, steam dump, and pressurizer pressure control. The ECCS, including the accumulators, is also modeled.
LOFTRAN also has the capability of calculating the transient value of DNBR based on the input from the core thermal safety limits. LOFTRAN is further discussed in Reference 5.
14.1.0.10.3 TWINKLE The TWINKLE program is a multi-dimensional spatial neutron kinetics code, which was patterned after steady-state codes used for reactor core design. The code uses an implicit finite-difference UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 11 of 64 Unit 2 method to solve the two-group transient neutron diffusion equations in one, two, and three dimensions. The code uses six delayed neutron groups and contains a detailed multi-region fuel-clad-coolant heat transfer model for calculating pointwise Doppler and moderator feedback effects. The code handles up to 2000 spatial points and performs its own steady-state initialization.
Aside from basic cross-section data and thermal-hydraulic parameters, the code accepts as input basic driving functions such as inlet temperature, pressure, flow, boron concentration, RCCA motion, and others. Various edits are provided; e.g., channelwise power, axial offset, enthalpy, volumetric surge, pointwise power and fuel temperatures.
The TWINKLE code is used to predict the kinetic behavior of a reactor for transients which cause a major perturbation in the spatial neutron flux distribution.TWINKLE is further described in Reference 6.
14.1.0.10.4 THINC The THINC-IV computer program is used to perform thermal-hydraulic calculations. The THINC-IV code calculates coolant density, mass velocity, enthalpy, void fractions, static pressure, and DNBR distributions along flow channels within a reactor core under all expected operating conditions. The THINC-IV code is described in detail in References 7 and 8, including models and correlations used.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 12 of 64 Unit 2 14.1.0.11 References for Section 14.1.0
- 1. Friedland, A. J., Ray, S., "Revised Thermal Design Procedure," WCAP-11397-P-A, April 1989.
- 2. Ellenberger S. L. et al., "Design Bases for the Thermal Overpower T and Thermal Overtemperature T Trip Functions," WCAP-8746-A, September 1986.
- 3. ANSI/ANS-5.1-1979, "Decay Heat Power In Light Water Reactors," August 29, 1979.
- 4. Hargrove, H. G., "FACTRAN - A FORTRAN-IV Code for Thermal Transients in a UO2 Fuel Rod," WCAP-7908, June 1972.
- 5. Burnett, T, W. T., et al., "LOFTRAN Code Description," WCAP-79O7-A, April 1984.
- 6. Risher, D. H., Jr., and Barry, R. F., "TWINKLE - a Multi-Dimensional Neutron Kinetics Computer Code," WCAP-8028-A, January 1975.
- 8. Hochreiter, L. E., Chelemer, H., Chu, P. T, "THINC-IV An Improved Program for Thermal-Hydraulic Analysis of Rod Bundle Cores," WCAP-7956, June 1973.
- 9. AEP-02-9, 1/23/02, American Electric Power, Donald C. Cook Unit 2 RTD Response Time Delay Evaluation UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 13 of 64 Unit 2 14.1.1 Uncontrolled Rod Cluster Control Assembly (RCCA) Bank Withdrawal from AaSubcritical Condition 14.1.1.1 Identification of Causes and Accident Description An RCCA withdrawal incident is defined as an uncontrolled addition of reactivity to the reactor core caused by withdrawal of RCCA banks resulting in a power excursion. While the occurrence of a transient of this type is highly unlikely, such a transient could be caused by a malfunction of the reactor control or control rod drive systems. This could occur with the reactor either subcritical or at power. The "at power" case is discussed in Section 14.1.2.
Reactivity is added at a prescribed and controlled rate in bringing the reactor from a shutdown condition to a low power level during startup by RCCA bank withdrawal. Although the initial startup procedure may use the method of boron dilution, the normal startup is with RCCA bank withdrawal. RCCA bank motion can cause much faster changes in reactivity than can be made by changing boron concentration.
The control rod drive mechanisms are wired into preselected banks, which are not altered during the core life. The RCCAs are therefore physically prevented from being withdrawn in other than their respective banks, except for the case of manually retrieving a dropped RCCA as provided for in approved operating procedures (see Section 14.1.3). Power supplied to the rod banks is controlled such that no more than two banks can be withdrawn at any time. The RCCA drive mechanism is of the magnetic latch type and the coil actuation is sequenced to provide variable speed travel. The maximum reactivity insertion rate is analyzed by assuming the simultaneous withdrawal of the combination of the two banks of the maximum combined worth at maximum speed.
Should a continuous control rod assembly withdrawal be initiated, the transient will be terminated by the following reactor trip functions.
- 1. Source range neutron flux trip - actuated when either of two independent source range channels indicates a flux above a preselected, manually adjustable value. This trip function may be manually bypassed when either intermediate range flux channel indicates a flux above the source range cutoff level. It is automatically reinstated when both intermediate range channels indicate a flux below the source range cutoff level.
- 2. Intermediate range neutron flux trip - actuated when either of two independent intermediate range channels indicates a flux above a preselected, manually adjustable value. This trip function may be manually bypassed when two of the four power range channels are reading UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 14 of 64 Unit 2 above approximately 10 percent of full power flux and is automatically reinstated when three of the four power range channels indicate a flux below this value.
- 3. Power range high neutron flux trip (low setting) - actuated when two out of the four power channels indicate a flux above approximately 25 percent of full power flux. This trip function may be manually bypassed when two of the four power range channels indicate a flux above approximately 10 percent of full power flux and is automatically reinstated when three of the four channels indicate a flux below this value.
- 4. Power range neutron flux level trip (high setting) - actuated when two out of the four power range channels indicate a flux level above a preset setpoint. This trip function is always active.
In addition, control rod stops on intermediate range flux and high power range flux serve to discontinue rod withdrawal and prevent the need to actuate the intermediate range flux trip and the power range flux trip, respectively.
The neutron flux response to a continuous reactivity insertion is characterized by a very fast power rise terminated by the reactivity feedback effect of the negative fuel temperature coefficient. This self-limitation of the initial power burst results from a fast negative fuel temperature feedback (Doppler effect) and is of prime importance during a startup incident since it limits the power to a tolerable level prior to protective action. After the initial power burst, the neutron flux is momentarily reduced and then, if the incident is not terminated by a reactor trip, the neutron flux increases again, but at a much slower rate.
Termination of the startup incident by the previously discussed protection channels prevents core damage. In addition, the reactor trip from pressurizer high pressure serves as a backup to terminate the incident before an overpressure condition could occur.
14.1.1.2 Analysis of Effects and Consequences 14.1.1.2.1 Method of Analysis The analysis of the uncontrolled RCCA bank withdrawal from subcritical accident is performed in three stages: first, an average core nuclear power transient calculation, then, an average core heat transfer calculation, and finally, the departure from nucleate boiling ratio (DNBR) calculation.
The average core nuclear power calculation is performed using spatial neutron kinetics methods (TWINKLE) (Reference 1) to determine the average power generation with time including the various total core feedback effects, i.e., Doppler reactivity and moderator reactivity. The average heat flux and temperature transients are determined by performing a fuel rod transient heat transfer UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 15 of 64 Unit 2 calculation in FACTRAN (Reference 2). The average heat flux is next used in THINC (References 3 and 4) for transient DNBR calculations.
Analysis of this transient incorporates the neutron kinetics, including six delayed neutron groups and the core thermal and hydraulic equations. In addition to the neutron flux response, the average fuel, clad and water temperature, and also the heat flux response, are computed.
In order to give conservative results for a startup incident, the following additional assumptions are made concerning the initial reactor conditions:
- 1. Since the magnitude of the neutron flux peak reached during the initial part of the transient is strongly dependent on the Doppler power reactivity coefficient, a conservatively low value for Doppler power defect (-1000 pcm) is used for any given rate of reactivity insertion.
- 2. The contribution of the moderator reactivity coefficient is negligible during the initial part of the transient because the heat transfer time constant between the fuel and the moderator is much longer than the neutron flux response time constant. However, after the initial neutron flux peak, the succeeding rate of power increase is affected by the moderator temperature reactivity coefficient. Although during normal operation (100% rated power),
the moderator coefficient will not be positive at any time in core life, a highly conservative value has been used in the analysis to yield the maximum peak core heat flux. The analysis is based on a moderator coefficient which was at least +5 pcm/oF at the zero power nominal average temperature, and which became less positive for higher temperatures. This was necessary since the TWINKLE computer code used in the analysis is a diffusion theory code rather than a point-kinetics approximation and the moderator temperature feedback cannot be artificially held constant with temperature.
- 3. The reactor is assumed to be at hot zero power (547oF). This assumption is more conservative than that of a lower initial system temperature. The higher initial system temperature yields a larger fuel-to-water heat transfer, a larger fuel thermal capacity, and a less-negative (smaller absolute magnitude) Doppler coefficient. The less-negative Doppler coefficient reduces the Doppler feedback effect thereby increasing the neutron flux peak.
The high neutron flux peak combined with a high fuel thermal capacity and larger thermal conductivity yields a larger peak heat flux. The initial multiplication factor (ko) is assumed to be closely approaching 1.0 since this results in the maximum neutron flux peak.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 16 of 64 Unit 2
- 4. Two reactor coolant pumps are assumed to be in operation. This is conservative with respect to the DNB transient.
- 5. The most adverse combination of instrumentation and setpoint errors, as well as delays for trip signal actuation and control rod assembly release, are taken into account. A 10%
increase has been assumed for the power range flux trip, low setpoint raising it from the nominal value of 25% to a value of 35% in addition to taking no credit for the source and intermediate range protection. Reference to Figure 14.1.1-1, however, shows that the rise in nuclear flux is so rapid that the effect of errors in the trip setpoint on the actual time at which the rods are released is negligible. In addition to the above, the rate of negative reactivity insertion corresponding to the trip action is based on the assumption that the highest worth control rod assembly is stuck in its fully withdrawn position.
The accident is analyzed using the Standard Thermal Design Procedure with the initial conditions shown in Table 14.1.0-2. The analysis was performed for a reactivity insertion rate of 63 pcm/sec (1 pcm = 10-5 k/k). This reactivity insertion rate assumed is greater than that for the simultaneous withdrawal of the combination of the two sequential control banks having the greatest combined worth at maximum speed (48.125 inches/minute).
14.1.1.2.2 Results The nuclear power, heat flux, fuel average temperature, and clad temperature versus time transients are shown in Figures 14.1.1-1 and 14.1.1-2. In addition, the time sequence of events is presented in Table 14.1.1-1. The insertion rate of 63 pcm/sec, coupled with the reduced RCS pressure of 2100 psia, yields a minimum DNBR which remains above the safety analysis limit values for both a full VANTAGE 5 core and for a mixed core.
For the rod withdrawal from subcritical event, the core axial power distribution is severely peaked to the bottom of the core. The W-3 DNB correlation is used to evaluate DNBR in the span between the lower non-mixing vane grid and the first mixing vane grid. The WRB-2 correlation remains applicable for the rest of the fuel assembly. For all regions of the core, the DNB design bases are met.
14.1.1.3 Conclusions The minimum DNBR remains above the safety analysis limit values for both a full VANTAGE 5 core and for a mixed core. In addition, the fuel and clad temperatures remain well below the limit values. Thus, there will be no cladding damage and no release of fission products to the reactor coolant system as a result of DNB.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 17 of 64 Unit 2 14.1.1.4 References for Section 14.1
- 1. Risher, D. H., Jr., and Barry, R. F., "TWINKLE - a Multi-Dimensional Neutron Kinetics Computer Code," WCAP-8028-A, January 1975.
- 2. Hargrove, H.G., "FACTRAN - A FORTRAN-IV Code for Thermal Transients in a UO2 Fuel Rod," WCAP-7908, June 1972.
- 4. Hochreiter, L. E., Chelemer, H., Chu, P. T., "THINC-IV An Improved Program for Thermal-Hydraulic Analysis of Rod Bundle Cores," WCAP-7956, June 1973.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 18 of 64 Unit 2 14.1.2 Uncontrolled Rod Cluster Control Assembly (RCCA) Bank Withdrawal at Power (Full Vantage 5 Core) 14.1.2.1 Identification of Causes and Accident Description An uncontrolled rod control cluster assembly (RCCA) withdrawal at power results in an increase in core heat flux. Since the heat extraction from the steam generator lags behind the power generation until the steam generator pressure reaches the relief or safety valve setpoint, there is a net increase in reactor coolant temperature. Unless terminated by manual or automatic action, the power mismatch and resultant coolant temperature rise would eventually result in DNB.
Therefore, to minimize the possibility of breaching the cladding, the reactor protection system is designed to terminate any such transient before the DNBR falls below the limit value.
The automatic features of the reactor protection system which minimize adverse effects to the core in an RCCA bank withdrawal incident at power include the following:
1.
Nuclear power range instrumentation actuates a reactor trip on high neutron flux if two out of four channels exceed an overpower setpoint.
2.
Reactor trip is actuated if any two out of four T channels exceed an overtemperature T setpoint. This setpoint is automatically varied with axial power distribution, coolant average temperature and pressure to protect against DNB.
- 3.
Reactor trip is actuated if any two out of four T channels exceed an overpower T setpoint. This setpoint is automatically varied with coolant average temperature so that the allowable fuel power rating is not exceeded.
4.
A high pressure reactor trip, actuated from any two out of four pressure channels, is set at a fixed point. This set pressure is less than the set pressure for the pressurizer safety valves.
5.
A high pressurizer water level reactor trip, actuated from any two out of three level channels, is set at a fixed point.
In addition to the above listed reactor trips, there are the following RCCA withdrawal blocks:
- a.
High neutron flux (one out of four) b.
Overpower T (two out of four)
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 19 of 64 Unit 2
- c.
Overtemperature T (two out of four)
The manner in which the combination of overpower T and overtemperature T trips provide protection over the full range of reactor coolant system conditions is illustrated in Figure 14.1.0-
- 6. This figure represents the allowable conditions of reactor coolant loop average temperature and power with the design power capability in a two-dimensional plot.
The purpose of this analysis is to demonstrate the manner in which the above protective systems function for various reactivity insertion rates from different initial conditions. Reactivity insertion rates and initial conditions govern which protective function occurs first.
14.1.2.2 Analysis of Effects and Consequences 14.1.2.2.1 Method of Analysis This transient is analyzed using the LOFTRAN code (Reference 1). The core limits as illustrated in Figure 14.1.0-6 are used as input to LOFTRAN to determine the minimum DNBR during the transient.
The analysis is performed to bound the reduced RCS temperature and pressure operation along with the range of conditions possible for the potential future uprating of Cook Nuclear Plant Unit
- 2.
This accident is analyzed with the Revised Thermal Design Procedure (Reference 2). Plant characteristics and initial conditions are shown in Table 14.1.0-3. For an uncontrolled rod withdrawal at power accident, the following conservative assumptions are made:
A.
Nominal values are assumed for the initial reactor power, pressure, and RCS temperatures (see Table 14.1.0-3). Uncertainties in initial conditions are included in the limit DNBR as described in Reference 2.
B.
Reactivity coefficients - two cases are analyzed:
- 1.
Minimum Reactivity Feedback. A +5 pcm/ oF moderator temperature coefficient of reactivity and a least negative Doppler only power coefficient (see Table 14.1.0-3) are assumed.
2.
Maximum Reactivity Feedback. A conservatively large positive moderator density coefficient (corresponding to a large negative moderator temperature coefficient) and a most negative Doppler-only power coefficient (See Table 14.1.0-3) are assumed.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 20 of 64 Unit 2 C.
The reactor trip on high neutron flux is assumed to be actuated at a conservative value of 118 percent of nominal core power of 3588 MWt. The T trips include all adverse instrumentation and setpoint errors, while the delays for the trip signal actuation are assumed at their maximum values.
D.
The RCCA trip insertion characteristic is based on the assumption that the highest worth assembly is stuck in its fully withdrawn position.
E.
The maximum positive reactivity insertion rate is greater than that for the simultaneous withdrawal of the combinations of the two control banks having the maximum combined worth at maximum speed.
F.
Reactor trip on high pressurizer water level is assumed available, with a delay of 2 seconds for rod motion, for cases analyzed to demonstrate that this trip will prevent the pressurizer from filling. It actuates earlier than either the OTT or high neutron flux trip functions to demonstrate this protection during pressurizer filling scenarios. Minimum DNBR calculations were conservatively performed without taking credit for the high pressurizer water level trip.
14.1.2.2.2 Results Figures 14.1.2B-1 through 14.1.2B-3 show the transient response for a rapid RCCA bank withdrawal incident starting from full power. Reactor trip on high neutron flux occurs shortly after the start of the accident. Since this is rapid with respect to the thermal time constants of the plant, small changes in T-avg and pressure result and margin to DNB is maintained.
The transient response for a slow RCCA bank withdrawal from full power is shown in Figures 14.1.2B-4 through 14.1.2B-6. Reactor trip on overtemperature T occurs after a longer period and the rise in temperature is larger and pressure is smaller than for rapid RCCA bank withdrawal.
Again, the minimum DNBR is greater than the limit value.
Figure 14.1.2B-7 shows the minimum DNBR as a function of reactivity insertion rate from initial full power operation for minimum and maximum reactivity feedback. It can be seen that two reactor trip channels provide DNB protection over the whole range of reactivity insertion rates.
These are the high neutron flux and overtemperature T channels. The minimum DNBR is always greater than the limit value.
Figures 14.1.2B-8 and 14.1.2B-9 show the minimum DNBR as a function of reactivity insertion rate for RCCA bank withdrawal incidents starting at 60 and 10 percent power respectively. The UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 21 of 64 Unit 2 results are similar to the 100 percent power case, except as the initial power is decreased, the range over which the overtemperature T trip is effective is increased. In neither case does the DNBR fall below the limit value.
The shape of the curves of minimum DNBR versus reactivity insertion rate in the referenced figures is due both to reactor core and coolant system transient response and to protection system action in initiating a reactor trip.
The results of cases which examined a conservative pressurizer water volume transient due to the uncontrolled RCCA bank withdrawal at power accident showed that credit for the high pressurizer water level reactor trip was required to prevent the pressurizer from filling. An analysis value of 100% span was assumed for the high pressurizer water level reactor trip setpoint. A time delay of 2 seconds from actuation of the high pressurizer water level reactor trip signal until rod motion was determined adequate to terminate the transient and prevent the pressurizer from filling. For comparison purposes, the pressurizer fills at 1898 ft3 (which includes the pressurizer surge line volume).
The calculated sequence of events for the uncontrolled RCCA bank withdrawal at power incident are shown in Table 14.1.2B-1 for large and small reactivity insertion rates. These sequence of events are for the cases initiated from full power assuming maximum reactivity feedback conditions.
Effect of the RTD Bypass Elimination Evaluation performed to support RTD Bypass Elimination demonstrates that the conclusions of the accident analysis remain valid.
14.1.2.3 Conclusions The high neutron flux and overtemperature T trip channels provide adequate protection over the entire range of possible reactivity insertion rates (i.e., the minimum value of DNBR is always larger than the limit value for all fuel types). Also, the high pressurizer water level reactor trip prevents the pressurizer from filling.
14.1.2.4 References for Section 14.1.2
- 1. Burnett, T. W. T., et al., "LOFTRAN Code Description," WCAP-7907-A, April 1984.
- 2. Friedland, A. J., Ray, S., "Revised Thermal Design Procedure," WCAP-11397-P-A, April 1989.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 22 of 64 Unit 2 14.1.3 Rod Cluster Control Assembly (RCCA) Misalignment (Including RCCA Drop) 14.1.3.1 Identification of Causes and Accident Description Rod cluster control assembly (RCCA) misoperation accidents include:
A.
One or more dropped RCCAs within the same group.
B.
A dropped RCCA bank.
C.
Statically misaligned RCCA.
Each RCCA has a position indicator channel which displays the position of the assembly. The displays of assembly positions are grouped for the convenience of the operator. A rod bottom light, local alarm, and control room annunciator are actuated at 20 steps indicated (or less) to confirm a fully inserted RCCA. Group demand position is also indicated.
Except for the case of manually retrieving a dropped RCCA as provided for in approved operating procedures, as described later, RCCAs are moved in preselected banks, and the banks are moved in the same preselected sequence. Some banks of RCCAs are divided into two groups. The rods comprising a group operate in parallel through multiplexing thyristors. If a bank of RCCAs consist of two groups, the groups are moved in a staggered fashion, but always within one step of each other. A definite schedule of actuation (or deactuation) of the stationary gripper, movable gripper, and lift coils of a mechanism is required to withdraw the RCCA attached to the mechanism.
Mechanical failures are in the direction of insertion or immobility.
The dropped RCCAs, dropped RCCA bank, and statically misaligned RCCA events are considered incidents of moderate frequency.
A dropped RCCA or RCCA bank is detected by:
Sudden drop in the core power level as seen by the nuclear instrumentation system.
Asymmetric power distribution as seen on out-of-core neutron detectors or core exit thermocouples.
Local alarm/control room annunciator Rod bottom light Rod deviation alarm.
Rod position indication.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 23 of 64 Unit 2 Misaligned RCCAs are detected by:
Asymmetric power distribution as seen on out-of-core neutron detectors or core exit thermocouples.
Rod deviation alarm.
Rod position indicators.
The resolution of the rod position indicator channel is +/-5 percent of the 12 foot measurement span (12 steps). Deviation of any RCCA from its group by twice this distance (10 percent of span or 24 steps) will not cause power distributions worse than the design limits. As the power level is lowered, the limits for Fq and FH increase. These increases can be used for accommodating increased RCCA misalignment at a lower power level. If the measured Fq and FH at 100% RTP are smaller than the corresponding limits at 100% RTP, then these margins can be used for accommodating larger than 12-step misalignment. (Reference 2). The deviation monitor alerts the operator to rod deviation with respect to the group position in excess of allowed misalignment.
If the rod deviation monitor is not operable, the operator is required to take action as required by the Technical Specifications.
If one or more rod position indicator channels should be out of service, detailed operating instructions shall be followed to ensure the alignment of the non-indicated RCCAs. The operator is also required to take action, as required by the Technical Specifications.
14.1.3.2 Analysis of Effect and Consequences 14.1.3.2.1 Method of Analysis A.
One or More Dropped RCCAs Within the Same Group For evaluation of the dropped RCCA event, the transient system response is calculated using the LOFTRAN Code (Reference 1). The code simulates the neutron kinetics, reactor coolant system (RCS), pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety valves.
The code computes pertinent plant variables including temperatures, pressures, and power level.
Conservative nominal values for initial reactor power, temperature, and RCS pressure are assumed to bound the reduced temperature and pressure operation along with the range of conditions possible for the potential future rerating of Cook Nuclear Plant Unit 2. The initial conditions are presented in Table 14.1.0-2.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 24 of 64 Unit 2 Statepoints are calculated and nuclear models are used to obtain a hot channel factor consistent with the primary system conditions and reactor power. By incorporating the primary conditions from the transient and the hot channel factor from the nuclear analysis, the departure from nucleate boiling (DNB) design basis is shown to be met using the THINC Code (References 2 and 3). The transient response, nuclear peaking factor analysis, and DNB design basis confirmation are performed in accordance with the methodology described in Reference 4. Note that operation with automatic rod control is assumed for the analysis and that the analysis does not take credit for a negative flux rate reactor trip.
B.
Dropped RCCA Bank A dropped RCCA bank results in a symmetric power change in the core. As discussed in Reference 4, assumptions made for the dropped RCCA(s) analysis provide a bounding analysis for the dropped RCCA bank.
C.
Statically Misaligned RCCA Steady-state power distributions are analyzed using the methodology as described in Reference 4. The peaking factors are then used as input to the THINC code to calculate the departure from nucleate boiling ratio (DNBR).
14.1.3.2.2 Results A.
One or More Dropped RCCAs Within the Same Group Single or multiple dropped RCCAs within the same group result in a negative reactivity insertion. The core is not adversely affected during this period, since power is decreasing rapidly. Power may be re-established either by reactivity feedback or control bank withdrawal.
Following a dropped rod event in manual rod control, the plant will establish a new equilibrium condition. The equilibrium process without control system interaction is monotonic, thus removing power overshoot as a concern and establishing the automatic rod control mode of operation as the limiting case.
For a dropped RCCA event in the automatic rod control mode, the rod control system detects the drop in power and initiates control bank withdrawal. Power overshoot may occur due to this action by the automatic rod controller after which the control system will insert the control bank to restore nominal power. Figures UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 25 of 64 Unit 2 14.1.3-1 and 14.1.3-2 show a typical transient response to a dropped RCCA (or RCCAs) in automatic control. In all cases, the minimum DNBR remains above the limit value.
Following plant stabilization, normal rod retrieval or shutdown procedures are followed. The operator may manually retrieve the RCCA by following approved operating procedures.
B.
Dropped RCCA Bank A dropped RCCA bank typically results in a negative reactivity insertion greater than 500 pcm (1 pcm = 10-5k/k). The core is not adversely affected during the insertion period, since power is decreasing rapidly. The transient will proceed as described in part A. However, the return to power will be less due to the greater worth of an entire bank. Following plant stabilization, normal rod retrieval or shutdown procedures are followed to further cool down the plant.
C.
Statically Misaligned RCCA The most severe misalignment situations with respect to DNBR at significant power levels arise from cases in which one RCCA is fully inserted or where bank D is fully inserted with one RCCA fully withdrawn. Multiple independent alarms, including a bank insertion limit alarm, alert the operator well before the postulated conditions are approached. The bank can be inserted to its insertion limit with any one assembly fully withdrawn without the DNBR falling below the limit value.
The insertion limits in the Technical Specifications may vary from cycle to cycle, depending on a number of limiting criteria. The full-power insertion limits on control bank D must be chosen to be above that position which meets the minimum DNBR and peaking factors. The full power insertion limit is usually dictated by other criteria. Detailed results will vary from cycle to cycle depending on fuel arrangements.
For this RCCA misalignment, with bank D inserted to its full-power insertion limit and one RCCA fully withdrawn, DNBR does not fall below the limit value. This case is analyzed assuming that the initial reactor power, pressure, and RCS temperature are at their nominal values (as given in Table 14.1.0-2), with the increased radial peaking factor associated with the misaligned RCCA.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 26 of 64 Unit 2 For RCCA misalignments with one RCCA fully inserted, the DNBR does not fall below the limit value. This case is analyzed assuming the initial reactor power, pressure, and RCS temperatures are at their nominal values (as given in Table 14.1.0-2), with the increased radial peaking factor associated with the misaligned RCCA.
DNB does not occur for the RCCA misalignment incident, and thus the ability of the primary coolant to remove heat from the fuel rod is not reduced. The peak fuel temperature corresponds to a linear heat generation rate based on the radial peaking factor penalty associated with the misaligned RCCA and the design axial power distribution. The resulting linear heat generation is well below that which would cause fuel melting.
Following the identification of an RCCA group misalignment condition by the operator, the operator is required to take action as required by the plant Technical Specifications and operating instructions.
14.1.3.3 Conclusions For cases of dropped RCCAs or dropped banks, the DNBR remains greater than the limit value and, therefore, the DNB design basis is met.
14.1.3.4 References for Section 14.1.3
- 1. Burnett, T, W. T., et al., "LOFTRAN Code Description," WCAP-7907-A, April 1984.
- 3. Hochreiter, L. E., Chelemer, H., Chu, P. T., "THINC-IV An Improved Program for Thermal-Hydraulic Analysis of Rod Bundle Cores," WCAP-7956, June 1973.
- 4. Haessler, R. L. et. al., "Methodology for the Analysis of the Dropped Rod Event," WCAP-11394 (proprietary) and WCAP-11395 (nonproprietary), April 1987.
- 5. "Donald C. Cook Nuclear Plant Control Rod Misalignment Analysis," September 1993. to AEP:NRC:1182 UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 27 of 64 Unit 2 14.1.4 Rod Cluster Control Assembly Drop Rod cluster control assembly drop is discussed in Section 14.1.3.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 28 of 64 Unit 2 14.1.5 Uncontrolled Boron Dilution 14.1.5.1 Identification of Causes and Accident Description Reactivity can be added to the core by feeding primary grade water into the reactor coolant system via the reactor makeup portion of the chemical and volume control system (CVCS). Boron dilution is a manual operation. A boric acid blend system is provided to permit the operator to match the boron concentration of reactor coolant makeup water during normal charging to that in the reactor coolant system. The CVCS is designed to limit, even under various postulated failure modes, the potential rate of dilution to a value which provides the operator sufficient time to correct the situation in a safe and orderly manner.
The opening of the primary water makeup control valve supplies water to the reactor coolant system which can dilute the reactor coolant. Inadvertent dilution can be readily terminated by closing this valve. In order for makeup water to be added to the reactor coolant system, at least one charging pump must also be running in addition to the primary water pumps.
The rate of addition of unborated water makeup to the reactor coolant system is limited by the capacity of the primary water pumps. The maximum addition rate in this case is 225 gpm with both primary water pumps running. The 225 gpm reactor makeup water delivery rate is based on a pressure drop calculation comparing the pump curves with the system resistance curve. This is the maximum delivery based on the unit piping layout. Normally, only one primary water makeup pump is operating while the other is on standby.
The boric acid from the boric acid storage tank (BAST) is blended with primary grade water in the blender and the composition is determined by the preset flow rates of boric acid and primary grade water on the control board.
In order to dilute, two separate operations are required. First, the operator must switch from the automatic makeup mode to a dilute mode; second, the control switch must be taken to the start position. Omitting either step would prevent dilution. This makes the possibility of inadvertent dilution very remote.
Information on the status of reactor coolant makeup is continuously available to the operator.
Lights are provided on the control board to indicate the operating condition of pumps in the chemical and volume control system. Alarms are actuated to warn the operator if boric acid or demineralized water flow rates deviate from preset values as a result of system malfunction.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 29 of 64 Unit 2 14.1.5.2 Analysis of Effects and Consequences Method of Analysis To cover the phases of the plant operation, boron dilution during refueling, startup and power operation are examined. Included in the analysis was the effect of the difference in the density of unborated makeup water and the density of the reactor coolant. The analysis is to show that, from initiation of the event, sufficient time is available to allow the operator to determine the cause of the addition and take corrective action before the shutdown margin is lost.
14.1.5.2.1 Dilution During Refueling During refueling, the following conditions are assumed:
- 1. One residual heat removal (RHR) system train is in operation.
- 2. A maximum dilution flow of 225 gpm, limited by the capacity of the two primary water makeup pumps, and uniform mixing in the reactor vessel are assumed.
- 3. The initial RCS boron concentration is 2000 ppm, corresponding to a shutdown margin of at least 5 %k/k with all RCCAs in.
- 4. A minimum RCS water volume of 3282.65 ft3 is assumed based on RCS maximum temperature of 140°F during mid-loop conditions for boron dilution analysis. This corresponds to the volume necessary to fill the reactor vessel to the mid-plane of the nozzle to ensure mixing via the RHR loop.
- 5. The critical boron concentration is assumed to be 1500 ppm, corresponding to all RCCAs in, no Xenon. The 500 ppm change from the initial condition noted above is a conservative minimum value.
14.1.5.2.2 Dilution During Startup Prior to startup, the RCS is filled with borated water from the refueling water storage tank. Mixing of the reactor coolant is maintained by operation of the reactor coolant pumps.
Conditions assumed for the analysis are:
- 1. Conservatively high dilution flow capacity for the two primary water makeup pumps is considered, 225 gpm.
- 2. A minimum RCS water volume of 9595 ft3. This corresponds to the active RCS volume excluding the pressurizer, surge line, reactor vessel dome and 10% of the steam generator UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 30 of 64 Unit 2 tube volume. The RCS water mass is conservatively calculated at high temperature and reduced RCS pressure operation.
- 3. The initial boron concentration is assumed to be 1800 ppm, which is a conservative maximum value for the critical concentration at the condition of hot zero power, rods to insertion limits, and no Xenon.
- 4. The critical boron concentration following reactor trip is assumed to be 1550 ppm, corresponding to the hot zero power, all rods inserted (minus the most reactive RCCA), no Xenon condition. The 250 ppm change from the initial condition noted above is a conservative minimum value.
14.1.5.2.3 Dilution During Power Operation During power operation, the plant may be operated in either automatic or manual rod control. Two cases are considered; the reactor in automatic rod control and the reactor in manual rod control.
Conditions assumed for these two cases are:
- 1. Dilution flow at power is the maximum capacity of the makeup water pumps, 225 gpm.
- 2. A minimum RCS water volume of 9595 ft3. This corresponds to the active RCS volume excluding the pressurizer, surge line, reactor vessel dome and 10% of the steam generator tube volume. The RCS water mass is conservatively calculated at high temperature and reduced RCS pressure operation.
- 3. The initial boron concentration is assumed to be 1900 ppm, which is a conservative maximum value for the critical concentration at the condition of hot full power, rods to insertion limits, and no Xenon.
- 4. The critical boron concentration following reactor trip is assumed to be 1550 ppm, corresponding to the hot zero power, all rods inserted (minus the most reactive RCCA), no Xenon condition. The 350 ppm change from the initial condition noted above is a conservative minimum value.
Plant characteristics and initial conditions are shown in Table 14.1.0-2.
14.1.5.2.4 Dilution During Shutdown A plant-specific evaluation of the boron dilution event during shutdown (hot and cold) was performed. This evaluation is based upon a generic boron dilution analysis assuming active RCS and RHR volumes, which are conservative with respect to the Cook plant. Additionally, the analysis accommodates mid-loop cold-shutdown operation. The evaluation is applicable for UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 31 of 64 Unit 2 maximum dilution flow rates up to 300 gpm and minimum RHR flow rates of 2000 gpm.
Maximum dilution flow rate is limited to 225 gpm by the primary water pump capacity. In the event of a boron dilution accident during shutdown, the operator is provided with sufficient information to maintain an appropriate boron concentration to conservatively assure at least 15 minutes will be available for operator action to terminate the dilution prior to the reactor reaching a critical condition.
14.1.5.3 Results 14.1.5.3.1 Dilution During Refueling For dilution during refueling, there are more than 30 minutes available for operator action from the time of initiation of the event to loss of shutdown margin (5 %k/k). The operator has prompt and definite indication of the boron dilution from the audible count rate source range monitor (SRM) instrumentation. The SRM also gives a high count rate alarm in the reactor containment and the control room. The count rate increase is proportional to the subcritical multiplication factor.
14.1.5.3.2 Dilution During Startup For dilution during startup, there are more than 35 minutes available for the operator action from the time of initiation of the event to loss of shutdown margin (1.3 %k/k).
14.1.5.3.3 Dilution During Power Operation With the reactor in automatic control, the power and temperature increase from the boron dilution results in insertion of the control rods and a decrease in the available shutdown margin. The rod insertion limit alarms (low and low-low settings) alert the operator that a dilution event is in progress. There are more than 46 minutes from the time of alarm (low-low rod insertion limit) to loss of shutdown margin (1.3 %k/k).
With the reactor in manual control and no operator action taken to terminate the transient, the power and temperature rise will cause the reactor to reach the overtemperature T trip setpoint resulting in a reactor trip. The boron dilution transient in this case is essentially equivalent to an uncontrolled RCCA withdrawal at power. The maximum reactivity insertion rate for a boron dilution is conservatively estimated to be 2.5 pcm/sec which is within the range of insertion rates analyzed. There are more than 44 minutes available for operator action from the time of alarm (overtemperature T) to loss of shutdown margin (1.3 %k/k). This operator action time is conservatively calculated to bound both sets of overtemperature T setpoints discussed in Section 14.1.0.6.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 32 of 64 Unit 2 Table 14.1.5-1 contains the time sequence of events for this accident.
Effect of the RTD Bypass Elimination Evaluation performed to support RTD Bypass Elimination demonstrates that the conclusions of the accident analysis remain valid.
14.1.5.4 Conclusions Because of the steps involved in the dilution process, an erroneous dilution is considered unlikely.
Nevertheless, if it does occur, numerous alarms and indications are available to alert the operator to the condition. The maximum reactivity addition due to the dilution is slow enough to allow the operator to determine the cause of the dilution and take corrective action before shutdown margin is lost.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 33 of 64 Unit 2 14.1.6 Loss of Forced Reactor Coolant Flow (Including Locked Rotor) 14.1.6.1 Loss of Reactor Coolant Flow 14.1.6.1.1 Identification of Causes and Accident Description A loss of forced reactor coolant flow incident may result from a mechanical or an electrical failure in a reactor coolant pump, or from a fault in the power supply to all reactor coolant pumps. If the reactor is at power at the time of the accident, the immediate effect of a loss of coolant flow is a rapid increase in the coolant temperature which is magnified by a positive MTC. This increase could result in DNB with subsequent adverse effects to the fuel if the reactor were not tripped promptly. The following reactor trips provide necessary protection against a loss of coolant flow accident:
- 1. Reactor coolant pump power supply undervoltage or underfrequency.
- 2. Low reactor coolant loop flow.
The reactor trip on reactor coolant pump undervoltage is provided to protect against conditions which can cause a loss of voltage to all reactor coolant pumps, i.e., loss of offsite power. This function is blocked below approximately 11 percent power (Permissive 7).
The reactor trip on reactor coolant pump underfrequency is provided to trip the reactor for an underfrequency condition, resulting from frequency disturbances on the power grid.
The reactor trip on low primary coolant loop flow is provided to protect against loss of flow conditions which affect only one reactor coolant loop. This function is generated by two out of three low flow signals per reactor coolant loop. Above approximately 31 percent power (Permissive 8), low flow in any loop will actuate a reactor trip. Between approximately 10 percent power and 31 percent power (Permissive 7 and Permissive 8), low flow in any two loops will actuate a reactor trip. If the maximum grid frequency decay rate is less than approximately 2.5 Hz/second this trip function will protect the core from underfrequency events.
The normal power supplies for the pumps are four buses connected to the generator. Each bus supplies power to one pump. When a generator trip occurs, the pumps are automatically transferred to a bus supplied from external power lines, and the pumps will continue to supply coolant flow to the core. The simultaneous loss of power to all reactor coolant pumps is a highly unlikely event. Since each pump is on a separate bus, a single bus fault would not result in the loss of more than one pump. Following any turbine trip, where there are no electrical faults which UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 34 of 64 Unit 2 require tripping the generator from the network, the generator remains connected to the network for approximately 30 seconds. The reactor coolant pumps remain connected to the generator thus ensuring full flow for 30 seconds after the reactor trip before any transfer is made.
14.1.6.1.2 Analysis of Effects and Consequences 14.1.6.1.2.1 Method of Analysis The following loss of flow cases are analyzed:
1.
Loss of four pumps from nominal full power conditions with four loops operating.
2.
Loss of one pump from nominal full power conditions with four loops operating.
Simultaneous loss of electrical power to all reactor coolant pumps at full power (case 1 above) is the most severe credible loss of flow condition. For this condition reactor trip together with flow sustained by the inertia of the coolant and rotating pump parts will be sufficient to prevent RCS overpressurization and the DNBR from exceeding the safety analysis limit values.
Cook Nuclear Plant Unit 2 is required to have all four reactor coolant pumps operating during startup and power operation.
A full plant simulation is used in the analysis to compute the core average and hot spot heat flux transient responses, including flow coastdown, temperature, reactivity and control rod insertion effects. These data are then used in a detailed thermal-hydraulic computation to determine the margin to DNB. This computation solves the continuity, momentum, and energy equations of fluid flow and calculates DNBR using the W-3 (ANF fuel) and WRB-2 (VANTAGE 5 fuel) correlations. This accident is analyzed with the RTDP (Reference 1).
The analyses are performed with the most limiting temperature and pressure conditions to bound the range of conditions possible for the potential rerating of Cook Nuclear Plant Unit 2.
Uncertainties in initial conditions are included in the limit DNBR as described in Reference 1. The initial conditions used are shown in Table 14.1.0-2.
This transient is analyzed using three digital computer codes. First the LOFTRAN Code (Reference 2) is used to calculate the loop and core flow during the transient, the time of reactor trip based on the calculated flows, the nuclear power transient, and the primary system pressure and temperature transients. The FACTRAN Code(Reference 3) is then used to calculate the heat flux transient based on the nuclear power and flow from LOFTRAN.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 35 of 64 Unit 2 Finally, the THINC Code (Reference 4 and 5) is used to calculate the DNBR during the transient based on the heat flux from FACTRAN and flow from LOFTRAN. The DNBR transients presented represent the minimum of the typical or thimble cell for each type of fuel.
14.1.6.1.2.2 Results Figures 14.1.6-1 through 14.1.6-4 show the transient response for the loss of power to all RCPs with four loops in operation for a full VANTAGE 5 core. The reactor is assumed to be tripped on an undervoltage signal. Figure 14.1.6-4 shows the DNBR to be always greater than the safety analysis limit value for the most limiting fuel assembly cell. In addition, the DNBR analysis for this event for a mixed core verified that the DNBR remains above the safety analysis limit value for the most limiting fuel assembly cell.
Figures 14.1.6-5 through 14.1.6-8 show the transient response for the loss of one RCP with four loop operation for a full VANTAGE 5 core. For this case, the reactor is tripped on low flow signal.
Figure 14.1.6-8 shows the DNBR to be always greater than the safety analysis limit value for the most limiting fuel assembly cell. In addition, the DNBR analysis for this event for a mixed core verified that the DNBR remains above the safety analysis limit value for the most limiting fuel assembly cell.
In addition to the complete loss of flow (loss of power to four pumps), an underfrequency event with a frequency decay rate of 5 Hz/sec was also analyzed for a full VANTAGE 5 core. For this event, the reactor trip occurs on an underfrequency signal. The DNBR analysis of the underfrequency event verified that the DNBR remains above the safety analysis limit value for a full VANTAGE 5 core. The underfrequency event was determined to be the limiting event of all the loss of flow cases analyzed.
Since DNB does not occur, the ability of the primary coolant to remove heat from the fuel rod is not significantly reduced. Thus, the average fuel and clad temperature do not increase significantly above their respective initial values.
Time sequence of events is shown in Table 14.1.6-1 for the loss of flow cases.
14.1.6.1.3 Conclusions For all cases, the analysis shows that the minimum DNBR remains above the safety analysis limit value at all times during the transient. Thus, no adverse fuel effects or clad rupture is predicted, and all applicable acceptance criteria are met. For a full VANTAGE 5 core, the analysis supports a full power vessel average temperature of 581.3oF at an RCS pressure of either 2250 psia or 2100 psia.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 36 of 64 Unit 2 14.1.6.2 Locked Rotor Accident 14.1.6.2.1 Identification of Causes and Accident Description A transient analysis has been performed for the instantaneous seizure of a reactor coolant pump rotor. Flow through the affected reactor coolant loop is rapidly reduced, leading to a reactor trip on a low flow signal. Following the trip, heat stored in the fuel rods continues to pass into the core coolant, causing the coolant to expand. At the same time, heat transfer to the shell side of the steam generator is reduced, first because the reduced flow results in a decreased tube side film coefficient and then because the reactor coolant in the tubes cools down while the shell side temperature increases (turbine steam flow is reduced to zero upon plant trip). The rapid expansion of the coolant in the reactor core, combined with the reduced heat transfer in the steam generator causes an insurge into the pressurizer and a pressure increase throughout the reactor coolant system. The insurge into the pressurizer causes a pressure increase which in turn actuates the automatic spray system, opens the power-operated relief valves, and opens the pressurizer safety valves, in a sequence dependent on the rate of insurge and pressure increase. The power-operated relief valves are designed for reliable operation and would be expected to function properly during the accident. However, for conservatism, their pressure-reducing effect, as well as the pressure-reducing effect of the spray are not included in this analysis.
The locked rotor event is analyzed to demonstrate that the peak clad average temperature remains below the limit value and the peak RCS pressure remains below a value that would cause the faulted condition stress limits to be exceeded.
14.1.6.2.2 Analysis of Effects and Consequences 14.1.6.2.2.1 Method of Analysis Two digital-computer codes are used to analyze this transient. The LOFTRAN code (Reference
- 2) is used to calculate 1) the resulting loop and core flow transients following the pump seizure,
- 2) the time of reactor trip based on the loop flow transients, 3) the nuclear power following reactor trip, and 4) the peak RCS pressure. The thermal behavior of the fuel located at the core hot spot is investigated using the FACTRAN Code (Reference 3) based on the core flow and the nuclear power calculated by LOFTRAN. The FACTRAN code includes the use of a film boiling heat transfer coefficient.
The plant characteristics and the initial conditions are shown in Table 14.1.0-2. The analysis assumes offsite power is available following the reactor trip and turbine trip. Cook Nuclear Plant UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 37 of 64 Unit 2 Unit 2 is required to have all four reactor coolant pumps operating during startup and power operation. As such, the locked rotor accident analysis is performed for four loop operation.
14.1.6.2.2.2 Evaluation of the Pressure Transient After pump seizure, the neutron flux is rapidly reduced by control rod insertion. Rod motion begins 1 second after the flow in the affected loop reaches 87 percent of nominal flow. No credit is taken for the pressure reducing effect of the pressurizer relief valves, pressurizer spray, steam dump or controlled feedwater flow after plant trip. Although these operations are expected to occur and would result in a lower peak RCS pressure, an additional degree of conservatism is provided by ignoring their effect.
The pressurizer safety valves are assumed to initially pop open at 2575 psia and achieve rated flow at 2580 psia, thereby accounting for a +3% tolerance on the opening set pressure. Table 14.1.0-2 presents the initial conditions assumed for the peak pressure transient.
14.1.6.2.2.3 Evaluation of the Peak Clad Temperature In the analysis to determine the fuel rod thermal transients for this event, DNB is conservatively assumed to occur in the core at the initiation of the transient. Results obtained from analysis of this hot spot condition represent the upper limit with respect to clad temperature and zirconium water reaction. In the evaluation, the rod power at the hot spot is assumed to be 2.5 times the average rod power (i.e., FQ = 2.5) at the initial core power level. Table 14.1.0-2 presents the initial conditions assumed for the peak clad temperature transient.
14.1.6.2.2.4 Film Boiling Coefficient To model the effect of DNB occurring, the film boiling coefficient is calculated in the FACTRAN code using the Bishop-Sandberg-Tong film boiling correlation. The fluid properties are evaluated at film temperatures (average between wall and bulk temperatures). The program calculates the film coefficient at every time step based upon the actual heat transfer conditions at the time. The neutron flux, system pressure, bulk density, and mass flow rate as a function of time are used as program input.
For this analysis, the initial values of the pressure and the bulk density are used throughout the transient since they are the most conservative with respect to clad temperature response. As previously stated, for conservatism, DNB was assumed to start at the beginning of the accident to maximize the fuel rod thermal transient.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 38 of 64 Unit 2 14.1.6.2.2.5 Fuel Clad Gap Coefficient The magnitude and time dependence of the heat transfer coefficient between fuel and clad (gap coefficient) has a pronounced influence on the thermal results. The larger the value of the gap coefficient, the more heat is transferred between pellet and clad. Based on investigations on the effect of the gap coefficient upon the maximum clad temperature during the transient, the gap coefficient was assumed to increase from a steady state value consistent with initial fuel temperature to 10,000 BTU/hr-ft2-oF at the initiation of the transient. Thus the large amount of energy stored in the fuel because of the small initial value is released to the clad at the initiation of the transient.
14.1.6.2.2.6 Zirconium-Steam Reaction The zirconium-steam reaction can become significant above 1800oF (clad temperature). In order to take this phenomenon into account, the following correlation, which defines the rate of the zirconium-steam reaction, was introduced into the models (Reference 7).
(
)
(
) (
)
[
]
T 986
.1
/
45000 6
2 e
x x10 33.3 dt w
d
=
where:
w = amount reacted, mg/cm2 t = time, sec T = temperature, oK The reaction heat is 1510 cal/gm An additional analysis of the locked rotor event has been performed to address the VANTAGE 5 fuel transition. The purpose of this analysis was to determine the number of rods which experience DNB during the locked rotor event. Any rods which violated the 95/95 DNBR limits were assumed to fail in this analysis. This analysis is presented below for completeness and should not be treated as part of the licensing basis analysis for Cook Nuclear Plant Unit 2.
14.1.6.2.2.7 Evaluation of Rods-in-DNB during the Locked Rotor Event For the rods-in DNB analysis, the THINC Code (References 4 and 5) is used to calculate the DNBR during the transient based on predicted core conditions calculated by LOFTRAN Code (Reference
- 2) and FACTRAN Code (Reference 3). Results of the THINC analysis are then used to determine UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 39 of 64 Unit 2 the percentage of fuel rods which experience DNB. The rods-in DNB analysis is performed with the Revised Thermal Design Procedure (Reference 1).
14.1.6.2.2.8 Results The transient results for the locked rotor accident are shown in Figures 14.1.6-9 through 14.1.6-
- 12. The peak RCS pressure (2645 psia) reached during the transient is less than that which would cause stresses to exceed the faulted condition stress limits. The pressure response shown in Figure 14.1.6-10 is the response at the point in the reactor coolant system having the maximum pressure.
Also, the peak clad surface temperature (1978oF) is considerably less than 2375°F (the more restrictive temperature associated with Optimized ZIRLO fuel cladding at which clad embrittlement may be expected).
The maximum zirconium-steam reaction at the core hot spot is 0.5% by weight.
The results of the rods-in DNB analysis show that less than 11% of the fuel rods are predicted to be below the limit DNBR for the ANF fuel design. The radiological releases for the locked rotor rods-in DNB incident were determined to be within the acceptance criteria.
The time sequence of events is presented in Table 14.1.6-2, for the locked rotor event.
14.1.6.2.3 Locked Rotor Radiological Consequence Analysis See Unit 1 Section 14.1.6.4.8.
14.1.6.2.4 Conclusions A.
Since the peak RCS pressure reached during any of the transients is less than that which would cause stresses to exceed the faulted conditions stress limits, the integrity of the primary coolant system is maintained.
B.
Since the peak clad surface temperature calculated for the hot spot during the worst transient remains considerably less than the 2700°F limit for Standard ZIRLOfuel cladding and the 2375°F limit for Optimized ZIRLO fuel cladding, the core will remain in place and intact with no loss of core cooling capability.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 40 of 64 Unit 2 14.1.6.3 References for Section 14.1.6 1.
Friedland, A. J., Ray, S., "Revised Thermal Design Procedure," WCAP-11397-P-A, April 1989.
2.
Burnett, T, W. T., et al., "LOFTRAN Code Description," WCAP-7907-A, April 1984.
- 3.
Hargrove, H. G., "FACTRAN - A FORTRAN-IV Code for Thermal Transients in a UO2 Fuel Rod," WCAP-7908, June 1972.
4.
Hochreiter, L. E., "Application of the THINC-IV Program to PWR Design,"
WCAP-8195, October 1973.
5.
Hochreiter, L. E., Chelemer, H., Chu, P. T. "THINC-IV An Improved Program for Thermal-Hydraulic Analysis of Rod Bundle Cores," WCAP-7956, June 1973.
6.
Baker, L., and Just, L., "Studies of Metal Water Reactions of High Temperatures, III Experimental and Theoretical Studies of the Zirconium-Water Reaction," ANL-6548, Argonne National Laboratory, May 1962.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 41 of 64 Unit 2 14.1.7 Startup of an Inactive Reactor Coolant Loop Technical Specifications prohibit operation of the reactor with an idle reactor loop (Modes 1 and 2). Therefore, the condition for which this analysis is required is no longer applicable. As noted in the NRC Safety Evaluation related to the amendments that changed Technical Specification 3/4.4.1, Reactor Coolant Loops and Coolant Circulation, reanalysis of this section of the UFSAR is not required subsequent to the issuance of the enabling amendment (Unit 2, Amendment 82).
14.1.8 Loss of External Electric Load or Turbine Trip (Full Vantage 5 Core) 14.1.8.1 Identification of Causes and Accident Description The loss of external electrical load may result from an abnormal variation in network frequency or other adverse network operating conditions. It may also result from a trip of the turbine generator or in an unlikely opening of the main breaker from the generator which fails to cause a turbine trip but causes a rapid large nuclear steam supply system load reduction by the action of the turbine control. For either case, offsite power is available for the continued operation of plant components such as the reactor coolant pumps. The case of loss of offsite power to the station auxiliaries is analyzed in Section 14.1.12.
In the event the steam dump valves fail to open following a large loss of load, the steam generator safety valves may lift and the reactor may be tripped by the high pressurizer pressure signal or the high pressurizer water level or the overtemperature T signal. The steam generator shell side pressure and reactor coolant temperatures will increase rapidly. The pressurizer safety valves and steam generator safety valves are, however, sized to protect the reactor coolant system and steam generator against overpressure for all load losses without assuming availability of the steam dump system. The steam dump valves will not be opened for load reductions of 10% or less. For larger load reductions they may open depending on the capability of the reactor control system.
The most likely source of a complete loss of load in the nuclear steam supply system is a trip of the turbine-generator. In this case, there is a direct reactor trip signal (unless power is below approximately 31% power, i.e., below P-8) derived from the turbine emergency trip fluid pressure and turbine stop valves. Reactor coolant temperatures and pressure do not significantly increase if the steam dump system and pressurizer pressure control system are functioning properly. If the turbine condenser was not available, the excess steam generation would be dumped to the atmosphere. However, in this analysis, the behavior of the unit is evaluated for a complete loss of load from 100% of full power without a direct reactor trip primarily to show adequacy of the UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 42 of 64 Unit 2 pressure relieving devices and also to show that no core damage occurs. The Reactor Coolant System and Main Steam System pressure relieving capacities are designed to ensure safety of the unit without requiring the automatic rod control, pressurizer pressure control and/or steam dump control systems.
14.1.8.2 Analysis of Effects and Consequences 14.1.8.2.1 Method of Analysis The loss of load transients are analyzed by employing the detailed digital computer program LOFTRAN (Reference 1). The program simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety valves. The program computes pertinent plant variables including temperatures, pressures, and power level.
This accident is analyzed with the RTDP (Reference 2). Plant characteristics and initial conditions are shown in Table 14.1.0-3.
Major assumptions are summarized below:
A.
Initial Operating Conditions - nominal conditions (RTDP) are assumed.
B.
Moderator and Doppler Coefficients of Reactivity - the loss of load is analyzed with both maximum and minimum reactivity feedback. The maximum feedback cases assume a large positive moderator density coefficient (corresponding to a large negative moderator temperature coefficient) and the most negative Doppler power coefficient. The minimum feedback cases assume a positive moderator temperature coefficient and the least negative Doppler coefficients.
C.
Reactor Control - from the standpoint of the maximum pressures attained it is conservative to assume that the reactor is in manual control. If the reactor was in automatic control, the control rod banks would move prior to trip and reduce the severity of the transient.
D.
Pressurizer Spray and Power-Operated Relief Valves - two cases for both the minimum and maximum moderator feedback cases are analyzed:
1.
Full credit is taken for the effect of pressurizer spray and power-operated relief valves in reducing or limiting the coolant pressure. Safety valves are also available with a -3% tolerance on the opening set pressure.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 43 of 64 Unit 2 2.
No credit is taken for the effect of pressurizer spray and power-operated relief valves in reducing or limiting the coolant pressure. Safety valves are operable, with a +3% tolerance on the opening set pressure.
E.
Steam Release - no credit is taken for the operation of the steam dump system or steam generator power-operated relief valves. The steam generator pressure rises to the safety valve setpoints where steam release through the safety valves limits secondary steam pressure at the setpoint value.
F.
Feedwater Flow - main feedwater flow to the steam generators is assumed to be lost at the time of turbine trip. No credit is taken for auxiliary feedwater flow since a stabilized plant condition will be reached before auxiliary feedwater initiation is normally assumed to occur; however, the auxiliary feedwater pumps would be expected to start on a trip of the main feedwater pumps. The auxiliary feedwater flow would remove core decay heat following plant stabilization.
G.
Reactor trip is actuated by the first reactor protection system trip setpoint reached.
Trip signals are expected due to high pressurizer pressure, overtemperature T, high pressurizer water level, and low-low steam generator water level.
14.1.8.2.2 Results The transient responses for a loss of load from full power operation are shown for four cases: two cases for minimum reactivity feedback and two cases for maximum reactivity feedback (Figures 14.1.8-1 through 14.1.8-12).
Figures 14.1.8-1 through 14.1.8-3 show the transient responses for the loss of load with minimum reactivity feedback assuming full credit for the pressurizer spray and pressurizer power-operated relief valves. No credit is taken for the steam dump. The reactor is tripped by the overtemperature T signal.
The minimum DNBR remains well above the safety analysis limit value. The pressurizer safety valves are actuated for this case to limit primary system pressure. The steam generator safety valves prevent overpressurization of the secondary system, maintaining pressure below 110 percent of design value.
Figures 14.1.8-4 through 14.1.8-6 show the responses for the total loss of steam load with maximum reactivity feedback. All other plant parameters are the same as the above. The DNBR increases throughout the transient and never drops below its initial value. Pressurizer relief valves and steam generator safety valves prevent overpressurization in primary and secondary systems, UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 44 of 64 Unit 2 respectively. The reactor is tripped by the low-low steam generator water level signal. The pressurizer safety valves are not actuated for this case.
In the event that feedwater flow is not terminated at the time of turbine trip for this case, flow would continue under automatic control with the reactor at a reduced power. The operator would take action to terminate the transient and bring the plant to a stabilized condition. If no action was taken by the operator, the reduced power operation would continue until the condenser hotwell was emptied. A low-low steam generator water level reactor trip would be generated along with auxiliary feedwater initiation signals. Auxiliary feedwater would then be used to remove decay heat with the results less severe than those presented in Section 14.1.9, Loss of Normal Feedwater Flow.
The loss of load accident was also studied assuming the plant to be initially operating at full power with no credit taken for the pressurizer spray, pressurizer power-operated relief valves, or steam dump. The reactor is tripped on the high pressurizer pressure signal. Figures 14.1.8-7 through 14.1.8-9 show the transient responses with minimum reactivity feedback. The neutron flux remains essentially constant at full power until the reactor is tripped. The DNBR never goes below its initial value throughout the transient. In this case, the pressurizer safety valves are actuated, and maintain system pressure below 110 percent of the design value.
Figures 14.1.8-10 through 14.1.8-12 show the transient responses with maximum reactivity feedback with the other assumptions being the same as in the preceding case. Again, the DNBR increases throughout the transient and the pressurizer safety valves are actuated to limit primary pressure.
The calculated sequence of events for the loss of external electric load incident are shown in Table 14.1.8-1.
14.1.8.3 Conclusions Results of the analyses show that the plant design is such that a loss of load without a direct or immediate reactor trip presents no hazard to the integrity of the RCS or the main steam system.
Pressure relieving devices incorporated in the two systems are adequate to limit the maximum pressures to within the design limits. The integrity of the core is maintained by operation of the reactor protection system, i.e., the DNBR will be maintained above the safety limit value.
14.1.8.4 Evaluation of Lower Initial RCS Temperature An evaluation has been performed for a lower initial RCS average temperature in analysis of the Loss of Load/Turbine Trip (LOL/TT) event (References 3 and 4). The current analysis uses UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 45 of 64 Unit 2 nominal full power temperature plus the temperature uncertainty in modeling the pressure transient case. However, recent analysis shows that a lower initial temperature delays actuation of the secondary-side main steam safety valves and results in a higher peak RCS pressure. The difference in peak RCS pressure is caused by a slight variation in the timing of main steam safety valve actuation and the time of maximum RCS pressure. The evaluation concludes that RCS pressure increases by 1 psi to a peak RCS pressure of 2689.8 psia. The peak RCS pressure remains below the applicable maximum allowable RCS pressure limit of 2748.5 psia (110% of design pressure).
Therefore, the conclusion of the analysis, that the LOL/TT events present no hazard to the integrity of the RCS, remains valid.
Effect of the RTD Bypass Elimination Evaluation performed to support RTD Bypass Elimination demonstrates that the conclusions of the accident analysis remain valid.
14.1.8.5 References for Section 14.1.8 1.
Burnett, T, W. T., et al., "LOFTRAN Code Description," WCAP-7907-A, April 1984.
- 2.
Friedland, A. J., Ray, S., "Revised Thermal Design Procedure," WCAP-11397-P-A, April 1989.
- 3.
AEP-03-8, AEP DC Cook Units 1 and 2 NSAL-03-1: Safety Analysis Modeling Loss of Load/Turbine Trip, February 3, 2003.
- 4.
NSAL-03-1, Safety Analysis Modeling Loss of Load/Turbine Trip, 1/27/03.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 46 of 64 Unit 2 14.1.9 Loss of Normal Feedwater 14.1.9.1 Identification of Causes and Accident Description A loss of normal feedwater (from pump failures, valve malfunctions, or loss of offsite AC power) results in a reduction in capability of the secondary system to remove the heat generated in the reactor core. If an alternative supply of feedwater were not supplied to the plant, core residual heat following reactor trip would heat the primary system water to the point where water relief from the pressurizer would occur, resulting in a substantial loss of water from the RCS. Since the plant is tripped well before the steam generator heat transfer capability is reduced, the primary system variables never approach a DNB condition.
The following provides the necessary protection against a loss of normal feedwater:
1.
Reactor trip in low-low water level in any steam generator.
2.
Reactor trip on low feedwater flow signal in any steam generator. (This signal is actually a steam flow-feedwater flow mismatch in coincidence with low water level.)
3.
Two motor driven auxiliary feedwater pumps which are started on:
a.
Low-low level in any steam generator.
- b.
Trip of all main feedwater pumps.
- c.
Any safety injection signal.
- d.
4kV bus loss of voltage.
- e.
Manual actuation.
The motor-driven auxiliary feedpumps each feed two of the unit's four steam generators.
- 4.
One turbine driven auxiliary feedwater pump is started on:
- a.
Low-low level in any two steam generators.
- b.
- c.
Manual actuation.
- d.
Reactor coolant pump bus undervoltage.
The turbine driven auxiliary feedpump feeds all four of the unit's steam generators.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 47 of 64 Unit 2 The auxiliary feedwater system is started automatically. The turbine driven auxiliary feedwater pump utilizes steam from the secondary system and exhausts to the atmosphere. The motor driven auxiliary feedwater pumps are supplied by power from the diesel generators if a loss of offsite power occurs. The pumps take suction directly from the condensate storage tank for delivery to the steam generators.
An analysis of the system transient is presented below to show that following a loss of normal feedwater, the auxiliary feedwater system is capable of removing the stored and residual heat, thus preventing either overpressurization of the RCS or uncovering the core, and returning the plant to a safe condition.
14.1.9.2 Analysis of Effects and Consequences 14.1.9.2.1 Method of Analysis A detailed analysis using the LOFTRAN Code (Reference 1) is performed in order to obtain the plant transient following loss of normal feedwater. The simulation describes the plant thermal kinetics, RCS including the natural circulation, pressurizer, steam generators and feedwater system. The digital program computes pertinent variables including the steam generator level, pressurizer water level, and reactor coolant average temperature.
Assumptions made in the analysis are: To ensure that the pressurizer does not overfill, the direction of conservatism in the initial conditions was examined. The initial nominal RCS temperature of 581.3oF along with a nominal pressure of 2250 psia was found to produce the most conservative results.
A.
The plant is initially operating at 102 percent of the Cook Nuclear Plant Unit 2 core power level 3588 MWt, plus 20 MWt for reactor coolant pump heat.
B.
A conservative core residual heat generation based upon long term operation at the initial power level preceding the trip. The ANS 1979 Decay Heat Model plus two sigma uncertainty was assumed.
C.
Reactor trip occurs on steam generator low-low level at 0.0% of narrow range span.
D.
The worst single failure in the auxiliary feedwater system occurs (e.g., failure of turbine driven auxiliary feedwater pump).
E.
Auxiliary feedwater is delivered to four steam generators at a rate of 450 gpm. The 450 gpm is assumed evenly split among the four steam generators and is delivered UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 48 of 64 Unit 2 by two motor driven pumps at a steam generator pressure of 1123 psia. Automatic initiation of the auxiliary feedwater is assumed 60 seconds after a low-low steam generator signal is actuated.
F.
Secondary system steam relief is achieved through the steam generator safety valves. First four safety valves at an actuation pressure of 1123 psia were assumed in the analysis.
G.
The initial reactor coolant average temperature is 4.1oF higher than the nominal value of 581.3oF, and initial pressurizer pressure is 62.6 psi higher than the nominal pressure of 2250 psia.
H.
The initial pressurizer water level is assumed to be at the maximum nominal setpoint (61.1% NRS) plus uncertainties (5% NRS).
I.
Pressurizer power operated relief valves (PORVs) are assumed operable to maximize pressurizer water volume.
J.
The maximum pressurizer spray flow rate is assumed to maximize pressurizer water volume.
K.
An auxiliary feedwater line purge volume of 100 ft3 per loop was assumed. This is the volume that needs to be purged before the relatively cold auxiliary feedwater reaches the steam generators.
An evaluation has been performed to justify an increase in the as-found tolerance of the main steam safety valves (MSSVs) from +/-1% to +/-3%. The evaluation took credit for the staggered actuation of the MSSVs. The evaluation assumed that the MSSVs opened at 3% above the nominal lift pressure for each valve. The evaluation demonstrated that the secondary side pressure (assuming the staggered actuation of the MSSVs) would not exceed 1123 psia during the time when AFW is being supplied. The secondary side pressure transient would not preclude the AFW flow rate assumed in the analysis from being supplied to the steam generators.
An evaluation has been performed to justify an increase in the as-found tolerance of the main steam safety valves (MSSVs) from +/-1% to +/-3%. The evaluation took credit for the staggered actuation of the MSSVs. The evaluation assumed that the MSSVs opened at 3% above the nominal lift pressure for each valve. The evaluation demonstrated that the secondary side pressure (assuming the staggered actuation of the MSSVs) would not exceed 1123 psia during the time when AFW is being supplied. The secondary side pressure transient would not preclude the AFW flow rate assumed in the analysis from being supplied to the steam generators.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 49 of 64 Unit 2 Plant characteristics and initial conditions are shown in Table 14.1.0-2.
14.1.9.2.2 Results Figures 14.1.9-1 through 14.1.9-3 show the significant plant parameters following a loss of normal feedwater.
Following the reactor and turbine trip from full load, the water level in the steam generators will fall due to the collapse of voids and because steam flow through the safety valves continues to dissipate the stored and generated heat. One minute following the initiation of the low-low level trip, the motor driven auxiliary feedwater pumps are automatically started, reducing the rate of water level decrease.
The plot of pressurizer water volume clearly shows that the pressurizer does not fill. For comparison purposes, the pressurizer fills at 1889 ft3 (which includes the pressurizer surge volume).
The calculated sequence of events for this transient are shown in Table 14.1.9-1.
14.1.9.3 Conclusions Results of the analysis show that a loss of normal feedwater does not adversely affect the core, the RCS, or the steam system since the auxiliary feedwater capacity is such that reactor coolant water is not relieved from the pressurizer relief or safety valves.
An evaluation has been performed (Reference 2) to address the impact of pressurizer heaters on this event. Historically, the pressurizer heaters were not modeled. The evaluation also included properly modeling the pressurizer spray effectiveness at pressurizer water levels approaching a water-solid condition. The evaluation considered a reduction in the initial value assumed for the moderator temperature coefficient (MTC) from the part-power limit value of 5 pcm/°F to the full-power limit value of 0 pcm/°F. The use of the zero MTC remains conservative, and bounds part-power conditions with a corresponding positive MTC. The results of the evaluation determined that all acceptance criteria continue to be met. No changes to the figures and tables presented in this section were made as part of this evaluation.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 50 of 64 Unit 2 14.1.9.4 References for Section 14.1.9 1.
Burnett, T, W. T., et al., "LOFTRAN Code Description," WCAP-7907-A, April 1984.
- 2.
Westinghouse Letter AEP-98-127, Ref: NSAL-98-007, American Electric Power Service Corporation D. C. Cooks 1 and 2 Analysis Modeling of Pressurizer Heaters, dated August 11, 1998.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 51 of 64 Unit 2 14.1.10 Excessive Heat Removal due to Feedwater System Malfunctions (Full Vantage 5 Core) 14.1.10.1 Feedwater System Malfunctions Causing a Reduction in Feedwater Temperature 14.1.10.1.1 Identification of Causes and Accident Description Reductions in feedwater temperature will result in an increase in core power by initially decreasing reactor coolant temperature. Such transients are attenuated by the thermal capacity of the secondary plant and of the RCS. The high neutron flux trip, overtemperature T trip, and overpower T trip prevent any power increase which could lead to a departure from nucleate boiling ratio (DNBR) less than the limit value.
A reduction in feedwater temperature may be caused by the accidental opening of a feedwater heater bypass valve which diverts flow around a portion of the feedwater heaters. In the event of an accidental opening of the bypass valve, there is a sudden reduction in feedwater inlet temperature to the steam generators. At power, this increased subcooling will create a greater load demand on the RCS.
With the plant at no-load (hot zero power) conditions, the addition of cold feedwater will cause a decrease in RCS temperature and, thus, a reactivity insertion due to the effects of the negative moderator temperature coefficient of reactivity. However, the rate of energy change is reduced as load and feedwater flow decrease so the transient is less severe than the full power case. The net effect on the RCS due to a reduction in feedwater temperature is that the reactor will reach a new equilibrium condition at a power level corresponding to the new steam generator T.
14.1.10.1.2 Analysis of Effects and Consequences 14.1.10.1.2.1 Method of Analysis This transient is analyzed by computing conditions at the feedwater pump inlet following opening of the heater bypass valve. These feedwater conditions are then used to perform a heat balance through the high pressure heaters. This heat balance gives the new feedwater conditions at the steam generator inlet.
The following assumptions are made:
1.
Plant initial power level corresponding to guaranteed NSSS thermal output.
2.
Simultaneous actuation of either a low pressure heater bypass valve or a high pressure heater bypass valve and isolation of one string of feedwater heaters.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 52 of 64 Unit 2 14.1.10.1.2.2 Results Opening of either a low pressure heater bypass valve or a high pressure heater bypass valve causes a reduction in feedwater temperature which increases the thermal load on the primary system. The calculated reduction in feedwater temperature due to opening of a high pressure heater bypass valve is higher than that of the opening of a low pressure heater bypass valve and is less than 60oF.
This reduction in feedwater temperature results in an increase in heat load on the primary system of less than 10 percent of full power. The increased thermal load, due to opening of the low pressure heater bypass valve, would result in a transient very similar (but of reduced magnitude) to that presented in Section 14.1.11B for an excessive increase in secondary steam flow incident, which evaluates the consequences of a 10 percent step load increase. Therefore, the results of this analysis are not presented.
14.1.10.1.3 Conclusions The decrease in feedwater temperature transient is less severe than the increase in secondary steam flow event (Section 14.1.11B). Based on results presented in Section 14.1.11B, the applicable acceptance criteria for the decrease in feedwater temperature event have been met.
14.1.10.2 Feedwater System Malfunctions Causing an Increase in Feedwater Flow 14.1.10.2.1 Identification of Causes and Accident Description Addition of excessive feedwater is a means of increasing core power above full power. Such transients are attenuated by the thermal capacity of the secondary plant and of the reactor coolant system. The high neutron flux trip, overpower T trip and overtemperature T trip prevent any power increase which could lead to DNBR less than the minimum allowable value in the event that the steam generator high-high level protection has not been actuated.
Excessive feedwater flow may be caused by the full opening of one or more feedwater control valves due to a feedwater control system malfunction or an operator error. At power conditions, this excess flow causes a greater load demand on the reactor coolant system due to increased subcooling in the steam generators. With the plant at no load conditions, the addition of cold feedwater will cause a decrease in reactor coolant system temperature and thus a reactivity insertion due to the effects of the negative moderator temperature coefficient of reactivity.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 53 of 64 Unit 2 14.1.10.2.2 Analysis Effects and Consequences 14.1.10.2.2.1 Method of Analysis The excessive heat removal due to a feedwater system malfunction transient is analyzed by using the detailed digital computer code LOFTRAN (Reference 1). This code simulates the neutron kinetics of the reactor coolant system, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety valves. The code computes pertinent plant variables including temperatures, pressures, and power level.
The system is analyzed to demonstrate acceptable consequences in the event of an excessive feedwater addition, due to a control system malfunction or operator error which allows one or more feedwater control valves to open fully. The following cases have been analyzed:
1a.
Accidental full opening of one feedwater control valve with the reactor at full power assuming automatic and manual rod control and a conservatively large negative moderator temperature coefficient of reactivity.
1b.
Accidental full opening of all feedwater control valves with the reactor at power assuming the reactor in automatic and manual control and conservatively large moderator negative coefficient of reactivity.
- 2.
Accidental full opening of a feedwater control valve with the reactor at no load (hot zero power) conditions and assuming a conservatively large negative moderator temperature coefficient of reactivity.
This accident is analyzed using the Revised Thermal Design Procedure (Reference 2). Plant characteristics and initial conditions shown in Table 14.1.0-3.
The reactivity insertion rate following a feedwater system malfunction is calculated with the following assumptions:
A.
Initial reactor power, pressure, and RCS temperatures are assumed to be at their conservative nominal values. Uncertainties in initial conditions are included in the limit DNBR.
B.
For the feedwater control valve accident at full power, case 1a assumed one feedwater control valve to malfunction resulting in a step increase to 200% of nominal feedwater flow to one steam generator. For case 1b, all feedwater control valves are assumed to malfunction in a step increase to 200% of nominal feedwater flow to all four steam generators.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 54 of 64 Unit 2 C.
For the feedwater control valve accident at no load conditions, feedwater control valve malfunction occurs which results in an increase in flow to one steam generator from zero to 200% of the nominal full load value.
D.
For the no load condition, feedwater temperature is at a value of 32oF.
E.
No credit is taken for the heat capacity of the RCS and steam generator thick metal in attenuating the resulting plant cooldown.
F.
The feedwater flow resulting from a fully open control valve is terminated by a steam generator high-high level trip signal which closes all feedwater control and isolation valves, trips the main feedwater pumps and trips the turbine.
Normal reactor control system and engineered safety systems are not required to function. The reactor protection system may function to trip the reactor due to overpower or turbine trip on high-high steam generator water level conditions.
14.1.10.2.2.2 Results In the case of an accidental full opening of one feedwater control valve with the reactor at zero power and the above mentioned assumptions, the maximum reactivity insertion rate is 114.3 pcm/sec (1 pcm = 10-5 k/k).
An analysis has been performed to demonstrate that the applicable DNB criteria are met. A conservative reactivity insertion rate of 120 pcm/sec was assumed to bound the reactivity insertion rate calculated for the zero power feedwater malfunction analysis. The method of analysis used is the same as discussed in Section 14.1.1 (Uncontrolled RCCA Withdrawal From A Subcritical Condition Analysis), except that the analysis assumed four (4) reactor coolant pumps to be in operation as required by the Cook Nuclear Plant Unit 2 Technical Specifications in Mode 2. A conservatively low value of Doppler Power Defect (-1000 pcm) was assumed in this analysis.
Although the reactivity insertion rate for the zero power feedwater system malfunction is calculated assuming reactivity parameters representative of EOL core conditions to maximize the reactivity insertion rate, the DNB analysis was conservatively performed at BOL conditions to yield a high value of peak heat flux.
The DNB analysis performed for the hot zero power feedwater malfunction analysis with a reactivity insertion rate of 120 pcm/sec yields a minimum DNBR which remains above the safety analysis limit value for the full VANTAGE 5 core.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 55 of 64 Unit 2 One additional case of the feedwater flow malfunction at zero power is also analyzed in which the amount of excess flow to the faulted steam generator assumed to be equally divided among all 4 loops (total excess feedwater flow no greater than 200% of loop full power flow). The results show that this case is bounded by the single-loop feedwater flow malfunction analysis.
The full power cases (maximum reactivity feedback coefficients with manual rod control for both single and multiple FCV failures) give the largest reactivity feedback and result in the greatest power increase. Assuming the reactor to be in the automatic rod control mode results in a slightly less severe transient. The rod control system is not required to function for an excessive feedwater flow event.
For all excessive feedwater cases, continuous addition of cold feedwater is prevented by automatic feedwater isolation on a steam generator high-high water level signal. In addition, a turbine trip is initiated. A reactor trip on turbine trip was then assumed as a means of terminating the transient in the analysis. The reactor trip prevents reactor coolant heatup consistent with the cooldown characteristics of the feedwater malfunction event. The reactor trip on turbine trip was assumed as an anticipatory trip. If the reactor trip was not assumed, the transient would progress into a heatup event, in particular, a loss of normal feedwater due to the isolation which occurs on the high-high steam generator water level signal. A reactor trip would then be provided by a low-low steam generator water level signal. The reactor trip on turbine trip is not required for core protection for this event. The results (minimum DNBR) of the feedwater malfunction analysis would be essentially unchanged if the reactor trip was not assumed to occur on turbine trip.
Following reactor trip and feedwater isolation, the plant will approach a stabilized condition at hot standby. Normal plant operating procedures may then be followed. The operating procedures would call for operator action to control RCS boron concentration and pressurizer level using the CVCS and to maintain steam generator level through control of the main or auxiliary feedwater system. Any action required of the operator to maintain the plant in a stabilized condition will be in a time frame in excess of ten minutes following reactor trip.
Transient results, Figures 14.1.10B-1 through 14.1.10B-8, show the nuclear power, T-avg, pressurizer pressure and DNBR for the full power cases (with and without rod control and with single and multi-loop failure). The DNBR does not drop below the safety analysis limit value.
Since the power level rises during the excessive feedwater flow incident, the fuel temperatures will also rise until after reactor trip occurs. The core heat flux lags behind the neutron flux response due to the fuel rod thermal time constant; hence, the peak heat flux does not exceed 118 percent UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 56 of 64 Unit 2 of its nominal value (i.e., the assumed high neutron flux trip setpoint). The peak fuel temperature will thus remain below the fuel melting temperature.
The transient results show that DNB does not occur at any time during the excessive feedwater flow incident; thus, the ability of the primary coolant to remove heat from the fuel rods is not reduced. The fuel cladding temperature therefore does not rise significantly above its initial value during the transient.
The calculated sequence of events for the increase in feedwater flow for the full power cases are shown in Tables 14.1.10B-1 through 14.1.10B-4.
14.1.10.2.2.2.1 Evaluation to Support 240% Nominal Main Feedwater Flow An evaluation of the Feedwater Malfunction (FWM) event was performed to support increasing assumed main feedwater flow to 240% of nominal. The evaluation was performed to encompass the hot full power (HFP) and hot zero power (HZP) cases. The HFP cases showed an acceptable impact on DNB ratio (DNBR) because although more feedwater flow would exacerbate the cooldown and subsequent return-to-power, it also causes faster actuation of feedwater isolation and turbine trip on the high-high steam generator water level signal. The HZP FWM cases are analyzed to show that the maximum reactivity insertion rate caused by the cooldown does not exceed the maximum rate used in the rod withdrawal from subcritical (RWFS) analysis. Since the HZP FWM cases reanalyzed for this evaluation calculated reactivity insertion rates that remained well below the RWFS values the DNB design basis continues to be met with 240% MFW flow.
14.1.10.2.3 Conclusions The results of the analysis show that the DNB ratios encountered for an excessive feedwater addition at power are above the safety analysis limit value; hence, no fuel or clad damage is predicted. Additionally, an analysis at hot zero power demonstrates that the minimum DNBR remains above the safety analysis limit for the reactivity insertion rate which occurs at no-load conditions following an excessive feedwater addition.
14.1.10.2.4 References for Section 14.1.10 1.
Burnett, T, W. T., et al., "LOFTRAN Code Description," WCAP-7907-A, April 1984.
- 2.
Friedland, A. J., Ray, S., "Revised Thermal Design Procedure," WCAP-11397-P-A, April 1989.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 57 of 64 Unit 2 14.1.11 Excessive Load Increase Incident (Full Vantage 5 Core) 14.1.11.1 Identification of Causes and Accident Description An excessive load increase incident is defined as a rapid increase in steam flow that causes a power mismatch between the reactor core power and the steam generator load demand. The reactor control system is designed to accommodate a ten percent (10%) step load increase and a five percent (5%) per minute ramp load increase in the range of 15 to 100 percent of full power. Any loading rate in excess of these values may cause a reactor trip actuated by the reactor protection system.
This accident could result from either an administrative violation such as excessive loading by the operator or an equipment malfunction in the steam dump control or turbine speed control.
During power operation, steam dump to the condenser is controlled by reactor coolant condition signals, i.e., high reactor coolant temperature indicates a need for steam dump. A single controller malfunction does not cause steam dump; an interlock is provided which blocks the opening of the valves unless a large turbine load decrease or turbine trip has occurred.
Protection against an excessive load increase accident is provided by the following reactor protection system signals:
Overpower T Overtemperature T Power range high neutron flux Low pressurizer pressure 14.1.11.2 Analysis of Effects and Consequences 14.1.11.2.1 Method of Analysis This accident is analyzed using the LOFTRAN Code (Reference 1). This code simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, steam generator safety valves, and feedwater system. The code computes pertinent plant variables including temperatures, pressures, and power level.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 58 of 64 Unit 2 Four cases are analyzed to demonstrate the plant behavior following a 10 percent step load increase from rated load. These cases are as follows:
A.
Manual rod control with minimum moderator reactivity feedback B.
Manual rod control with maximum moderator reactivity feedback C.
Automatic rod control with minimum moderator reactivity feedback D.
Automatic rod control with maximum moderator reactivity feedback For the minimum moderator feedback cases, it was assumed that the core has a zero moderator temperature coefficient of reactivity and the least negative Doppler only power coefficient curve.
This results in the least inherent transient response capability. The zero moderator temperature coefficient of reactivity bounds a positive moderator temperature coefficient for this cooldown event. For the maximum moderator feedback cases, the moderator temperature coefficient of reactivity has its highest absolute value and the most negative Doppler only power coefficient curve.
This results in the largest amount of reactivity feedback due to changes in coolant temperature.
A 10 percent step increase in steam demand is assumed, and all cases are studied without credit being taken for pressurizer heaters.
This accident is analyzed with the RTDP as described in Reference (2). Conservative nominal values are assumed for the initial reactor power, pressure, and RCS temperature. Uncertainties in initial conditions are included in the limit DNBR. Plant characteristics and initial conditions are shown in Table 14.1.0-3.
Normal reactor control systems and engineered safety systems are not required to function. The reactor protection system is assumed to be operable; however, reactor trip is not encountered for most cases due to the error allowances assumed in the setpoints.
The cases which assume automatic rod control are analyzed to ensure that the worst case is presented. The automatic function is not required.
14.1.11.2.2 Results Figures 14.1.11B-1 through 14.1.11B-4 illustrate the transient with the reactor in the manual control mode. As expected, for the minimum moderator feedback case there is a slight power increase, and the average core temperature shows a large decrease. This results in a DNBR which increases above its initial value. For the maximum moderator feedback, manually controlled case UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 59 of 64 Unit 2 there is a large increase in reactor power due to the moderator feedback. A reduction in DNBR is experienced but DNBR remains above the safety analysis limit value.
Figures 14.1.11B-5 through 14.1.11B-8 illustrate the transient assuming the reactor is in the automatic control mode. Both the minimum and maximum moderator feedback cases show that core power increases, thereby reducing the rate of decrease in coolant average temperature and pressurizer pressure. For both of these cases, the minimum DNBR remains above the safety analysis limit value.
For all cases, the plant rapidly reaches a stabilized condition at the higher power level. Normal plant operating procedures would then be followed to reduce power.
The excessive load increase incident is an overpower transient for which the fuel temperatures will rise. Reactor trip does not occur for the cases analyzed, and the plant reaches a new equilibrium condition at a higher power level corresponding to the increase in steam flow.
The calculated sequence of events for the excessive load increase incident are shown in Table 14.1.11B-1.
14.1.11.3 Conclusions The analysis presented above shows that for a ten percent (10%) step load increase, the DNBR remains above the safety analysis limit value, thereby precluding fuel or clad rupture. The plant reaches a stabilized condition rapidly following the load increase.
14.1.11.4 References for Section 14.1.11 1.
Burnett, T, W. T., et al., "LOFTRAN Code Description," WCAP-7907-A, April 1984.
- 2.
Friedland, A. J., Ray, S., "Revised Thermal Design Procedure," WCAP-11397-P-A, April 1989.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 60 of 64 Unit 2 14.1.12 Loss of Offsite Power (LOOP) to the Station Auxiliaries 14.1.12.1 Identification of Causes and Accident Description A complete loss of all (non-emergency) AC power (e.g. offsite power) may result in the loss of all power to the plant auxiliaries, i.e., the RCPs, condensate pumps, etc. The loss of power may be caused by a complete loss of the offsite grid accompanied by a turbine generator trip at the station, or by a loss of the onsite AC distribution system.
This transient is analyzed to show the adequacy of the heat removal capability of the auxiliary feedwater system. This transient is more severe than the loss of external electric load or turbine trip event (Section 14.1.8) analyzed because in this case the decrease in heat removal by the secondary system is accompanied by a flow coastdown which further reduces the capacity of the primary coolant to remove heat from the core. The reactor will trip due to: (1) turbine trip; (2) upon reaching one of the trip setpoints in the primary and secondary systems as a result of the flow coastdown and decrease in secondary heat removal; or (3) due to loss of power to the control rod drive mechanisms as a result of the loss of AC power to the plant.
Following a loss of power with turbine and reactor trips, the sequence described below will occur:
A.
Plant vital instruments are supplied from emergency DC power sources.
B.
As the steam system pressure rises following the trip, the steam generator power-operated relief valves may be automatically opened to the atmosphere. The condenser is assumed not to be available for steam dump. If the steam flow rate through the power relief valves is not available, the steam generator safety valves may lift to dissipate the sensible heat of the fuel and coolant plus the residual decay heat produced in the reactor.
C.
As the no load temperature is approached, the steam generator power-operated relief valves (or safety valves, if the power operated relief valves are not available) are used to dissipate the residual decay heat and to maintain the plant at the hot standby condition.
D.
The standby diesel generators, started on loss of voltage on the plant emergency buses, begin to supply plant vital loads.
The motor driven auxiliary feedwater pumps are supplied power by the diesels and the turbine-driven pump utilizes steam from the main steam system. Both type pumps are designed to supply rated flow within one minute of the initiating signal even if a loss of all non-emergency AC power UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 61 of 64 Unit 2 occurs simultaneously with loss of normal feedwater. The turbine exhausts the used steam to the atmosphere. The auxiliary feedwater pumps take suction from the condensate storage tank for delivery to the steam generators.
14.1.12.2 Analysis of Effects and Consequences Following the RCP coastdown caused by the loss of AC power, the natural circulation capability of the RCS will remove residual and decay heat from the core, aided by auxiliary feedwater in the secondary system. Although there is no RCP heat to remove, an analysis is presented here to show that the natural circulation flow in the RCS following a loss of AC power event is sufficient to remove residual heat from the core.
14.1.12.2.1 Method of Analysis A detailed analysis using the LOFTRAN Code (Reference 1) is performed to obtain the plant transient following a loss of all AC power. The simulation describes the plant thermal kinetics, RCS including the natural circulation, pressurizer, steam generators and feedwater system. The digital program computes pertinent variables including the steam generator level, pressurizer water level, and reactor coolant average temperature.
The assumptions used in the analysis are as follows:
A.
The plant is initially operating at 102% of the Cook Nuclear Plant Unit 2 rerating power level of 3608 MWt (NSSS including pump heat).
B.
A conservative core residual heat generation based upon long term operation at the initial power level preceding the trip. The ANS 1979 Decay Heat model plus two sigma uncertainty was assumed.
C.
A heat transfer coefficient in the steam generator associated with RCS natural circulation following the RCP coastdown.
D.
Reactor trip occurs on steam generator low-low level at 0% of narrow range span.
No credit is taken for immediate release of the control rod drive mechanisms caused by a loss of offsite power.
E.
Auxiliary feedwater is delivered to four steam generators at a rate of 430 gpm. The 430 gpm is assumed evenly split among four steam generators and is delivered by two motor driven pumps at a steam generator safety valve actuation pressure of UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 62 of 64 Unit 2 1133 psia. Automatic initiation of the auxiliary feedwater is assumed 60 seconds after a low-low steam generator signal is actuated. The failure of the turbine driven auxiliary feedwater pump is assumed as the limiting single failure for this event.
F.
Secondary system steam relief is achieved through the steam generator safety valves. These safety valves are assumed to be actuated at 1133 psia.
G.
The initial reactor coolant average temperature is 5.6oF lower than the nominal value of 547oF, and initial pressurizer pressure is 62.6 psi higher than nominal pressure of 2250 psia.
H.
The initial pressurizer water level is assumed to be at the maximum nominal setpoint of 61.1% NRS plus uncertainties (5% NRS).
I.
Pressurizer power operated relief valves (PORVs) are assumed operable to maximize pressurizer water volume.
J.
The maximum pressurizer spray flow rate is assumed to maximize pressurizer water volume.
K.
An auxiliary feedwater line purge volume of 100 ft3 per loop was assumed. This is the volume that needs to be purged before the relatively cold auxiliary feedwater reaches the steam generators.
Plant characteristics and initial conditions are shown in Table 14.1.0-2.
An evaluation has been performed to justify an increase in the as-found tolerance of the main steam safety valves (MSSVs) from +/-1% to +/-3%. The evaluation took credit for the staggered actuation of the MSSVs. The evaluation assumed that the MSSVs opened at 3% above the nominal lift pressure for each valve. The evaluation demonstrated that the secondary side pressure (assuming the staggered actuation of the MSSVs) would not exceed 1133 psia during the time when AFW is being supplied. The secondary side pressure transient would not preclude the AFW flow rate assumed in the analysis from being supplied to the steam generators.
An evaluation has been performed to justify an increase in the as-found tolerance of the main steam safety valves (MSSVs) from +/-1% to +/-3%. The evaluation took credit for the staggered actuation of the MSSVs. The evaluation assumed that the MSSVs opened at 3% above the nominal lift pressure for each valve. The evaluation demonstrated that the secondary side pressure (assuming the staggered actuation of the MSSVs) would not exceed 1133 psia during the time when AFW is being supplied. The secondary side pressure transient would not preclude the AFW flow rate assumed in the analysis from being supplied to the steam generators.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 63 of 64 Unit 2 14.1.12.2.2 Results The transient response of the RCS following a loss of AC power is shown in Figures 14.1.12-1 and 14.1.12-2.
The LOFTRAN code results show that the natural circulation flow available is sufficient to provide adequate core decay heat removal following reactor trip and RCP coastdown. The plot of pressurizer water volume shows that the pressurizer does not fill. For comparison purposes, the pressurizer fills at 1889 ft3 (which includes the pressurizer surge volume).
The calculated sequence of events for this transient are shown in Table 14.1.12-1.
14.1.12.3 Conclusions Analysis of the natural circulation capability of the RCS has demonstrated that sufficient heat removal capability exists following RCP coastdown to prevent fuel or clad rupture. Thus, a loss of AC power to station auxiliaries does not adversely affect the core, the RCS, or the steam system, and the auxiliary feedwater capability is sufficient to preclude water relief through the pressurizer relief or safety valves.
An evaluation has been performed (Reference 2) to address the impact of pressurizer heaters on this event. Historically, the pressurizer heaters were not modeled. The evaluation also included properly modeling the pressurizer spray effectiveness at pressurizer water levels approaching a water-solid condition. The evaluation considered a reduction in the initial value assumed for the moderator temperature coefficient (MTC) from the part-power limit value of 5 pcm/°F to the full-power limit value of 0 pcm/°F. The use of the zero MTC remains conservative, and bounds part-power conditions with a corresponding positive MTC. The results of the evaluation determined that all acceptance criteria continue to be met. No changes to the figures and tables presented in this section were made as part of this evaluation.
14.1.12.4 References for Section 14.1.12 1.
Burnett, T, W. T., et al., "LOFTRAN Code Description," WCAP-7907-A, April 1984.
2.
Westinghouse Letter AEP-98-127, Ref: NSAL-98-007, American Electric Power Service Corporation D. C. Cooks 1 and 2 Analysis Modeling of Pressurizer Heaters, dated August 11, 1998.
UFSAR Revision 31.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
30.0 Section:
14.1 Page: 64 of 64 Unit 2 14.1.13 Turbine-Generator Accident Refer to Unit 1 Section 14.1.13.
UFSAR Revision 31.0