ML24159A176

From kanterella
Jump to navigation Jump to search
Updated Final Safety Analysis Report (Ufsar), Revision 32, Chapter 14, Section 14.1, Core and Coolant Boundary Protection Analysis (Unit 1)
ML24159A176
Person / Time
Site: Cook  American Electric Power icon.png
Issue date: 05/30/2024
From:
Indiana Michigan Power Co
To:
Office of Nuclear Reactor Regulation
Shared Package
ML24159A261 List: ... further results
References
AEP-NRC-2024-20
Download: ML24159A176 (1)
v • d • e


Text

INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: i of v

14.1 CORE AND COOLANT BOUNDARY PROTECTION ANALYSIS............1 14.1.0.1 Analyzed Operating Conditions....................................................... 1 14.1.0.2 Reactor Protection System (RPS) and Engineered Safety Features (ESF) Setpoints Assumed in Analysis............................................. 2 14.1.0.3 Reactor Trip Setpoints..................................................................... 3 14.1.0.4 Methodology.................................................................................... 5 14.1.0.5 Initial Conditions.............................................................................. 5 14.1.0.6 Reactor Core Power Distribution..................................................... 7 14.1.0.7 Reactor Trip..................................................................................... 7 14.1.0.8 Other Assumptions.......................................................................... 8 14.1.0.9 Computer Codes Utilized................................................................ 9 14.1.0.9.1 FACTRAN...........................................................................................9 14.1.0.9.2 LOFTRAN.......................................................................................... 10 14.1.0.9.3 TW INK L E.......................................................................................... 10 14.1.0.9.4 THINC............................................................................................... 11 14.1.0.9.5 VIPRE................................................................................................ 11 14.1.0.9.6 ANC................................................................................................... 11 14.1.0.10 References for Section 14.1.0....................................................... 11 14.1.1 Uncontrolled RCCA Withdraw al from a Subcritical Condition

................................................................................................. 13 14.1.1.1 Method of Analysis........................................................................ 14 Effect of the Replacement Steam Generators on Unit 1..................................... 16 Effect of the MUR Program on Unit 1................................................................. 17 Effect of the Return to RCS NOP/NOT Program on Unit 1................................. 17 14.1.1.2 Results and Conclusions............................................................... 17 14.1.2 Uncontrolled RCCA Withdraw al At Pow er............................ 19 14.1.2.1 Introduction.................................................................................... 19 14.1.2.2 Method of Analysis........................................................................ 20

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: iiof v

14.1.2.3 Results.......................................................................................... 21 Effect of the RTD Bypass Elimination................................................................. 22 Effect of the Return to RCS NOP/NOT Program on Unit 1................................. 22 14.1.2.4 Conclusions................................................................................... 23 14.1.2.5 References for Section 14.1.2....................................................... 23 14.1.3 Rod Cluster Control Assembl y Misalignment...................... 24 14.1.3.1 Method of Analysis........................................................................ 25 14.1.3.2 Results.......................................................................................... 26 Effect of the Replacement Steam Generators on Unit 1..................................... 28 Effect of the MUR Program on Unit 1................................................................. 28 Effect of the Return to RCS NOP/NOT Program on Unit 1................................. 29 14.1.3.3 References for Section 14.1.3....................................................... 29 14.1.4 RCCA Drop.............................................................................. 30 14.1.5 Chemical and Volume Control System Malfunction............ 30 Effect of the Replacement Steam Generators on Unit 1..................................... 31 Effect of the MUR Program on Unit 1................................................................. 31 Effect of the RTD Bypass Elimination................................................................. 31 Effect of the Return to RCS NOP/NOT Program on Uni t 1................................. 32 Conclusions.................................................................................................. 32 14.1.5.1 References for Section 14.1.5....................................................... 32 14.1.6 Loss of Reactor Coolant Flow (Including Locked Rotor Anal ysis)................................................................................. 33 14.1.6.1 Method of Analysis........................................................................ 33 14.1.6.2 Results.......................................................................................... 34 Effect of the Replacement Steam Generators on Unit 1..................................... 34 Effect of the MUR Program on Unit 1................................................................. 35 Effect of the Return to RCS NOP/NOT Program on Unit 1................................. 35 14.1.6.3 Conclusions................................................................................... 35

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: iiiof v

14.1.6.4 Locked Rotor Accident.................................................................. 36 14.1.6.4.1 Method of Analysis............................................................................ 36 14.1.6.4.2 Evaluation of the Pressure Transient................................................ 36 14.1.6.4.3 Evaluation of DNB in the Core During the Accident.......................... 37 14.1.6.4.4 Film Boiling Coefficient...................................................................... 37 14.1.6.4.5 Fuel Clad Gap Coefficient................................................................. 38 14.1.6.4.6 Zirconium-Steam Reaction................................................................ 38 14.1.6.4.7 Results.............................................................................................. 38 Effect of the Replacement Steam Generators on Unit 1..................................... 39 Effect of the MUR Program on Unit 1................................................................. 39 Effect of the Return to RCS NOP/NOT Program on Unit 1................................. 39 14.1.6.4.8 Locked Rotor Radiological Consequence Analysis........................... 40 14.1.6.4.9 Conclusions....................................................................................... 41 14.1.6.5 References for Section 14.1.6....................................................... 41 14.1.7 Startup of an Inactive Reactor Coolant Loop....................... 42 14.1.8 Loss of External Electrical Load........................................... 43 14.1.8.1 Method of Analysis........................................................................ 43 14.1.8.2 Results.......................................................................................... 45 14.1.8.3 Conclusions................................................................................... 46 14.1.8.4 Evaluation of Lower Initial RCS Temperature............................... 46 Effect of the RTD Bypass Elimination................................................................. 47 Effect of the Return to RCS NOP/NOT Program on Unit 1................................. 47 14.1.8.5 References for Section 14.1.8....................................................... 47 14.1.9 Loss of Normal Feedw ater Flow............................................ 48 14.1.9.1 Method of Analysis........................................................................ 48 14.1.9.2 Results.......................................................................................... 50 Effect of the MUR Program on Unit 1................................................................. 50 Effect of the Return to RCS NOP/NOT Program on Unit 1................................. 50

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: iv of v

14.1.9.3 Conclusions................................................................................... 50 14.1.9.4 References For Section 14.1.9...................................................... 51 14.1.10 Excessive Heat Removal Due to Feedwater System Malfunctions........................................................................... 52 14.1.10.1 Feedwater System Malfunctions Causing a Reduction in Feedwater Temperature.................................................................................. 52 14.1.10.1.1 Method of Analysis............................................................ 52 14.1.10.1.2 Results.............................................................................. 53 14.1.10.1.3 Conclusions....................................................................... 53 14.1.10.2 Feedwater System Malfunctions Causing an Increase in Feedwater Flow............................................................................................... 53 14.1.10.2.1 Method of Analysis............................................................................ 54 14.1.10.2.2 Results.............................................................................................. 55 14.1.10.2.2.1 Effect of the MUR Program on Unit 1........................................... 57 14.1.10.2.2.2 Effect of the Return to RCS NOP/NOT Program on Unit 1........... 58 14.1.10.2.2.3 Evaluation to Support 240% Nominal Main Feedwater Flow........ 58 14.1.10.2.3 Conclusions....................................................................................... 58 14.1.10.2.4 References for Section 14.1.10......................................................... 59 14.1.11 Excessive Load Increase Incident......................................... 60 14.1.11.1 Method of Analysis........................................................................ 60 14.1.11.2 Results.......................................................................................... 61 Effect of the Replacement Steam Generators on Unit 1..................................... 62 Effect of the MUR Program on Unit 1................................................................. 62 Effect of the Return to RCS NOP/NOT Program on Unit 1................................. 62 14.1.11.3 Conclusions................................................................................... 63 14.1.12 Loss of All AC Pow er to the Plant Auxiliaries...................... 64 14.1.12.1 Identification of Causes and Accident Description........................ 64 14.1.12.2 Method of Analysis........................................................................ 65

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: v of v

14.1.12.3 Results.......................................................................................... 66 Effect of the MUR Program on Unit 1................................................................. 66 Effect of the Return to RCS NOP/NOT Program on Unit 1................................. 67 14.1.12.4 Conclusions................................................................................... 67 14.1.12.5 References for 14.1.12.................................................................. 68 14.1.13 Turbine-Generator Safety Anal ysis....................................... 69 14.1.13.1 Introduction.................................................................................... 69 14.1.13.1.1 Unit 1 - Turbine................................................................................. 71 14.1.13.1.2 Unit No. 2 - Turbine........................................................................... 72 Units 1 and 2.................................................................................................. 73 14.1.13.2 Failure of Turbine-Generator Rotating Elements.......................... 74 14.1.13.2.1 Unit 1 (General Electric 4)................................................................... 76 14.1.13.2.1.1 Vane of Last -Stage Blade - Unit No. 1 (See Figure 14.1.13-4)4

.................................................................................................. 77 14.1.13.2.1.2 Fragment of Last Stage Wheel - Unit 14.................................. 77 14.1.13.2.2 Unit 2 (Brown-Boveri)4....................................................................... 78 14.1.13.2.2.1 Vane of Last Stage Blade - Unit No. 2 (See Figure 14.1.13-5) 80 14.1.13.2.2.2 Fragment of Next to Last Stage Disc - Unit 24......................... 81 14.1.13.2.3 Generator Retaining Ring and Other Parts - Units 1 and 2............... 82 14.1.13.2.4 High Pressure Turbine - Units 1 and 2.............................................. 82 Effect of the Replacement Steam Generators on Unit 1..................................... 82 14.1.13.3 References for Section 14.1.13..................................................... 83

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 1 of 83

14.1 CORE AND COOLANT BOUNDARY PROTECTION ANALYSIS

The Reactor Control and Protection System is relied upon to protect the core and reactor coolant boundary against the following fault conditions:

1. Uncontrolled RCCA bank withdrawal from a subcritical condition
2. Uncontrolled RCCA bank withdrawal at power
3. RCCA misalignment (this encompasses RCCA drop)
4. Uncontrolled Boron dilution
5. Loss of reactor coolant flow (including locked rotor)
6. Start-up of an inactive reactor coolant loop
7. Loss of external electrical load and/or turbine trip
8. Loss of normal feedwater
9. Excessive heat removal due to feedwater s ystem malfunctions
10. Excessive load increase
11. Loss of offsite power (LOOP) to the station auxiliaries
12. Turbine-generator overspeed

14.1.0.1 Analyzed Operating Conditions The safety anal yses in this chapter support operation of Cook Unit 1 at Return to RCS NOP/NOT conditions. The safety analyses demonstrate that all applicable UFSAR safety limits are satisfied for each analyzed event at the conditions specified in Cases 7 and 8 of Table 14.1-1 (core power of 3315 MWt, primary operating pressure of 2250 psia, full power primary vessel average temperature range of 553.7°F to 575.4°F, and 30% SGTP).

While all of the Chapter 14 safety analyses support operation at Return to RCS NOP/NOT conditions, not all safety analyses were reanalyzed for the program. Many analyses were demonstrated to conservatively bound operation at Return to RCS NOP/NOT conditions based on the previously analyzed conditions. Cases 1 through 8 of Table 14.1-1 present the range of conditions reflected in the various Chapter 14 safety analyses. Thus, various combinations of conditions that bound those of Return to RCS NOP/NOT operation are supported by various Chapter 14 safet y anal yses; however, operation of Cook Unit 1 is only supported for Cases 7 and 8 of Table 14.1-1.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 2 of 83

Cases 5 and 6 present rerating conditions for Cook Unit 1. These cases were analyzed in anticipation of a potential future power uprate for Cook Unit 1; they supported a core power level of 3413 MWt, vessel average temperature range of 547.0°F to 578.7°F, and 10% SGTP.

Subsequently, analyses were performed to support the reduced temperature and pressure conditions presented in Cases 3 and 4 of Table 14.1-1. The reduced temperature and pressure analysis program reduced the analyzed core power level to 3250 MWt, narrowed the vessel average temperature range to 553.0°F to 576.3°F, supported a primary operating pressure of 2250 psia or 2100 psia, and supported 30% SGTP. Later, a Measurement Uncertainty Recapture (MUR) program was performed, supporting the conditions presented in Cases 1 and 2 of Table 14.1-1.

The MUR program increased the analyzed core power level to 3315 MWt, reduced the vessel average temperature range to 553.7°F to 575.4°F, and continued to support both primary operating pressures and 30% SGTP.

Note that the non-LOCA anal yses are based on a Thermal Design Flow (TDF) of 83,200 gpm /

loop and a Minimum Measured Flow (MMF) of 84,775 gpm / loop. However, subsequent evaluations were performed to show that the following higher flows are also supported: 88,500 gpm / loop (TDF) and 90,725 gpm / loop (MMF). The safet y anal yses support a maximum average SGTP level of 30%, provided the minimum measured RCS flow of 84,775 gpm / loop is met and the RCS temperature and pressure presented in Table 14.1-1 (Cases 7 and 8) are not exceeded. A 5% RCS flow asymmetry is also supported b y the safet y anal yses. Specifically, a total RCS flow rate of 339,100 gpm with a reduction of RCS flow in one loop of 5% below the average loop flow rate was evaluated in the safet y anal yses. As long as the total minimum measured RCS flow is equal to or greater than 339,100 gpm, the flow rate in one loop may be below 84,775 gpm by as much as 5%. Should the flow rate in more than one loop be below 84,775 gpm, a total loop flow shortfall less than or equal to 5% of 84,775 gpm is supported by the safety anal yses, provided the total minimum measured RCS flow is equal to or greater than 339,100 gpm.

14.1.0.2 Reactor Protection System (RPS) and Engineered Safety Features (ESF) Setpoints Assumed in Analysis To enhance operating flexibility for the RCS reduced temperature and pressure operation with a maximum average steam generator tube plugging level of 30%, certain Reactor Protection System (RPS) setpoints and emergency diesel generation (EDG) requirements were revised. The revised RPS setpoints include the overtemperature T (OTT) and the overpower T (OPT) reactor trips. Subsequently, a program was performed to return Unit 1 to RCS NOP/NOT operation. This

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 3 of 83

involved removing restrictions on the T' and T" values in the OTT and OPT setpoint equations, respectively. To demonstrate adequate overpower protection with the restrictions removed, an analysis of the full power case of the Rupture of a Steam Pipe event was performed in Section 14.2.5. The revised EDG requirement is relaxed, such that the total EDG start-up delay time supported by the safety analyses is now 30 seconds. The non-LOCA safety anal yses continue to support the 30 second EDG start-up delay time for the Return to NOP/NOT conditions.

A reactor trip is defined for analytical purposes as the insertion of all RCCAs except the most reactive one, which is assumed to remain in the fully withdrawn position. This is to provide margin in shutdown capability against the remote possibility of a stuck RCCA condition existing at a time when shutdown is required. The response times of the reactor trip system instrumentation are listed in Table 7.2-6.

Instrumentation is provided for continuously monitoring all individual RCCAs together with their respective bank position. This is done in the form of a deviation alarm system. Procedures are established to correct deviations. In the worst case, the plant will be shutdown in an orderly manner and the condition corrected.

In summary, reactor protection is designed to prevent cladding damage in all fault conditions listed previously. The most probable modes of failure in each RPS channel result in a signal calling for the protective reactor trip. Coincidence of two out of three (or two out of four) signals is required where single channel malfunction could cause spurious trips while at power. A single component or channel failure in the protection system itself coincident with one stuck RCCA is always permissible as a contingent failure and does not cause violation of the protection criteria. The reactor protection system is designed in accordance with the IEEE 279 "Standard for Nuclear Plant Protection Systems," August, 1968.

14.1.0.3 Reactor Trip Setpoints OTT and OPT setpoints were calculated using the methodology described in Reference 1 to support the 30% SGTP program. These setpoints initially included a limitation on the maximum allowable T" value to below the maximum full power vessel average temperature (T" = 563.0°F, full power Tavg of 576.3°F) to ensure overpower protection. The setpoints were subsequently confirmed to provide protection for revised core thermal safety limits as part of the MUR program, with a restriction being placed on T' (T'=574.0°F, full power Tavg of 575.4°F) to ensure the fI penalty limits remained bounding, and T" being further restricted to 562.1°F, corresponding to the reduction in maximum full power Tavg (from 576.3°F to 575.4°F).

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 4 of 83

With the Return to RCS NOP/NOT operation, an evaluation was performed to confirm that the setpoints provide protection with the restrictions on the maximum allowable values for T' and T" removed. For the Return to RCS NOP/NOT program, the maximum allowable T' and T" are equal to the maximum full power vessel average temperature for the Return to RCS NOP/NOT conditions (Cases 7 and 8 in Table 14.1-1). Figures 14.1-1, 14.1-2, 14.1-3, 14.1-3A, and 14.1-4 present the range of analyzed allowable RCS loop average temperature and T for the minimum measured flow and power distribution as a function of RCS pressure. Figure 14.1-3A represents the most limiting operating configuration (nominal T avg = 575.4°F, nominal RCS pressure = 2250 psia) of the range of conditions described in Cases 7 and 8 of Table 14.1-1 for the calculation of the OTT and OPT trip setpoints. Cook Unit 1 is no longer licensed to operate at an RCS pressure of 2100 psia or a vessel average temperature of 576.3°F, and restricting T' and T" below the maximum full power vessel average temperature is no longer necessary to support the obsolete operating conditions. Some safet y anal yses performed at reduced RCS pressure and temperature conditions were evaluated and found to be bounding for the Return to RCS NOP/NOT program; therefore, they remain the analyses of record. Hence, Figures 14.1-1 through 14.1-3 have been maintained for completeness, while Figures 14.1-3a and 14.1-4 demonstrate protection at Return to RCS NOP/NOT conditions. The boundaries of operation defined by the OPT and OTT trip setpoints are represented as "protection lines" on these diagrams. The protection lines are drawn to include all adverse instrumentation and setpoint errors so that under nominal conditions a reactor trip would occur well within the area bounded by these lines. The utility of this diagram is in the fact that the limit imposed by any given DNBR can be represented as a line. The DNB lines represent the locus of conditions for which the DNBR equals the safety analysis limit value. All points below and to the left of a DNB line for a given RCS pressure have a DNBR greater than the limit value. The diagram shows that DNB is prevented for all cases if the area enclosed within the maximum protection lines is not traversed by the applicable DNBR limit line at a ny point for a given RCS pressure.

The area of permissible operation (power, pressure, and temperature) is bounded by the combination of reactor trips: high neutron flux (fixed setpoint); high pressurizer pressure (fixed setpoint); low pressurizer pressure (fixed setpoint); overpower and overtemperature T (variable setpoints).

The safety limit value, which was used as the DNBR limit for all accidents analyzed with the Revised Thermal Design Procedure (RTDP) (Reference 2), is conservative compared to the actual design DNBR value required to meet the DNB design basis.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 5 of 83

Table 14.1-2 presents the limiting reactor trip setpoints assumed in the safety analyses and the time delay assumed for each trip function. The differences between the limiting reactor trip point assumed for the safety analyses and the nominal reactor trip point represent an allowance for instrumentation channel error and setpoint error. Time response testing demonstrates that actual instrument time delays are equal to or less than the assumed values. Additionally, reactor protection system channels are calibrated and instrument response times determined periodically in accordance with the Technical Specifications.

The safety analyses presented in the following sections assume that the reference average temperatures (T' and T") used in the OTT and OPT setpoint equations are rescaled to the full power average temperature each time the c ycle average temperature is changed. It is also assumed that the reference pressure (P') in the OTT equation is set equal to the nominal RCS pressure consistent with Return to RCS NOP/NOT conditions (2250 psia). The safety analyses also assume recalibration of the NIS excore detectors to compensate for the changes in coolant density each time the cycle operating conditions are changed.

14.1.0.4 Methodology The Unit 1 non-LOCA safety analyses for the Return to NOP/NOT operation with 30% steam generator tube plugging (SGTP) were performed using current Westinghouse methodology and computer codes. For the safet y anal yses presented in the following sections, the results show that the Return to RCS NOP/NOT operation at a core power level of 3315 MWt and with a maximum SGTP level of 30% for Unit 1, satisfies the applicable FSAR acceptance criteria.

14.1.0.5 Initial Conditions All transients have been analyzed or evaluated to demonstrate that Return to RCS NOP/NOT operation with a maximum average steam generator tube plugging level of 30% can be supported.

Several of the transients reflect initial condition values c onsistent with the previously analyzed transients that were performed to support the rerating (i.e., 3411 MWt core power) of Unit 1 or RCS reduced temperature and pressure operation (i.e., 2100 psia RCS pressure).

For each of the transients reanalyzed to support RCS reduced temperature and pressure operation with 30% SGTP, conservative nominal values for initial reactor thermal power and RCS temperature and pressure are assumed to bound the RCS reduced temperature and pressure operation. In support of the MUR power uprate program, evaluations and analyses have been

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 6 of 83

performed. The evaluations determined that the initial conditions supporting the RCS reduced temperature and pressure operation with 30% SGTP continue to bound the conditions of the power uprate. New analyses have been performed at the MUR power uprate conditions where an evaluation approach was not viable.

In support of the Return to RCS NOP/NOT program, evaluations and analyses have been performed. The evaluations determined that the initial conditions supporting the RCS reduced temperature and pressure operation at MUR power uprate conditions with 30% SGTP continue to bound the conditions of the Return to RCS NOP/NOT operation (with the exception of the Rupture of a Steam Pipe event presented in Section 14.2.5). The initial conditions for each safety analysis are presented in Table 14.1-3.

For most transients which are DNB limited, nominal values of initial conditions and the minimum measured flow1 (339,100 gpm) are assumed. The allowances on reactor thermal power and RCS temperature and pressure are determined on a statistical basis and are included in the limit DNBR as described in WCAP-11397 (Reference 2). This procedure is known as the "Revised Thermal Design Procedure" (RTDP).

For occurrences that are not DNB limited or in which RTDP is not emplo yed, the initial conditions are obtained by adding the maximum steady state errors to nominal values. In addition, the RCS thermal design flow1 (332,800 gpm) is used. The following steady state errors are considered:

A. Core Thermal Power +/-2% 2calorimetric error allowance

+/-4.1oFont+/-le+/-=deaaeaseme=

B. RCS Average Temperature e+/-+/-oallae;=pl1.0°F bias for cold-leg streaming C. RCS (Pressurizer) Pressure +/-67=psi=-=steadyte=fluuions=and=

measu+/-t=e+/-+/-o+/-=allow=

Tae=14.1=- 3=sma+/-izestialtionspute+/-es=used=itafety=ysisf==

c+/-eesn=Sections=14.1.1=tough=14.1.12=and=Sectionsahows=

wch=t+/-aiesmoyed=aNBlysis=usiTDP

=====================================

1=Sote=1fle=14.1- =

2=MURowp+/-e=usucedo+/-im+/-i+/-o+/-=allowce.The=sumfhange=in=Rhmalow=

dinnhe=Technilpecifications=andhe=MURudo+/-im+/-i+/-o+/-=allows=e°uo,+/-shan,=

t+/-il2%=val. =

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 7 of 83

14.1.0.6 Reactor Core Power Distribution The transient response of the reactor system is dependent on the initial power distribution. The nuclear design of the reactor core minimizes adverse power distribution through the placement of RCCAs and operation instructions. The power distribution may be characterized by the radial peaking factor, FH, and the total peaking factor, FQ. The peaking factor limits are given in the Technical Specifications.

For occurrences which may be DNB limited, the radial peaking factor is of importance. The radial peaking factor increases with decreasing power level due to RCCA insertion. This increase in FH is included in the core thermal safet y limits. All occurrences that may be DNB limited are assumed to begin with a FH consistent with the initial RCS thermal power level defined in the Technical Specifications.

The radial and axial power distributions are input to the THINC or VIPRE codes as described in Chapter 3.

For occurrences which may be overpower limited, the total peaking factor, FQ, is of importance.

All transients that may be overpower limited ar e assumed to begin with plant conditions including power distributions which are consistent with reactor operation as defined in the Technical Specifications.

For overpower occurrences which are slow with respect to the fuel rod thermal time constant, for example the uncontrolled boron dilution incident which lasts many minutes, and the excessive load increase incident which reaches equilibrium without causing a reactor trip, fuel temperature limits are discussed in Chapter 3. For overpower occurrences which are fast with respect to the fuel rod thermal time constant, for example the uncontrolled RCCA bank withdrawal from a subcritical condition and RCCA ejection occurrences which result in a large power rise over a few seconds, a detailed fuel heat transfer calculation is performed. Although the fuel rod thermal time constant is a function of system conditions, fuel burnup and fuel rod power, a typical value at beginning-of-life for high power fuel rods is approximately 7 seconds.

14.1.0.7 Reactor Trip A reactor trip signal acts to open the two trip breakers connected in series feeding power to the RCCA drive mechanism coils. The loss of power to the mechanism coils causes the mechanisms to release the RCCAs, which then fall b y gravity into the core. There are various instrumentation

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 8 of 83

delays associated with each reactor trip function, including delays in signal actuation, in opening the reactor trip breakers, and in the release of the RCCAs by the mechanisms. The total delay to reactor trip is defined as the time delay from the time that reactor trip conditions are reached to the time the RCCAs are free and begin to fall. The time delay assumed for each reactor trip function is given in Table 14.1-2.

The difference between the limiting reactor trip setpoint assumed for the safety analysis and the nominal reactor trip setpoint represents an allowance for instrumentation channel error and setpoint error.

The instrumentation drift and calorimetric errors used in establishing the maximum power range high neutron flux setpoint are presented in Table 14.1-4.

The negative reactivity insertion following a reactor trip is a function of the acceleration of the RCCAs and the variation in RCCA worth as a function of RCCA position. RCCA positions after the reactor trip have been determined experimentally as a function of time using a protot ype RCCA under simulated flow conditions. The resulting RCCA positions were combined with the RCCA worths to define the negative reactivity insertion as a function of time, according to Figure 14.1-5.

14.1.0.8 Other Assumptions Those analyses that model the mitigation effects of Protection and/or Engineered Safety Features have used the response times provided in Table 7.2-6 and 7.2-7.

Some input assumptions differ somewhat from values that may be found elsewhere in the UFSAR.

In particular, Tables 14.1-5, 14.1-6, and 14.1-7 display RCS volumes, steam generator mass, RCS pressure drops used in the current anal yses. These tables can be found in Reference 7. Table 14.1-7 lists the RCS pressure drops at Best Estimate flow calculated at 0% steam generator tube plugging and at 30% SGTP (Reference 7).

The time to draindown the RWST and the time to switchover to recirculation cooling affects the LOCA containment integrity analysis. For peak pressure considerations, it is conservative to switchover to recirculation sooner because of the decreased cooling effect during the recirculation phase of operation of the safety injection, the upper compartment spray, and the lower compartment spra y. Because the fluid enthalp y increases during the recirculation mode, the safety injection and spray efficiency is diminished. Also, once the steam generators have equilibrated, the mass and energy releases are determined based upon a boiloff calculation that is related to the safety injection water enthalpy. The higher the enthalpy, the larger the releases. Therefore,

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 9 of 83

utilizing a conservatively early switchover time sequence also results in higher and more conservative mass and energy releases to containment. Also included in the containment pressure calculation is the earl y part of the switchover sequence, when the containment sprays are initially drawing water from the RWST. During this period the sprays are shut off. It is also assumed that the spray switchover sequence is started, and is completed over a 4 minute period. This results in a spray interruption (i.e., no containment spray flow) during this period.

For the draindown calculation the maximum pump and spray flows are assumed during injection, and combined conservatively to shorten the time to start the switchover sequence. If necessary, valve closing time is neglected. The draindown and switchover sequence information is determined in a conservative manner to support the analytical basis for the peak pressure calculation. A table providing details of the various elements that were developed to support these assumptions is presented in Table 14.1-8. The detailed information in this table is not intended to serve as a requirement that the operators must meet while demonstrating the capability to perform emergency operating procedures related to the transfer to cold leg recirculation.

14.1.0.9 Computer Codes Utilized Summaries of the principal computer codes used in the safet y anal yses are given below. The codes used in the safet y anal ysis of each occurrence have been listed in Table 14.1-3.

14.1.0.9.1 FACTRAN FACTRAN calculates the transient temperature distribution in a cross -section of a metal clad UO2 fuel rod and the transient heat flux at the surface of the clad using as input the nuclear power and the time-dependent coolant parameters (pressure, flow, temperature, and density). The code uses a fuel model, which simultaneously exhibits the following features:

A. A sufficientl y large number of radial space increments to handle fast transients such as rod ejection accidents.

B. Material properties which are functions of temperature and a sophisticated fuel-to-clad gap heat transfer calculation.

C. The necessary calculations to handle post-departure from nucleate boiling (DNB) transients: film boiling heat transfer correlations, Zircaloy -water reaction, and partial melting of the materials.

FACTRAN is further discussed in Reference 3.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 10 of 83

14.1.0.9.2 LOFTRAN The LOFTRAN program is used for transient response studies of a pressurized water reactor (PWR) system to specified perturbations in process parameters. LOFTRAN simulates a multiloop system by a model containing the reactor vessel, hot and cold leg piping, steam generators (tube and shell sides), and the pressurizer. The pressurizer heaters, spray, relief, and safet y valves are also considered in the program. Point model neutron kinetics, and reactivity effects of the moderator, fuel, boron, and rods are included. The secondary side of the steam generator utilizes a homogeneous, saturated mixture for the thermal transients and a water level correlation for indication and control. The reactor protection system is simulated to include reactor trips on high neutron flux, overtemperature T, overpower T, and high and low pressure, low flow, and high pressurizer level. Control systems are also simulated including rod control, steam dump, feedwater control, and pressurizer pressure control. The ECCS, including the accumulators, is also modeled.

LOFTRAN also has the capability of calculating the transient value of DNBR based on the input from the core limits. The core limits represent the minimum value of DNBR as calculated for typical or thimble cell.

LOFTRAN is further discussed in Reference 4.

14.1.0.9.3 TWINKLE The TWINKLE program is a multi-dimensional spatial neutron kinetics code, which was patterned after stead y-state codes presentl y used for reactor core design.

The code uses an implicit finite-difference method to solve the two-group transient neutron diffusion equations in one, two, and three-dimensions. The code uses six delayed neutron groups and contains a detailed multi-region fuel-clad-coolant heat transfer model for calculating pointwise Doppler and moderator feedback effects. The code handles up to 2000 spatial points and performs its own steady-state initialization. Aside from basic cross -section data and thermal-hydraulic parameters, the code accepts as input basic driving functions such as inlet temperature, pressure, flow, boron concentration, control rod motion, and others. Various edits are provided, e.g.,

channelwise power, axial offset, enthalpy, volumetric surge, pointwise power, and fuel temperatures.

The TWINKLE code is used to predict the kinetic behavior of a reactor for transients which cause a major perturbation in the spatial neutron flux distribution.

TWINKLE is further described in Reference 5.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 11 of 83

14.1.0.9.4 THINC The TH INC-IV computer program, as approved b y the NRC, is used to determine coolant densit y, mass velocity, enthalpy, vapor void, static pressure, and DNBR distributions along parallel flow channels within a reactor core under all expected operating conditions. The THINC-IV code is described in detail in Reference 6.

14.1.0.9.5 VIPRE The VIPRE computer program performs thermal-hydraulic calculations. This code calculates coolant density, mass velocity, enthalpy, void fractions, static pressure, and DNBR distributions along flow channels within a reactor core.

The VIPRE computer program is further discussed in Reference 12.

14.1.0.9.6 ANC The ANC computer program is an advanced nodal code capable of two-dimensional and three dimensional neutronics calculations. ANC is the reference model for certain safety analysis calculations, power distributions, peaking factors, critical boron concentrations, control rod worths, reactivity coefficients, etc. In addition, three-dimensional ANC validates one-dimensional and two-dimensional results and provides information about radial (x-y) peaking factors as a function of axial position. It can calculate discrete pin powers from radial nodal information as well.

The ANC computer program is further discussed in Reference 13.

14.1.0.10 References for Section 14.1.0

1. Ellenberger, S. L., et. al., "Design Bases for the Thermal Overpower T and Thermal Overtemperature T Trip Functions," WCAP-8746, March 1977.
2. Friedland, A. J., Ray, S., "Revised Thermal Design Procedure," WCAP-11397-P-A, April 1989.
3. Hargrove, H. G., "FACTRAN - A FORTRAN IV Code for Thermal Transients in a UO2 Fuel Rod," WCAP-7908-A, December 1989.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 12 of 83

4. Burnett, T. W. T., et. al., "LOFTRAN Code Description," WCAP-7907-A, April 1984.
5. Risher, D. H., Jr., and R. F. Barry, "TWINKLE - A Multi-Dimensional Neutron Kinetics Code," WCAP-8028-A, January 1975.
6. Friedland, A. J. and Ray, S., "Improved THINC IV Modeling for PWR Core Design," WCAP-12330-P, August 1989.
7. McFetridge, R. H., American Electric Power Service Corporation Donald C. Cook Nuclear Plant Unit 1 Steam Generator Tube Plugging Engineering Report, WCAP-14286, December 1995.
8. V. VanderBurg to K. R. Worthington, Safet y Review of a Proposal to Use the Valve Travel Times from the Unit 1 Steam Generator Tube Plugging and Unit 2 Uprate Programs for the Sump Recirculation Model in Lieu of Those Found in Section 6.2.2 of the UFSAR, November 13, 1996
9. WCAP 11902, Rerated Power and Revised Temperature and Pressure Operation for Donald C. Cook Nuclear Plant Units 1 & 2 Licensing Report, Supplement 1, September 1989.
10. WCAP 14285, Donald C. Cook Nuclear Plant Unit 1 Steam Generator Tube Plugging Program Licensing Report, Revision 1, May 1995.
11. AEP-00-285, 12/15/00, American Electric Power, Donald C. Cook Unit 1 RTD Time Response Delay Evaluation.
12. Y. X. Sung, et al., "VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis," WCAP-14565-P-A (Proprietary) / WCAP-15306-NP-A (Non-Proprietary), October 1999.
13. Y. S. Liu, et al., "ANC: A Westinghouse Advanced Nodal Computer Code,"

WCAP-10965-P-A, September 1986.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 13 of 83

14.1.1 Uncontrolled RCCA Withdraw al from a Subcritical Condition An RCCA withdrawal incident is defined as an uncontrolled addition of reactivity to the reactor core by withdrawal of RCCA banks resulting in a power excursion. While the occurrence of a transient of this type is highly unlikely, such a transient could be caused by a malfunction of the reactor control or control rod drive systems. This could occur with the reactor either subcritical or at power. The "at power" case is discussed in Section 14.1.2.

Reactivity is added at a prescribed and controlled rate in bringing the reactor from a shutdown condition to a low power level during startup by RCCA bank withdrawal. Although the initial startup procedure may use the method of boron dilution, the normal startup is with RCCA bank withdrawal. RCCA bank motion can cause much faster changes in reactivity than can be made b y changing boron concentration.

The control rod drive mechanisms are wired into preselected banks, and these bank configurations are not altered during the core life. The RCCAs are therefore physically prevented from being withdrawn in other than their respective banks, except for the case of manually retrieving a dropped RCCA as provided for in approved operating procedures. (See Section 14.1.3.) Power supplied to the rod banks is controlled such that no more than two banks can be withdrawn at any time. The RCCA drive mechanism is of the magnetic latch type and the coil actuation is sequenced to provide variable speed rod travel. The maximum reactivity insertion rate is analyzed by assuming the simultaneous withdrawal of the combination of the two banks of the maximum combined worth at maximum speed.

Should a continuous RCCA withdrawal be initiated, the transient will be terminated b y the following reactor trip functions:

1. Source range neutron flux level trip-actuated when either of two independent source range channels indicates a flux level above a preselected, manually adjustable value. This trip function may be manually b ypassed when either intermediate range flux channel indicates a flux level above the source range cutoff level. It is automatically reinstated when both intermediate range channels indicate a flux level below the source range cutoff level.
2. Intermediate range neutron flux level trip - actuated when either of two independent intermediate range channels indicates a flux level above a preselected, manually adjustable value. This trip function may be manually bypassed when two of the four power range channels are reading above approximately 10 percent of full

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 14 of 83

power flux and is automatically reinstated when three of the four power range channels indicate a flux level below this value.

3. Power range neutron flux level trip (low setting) - actuated when two out of the four power range channels indicate a flux level above approximately 25 percent of full power flux. This trip function may be manually b ypassed when two of the four power range channels indicate a flux level above approximately 10 percent of full power flux and is automatically reinstated when three of the four channels indicate a flux level below this value.
4. Power range neutron flux level trip (high setting) - actuated when two out of the four power range channels indicate a flux level above a preset setpoint. This trip function is always active.

In addition, control rod stops on high intermediate range flux level and high power range flux level serve to discontinue rod withdrawal and prevent the need to actuate the intermediate range flux level trip and the power range flux level trip, respectively.

The neutron flux response to a continuous reactivity insertion is characterized by a very fast power rise terminated b y the reactivity feedback effect of the negative fuel temperature coefficient. This self-limitation of the initial power burst results from a fast negative fuel temperature feedback (Doppler effect) and is of prime importance during a startup incident since it limits the power to a tolerable level prior to external protective action.

After the initial power burst, the neutron flux is momentarily reduced and then, if the incident is not terminated by a reactor trip, the neutron flux increases again, but at a much slower rate.

Termination of the startup incident by the above protection channels prevents core damage. In addition, the reactor trip from pressurizer high pressure serves as a backup to terminate the incident before an overpressure condition could occur.

14.1.1.1 Method of Analysis The analysis of the uncontrolled RCCA bank withdrawal from subcritical accident is performed in three states: first an average core nuclear power transient calculation, then an average core heat transfer calculation, and finally the departure from nucleate boiling ratio (DNBR) calculation. The average core nuclear calculation is performed using spatial neutron kinetics methods (TWINKLE) to determine the average power generation with time including the various total core feedback effects, i.e., Doppler reactivity and moderator reactivity. The average heat flux and temperature

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 15 of 83

transients are determined by performing a fuel rod transient heat transfer calculation in FACTRAN. The average heat flux is next used in THINC for transient DNBR calculation.

Analysis of this transient incorporates the neutron kinetics, including six delayed neutron groups and the core thermal and hydraulic equations. In addition to the neutron flux response, the average fuel, clad and water temperature, and also the heat flux response, are computed.

In order to give conservative results for a startup incident, the following additional assumptions are made concerning the initial reactor conditions:

1. Since the magnitude of the neutron flux peak reached during the initial part of the transient, for any given rate of reactivity insertion, is stro ngly dependent on the Doppler power reactivity defect, a conservatively low value is used for the startup incident -955 pcm.
2. The contribution of the moderator reactivity coefficient is negligible during the initial part of the transient because the heat tr ansfer time constant between the fuel and the moderator is much longer than the neutron flux response time constant.

However, after the initial neutron flux peak, the succeeding rate of power increase is affected by the moderator temperature reactivity coefficient. The analysis is based on a moderator coefficient which was at least +5 pcm/°F at the zero power nominal average temperature, and which became less positive for higher temperatures. This was necessary since the TWINKLE computer code used in the analysis is a diffusion theory code rather than a point kinetics approximation and the moderator temperature feedback cannot be artificially held constant with temperature.

3. The reactor is assumed to be at hot zero power (547°F). This assumption is more conservative than that of a lower initial system temperature. The higher initial system temperature yields a larger fuel to water heat transfer, a larger fuel thermal capacity, and a less negative (smaller absolute magnitude) Doppler coefficient. The less negative Doppler coefficient reduces the Doppler feedback effect thereby increasing the neutron flux peak. The high neutron flux peak combined with a high fuel thermal capacity and larger thermal conductivity yields a larger peak heat flux.

Initial multiplication factor (k o) is assumed to be closely approaching 1.0 since this results in the maximum neutron flux peak.

4. The most adverse combination of instrumentation and setpoint errors, as well as delays for trip signal actuation and control rod assembly release, are taken into

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 16 of 83

account. A 10% increase has been assumed for the power range flux trip setpoint raising it from the nominal value of 25% to a value of 35% in addition to taking no credit for the source and intermediate range protection. Reference to Figure 14.1.1-1, however, shows that the rise in nuclear flux is so rapid that the effect of errors in the trip setpoint on the actual time at which the rods are released is negligible. In addition to the above, the rate of negative reactivity insertion corresponding to the trip action is based on the assumption that the highest worth control rod assembly is stuck in its fully withdrawn position.

5. Two reactor coolant pumps are assumed to be in operation. This is conservative with respect to the DNB transient.

The accident is anal yzed using the Standard Thermal Design Procedure with the initial conditions listed in Table 14.1-3. The analysis was performed for a reactivity insertion rate of 75 pcm/sec, where 1 pcm is 10-5 K/K. This reactivity insertion rate assumed is greater than that for the simultaneous withdrawal of the combination of the two sequential control banks having the greatest combined worth at maximum speed (48.125 inches/minute). The moderator temperature coefficient used in the analysis was described in assumption number 2 of the previous paragraph.

Effect of the Replacement Steam Generators on Unit 1 The effect of the Unit 1 replacement steam generators on the uncontrolled rod cluster control assembly (RCCA) bank withdrawal from a subcritical condition accident was evaluated. The parameters that affect the RCS response to an RCCA bank withdrawal from subcritical are the reactivity insertion due to rod motion, moderator temperature reactivity coefficient, and Doppler reactivit y coefficient. These parameters are not affected b y steam generator replacement.

DNB for this event is primarily dictated by core power, axial power distribution, RCS pressure, and RCS flow. Core power and axial power distribution are not affected by generator replacement because moderator feedback, Doppler feedback, and rod worth are unaffected. The pressure used in the DNB calculations is a minimum static value, typicall y the initial RCS pressure, which is not affected by replacement. The analysis of record considers 30 percent steam generator tube plugging and the attendant reduction of RCS flow in the DNB anal ysis. The RCS flow with RSGs plugged at 10 percent is higher than flow with original steam generator (OSGs) plugged at 30 percent. Therefore, the DNB acceptance criteria are met with the RSGs at the maximum allowable plugging.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 17 of 83

Because the RSGs do not adversel y affect an y of the parameters that determine the system or core response to this event, the UFSAR analysis remains bounding for DC Cook Unit 1 with the RSG up to 10 percent tube plugging.

Effect of the MUR Program on Unit 1 An evaluation of the RCCA Bank Withdrawal from Subcritical was performed to support the MUR program. With the exception of the nominal heat flux, which increased as a result of the MUR program, the transient results used to evaluate the DNB consequences remain unchanged. To accommodate the increased nominal heat flux, allocation has been made from the margin available due to the difference between the design limit DNBR and the safety analysis limit DNBR, as described in Section 3.5.3. Therefore, the conclusions for the RCCA Bank Withdrawal from Subcritical anal ysis of record are applicable and remain valid for the MUR Program.

Effect of the Return to RCS NOP/NOT Program on Unit 1 An evaluation of the RCCA Bank Withdrawal from Subcritical event was performed to support the Return to RCS NOP/NOT program. The evaluation demonstrated that the analysis would realize additional margin to the DNB acceptance criterion through modeling the increased primar y pressure of the Return to RCS NOP/NOT conditions. Therefore, the conclusions for the RCCA Bank Withdrawal from Subcritical anal ysis of record are applicable and rem ain valid for the Return to RCS NOP/NOT program.

14.1.1.2 Results and Conclusions The nuclear power, heat flux, fuel average temperature, and clad temperature versus time for a 75 pcm/sec insertion rate are shown in Figures 14.1.1-1 and 14.1.1-2. This insertion rate, coupled with a positive moderator temperature coefficient of +5 pcm/°F, yields a peak heat flux, which does not exceed the nominal value. For the RCCA withdrawal from subcritical event, the core axial power distribution is assumed severel y peaked toward the bottom of the core. The W-3 DNB correlation is used to evaluate DNBR in the span between the lower, non-mixing vane grid and the first mixing vane grid. The WRB-1 correlation remains applicable for the rest of the fuel assembly.

For all regions of the core, the DNB design bases are met, even at the MUR uprated power level.

Taking into account the conservative assumptions with which the incident has been anal yzed, it is

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 18 of 83

concluded that the core and reactor coolant system are not adversel y affected, and that there is no clad damage.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 19 of 83

14.1.2 Uncontrolled RCCA Withdraw al At Pow er 14.1.2.1 Introduction An uncontrolled RCCA bank withdrawal at power results in an increase in core heat flux. Since the heat extraction from the steam generator lags behind the power generation until the steam generator pressure reaches the relief or safety valve setpoint, there is a net increase in reactor coolant temperature. Unless terminated by manual or automatic action, the power mismatch and resultant coolant temperature rise would eventually result in DNB. Therefore, to prevent the possibility of damage to the cladding, the reactor protection system is designed to terminate any such transient before the DNBR falls below the limit value.

The automatic features of the reactor protection system which prevent core damage in an RCCA bank withdrawal incident at power include the following:

1. Nuclear power range instrumentation actuates a reactor trip on high neutron flux if two out of four channels exceed an overpower setpoint.
2. Reactor trip is actuated if any two out of four T channels exceed an overtemperature T setpoint. This setpoint is automatically varied with axial power distribution, coolant average temperature and pressure to protect against DNB.
3. Reactor trip is actuated if any two out of four T channels exceed an overpower T setpoint. This setpoint is automatically varied with coolant average temperature to ensure that the allowable fuel power rating is not exceeded.
4. A high pressure reactor trip, actuated from any two out of four pressure channels, is set at a fixed point. This set pressure is less than the set pressure for the pressurizer safety valves.
5. A high pressurizer water level reactor trip, actuated from any two out of three level channels, is set at a fixed point.

In addition to the above listed reactor trips, there are the following RCCA bank withdrawal blocks.

a. High neutron flux (one out of four)
b. Overpower T (two out of four)
c. Overtemperature T (two out of four)

The manner in which the combination of overpower and overtemperature T trips provide protection over the full range of reactor coolant system conditions is illustrated in Figures 14.1-1

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 20 of 83

through 14.1-4. These figures represent the allowable conditions of reactor coolant loop average temperature and power with the design power distribution in a two-dimensional plot.

The boundaries of operation defined b y the overpower T trip and the overtemperature T trip are represented as "protection lines" on Figures 14.1-1 through 14.1-4. The protection lines are drawn to include all adverse instrumentation and setpoint errors, so that under nominal conditions trip would occur well within the area bounded by these lines.

The area of permissible operation (power, pressure and temperature) is completely bounded b y the combination of reactor trips: high neutron flux (fixed setpoint); high pressure (fixed setpoint); low pressure (fixed setpoint); overpower and overtemperature T (variable setpoints). These trips are designed to prevent a DNBR of less than the limit value.

The purpose of this analysis is to demonstrate the manner in which the above protective systems function for various reactivity insertion rates from different initial conditions. Reactivity insertion rates and initial conditions govern which protective function occurs first.

14.1.2.2 Method of Analysis This transient is analyzed by the LOFTRAN code. The core limits as illustrated in Figures 14.1-1 through 14.1-4 are used as input to LOFTRAN to determine the minimum DNBR during the transient.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 21 of 83

This accident is analyzed with the revised thermal design procedure described in Reference 1.

Plant characteristics and initial conditions are listed in Table 14.1 -3. For an uncontrolled rod withdrawal at power accident, the following conservative assumptions are made:

A. Initial reactor power, pressure, and RCS temperatures are assumed to be at their conservative nominal values. Uncertainties in initial conditions are included in the limit DNBR as described in Reference 1.

B. Reactivity coefficients - two cases are anal yzed:

1. Minimum Reactivity Feedback. A +5 pcm/°F moderator temperature coefficient of reactivity and a least negative Doppler only power coefficient (see Table 14.1-3) are assumed.
2. Maximum Reactivity Feedback. A conservativel y large negative moderator temperature coefficient and a most negative Doppler onl y power coefficient (See Table 14.1-3) are assumed.

C. The reactor trip on high neutron flux is assumed to be actuated at a conservative value of 118 percent of nominal full power. The T trips include all adverse instrumentation and setpoint errors, while the delays for the trip signal actuation are assumed at their maximum values.

D. The RCCA trip insertion characteristic is based on the assumption that the highest worth assembl y is stuck in its fully withdrawn position.

E. The analysis is performed for a range of positive reactivity insertion rates. The maximum reactivity insertion rate analyzed is larger than that caused by the greatest reactivity worth combination of two control banks moving simultaneously at maximum rod withdrawal speed.

14.1.2.3 Results Figures 14.1.2-1 through 14.1.2-3 show the transient response for a rapid RCCA bank withdrawal incident starting from full power (case A). Reactor trip on high neutron flux occurs shortly after the start of the accident. Since the nuclear power increase is rapid with respect to the thermal time constants of the fuel, small changes in Tavg and pressure result and margin to DNB is maintained.

The transient response for a slow RCCA bank withdrawal from full power (case B) is shown in Figures 14.1.2-4 through 14.1.2-6. Reactor trip on overtemperature T occurs after a longer period

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 22 of 83

of time compared to Case A and the rise in temperature is larger and the pressure increase is smaller. Again, the minimum DNBR is greater than the limit value.

Figure 14.1.2-7 shows the minimum DNBR as a function of reactivity insertion rate for transients initiated from full power operation for both minimum and maximum reactivity feedback. It can be seen that the high neutron flux and overtemperature T reactor trip functions provide protection over the whole range of reactivity insertion rates. The minimum DNBR is alwa ys greater than the limit value.

Figures 14.1.2-8 and 14.1.2-9 show the minimum DNBR as a function of reactivity insertion rate for RCCA bank withdrawal transients initiated from 60 and 10 percent power respectively. The results are similar to the 100 percent power case, except as the initial power is decreased, the range over which the overtemperature T trip provides primary protection is increased. In both cases the minimum DNBR is always greater than the limit value.

The shape of the curves of minimum DNBR versus reactivity insertion rate in the referenced figures is due both to reactor core and coolant system transient response and to protection system action in initiating a reactor trip.

The results of cases, which examined a conservative pressurizer water volume transient due to the uncontrolled RCCA bank withdrawal at power accident, showed that the pressurizer does not fill.

The time sequence of events for the RCCA bank withdrawal transient is shown in Table 14.1.2-1.

Effect of the RTD Bypass Elimination Evaluation performed to support RTD Bypass Elimination demonstrates that the conclusions of the accident anal ysis remain valid.

Effect of the Return to RCS NOP/NOT Program on Unit 1 An evaluation of the Uncontrolled RCCA Bank Withdrawal at Power event was performed to support the Return to RCS NOP/NOT program. The evaluation demonstrated that the analysis would realize additional margin to the DNB acceptance criterion through modeling the increased primary pressure of the Return to RCS NOP/NOT conditions. Therefore, the conclusions for the Uncontrolled RCCA Bank Withdrawal at Power analysis of record are applicable and remain valid for the Return to RCS NOP/NOT program.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 23 of 83

14.1.2.4 Conclusions The high neutron flux and overtemperature T trip channels provide adequate protection over the entire range of possible reactivity insertion rates, i.e., the minimum value of DNBR is always greater than the limit value. Also, the pressurizer does not fill.

14.1.2.5 References for Section 14.1.2

1. Friedland, A. J., Ray, S., "Revised Thermal Design Procedure," WCAP-11397-P-A, April 1989

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 24 of 83

14.1.3 Rod Cluster Control Assembl y Misalignment Rod cluster control assembly misalignment accidents include:

A. A dropped RCCA B. A dropped RCCA bank C. Statically misaligned RCCA Each RCCA has a position indicator channel which displays position of the assembly. The displays of assembly positions are grouped for the operator's convenience. A rod bottom light, local alarm, and control room annunciator are actuated at 20 steps indicated (or less) to confirm a fully inserted RCCA. Group demand position is also indicated.

Except for the case of manually retrieving a dropped RCCA as provided for in approved operating procedures, as described later, RCCAs are always moved in preselected banks, and the banks are always moved in the same preselected sequence. Some banks of RCCAs are divided into two groups. The rods comprising a group operate in parallel through multiplexing thyristors. If a bank of RCCAs consists of two groups, the groups are moved in a staggered fashion, but always within one step of each other. A definite schedule of actuation (or deactuation) of the stationary gripper, movable gripper, and lift coils of a mechanism is required to withdraw the RCCA attached to the mechanism. Since the stationary gripper, movable gripper, and lift coils associated with the RCCAs of a rod group are driven in parallel, an y single failure which would cause rod withdrawal would affect a minimum of one group. Mechanical failures are in the direction of insertion, or immobility.

A dropped RCCA or RCCA bank is detected by:

A. Sudden drop in the core power level as seen b y the nuclear instrumentation system; B. Asymmetric power distribution as seen on out-of-core neutron detectors or core exit thermocouples; C. Rod bottom light; D. Rod position deviation monitor; E. Rod position indication.

F. Local alarm/control room annunciator.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 25 of 83

Misaligned RCCA are detected b y:

A. Asymmetric power distribution as seen on out-of-core neutron detectors or core exit thermocouples; B. Rod position deviation monitor; C. Rod position indication.

The resolution of the rod position indicator channel is +/- 5 percent of the 12-foot measurement span

(+/-12 steps). Deviation of any RCCA from its group by twice this distance (10 percent of span or 24 steps) will not cause power distributions worse than the design limits. As the power level is lowered, the limits for FQ and FH increase. These increases can be used for accommodating increased RCCA misalignment at a lower power level. If the measured FQ and FH at 100% RTP are smaller than the corresponding limits at 100% RTP, then these margins can be used for accommodating larger than 12-step misalignment (Reference 2). The rod position deviation monitor alerts the operator to rod deviation with respect to the group position in excess of allowed misalignment. If the rod position deviation monitor is not operable, the operator is required to take action as required by the Technical Specifications. If one or more rod position indicator channels should be out of service, detailed operating instructions shall be followed to ensure the alignment of the non-indicating RCCAs. The operator is also required to take action as required by the technical specifications.

14.1.3.1 Method of Analysis

a. One or more dropped RCCAs from the same group.

For evaluation of the dropped RCCA event, the transient system response is calculated using the LOFTRAN code described in Section 14.1. The code simulates the neutron kinetics, reactor coolant s ystem, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety valves. The code computes pertinent plant variables including temperatures, pressures, and power level.

Statepoints are calculat ed and nucl ear models are used to obtain a hot channel factor consistent with the primary s ystem conditions and reactor power. By incorporating the primary conditions from the transient and the hot channel factor from the nuclear analysis, the DNB design basis is shown to be met using the THINC code described in Section 14.1. The transient response, nuclear peaking factor analysis,

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 26 of 83

and DNB design basis confirmation are performed in accordance with the methodology described in Reference 1. Note that this analysis does not take credit for a negative flux rate reactor trip.

b. Statically Misaligned RCCA Steady state power distributions are analyzed using the methodology described in Reference 1. The peaking factors are then used as input to the THINC code to calculate the DNBR.

14.1.3.2 Results

a. One or More Dropped RCCAs Single or multiple dropped RCCAs within the same group result in a negative reactivity insertion. The core is not adversely affected during this period, since power is decreasing rapidly. Power may be reestablished either by reactivity feedback or control bank withdrawal. Following plant stabilization, normal rod retrieval or shutdown procedures are followed. The operator may manuall y retrieve the RCCA by following approved operating procedures.

Following a dropped rod event in manual rod control, the plant will establish a new equilibrium condition. The equilibrium process without control system interaction is monotonic, thus removing power overshoot as a concern, and establishing the automatic rod control mode of operation as the limiting case.

For dropped RCCA event in the automatic rod control mode, the rod control system detects the drop in power and initiates control bank withdrawal. Power overshoot may occur due to this action by the automatic rod controller after which the control system will insert the control bank to restore nominal power. Figures 14.1.3-1 and 14.1.3-2 show a typical transient response to a dropped RCCA (or RCCAs) in automatic control. Uncertainties in the initial condition are in cluded in the DNB evaluation as described in Reference 1. In all cases, the minimum DNBR remains above the limit value.

b. Dropped RCCA Bank A dropped RCCA bank typically results in a reactivity insertion greater than 500 pcm. The core is not adversel y affected during the insertion period, since power is decreasing rapidly. The transient will proceed as described in Part A, above;

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 27 of 83

however the return to power will be less due to the greater worth of an entire bank.

Following plant stabilization, normal rod retrieval or shutdown procedures are followed to further cool down the plant. Any action required of the operator to maintain the plant in a stabilized condition will be in a time frame in excess of ten minutes following the incident.

c. Statically Misaligned RCCA The most severe misalignment situations with respect to DNBR at significant power levels arise from cases in which one RCCA is fully inserted, or where bank D is fully inserted with one RCCA fully withdrawn. Multiple independent alarms, including a bank insertion limit alarm, alert the operator well before the postulated conditions are approached. The bank can be inserted to its insertion limit with an y one assembly fully withdrawn without the DNBR falling below the limit value.

The insertion limits in the Technical Specifications may vary from time to time depending on a number of limiting criteria. It is preferable, therefore, to analyze the misaligned RCCA case at full power for a position of the control bank as deepl y inserted as the criteria on minimum DNBR and power peaking factor will allow.

The full power insertion limits on control bank D must then be chosen to be above that position and will usually be dictated b y other criteria. Detailed results will vary from cycle to cycle depending on fuel arrangements.

With bank D inserted to its full insertion limit and one RCCA fully withdrawn, DNBR does not fall below the limit value. This case is analyzed assuming the initial reactor power, pressure, and RCS temperatures are at their nominal values (as given in Table 14.1-3) but with the increased radial peaking factor associated with the misaligned RCCA.

DNB calculations have not been performed specifically for RCCAs missing from other banks; however, power shape calculations have been done as required for RCCA ejection analysis. Inspection of the power shapes shows that the DNB and peak kw/ft situation is less severe than the bank D case discussed above assuming insertion limits on the other banks equivalent to a bank D full-in insertion limit.

For RCCA misalignments with one RCCA fully inserted, the DNBR does not fall below the limit value. This case is analyzed assuming the initial reactor power, pressure, and RCS temperatures are at their nominal values, (as given in Table 14.1-

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 28 of 83

3) but with the increased radial peaking factor associated with the misaligned RCCA.

DNB does not occur for the RCCA misalignment incident and thus the ability of the primary coolant to remove heat from the fuel rod is not reduced. The peak fuel temperature corresponds to a linear heat generation rate based on the radial peaking factor penalty associated with the misaligned RCCA and the design axial power distribution. The resulting linear heat generation is well below that which would cause fuel melting.

Following the identification of a RCCA group misalignment condition by the operator, the operator is required to take action as required by the plant Technical Specifications and operating instructions.

Effect of the Replacement Steam Generators on Unit 1 The effect of the Unit 1 replacement steam generators on the rod cluster control assembly (RCCA) misalignment accidents was evaluated. Parameters that affect the response to a dropped RCCA or RCCA bank are reactivity insertion due to rod motion, moderator temperature reactivity coefficient, and Doppler reactivity coefficient. The key parameter that affects the response to a static RCCA misalignment is the resulting power distribution. These parameters are not affected by generator replacement.

The analysis of record considers 30 percent steam generator tube plugging and the attendant reduction of RCS flow in the DNB analysis. The RCS flow with RSGs plugged at 10 percent is higher than flow with original steam generators (OSGs) plugged at 30 percent. Therefore, the DNB acceptance criteria are met with the RSGs at the maximum allowable plugging of 10 percent.

Consequently, the conclusions of the static RCCA misalignment anal ysis of record are applicable, and all safet y criteria continue to be met for the RSG up to 10 percent tube plugging.

Effect of the MUR Program on Unit 1 An evaluation of these RCCA misalignment accidents was performed to support the MUR program. To accommodate the increased nominal heat flux, allocation has been made from the margin available due to the difference between the design limit DNBR and the safet y anal ysis limit DNBR, as described in Section 3.5.3. Therefore, the conclusions for the analysis of record are applicable and remain valid for the MUR Program.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 29 of 83

Effect of the Return to RCS NOP/NOT Program on Unit 1 An evaluation of the RCCA misalignment/dropped RCCA events was performed to support the Return to RCS NOP/NOT program. The evaluation demonstrated that the current licensing basis analyses, consisting of the generation and analysis of event statepoints as well as subsequent evaluations to support the RSG and MUR programs, support conditions that bound those of the Return to RCS NOP/NOT program. Therefore, the conclusions for the RCCA misalignment anal ysis of record are applicable and remain valid for the Return to RCS NOP/NOT program.

14.1.3.3 References for Section 14.1.3

1. Haessler, R. L., et. al., "Methodology for the Analysis of the Dropped Rod Event,:

WCAP-11394 (Proprietary) and WCAP-11395 (Non-Proprietary), April 1987.

2. "Donald C. Cook Nuclear Plant Control Rod Misalignment Analyses", September 1993. Attachment 4 to AEP:NRC:1182.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 30 of 83

14.1.4 RCCA Drop Section 14.1.4 has been combined with Section 14.1.3.

14.1.5 Chemical and Volume Control System Malfunction Reactivity can be added to the core b y feeding primary grade water into the reactor coolant s ystem via the reactor makeup portion of the chemical and volume control system. Boron dilution is a manual operation. A boric acid blend system is provided to permit the operator to match the boron concentration of reactor coolant makeup water during normal charging to that in the reactor coolant system. The chemical and volume control system (CVCS) is designed to limit, even under various postulated failure modes, the potential rate of dilution to a value which provides the operator sufficient time to correct the situation in a safe and orderly manner.

The opening of the primary water makeup control valve supplies water to the reactor coolant system which can dilute the reactor coolant. Inadvertent dilution can be readily terminated by closing this valve. In order for makeup water to be added to the reactor coolant system, at least one charging pump must also be running in addition to the primary water pumps.

The rate of addition of unborated water makeup to the reactor coolant system is limited by the capacity of the primary water pumps. The maximum addition rate in this case is 225 gpm with both primary water pumps running. The 225 gpm reactor makeup water delivery rate is based on a pressure drop calculation comparing the pump curves with the system resistance curve. This is the maximum delivery based on the unit piping layout. Normall y, only one primary water supply pump is operating while the other is on standby.

The boric acid from the boric acid tank is blended with primary grade water in the blender and the composition is determined by the preset flow rates of boric acid and primary grade water on the control board.

In order to dilute, two separate operations are required. First, the operator must switch from the automatic makeup mode to the dilute mode; second, the control switch must be taken to the start position. Omitting either step would prevent dilution. This makes the possibility of inadvertent dilution very remote.

Information on the status of reactor coolant makeup is continuously available to the operator.

Lights are provided on the control board to indicate the operating condition of pumps in the chemical and volume control system. Alarms are actuated to warn the operator if boric acid or demineralized water flow rates deviate from preset values as a result of s ystem malfunction.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 31 of 83

To cover all phases of the plant operation, boron dilution during shutdown, refueling, startup, and power operation were examined. Included in the anal ysis was the effect of the difference in the density of the unborated water makeup water and the density of the reactor coolant. The analysis is to show that, from initiation of the event, sufficient time is available to allow the operator to determine the cause of the addition and take corrective action before excessive shutdown margin is lost.

Effect of the Replacement Steam Generators on Unit 1 The effect of the RSGs on the results of the chemical and volume control system ( CVCS) malfunction was evaluated. Parameters that affect the RCS response during the CVCS malfunction are the dilution flow rate, initial boron concentration, and primary volume. The RSGs do not affect the dilution flow rate or the initial boron concentration. Furthermore, the primary volume of the RSG is larger than that of the original steam generator (OSG), reducing the reactivity insertion for a given dilution flow rate, increasing the time available for the operator to take action.

The lower reactivity insertion rate would result in a smaller reactor power increase for the at-power transient, and a slower increase in reactivity for the shutdown dilution events. Therefore, the conclusions in the UFSAR are applicable to operation with the RSGs.

Effect of the MUR Program on Unit 1 The effect of the uprate on the results of the Chemical and Volume Control System Malfunction event was evaluated. The critical parameters in the determination of the time available include the overall RCS active volume, the dilution flow rate, and the initial and critical boron concentrations.

The anal ysis does not explicitly model or consider the initial power level. The only possible impact from the increase in power level is with respect to the reactor trip time assumed in the anal ysis.

The result of this evaluation showed that there is a small change in the trip time. However, the time for operator action is still valid. Therefore, the conclusions for the Boron Dilution analysis of record are applicable and remain valid for the MUR Program.

Effect of the RTD Bypass Elimination Evaluation performed to support RTD Bypass Elimination demonstrates that the conclusions of the accident anal ysis remain valid.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 32 of 83

Effect of the Return to RCS NOP/NOT Program on Unit 1 An evaluation of the CVCS malfunction event was performed to support the Return to RCS NOP/NOT program. The evaluation demonstrated that the analyses for Modes 1 and 2 would realize a minimal benefit modeling Return to RCS NOP/NOT conditions (reduced tempera ture and increased pressure for Mode 1, increased pressure for Mode 2) due to the decreased coolant density used in volume calculations with respect to the densities used in the analyses of record.

Modes 4 and 5 and Mode 6 are not impacted b y the Return to RCS NOP/NOT operating conditions.

Therefore, the conclusions for the CVCS malfunction anal ysis of record are applicable and remain valid for the Return to RCS NOP/NOT program.

Conclusions Because of the steps involved in the dilution process, an erroneous dilution is considered highly unlikely. Nevertheless, if it does occur numerous alarms and indications are available to alert the operator to the condition. The maximum reactivity addition due to the dilution is slow enough to allow the operator to determine the cause of the addition and take corrective action before excessive shutdown margin is lost.

During certain types of operation, it is plausible that the refueling water storage tank (RWST) is at a lower boric acid concentration than the reactor coolant system water. Due to the large reactivit y margins inherent in the design basis for the RWST boron concentration and slow dilution process, it has been determined that this need not be considered as a dilution source. See Reference 1.

14.1.5.1 References for Section 14.1.5

1. Youngblood, B. J. (NRC), letter to J. E. Dolan (I&M), "Interpretation of Technical Specifications that Apply to Borated Water Addition to the Reactor Coolant System from the Refueling Water Storage Tank," April 8, 1986

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 33 of 83

14.1.6 Loss of Reactor Coolant Flow (Including Locked Rotor Anal ysis)

A loss of reactor coolant flow may result from a simultaneous loss of electrical supplies to all reactor coolant pumps. If the reactor is at power at the time of the accident, the immediate effect of loss of coolant flow is a rapid increase in the coolant temperature, which is magnified by the positive MTC. This increase could result in DNB with subsequent fuel damage if the reactor were not tripped promptly. The following trip circuits provide the necessary protection against a loss of coolant flow incident:

1. Undervoltage or underfrequency on pump power supply buses
2. Pump circuit breaker opening
3. Low reactor coolant flow These trip circuits and their redundancy are further described in Chapter 7 (Protective Systems).

Simultaneous loss of electrical power to all reactor coolant pumps at full power is the most severe credible loss of flow condition. For this condition, reactor trip together with flow sustained by the inertia of the coolant and rotating pump parts will be sufficient to prevent RCS overpressurization and the DNB ratio from exceeding the limit values.

14.1.6.1 Method of Analysis The following loss of flow cases are anal yzed:

1. Loss of four pumps from nominal full power conditions with four loops operating.
2. Loss of one pump from nominal full power conditions with four loops operating.

The normal power supplies for the pumps are four buses connected to the generator. Each bus supplies power to one pump. When a generator trip occurs, the pumps are automatically transferred to a bus supplied from external power lines, and the pumps will continue to supply coolant flow to the core. The simultaneous loss of power to all reactor coolant pumps is a highl y unlikely event. Since each pump is on a separate bus, a single bus fault would not result in the loss of more than one pump.

A full plant simulation is used in the analysis to compute the core average and hot spot heat flux transient responses, including flow coastdown, temperature, reactivity and control rod insertion effects.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 34 of 83

These data are then used in a detailed thermal-hydraulic computation to compute the margin to DNB using RTDP. This computation solves the continuity, momentum and energy equations of fluid flow together with the WRB-1 DNB correlation.

Uncertainties in initial conditions are included in the limit DNBR as described in Reference 1. The initial conditions used are listed in Table 14.1-3.

This transient is analyzed by three digital computer codes. First th e LOFTRAN code, described in Section 14.1, is used to calculate the loop and core flow during the transient, the time of reactor trip based on the calculated flows, the nuclear power transient, and the primary system pressure and temperature transients. The FACTRAN code, described in Section 14.1, is then used to calculate the heat flux transient based on the nuclear power and flow from LOFTRAN.

Finally, the THINC-IV code, also described in Section 14.1, is used to calculate the DNBR during the transient based on the heat flux from FACTRAN and flow from LOFTRAN. The DNBR transients presented represent the minimum of the typical or thimble cell for each type of fuel.

14.1.6.2 Results Figures 14.1.6-1 through 14.1.6-3 show the transient response for the loss of power to all RCPs with four loops in operation. The reactor is assumed to be tripped on undervoltage signal. Figure 14.1.6-3 shows the DNBR to be always greater than the limit value for the most limiting fuel assembly cell.

Figures 14.1.6-4 through 14.1.6-6 show the transient response for the loss of one RCP with four loop operation. The reactor is assumed to be tripped on low flow signal. Figure 14.1.6-6 shows the DNBR to be always greater than the limit value for the most limiting fuel assembly c ell. The sequence of events following each of these transients is included in Table 14.1.6-1.

Since DNB does not occur, the ability of the primary coolant to remove heat from the fuel rod is not significantly reduced. Thus, the average fuel and clad temperature do not increase significantl y above their respective initial values.

Effect of the Replacement Steam Generators on Unit 1 The effect of the RSGs on the loss of reactor coolant flow has been evaluated. Parameters that affect the approach to the DNB limit are the RCS flow, reactor coolant pump moment of inertia, and the relevant trip delay times. The stead y-state RCS flow with the RSGs plugged at 10 percent is higher than the flow with 30 percent plugging in the original steam generators (OSGs), therefore;

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 35 of 83

the initial DNB ratio is larger for the RSGs than for the OSGs. Reactor coolant flow coast down is primarily determined by the pump inertia and RCS hydraulic resistance. Pump inertia is not affected by the generator, however flow coast down time could be marginally increased with the RSGs due to the slightly lower flow resistance. Reactor trip delay time is a function of the equipment that comprises the trip string, which is not affected by the generator.

The margin to DNB during the event is improved with the RSGs. Therefore, the conclusions of the loss of flow analysis of record are applicable, and all safety criteria are met for the RSGs up to 10 percent tube plugging.

Effect of the MUR Program on Unit 1 An evaluation of the Loss of Flow event was performed to support the MUR program. With exception of the nominal heat flux, which increased as a result of the MUR program, the transient results used to evaluate the DNB consequences remain unchanged. To accommodate the increased nominal heat flux, allocation has been made from the margin available due to the difference between the design limit DNBR and the safet y analysis limit DNBR, as described in Section 3.5. 3.

Therefore, the conclusions for the Loss of Flow analysis of record are applicable and remain valid for the MUR Program.

Effect of the Return to RCS NOP/NOT Program on Unit 1 An evaluation of the Loss of Flow event was performed to support the Return to RCS NOP/NOT program. The evaluation demonstrated that the analysis would realize additional margin to the DNB acceptance criterion through modeling the increased primary pressure of the Return to RCS NOP/NOT conditions. Therefore, the conclusions for the Loss of Flow analysis of record are applicable and remain valid for the Return to RCS NOP/NOT program.

14.1.6.3 Conclusions The analysis shows that the DNBR will not decrease below the limit value at any time during the transient. Thus, no fuel or clad damage is predicted, and all applicable acceptance criteria are met even at the MUR uprated power level.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 36 of 83

14.1.6.4 Locked Rotor Accident A transient analysis has been performed for the instantaneous seizure of a reactor coolant pump rotor. Flow through the affected reactor coolant loop is rapidly reduced, leading to a reactor trip on a low flow signal. Following the trip, heat stored in the fuel rods continues to pass into the core coolant, causing the coolant to expand. At the same time, heat transfer to the shell side of the steam generator is reduced, first because the reduced flow results in a decreased tube side film coefficient and then because the reactor coolant in the tubes cools down while the shell side temperature increases (turbine steam flow is reduced to zero upon plant trip). The rapid expansion of the coolant in the reactor core, combined with the reduced heat transfer in the steam generator causes an insurge into the pressurizer and a pressure increase throughout the reactor coolant system. The insurge into the pressurizer causes a pressure increase which in turn actuates the automatic spray system, opens the power-operated relief valves, and opens the pressurizer safet y valves, in a sequence dependent on the rate of insurge and pressure increase. The power-operated relief valves are designed for reliable operation and would be expected to function properl y during the accident. However, for conservatism, their pressure-reducing effect as well as the pressure-reducing effect of the spray are not included in this analysis.

The locked rotor accident anal ysis was performed for four loop operation. The locked rotor event is examined to determine the DNB transient and to demonstrate that the peak RCS pressure and peak clad temperature remain below the limit value.

14.1.6.4.1 Method of Analysis Two digital-computer codes are used to analyze this transient. The LOFTRAN code is used to calculate the resulting loop and core flow transients following the pump seizure, the time of reactor trip based on the loop flow transients, the nuclear power following reactor trip, and to determine the peak pressure. The thermal behavior of the fuel located at the core hot spot is investigated using the FACTRAN code, using the core flow and the nuclear power calculated by LOFTRAN.

The FACTRAN code includes the use of a film boiling heat transfer coefficient.

14.1.6.4.2 Evaluation of the Pressure Transient After pump seizure, the neutron flux is rapidly reduced by control rod insertion. Rod motion begins 1 second after the flow in the affected loop reaches 87 percent of nominal flow. No credit is taken for the pressure reducing effect of the pressurizer relief valves, pressurizer spray, steam dump or controlled feedwater flow after plant trip.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 37 of 83

Although these operations are expected to occur and would result in a lower peak RCS pressure, an additional degree of conservatism is provided by ignoring their effect. Table 14.1-3 presents the initial conditions assumed for the peak pressure transient.

The analysis assumed that the pressurizer safety valves initially open at 2575 psia and achieve rated flow at 2580 psia.

14.1.6.4.3 Evaluation of DNB in the Core During the Accident For this accident, two DNB-related evaluations are made. The first evaluation has the assumption of rods going into DNB as a conservative initial condition in order to determine the clad temperature and zirconium water reaction. Results obtained from analysis of this "hot spot" condition represent the upper limit with respect to clad temperature and zirconium water reaction.

In the evaluation, the rod power at the hot spot is assumed to be 2.5 times the average rod power (i.e., FQ = 2.5) at the initial core power level. Table 14.1-3 presents the initial conditions assumed for the peak clad temperature evaluation.

A second evaluation made for this transient is to determine what percentage, if any, of rods are expected to be in DNB during the transient. For evaluation of this part of the transient, predicted core conditions are used as input to a THINC-IV calculation of the minimum DNBR during the transient. Results of the THINC-IV evaluation are then used to determine the percentage of fuel rods, which experience DNB. Table 14.1-3 presents the initial conditions assumed for the percentage of rods in DNB anal ysis.

14.1.6.4.4 Film Boiling Coefficient The film boiling coefficient is calculated in the FACTRAN code using the Bishop-Sandberg-Tong film boiling correlation. The fluid properties are evaluated at film temperatures (average between wall and bulk temperatures). The program calculates the film coefficient at ever y time step based upon the actual heat transfer conditions at the time. The neutron flux, system pressure, bulk density, and mass flow rate as a function of time are used as program input.

For this analysis, the initial values of the pressure and the bulk density are used throughout the transient since they are the most conservative with respect to clad temperature response. For conservatism, DNB was assumed to start at the beginning of the accident.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 38 of 83

14.1.6.4.5 Fuel Clad Gap Coefficient The magnitude and time dependence of the heat transfer coefficient between fuel and clad (gap coefficient) has a pronounced influence on the thermal results. The larger the value of the gap coefficient, the more heat is transferred between pellet and clad. Based on investigations of the effect of the gap coefficient upon the maximum clad temperature during the transient, the gap coefficient was assumed to increase from a steady state value consistent with initial fuel temperature to 10,000 BTU/hr-ft2-°F at the initiation of the transient. Thus the large amount of energy stored in the fuel because of the small initial value is released to the clad at the initiation of the transient.

14.1.6.4.6 Zirconium-Steam Reaction The zirconium-steam reaction can become significant above 1800°F (clad temperature). In order to take this phenomenon into account, the following correlation, which defines the rate of the zirconium-steam reaction, was introduced into the model:(2) d(w 62)-45,500 dt = 1.986T33.3x10exp where:

w = amount reacted, mg/cm2 t = time, sec T = temperature, °K The reaction heat is 1510 cal/gm

14.1.6.4.7 Results The transient results for the locked rotor accident are shown in Figures 14.1.6-7 through 14.1.6-9.

The peak RCS pressure (2641 psia) reached during the transient is less than that which would cause stresses to exceed the faulted condition stress limits. The pressure response shown in Figure 14.1.6-8 is the response at the point in the reactor coolant system having the maximum pressure.

Also, the peak clad surface temperature (1934°F) is considerably less than the 2700°F limit for Standard ZIRLO fuel cladding and the 2375°F limit for Optimized ZIRLO fuel cladding.. The sequence of events is included in Table 14.1.6-1.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 39 of 83

For the most limiting fuel assembly, less than 7% of the rods reach a DNBR value less than the limit value.

Effect of the Replacement Steam Generators on Unit 1 The effect of the RSGs on the locked rotor event has been evaluated. Parameters that determine the core and s ystem responses are the initial primary system flow, locked pump rotor resistance, and the low reactor coolant flow trip time. The steady-state RCS flow with the RSGs plugged at 10 percent is higher than the flow with 30 percent plugging in the original steam generators (OSGs), therefore; the initial DNB ratio is larger for the RSGs than for the OSGs. Neither the hydraulic resistance of a locked pump rotor nor the low flow trip delay time are affected b y steam generator replacement.

The RCS flow with the RSGs is higher than flow with the OSGs, so the DNBR is higher during the locked rotor event with the RSGs. The flow resistance of a locked rotor and the trip delay time do not change with steam generator replacement. Therefore, the locked rotor anal ysis of record is bounding for the RSGs up to 10 percent tube plugging.

Effect of the MUR Program on Unit 1 An evaluation of the Locked Rotor event was performed to support the MUR program. With exception of the nominal heat flux, which increased as a result of the MUR program, the transient results used to evaluate the DNB consequences remain unchanged. The RCS pressure criterion also continues to be met for this event. To accommodate the increased nominal heat flux, allocation has been made from the margin available due to the difference between the design limit DNBR and the safety analysis limit DNBR, as described in Section 3.5.3. Therefore, the conclusions for the Locked Rotor analysis of record are applicable and remain valid for the MUR Program.

Effect of the Return to RCS NOP/NOT Program on Unit 1 An evaluation of the Locked Rotor event was performed to support the Return to RCS NOP/NOT program. The evaluation demonstrated that the peak clad temperature and rods-in-DNB cases would realize additional margin to the applicable acceptance criteria through modeling the increased primary pressure of the Return to RCS NOP/NOT conditions since, as shown in Table 14.1-3, the initial conditions for the limiting cases were based on the reduced primary pressure of 2100 psia (2033 psia for the peak clad temperature case taking into account 67 psi uncertainty).

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 40 of 83

Additionally, all cases, including the peak RCS pressure case, would realize additional margin to the applicable acceptance criteria through modeling the maximum allowable vessel average temperature of the Return to RCS NOP/NOT conditions, which is less than the maximum allowable vessel average temperatures for the reduced temperature and pressure and rerating programs supported b y the analysis of record (refer to Table 14.1-1 and Table 14.1-3). Therefore, the conclusions for the Locked Rotor analysis of record are applicable and remain valid for the Return to RCS NOP/NOT program.

14.1.6.4.8 Locked Rotor Radiological Consequence Analysis For the locked rotor radiological consequence analysis, offsite power is assumed to be lost, and main steam condensers are assumed to be unavailable for steam dump. Twenty-four (24) hours after the accident the residual heat removal system is assumed to be in service, RCS temperature is assumed to be 212°F and steam and activity are no longer assumed to be released to the environment.

The radiological consequence analysis is performed based on Regulatory Guide 1.183 for the alternative source term. Parameters used in this analysis are listed in Table 14.1.6-2. Atmospheric dispersion factors are provided in Tables 2.2-11 and 2.2-12 The locked rotor radiological consequence anal ysis uses the departure from nucleate boiling ratio as a fuel cladding failure criterion. This analysis assumes that less than 11% of the fuel rods reach a departure from nucleate boiling ratio value less than the limit value. The core inventory is listed in Table 14.A.1-1.

The resulting dose consequences are shown below.

EAB LPZ Control Room (rem TEDE) (rem TEDE) (rem TEDE)

Locked Rotor Dose 1.82 0.80 4.74 Acceptance Limit 2.5 2.5 5

The offsite dose consequences meet the acceptance criteria of Regulatory Guide 1.183, and the control room dose is within the limit established by 10 CFR 50.67.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 41 of 83

14.1.6.4.9 Conclusions A. Since the peak RCS pressure reached during any of the transients is less than that which would cause stresses to exceed the faulted conditions stress limits, the integrit y of the primary coolant system is not endangered even at the MUR uprated power level.

B. Since the peak clad surface temperature calculated for the hot spot during the worst transient remains considerabl y less than 2375°F (the more restrictive temperature associated with Optimized ZIRLO fuel cladding at which clad embrittlement may be expected), the core will remain in place and intact with no loss of core cooling capability even at the MUR uprated power level.

C. The control room dose is within the 5 rem TEDE 10 CFR 50.67 limit, and the offsite dose consequences meet the acceptance criteria of Regulatory Guide 1.183.

14.1.6.5 References for Section 14.1.6

1. Friedland, A. J., Ray, S., "Revised Thermal Design Procedure," WCAP-11397-P-A, April, 1989.
2. Baker, L., and L. C. Just, "Studies of Metal Water Reactions of High Temperatures, III. Experimental and Theoretical Studies of Zirconium-Water Reaction," ANL-6548, May 1962.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 42 of 83

14.1.7 Startup of an Inactive Reactor Coolant Loop Technical Specifications prohibit operation of the reactor with an idle reactor loop (Modes 1 and 2). Therefore, the condition for which this analysis is required is no longer applicable. As noted in the NRC Safety Evaluation related to the amendments that changed Technical Specification 3/4.4.1, Reactor Coolant Loops and Coolant Circulation, reanalysis of this section of the UFSAR is not required subsequent to the issuance of the enabling amendment (Unit 1, Amendment 120).

Per Technical Specification 3.4.4, Cook 1 is not permitted to operate with less than four reactor coolant pumps during Modes 1 and 2. The effects of the RSGs, MUR program, and Return to RCS NOP/NOT program on the startup of an inactive loop event are, therefore, not evaluated.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 43 of 83

14.1.8 Loss of External Electrical Load The loss of external electrical load may result from an abnormal variation in network frequency, or other adverse network operating conditions. It may also result from a trip of the turbine generator or in an unlikely opening of the main breaker from the generator which fails to cause a turbine trip but causes a rapid large nuclear steam supply system load reduction by the action of the turbine control.

In the event the steam dump valves fail to open following a large load loss the steam generator safet y valves may lift and the reactor may be tripped by the high pressurizer pressure signal or the high pressurizer water level signal. The steam generator shell side pressure and reactor coolant temperature will increase rapidly. The pressurizer safet y valves and steam generator safet y valves are, however, sized to protect the reactor coolant system and steam generator against overpressure for all load losses without assuming availability of the steam dump system. The steam dump valves will not be opened for load reductions of 10% or less. For larger load reductions they may open depending on the capability of the reactor control system.

The most likely source of a complete loss of load in the nuclear steam supply system is a trip of the turbine-generator. In this case, there is a direct reactor trip signal (unless power is below approximately 31% power, i.e., below P-8) derived from the turbine emergency trip fluid pressure.

Reactor coolant temperatures and pressure do not significantl y increase if the steam dump system and pressurizer pressure control system are functioning properly. However, in this analysis, the behavior of the unit is evaluated for a complete loss of load from 100% of full power without a direct reactor trip primarily to show adequacy of the pressure relieving devices and also to show that no core damage occurs. The reactor coolant system and main steam s ystem pressure relieving capacities are designed to ensure safety of the unit without requiring the automatic rod control, pressurizer pressure control and/or steam dump control systems.

14.1.8.1 Method of Analysis The loss of load transients are analyzed by employing the detailed digital computer program LOFTRAN (Reference 1), as described in Section 14.1. The program simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safet y valves, pressurizer spra y, steam generator, and steam generator safety valves. The program computes pertinent plant variables including temperatures, pressures, and power level.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 44 of 83

This accident is analyzed with the Revised Thermal Design Procedure (Reference 2), as mentioned in Section 14.1. Plant characteristics and initial conditions are listed in Table 14.1-3.

Major assumptions are summarized below:

A. Initial Operating Conditions - nominal initial conditions for reactor power, pressure, and RCS temperatures are assumed for statistical DNB anal yses.

B. Moderator and Doppler Coefficients of Reactivity - the loss of load is analyzed with both maximum and minimum reactivity feedback. The maximum feedback cases assume a large negative moderator temperature coefficient and the most negative Doppler power coefficient. The minimum feedback cases assume a +5 pcm/°F MTC and the least negative Doppler coefficients.

C. Reactor Control - from the standpoint of the maximum pressures attained it is conservative to assume that the reactor is in manual control. If the reactor were in automatic control, the control rod banks would move prior to trip and reduce the severit y of the transient.

D. Pressurizer Spray and Power-Operated Relief Valves - two cases for both the minimum and maximum moderator feedback cases are anal yzed:

1. Full credit is taken for the effect of pressurizer spray and power-operated relief valves in reducing or limitin g the coolant pressure. Safet y valves are also available.
2. No credit is taken for the effect of pressurizer spray and power-operated relief valves in reducing or limiting the coolant pressure. Safet y valves are operable.

E. Steam Release - no credit is taken for the operation of the steam dump system or steam generator power-operated relief valves. The steam generator pressure rises to the safety valve setpoints where steam release through the safety valves limits secondar y steam pressure.

F. Feedwater Flow - main feedwater flow to the steam generators is assumed to be lost at the time of turbine trip. No credit is taken for auxiliary feedwater flow since a stabilized plant condition will be reached before auxiliary feedwater initiation is normally assumed to occur; however, the auxiliary feedwater pumps would be expected to start on a trip of the main feedwater pumps. The auxiliary feedwater flow would remove core decay heat following plant stabilization.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 45 of 83

G. Reactor trip is actuated by the first reactor protection system trip setpoint reached.

Trip signals are expected due to high pressurizer pressure, overtemperature T, high pressurizer water level, and low-low steam generator water level.

14.1.8.2 Results The transient responses for a loss of load from 100% full power operation are shown for four cases:

two cases for minimum reactivity feedback and two cases for maximum reactivity feedback (Figures 14.1.8-1 through 14.1.8-12).

Figures 14.1.8-1 through 14.1.8-3 show the transient responses for the loss of load with minimum reactivit y feedback assuming full credit for the pressurizer spray and pressurizer power-operated relief valves. No credit is taken for the steam dump. The reactor is tripped by the overtemperature T trip signal.

The minimum DNBR remains well above the limit value. The pressurizer relief and safety valves prevent overpressurization of the primary system. The steam generator safety valves prevent overpressurization of the secondary system, maintaining pressure below 110 percent of design value.

Figures 14.1.8-4 through 14.1.8-6 show the responses for the total loss of steam load with maximum reactivity feedback. All other plant parameters are the same as the above. The DNBR increases throughout the transient and never drops below its initial value. Pressurizer relief valves and steam generator safety valves prevent overpressurization in primary and secondary s ystems, respectively. The reactor is tripped by the low-low steam generator water level signal. The pressurizer safety valves are not actuated for this case.

In the event that feedwater flow is not terminated at the time of turbine trip for this case, flow would continue under automatic control with the reactor at a reduced power. The operator would take action to terminate the tr ansient and bring the plant to a stabilized condition. If no action were taken by the operator the reduced power operation would continue until the condenser hotwell was emptied. A low-low steam generator water level reactor trip would be generated along with auxiliary feedwater initiation signals. Auxiliary feedwater would then be used to remove decay heat with the results less severe than those presented in Section 14.1.9, Loss of Normal Feedwater Flow.

The loss of load accident was also studied assuming the plant to be initially operating at full power with no credit taken for the pressurizer spray, pressurizer power-operated relief valves, or steam

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 46 of 83

dump. The reactor is tripped on the high pressurizer pressure signal. Figures 14.1.8-7 through 14.1.8-9 show the transient responses with minimum reactivity feedback. The neutron flux remains essentially constant at full power until the reactor is tripped. The DNBR never goes below its initial value throughout the transient. In this case the pressurizer safet y valves are actuated, and maintain system pressure below 110 percent of the design value.

Figures 14.1.8-10 through 14.1.8-12 show the transient responses with maximum reactivity feedback with the other assumptions being the same as in the preceding case. Again, the DNBR increases throughout the transient and the pressurizer safet y valves are actuated to limit primary pressure.

The sequence of events following each of these transients is included in Table 14.1.8-1.

14.1.8.3 Conclusions Results of the analyses show that the plant design is such that a loss of load without a direct or immediate reactor trip presents no hazard to the integrity of the RCS or the main steam system.

Pressure relieving devices incorporated in the two systems are adequate to limit the maximum pressures to within the design limits.

The integrity of the core is maintained by operation of the reactor protection system, i.e., the DNBR will be maintained above the limit value.

14.1.8.4 Evaluation of Lower Initial RCS Temperature An evaluation has been performed for a lower initial RCS average temperature in analysis of the Loss of Load/Turbine Trip (LOL/TT) event (References 3 and 4). The current analysis uses nominal full power temperature plus the temperature uncertaint y in modeling the pressure transient case. However, recent analysis shows that a lower initial temperature delays actuation of the secondar y-side main steam safety valves and results in a higher peak RCS pressure. The difference in peak RCS pressure is caused by a slight variation in the timing of main steam safety valve actuation and the time of maximum RCS pressure. The evaluation concludes that RCS pressure increases by 3 psi to a peak RCS pressure of 2679.6 psia. The peak RCS pressure remains below the applicable maximum allowable RCS pressure limit of 2748.5 psia (110% of design pressure).

Therefore, the conclusion of the analysis, that the LOL/TT events present no hazard to the integrit y of the RCS, remains valid.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 47 of 83

Effect of the RTD Bypass Elimination Evaluation performed to support RTD Bypass Elimination demonstrates that the conclusions of the accident anal ysis remain valid.

Effect of the Return to RCS NOP/NOT Program on Unit 1 An evaluation of the LOL/TT event was performed to support the Return to RCS NOP/NOT program. The evaluation demonstrated that the analysis would realize additional margin to both the DNB and peak pressure acceptance criteria through modeling the increased primary pressure of the Return to RCS NOP/NOT conditions. Additionally, both the DNB and the peak pressure cases would realize additional margin to the applicable acceptance criteria through modeling the maximum allowable vessel average temperature of the Return to RCS NOP/NOT conditions, which is less than the maximum allowa ble vessel average t emperatures for the reduced temperature and pressure and rerating programs supported by the analysis of record (refer to Table 14.1-1 and Table 14.1-3). The anal ysis of record assumed a lower RCS pressure that was related to 2100 psia, which is conservative for the RCS pressure acceptance criterion since lower initial pressure dela ys the high pressurizer pressure reactor trip. Therefore, the conclusions for the LOL/TT analysis of record are applicable and remain valid for the Return to RCS NOP/NOT program.

14.1.8.5 References for Section 14.1.8

1. Burnett, T.W.T., et al., LOFTRAN Code Description, WCAP -7907-A, April 1984.
2. Friedland, A.J., Ray, S., Revised Thermal Design Procedure, WCAP -11397-P-A, April 1989.
3. AEP-03-8, AEP DC Cook Units 1 and 2 NSAL 1: Safety Analysis Modeling Loss of Load/Turbine Trip, February 3, 2003.
4. NSAL-03-1, Safet y Analysis Modeling Loss of Load/Turbine Trip, 1/27/03.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 48 of 83

14.1.9 Loss of Normal Feedw ater Flow A loss of normal feedwater (from pump failures, valve malfunctions, or loss of offsite AC power) results in a reduction in capability of the secondary system to remove the heat generated in the reactor core. If an alternative supply of feedwater were not supplied to the plant, core residual heat following reactor trip would heat the primary system water to the point where water relief from the pressurizer would occur, resulting in a substantial loss of water from the RCS. Since the plant is tripped well before the steam generator heat transfer capability is reduced, the primary system variables never approach a DNB condition.

The reactor trip on low-low water level in an y steam generator provides the necessary protection against a loss of normal feedwater.

The auxiliary feedwater system is started automatically. The turbine driven auxiliary feedwater pump utilizes steam from the secondary s ystem and exhausts to the atmosphere. The motor driven auxiliary feedwater pumps are supplied by power from the diesel generators if a loss of offsite power occurs. The pumps take suction directly from the condensate storage tank for delivery to the steam generators.

An analysis of the system transient is presented below to show that following a loss of normal feedwater when in reduced temperature and pressure operation, the auxiliary feedwater system is capable of removing the stored and residual heat, thus preventing either overpressurization of the RCS or uncovering the core, and returning the plant to a safe condition.

14.1.9.1 Method of Analysis A detailed analysis using the LOFTRAN code (described in Section 14.1) is performed in order to obtain the plant transient following loss of normal feedwater. The simulation describes the plant thermal kinetics, RCS including the natural circulation, pressurizer, steam generators and feedwater system. LOFTRAN computes pertinent variables including the steam generator level, pressurizer water level, and reactor coolant average temperature.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 49 of 83

Assumptions made in the anal ysis are:

A. The plant is initially operating at 102 percent of the Cook Nuclear Plant Unit 1 NSSS Engineered Safeguards power of 3409 MWt, and 20 MWt of reactor coolant pump heat.

B. A conservative core residual heat generation based upon long term operation at the initial power level preceding the trip. The ANS 1979 decay heat model plus two sigma uncertaint y was assumed.

C. Reactor trip occurs on steam generator low-low level.

D. The worst single failure in the auxiliary feedwater system occurs (e.g., failure of motor driven auxiliary feedwater pump).

E. The event is modeled with auxiliary feedwater being delivered to four steam generators at a rate of 400 gpm. Automatic initiation of the auxiliary feedwater is assumed 60 seconds after a low-low steam generator signal is actuated.

F. Secondary system steam relief is achieved through the steam generator safety valves.

G. The initial reactor coolant average temperature is 4.1°F lower than the nominal temperature, and initial pressurizer pressure is 67 psi higher than the nominal pressure of 2250 psia.

H. The initial pressurizer water level is assumed to be at the nominal programmed level (40% NRS) plus uncertainties (5% NRS).

I. Pressurizer power operated relief valves (PORVs) are assumed inoperable to maximize pressurizer water volume.

J. The maximum pressurizer spray flow rate is assum ed to maximize pressurizer water volume.

K. An auxiliary feedwater line purge volume of 78 ft3 was assumed. This is the volume that needs to be purged before the relatively cold auxiliary feedwater reaches the steam generators.

Plant characteristics and initial conditions are shown in Table 14.1-3.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 50 of 83

14.1.9.2 Results Figures 14.1.9-1 and 14.1.9-2 show the significant plant parameters following a loss of normal feedwater.

Following the reactor and turbine trip from full load, the water level in the steam g enerators will fall due to the reduction of steam generators void fraction and because steam flow through the safety valves continues to dissipate the stored and generated heat. One minute following the initiation of the low-low level trip, the motor driv en auxiliary feedwater pumps are automaticall y started, reducing the rate of water level decrease. The plot of pressurizer water volume clearly shows that the pressurizer does not fill.

The sequence of events for this transient is included in Table 14.1.9-1.

Effect of the MUR Program on Unit 1 The effect of the MUR program on the results of the Loss of Normal Feedwater Flow was evaluated. This evaluation showed that the analysis assumes the plant is initially operating at 102% of the NSSS Engineered Safeguards power of 3409 MWt. This assumed power level is greater than the MUR program power level. Therefore, the conclusions for the Loss of Normal Feedwater Flow anal ysis of record are applicable and remain valid for the MUR program.

Effect of the Return to RCS NOP/NOT Program on Unit 1 An evaluation of the Loss of Normal Feedwater event was performed to support the Return to RCS NOP/NOT program. The evaluation demonstrated that the analysis of record remains bounding with respect to Return to RCS NOP/NOT conditions because the analysis of record supports the increased NSSS power level of the rerating program and was performed at 2100 psia and 2250 psia (refer to Table 14.1-1). Therefore, the conclusions for the Loss of Normal Feedwater anal ysis of record are applicable and remain valid for the Return to RCS NOP/NOT program.

14.1.9.3 Conclusions Results of the anal ysis show that a loss of normal feedwater does not adversely affect the core, the RCS, or the steam s ystem since the auxiliary feedwater capacit y is such that reactor coolant water is not relieved from the pressurizer relief or safet y valves.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 51 of 83

An evaluation has been performed (Reference 1) to address the impact of pressurizer heaters on this event. Historically, the pressurizer heaters were not modeled. The evaluation also included properly modeling the pressurizer spray effectiveness at pressurizer water levels approaching a water-solid condition. The results of the evaluation determined that all acceptance criteria continue to be met. No changes to the figures and tables presented in this section were made as part of this evaluation.

An evaluation has been performed (Westinghouse letter AEP-00-260, dated 11/1/2000) to address the effects of throttling the turbine -driven auxiliary feedwater pump (TDAFP) discharge valves.

With these valves throttled, the single failure of one of the two motor-driven auxiliary feedwater pumps (MDAFPs) results in flow rates to two of the four steam generators (SGs) that are much less than those assumed if the TDAFP is the single failure. The evaluation, which is based upon anal yses that address the effects of replacement SGs, considered a total auxiliary feedwater (AFW) flow rate of 400 gpm, with an assumed distribution of 162.4 gpm to each of two SGs, and 37.6 gpm to each of the remaining SGs. The evaluation determined that a loss of normal feedwater, with the reduced and skewed AFW flows that result from throttling the TDAFP discharge valves, with an assumed failure of one MDAFP:

a. does not result in reactor coolant water being relieved from the pressurizer relief or safet y valves, and
b. the overpressure conditions and the departure from nucleate boiling ratio conditions continue to remain bounded by the Loss of External Electrical Load event (14.1.8).

Therefore, the reduced/skewed AFW flow rates due to a failed MDAFP, with the TDAFP discharge valves throttled do not adversel y affect the core, the RCS, or the steam system.

14.1.9.4 References For Section 14.1.9

1. Westinghouse Letter AEP-98-127, Ref: NSAL-98-007, Am erican Electric Power Service Corporation D. C. Cooks 1 and 2 Analysis Modeling of Pressurizer Heaters, dated August 11, 1998.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 52 of 83

14.1.10 Excessive Heat Removal Due to Feedw ater System Malfunctions 14.1.10.1 Feedwater System Malfunctions Causing a Reduction in Feedwater Temperature Reductions in feedwater temperature will result in an increase in core power by initially decreasing reactor coolant temperature. Such transients are attenuated by the thermal capacity of the secondary plant and of the reactor coolant system (RCS). The high neutron flux and overpower T trips provide overpower protection to mitigate the consequences of the event. Additionall y long-term addition of excessive feedwater is prevented by the steam generator Hi-Hi level protection.

A reduction in feedwater temperature may be caused by the accidental opening of a feedwater heater bypass valve, which diverts flow around a portion of the feedwater heaters. In the event of an accidental opening of the bypass valve, there is a sudden reduction in feedwater inlet temperature to the steam generators. At power, this increased subcooling will create a greater load demand on the RCS.

With the plant at no-load (hot zero power) conditions, the addition of cold feedwater will cause a decrease in RCS temperature and, thus, a reactivity insertion due to the effects of the negative moderator temperature coefficient of reactivity. However, the rate of energy change is reduced as load and feedwater flow decrease so the transient is less severe than the full power case. The net effect on the RCS due to a reduction in feedwater temperature is that the reactor will reach a new equilibrium condition at a power level corresponding to the new steam generator T.

14.1.10.1.1 Method of Analysis This transient is analyzed by computing conditions at the feedwater pump inlet following opening of the heater bypass valve. These feedwater conditions are then used to perform a heat balance through the high pressure heaters. This heat balance gives the new feedwater conditions at the steam generator inlet.

The following assumptions are made:

1. Plant initial power level corresponding to guaranteed NSSS thermal output.
2. Simultaneous actuation of either a low pressure heater bypass valve or a high pressure heater b ypass valve and isolation of one string of feedwater heaters.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 53 of 83

14.1.10.1.2 Results Opening of either a low pressure heater b ypass valve or a high pressure heater b ypass valve causes a reduction in feedwater temperature which increases the thermal load on the primar y s ystem. The calculated reduction in feedwater temperature due to opening of a high pressure heater bypass valve is less than 60oF and bounds that of the opening of a low pressure heater bypass valve. This reduction in feedwater temperature results in an increase in heat load on the primar y s ystem of less than 10 percent of full power. The increased thermal load, due to opening of the low pressure heater bypass valve, would result in a transient very similar (but of reduced magnitude) to that presented in Section 14.1.11 for an excessive increase in secondary steam flow incident, which evaluates the consequences of a 10 percent step load increase. Therefore, the results of this anal ysis are not presented.

14.1.10.1.3 Conclusions The decrease in feedwater temperature transient is less severe than the increase in secondar y steam flow event (Section 14.1.11). Based on results presented in Section 14.1.11, the applicable acceptance criteria for the decrease in feedwater temperature event have been met.

14.1.10.2 Feedwater System Malfunctions Causing an Increase in Feedwater Flow Addition of excessive feedwater is a means of increasing core power above full power. Such transients are attenuated by the thermal capacit y of the secondary plant and of the reactor coolant system. The high neutron flux trip, overpower T trip and overtemperature T trip prevent any power increase which could lead to DNBR less than the minimum allowable value in the event that the steam generator high level protection has not been actuated.

Excessive feedwater flow may be caused b y full opening of one or more feedwater control valves due to a feedwater control system malfunction or an operator error. At power conditions this excess flow causes a greater load demand on the reactor coolant system due to increased subcooling in the steam generators. With the plant at no load conditions, the addition of cold feedwater may cause a decrease in reactor coolant system temperature and thus a reactivity insertion due to the effects of the negative moderator coefficient of reactivity.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 54 of 83

14.1.10.2.1 Method of Analysis The excessive heat removal due to a feedwater s ystem malfunction transient is analyzed b y usin g the detailed digital computer code LOFTRAN, described in Section 14.1. This code simulates the neutron kinetics of the reactor coolant system, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety valves. The code computes pertinent plant variables including temperatures, pressures, and power level.

The system is analyzed to demonstrate acceptable consequences in the event of an excessive feedwater addition, due to a control system malfunction or operator error, which allows one or more feedwater control valves to open full y. The following cases have been anal yzed:

1a. Accidental full opening of one feedwater control valve with the reactor at power assuming the reactor in automatic and manual control and conservatively large negative moderator coefficient of reactivity.

1b. Accidental full opening of all feedwater control valves with the reactor at power assuming the reactor in automatic and manual control and conservatively large negative moderator coefficient of reactivity.

2. Accidental full opening of a feedwater control valve with the reactor at no load conditions and assuming a conservatively large negative moderator coefficient of reactivit y.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 55 of 83

This accident is analyzed with the Revised Thermal Design Procedure cited in Section 14.1. Plant characteristics and initial conditions, are listed in Table 14.1-3. The reactivity insertion rate following a feedwater system malfunction is calculated with the following assumptions:

A. Initial reactor power, pressure, and RCS temperatures are assumed to be at their conservative nominal values. Uncertainties in initial conditions are included in the limit DNBR.

B. For the feedwater control valve accident at full power, case 1a assumed one feedwater control valve to malfunction resulting in a step increase to 200% of nominal feedwater flow to one steam generator.

For case 1b, all feedwater control valves are assumed to malfunction in a step increase to 200% of nominal feedwater flow to all four steam generators.

C. For the feedwater control valve accident at zero load condition, a feedwater control valve malfunction occurs which results in an increase in flow to one steam generator from zero to 200 percent of the nominal full load value.

D. For the zero load condition, feedwater temperature is at a conservatively low value of 32° F.

E. No credit is taken for the heat capacity of the RCS and steam generator thick metal in attenuating the resulting plant cooldown.

F. The feedwater flow resulting from a fully open control valve is terminated by a steam generator high-high level trip signal, which closes all feedwater control, and isolation valves, trips the main feedwater pumps and trips the turbine.

Normal reactor control system and engineered safety systems are not required to function. The reactor protection s ystem may function to trip the reac tor due to overpower or turbine trip on high-high steam generator water level.

14.1.10.2.2 Results In the case of an accidental full opening of one feedwater control valve with the reactor at zero power and the above mentioned assumptions, the maximum reactivity insertion rate is 88 pcm/sec, where 1 pcm is 10-5 k/k.

An analysis has been performed to demonstrate that the applicable DNB criteria are met. A conservative reactivity insertion rate of 120 pcm/sec is assumed to bound the reactivity insertion rate calculated for the zero power feedwater malfunction anal ysis. The method of analysis used is

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 56 of 83

the same as discussed in Section 14.1.1 (Uncontrolled RCCA Withdrawal f rom a Subcritical Condition Analysis), except that the analysis assumed four (4) reactor coolant pumps to be in operation as required by the Cook Nuclear Plant Unit 1 Technical Specifications in Mode 2.

Although the reactivity insertion rate for the zero power feedwater system malfunction is calculated assuming reactivity parameters representative of EOL core conditions to maximize the reactivit y insertion rate, the DNB anal ysis is conservatively performed at BOL conditions to yield a high value of peak heat flux.

The DNB analysis performed for the hot zero power feedwater malfunction analysis with an insertion rate of 120 pcm/sec yields a minimum DNBR wh ich remains above the safety anal ysis limit value.

One additional case of the feedwater flow malfunction at zero power is analyzed in which the amount of excess flow to one steam generator is assumed to be equally divided among all 4 loops (total excess feedwater flow no greater than 200% of loop full power flow). The results show that this case is bounded by the single-loop feedwater flow malfunction anal ysis.

For the single FCV failure case initiated at full power, the case assuming maximum reactivity feedback coefficients and automatic rod control gives the largest reactivity feedback and results in the greatest power increase. Assuming the reactor to be in the manual rod control mode results in a slightl y less severe transient. The rod control system is not required to function for an excessive feedwater flow event.

Among the full power cases which assume the accidental full opening of all feedwater control valves, the case modeling maximum reactivity feedback coefficients and manual rod control gives the largest reactivity feedback and results in the greatest power increase. Assuming the reactor to be in automatic rod control mode results in a slightly less severe transient. The rod control system is not required to function for an excessive feedwater flow event.

For all excessive feedwater cases, continuous addition of cold feedwater is prevented b y automatic feedwater isolation on steam generator high-high level signal. In addition, a turbine trip is initiated.

A reactor trip on turbine trip was then assumed as a means of terminating the transient anal ysis.

The reactor trip prevents reactor coolant heatup consistent with the cooldown characteristics of the feedwater malfunction event. The reactor trip on turbine trip was assumed as an anticipatory trip.

If the reactor trip was not assumed, the transient would progress into a heatup event, in particular, a loss of normal feedwater due to the isolation which occurs on high-high steam generator water level signal. A reactor trip would then be provided by a low-low steam generator water level signal. The reactor trip on turbine trip was not required for core protection for this event. The

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 57 of 83

results (minimum DNBR) of the feedwater malfunction analysis would be essentially unchanged if the reactor trip was not assumed to occur on turbine trip.

Following reactor trip and feedwater isolation, the plant will approach a stabilized condition at hot standby. Normal plant operating procedures may then be followed. The operating procedures would call for operator action to control RCS boron concentration and pressurizer level using the CVCS and to maintain steam generator level through control of the main or auxiliary feedwater system. Any action required of the operator to maintain the plant in a stabilized condition will be in a time frame in excess of ten minutes following reactor trip.

Transient results, Figures 14.1.10- 1 through 14.1.10- 8, show, as a function of time, the nuclear power, core average temperature, pressurizer pressure and DNBR that are associated with the increased thermal load on the reactor. The DNBR does not drop below the limit value.

Since the power level rises during the excessive feedwater flow incident, the fuel temperatures will also rise until after reactor trip occurs. The core heat flux lags behind the neutron flux response due to the fuel rod thermal time constant; hence the peak heat flux does not exceed 118 percent of its nominal value (i.e., the assumed high neutron flux trip setpoint). The peak fuel temperature will thus remain below the fuel melting temperature.

The transient results show that DNB does not occur at any time during the excessive feedwater flow incident; thus, the ability of the primary coolant to remove heat from the fuel rod is not reduced. The fuel cladding temperature therefore does not rise significantly above its initial value during the transient.

The calculated sequence of events for the increase in feedwater flow for the full power cases are shown in Table 14.1.10-1.

14.1.10.2.2.1 Effect of the MUR Program on Unit 1 An evaluation of the Feedwater Malfunction at No Load Conditions event was performed to support the MUR program. With exception of the nominal heat flux, which increased as a result of the MUR program, the transient results used to evaluate the DNB consequences remain unchanged. To accommodate the increased nominal heat flux, allocation has been made from the margin available due to the difference between the design limit DNBR and the safet y anal ysis limit DNBR, as described in Section 3.5.3. Therefore, the conclusions for the Feedwater Malfunction at No Load Conditions analysis of record are applicable and remain valid for the MUR Program.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 58 of 83

14.1.10.2.2.2 Effect of the Return to RCS NOP/NOT Program on Unit 1 An evaluation of the Feedwater Malfunction event was performed to support the Return to RCS NOP/NOT program. The evaluation demonstrated that the analysis of both the no-load and at-power cases would realize additional margin to the applicable acceptance criteria through modeling the increased primary pressure of the Return to RCS NOP/NOT conditions.

Additionally, the at-power case would realize additional margin through modeling the maximum allowable vessel average temperature of the Return to RCS NOP/NOT conditions, which is less than the maximum allowable vessel average temperatures for the reduced temperature and pressure and rerating programs supported by the analysis of record (refer to Table 14.1-1 and Table 14.1-3). Therefore, the conclusions for the Feedwater Malfunction analysis of record are applicable and remain valid for the Return to RCS NOP/NOT program.

14.1.10.2.2.3 Evaluation to Support 240% Nominal Main Feedwater Flow An evaluation of the Feedwater Malfunction (FWM) event was performed to support increasing assumed main feedwater flow to 240% of nominal. The evaluation was performed to encompass the hot full power (HFP) and hot zero power (HZP) cases. The HFP cases showed an acceptable impact on DNB ratio (DNBR) because although more feedwater flow would exacerbate the cooldown and subsequent return-to-power, it also causes faster actuation of feedwater isolation and turbine trip on the high-high steam generator water level signal. The HZP FWM cases are analyzed to show that the maximum reactivity insertion rate caused by the cooldown does not exceed the maximum rate used in the rod withdrawal from subcritical (RWFS) anal ysis. Since the HZP FWM cases reanal yzed for this evaluation calculated reactivity insertion rates that remained well below the RWFS values the DNB design basis continues to be met with 240% MFW flow.

14.1.10.2.3 Conclusions The results of the analysis show that the DNB ratios encountered for an excessive feedwater addition at power are above the limit value; hence, no fuel or clad damage is predicted.

Additionally, an anal ysis at hot zero power demonstrates that the minimum DNBR remains above the safety analysis limit for the reactivity insertion rate which occurs at no -load conditions following an excessive feedwater addition.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 59 of 83

14.1.10.2.4 References for Section 14.1.10

1. Burnett, T, W. T., et al., "LOFTRAN Code Description," WCAP-7907-A (nonproprietary), April 1984
2. Friedland, A. J., Ray, S., "Revised Thermal Design Procedure," WCAP-11397-P-A (proprietary), WCAP-11397-A (nonproprietary), April 1989.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 60 of 83

14.1.11 Excessive Load Increase Incident An excessive load increase incident is defined as a rapid increase in steam flow that causes a power mismatch between the reactor core power and the steam generator load demand. The reactor control system is designed to accommodate, without a reactor trip, a ten percent (10%) step load increase and a five percent (5%) per minute ramp load increase in the range of 15 to 100 percent of full power. Any loading rate in excess of these values may cause a reactor trip actuated by the reactor protection s ystem.

This accident could result from either an administrative violation such as excessive loading b y the operator or an equipment malfunction in the steam dump control or turbine speed control.

During power operation, steam dump to the condenser is controlled by reactor coolant condition signals, i.e., high reactor coolant temperature indicates a need for steam dump. A single controller malfunction does not cause steam dump; an interlock is provided which blocks the opening of the valves unless a large turbine load decrease or turbine trip has occurred.

Protection against an excessive load increase accident is provided by the following reactor protection system signals:

1. Overpower T
2. Overtemperature T
3. Power range high neutron flux
4. Low pressurizer pressure

14.1.11.1 Method of Analysis This accident is analyzed using the LOFTRAN Code as described in Section 14.1. This code simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, steam generator safet y valves, and feedwater s ystem. The code computes pertinent plant variables including temperatures, pressures, and power level.

Four cases are anal yzed to demonstrate the plant behavior following a 10 percent step load increase from rated load. These cases are as follows:

A. Reactor control in manual with minimum moderator reactivity feedback.

B. Reactor control in manual with maximum moderator reactivity feedback.

C. Reactor control in automatic with minimum moderator reactivity feedback.

D. Reactor control in automatic with maximum moderator reactivity feedback.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 61 of 83

For the minimum moderator feedback cases, it was assumed that the core has a zero moderator temperature coefficient of reactivity and the least negative Doppler onl y power coefficient curve.

This results in the least inherent transient response capability. The zero moderator temperature coefficient of reactivity bounds a positive moderator temperature coefficient for this cooldown event. For the maximum moderator feedback cases, the moderator temperature coefficient of reactivity has its highest absolute value and the most negative Doppler only power coefficient curve. This results in the largest amount of reactivity feedback due to changes in coolant temperature.

A 10 percent step increase in steam demand is assumed, and all cases are studies without credit being taken for pressurizer heaters.

This accident is analyzed with the Improved Thermal Design Procedure as cited in Section 14.1.

Initial reactor power, pressure, and RCS temperature are assumed to be at their conservative nominal values. Uncertainties in initial conditions are included in the limit DNBR.

Plant characteristics and initial conditions are listed in Table 14.1 -3.

Normal reactor control systems and engineered safety systems are not required to function. The reactor protection system is assumed to be operable; however, reactor trip is not encountered for most cases due to the error allowances assumed in the setpoints.

The cases which assume automatic rod control are analyzed to ensure that the worst case is presented. The automatic function is not required.

14.1.11.2 Results Figures 14.1.11-1 through 14.1.11-4 illustrate the transient with the reactor in the manual control mode. As expected, for the minimum moderator feedback case there is a slight power increase, and the average core temperature shows a large decrease. This results in a DNBR which increases above its initial value. For the maximum moderator feedback, manually controlled case there is a large increase in reactor power due to the moderator feedback. A reduction in DNBR is experienced but DNBR remains above the limit value.

Figure 14.1.11-5 through 14.1.11-8 illustrate the transient assuming the reactor is in the automatic control mode. Both the minimum and maximum moderator feedback cases show that core power increases, thereby reducing the rate of decrease in coolant average temperature and pressurizer pressure. For both of these cases, the minimum DNBR remains above the limit value.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 62 of 83

For all cases, the plant rapidly reaches a stabilized condition at the higher power level. Normal plant operating procedures would then be followed to reduce power.

The excessive load increase incident is an overpower transient for which the fuel temperatures will rise. Reactor trip does not occur for the cases analyzed, and the plant reaches a new equilibrium condition at a higher power level corresponding to the increase in steam flow.

Effect of the Replacement Steam Generators on Unit 1 The effect of the RSGs on the results of the Excess Load Increase Event was evaluated. Four cases are presented for the excessive load increase event. The analysis cases consider a 10 percent increase in load with minimum and maximum moderator reactivity feedback, with and without automatic reactor control. The degree of the load increase is prescriptive, and is uneffected by steam generator replacement. The increase in steam generator heat removal would be the same for either steam generator. Therefore, the response of the balance of plant to the event with this RSGs would be identical to that in the current analysis. The RCS flow increases slightly with the RSGs. Therefore, the margin to the minimum DNB ratio would be slightly increased with the RSGs in the loops. Therefore, the conclusions of the excessive load increase analysis are applicable, and all acceptance criteria are met for the RSG up to 10 percent tube plugging.

Effect of the MUR Program on Unit 1 The effect of the MUR program on the results of the Excessive Load Increase Incident was evaluated. This evaluation showed that the analysis assumes the plant is initially operating at a power level greater than the MUR program power level. Therefore, the conclusions for the Excessive Load Increase Incident anal ysis of record remain valid for the MUR program.

Effect of the Return to RCS NOP/NOT Program on Unit 1 An evaluation of the Excessive Load Increase event was performed to support the Return to RCS NOP/NOT program. The evaluation demonstrated that the analysis would realize additional margin to the DNB acceptance criterion through modeling the increased primary pressure of the Return to RCS NOP/NOT conditions. Additional margin to the applicable acceptance criteria would be realized through modeling the maximum allowable vessel average temperature of the Return to RCS NOP/NOT conditions, which is less than the vessel average temperature modeled in the analysis of record (refer to Table 14.1-1 and Table 14.1-3). Therefore, the conclusions for

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 63 of 83

the Excessive Load Increase anal ysis of record are applicable and remain valid for the Return to RCS NOP/NOT program.

14.1.11.3 Conclusions The analysis presented above shows that for a ten percent (10%) step load increase, the DNBR remains above the limit value, thereby precluding fuel or clad damage. The plant reaches a stabilized condition rapidly following the load increase.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 64 of 83

14.1.12 Loss of All AC Pow er to the Plant Auxiliaries 14.1.12.1 Identification of Causes and Accident Description A complete loss of all (non-emergency) AC power (i.e. offsite power) may result in the loss of all power to the plant auxiliaries, i.e., the RCPs, condensate pumps, etc. The loss of power may be caused b y a complete loss of the offsite grid accompanied b y a turbine generator trip at the station, or by a loss of the onsite AC distribution system.

This transient is analyzed to show the adequacy of the heat removal capability of the auxiliary feedwater s ystem. This transient is more severe than the loss of load event analyzed because in this case the decrease in heat removal by the secondary system is accompanied by a flow coastdown which further reduces the capacit y of the primary coolant to remove heat from the core.

The reactor will trip due to:

1. turbine trip;
2. upon reaching one of the trip setpoints in the primary and secondary systems as a result of the flow coastdown and decrease in secondary heat removal; or
3. due to loss of power to the control rod drive mechanisms as a result of the loss of power to the plant.

Following a loss of power with turbine and reactor trips, the sequence described below will occur:

A. Plant vital instruments are supplied from emergency DC power sources.

B. As the steam system pressure rises following the trip, the steam generator power -

operated relief valves may be automatically opened to the atmosphere. The condenser is assumed not to be available for steam dump. If the steam flow rate through the power relief valves is not sufficient, the steam generator safety valves may lift to dissipate the sensible heat of the fuel and coolant plus the residual decay heat produced in the reactor.

C. As the no load temperature is approached, the steam generator power-operated relief valves (or safety valves, if the power operated relief valves are not available) are used to dissipate the residual decay heat and to maintain the plant at the hot standby condition.

D. The standby diesel generators, started on loss of voltage on the plant emergency busses, begin to supply plant vital loads.

The motor driven auxiliary feedwater pumps are supplied power by the diesels and the turbine-driven pump utilizes steam from the main steam system. Both t ype pumps are designed to suppl y

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 65 of 83

rated flow within one minute of the initiating signal even if a loss of all non -emergency AC power occurs simultaneousl y with loss of normal feedwater. The turbine exhausts the used steam to the atmosphere. The auxiliary feedwater pumps take suction from the condensate storage tank for deliver y to the steam generators.

Following the RCP coastdown caused by the loss of AC power, the natural circulation capabilit y of the RCS will remove residual and deca y heat from the core, aided b y auxiliary feedwater in the secondary system. An analysis is presented here to show that the natural circulation flow in the RCS following a loss of AC power event is sufficient to remove residual heat from the core.

14.1.12.2 Method of Analysis A detailed analysis using the LOFTRAN Code, described in Section 14.1, is performed to obtain the plant transient following a loss of offsite power. The simulation describes the plant thermal kinetics, RCS including the natural circulation, pressurizer, steam generators and feedwater system. The digital program computes pertinent variables including the steam generator level, pressurizer water level, and reactor coolant average temperature.

A. The plant is initially operating 102% of the Cook Nuclear Plant Unit 1 NSSS Engineered Safeguards power of 3409 MWt, and 20 MWt of reactor coolant pump heat.

B. A conservative core residual heat generation based upon long term operation at the initial power level preceding the trip. The ANS 1979 Decay Heat model, plus two sigma uncertaint y, was assumed.

C. A heat transfer coefficient in the steam generator associated with RCS natural circulation following the RCP coastdown.

D. Reactor trip occurs on steam generator low-low level. No credit is taken for immediate release of the control rod drive mechanisms caused by a loss of offsite power.

E. The event is modeled with auxiliary feedwater being delivered to four steam generators by one motor driven auxiliary feedwater pump and one turbine driven auxiliary feedwater pump at 400 gpm. Automatic initiation of the auxiliary feedwater is assumed 80 seconds after a low-low steam generator level signal is actuated. The failure of the motor driven auxiliary feedwater pump is assumed as the limiting single failure for this event.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 66 of 83

F. Secondary system steam relief is achieved through the steam generator safety valves.

G. The initial reactor coolant average temperature is 4.1°F lower than the nominal temperature, and initial pressurizer pressure is 67 psi lower than the nominal pressure of 2100 psia. Note that, as discussed in subsection 14.1.12.3, the analysis performed to support operation at the lower operating pressure of 2100 psia is bounding of operation at the Return to RCS NOP/NOT operating pressure of 2250 psia.

H. The initial pressurizer water level is assumed to be at the nominal programmed level (40% NRS) plus uncertainties (5% NRS).

I. Pressurizer power operated relief valves (PORVs) are assumed inoperable to maximize pressurizer water volume.

J. The maximum pressurizer spra y flow rate is assumed to maximize pressurizer water volume.

K. An auxiliary feedwater line purge volume of 78 ft3 was assumed. This is the volume that needs to be purged before the relatively cold auxiliary feedwater reaches the steam generators.

L. The loss of offsite power event is modeled as a loss of normal feedwater, without offsite power available. This analysis bounds the loss of offsite power.

Plant characteristics and initial conditions listed in Table 14.1 -3.

14.1.12.3 Results The transient response of the RCS following a loss of AC power is shown in Figures 14.1.12-1 and 14.1.12-2.

The LOFTRAN code results show that the natural circulation flow available is sufficient to provide adequate core decay heat removal following reactor trip and RCP coastdown.

The plot of pressurizer water volume clearl y shows that the pressurizer does not fill.

The sequence of events for this transient is included in Table 14.1.12-1.

Effect of the MUR Program on Unit 1 The effect of the MUR program on the results of the Loss of All AC Power to the plant auxiliaries was evaluated. This evaluation showed that the analysis assumes the plant is initially operating at

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 67 of 83

102% of the NSSS Engineered Safeguards power of 3409MWt. This assumed power level is greater than the MUR program power level combined with the lower uncertainty. Therefore, the conclusions for the Loss of All AC Power analysis of record are applicable and remain valid for the MUR program.

Effect of the Return to RCS NOP/NOT Program on Unit 1 An evaluation of the Loss of All AC Power event was performed to support the Return to RCS NOP/NOT program. The evaluation demonstrated that the analysis of record remains bounding with respect to Return to RCS NOP/NOT conditions because the analysis of record supports the increased NSSS power level of the rerating program (refer to Table 14.1-1). Therefore, the conclusions for the Loss of All AC Power analysis of record are applicable and remain valid for the Return to RCS NOP/NOT program.

14.1.12.4 Conclusions Analysis of the natural circulation capability of the RCS has demonstrated that sufficient heat removal capability exists following RCP coastdown to prevent fuel or clad damage.

An evaluation has been performed (Reference 1) to address the impact of pressurizer heaters on this event. Historically, the pressurizer heaters were not modeled. The evaluation also included properly modeling the pressurizer spray effectiveness at pressurizer water levels approaching a water-solid condition. The results of the evaluation determined that all acceptance criteria continue to be met. No changes to the figures and tables presented in this section were made as part of this evaluation.

An evaluation has been performed (Westinghouse letter AEP-00-260, dated 11/1/2000) to address the effects of throttling the turbine -driven auxiliary feedwater pump (TDAFP) discharge valves.

With these valves throttled, the single failure of one of the two motor-driven auxiliary feedwater pumps (MDAFPs) results in flow rates to two of the four steam generators (SGs) that are much less than those assumed if the TDAFP is the single failure. The evaluation, which is based upon anal yses that address the effects of replacement SGs, considered a total auxiliary feedwater (AFW) flow rate of 400 gpm, with an assumed distribution of 162.4 gpm to each of two SGs, and 37.6 gpm to each of the remaining SGs. The evaluation determined that a loss of all AC power to the

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 68 of 83

plant auxiliaries, with the reduced and skewed AFW flows that result from throttling the TDAFP discharge valves, with an assumed failure of one MDAFP:

a. does not result in reactor coolant water being relieved from the pressurizer relief or safet y valves,
b. the overpressure conditions continue to remain bounded by the Loss of External Electrical Load event (14.1.8), and
c. the departure from nucleate boiling ratio conditions continue to be bounded by the Complete Loss of Flow event (14.1.6).

Therefore, the reduced/skewed AFW flow rates due to a failed MDAFP, with the TDAFP discharge valves throttled, has been shown to continue to provide sufficient heat removal capability following the RCP coastdown to prevent fuel or cladding damage.

14.1.12.5 References for 14.1.12

1. Westinghouse Letter AEP-98-127, Ref: NSAL-98-007, American Electric Power Service Corporation D. C. Cooks 1 and 2 Analysis Modeling of Pressurizer Heaters, dated August 11, 1998.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 69 of 83

14.1.13 Turbine-Generator Safety Anal ysis 14.1.13.1 Introduction This section deals with a safet y anal ysis of the main turbine-generators and presents the results of the licensee's study of the consequences of a failure. It is summarized as follows:

1. The turbine-generators are safe and reliable and the chance of a failure during normal operation, which could endanger the reactor and associated Seismic Class I nuclear s ystems is extremely small.
2. The chance of a turbine running away out of control to destruction is also extremely small.
3. For the Unit 1 and Unit 2 Alstom low-pressure turbines, turbine missile probability analysis indicates that the probability of the generation of a turbine missile (including turbine overspeed conditions) is below the NRC limit which would require missile analysis. Therefore, no additional missile analysis is required for the Unit 1 and Unit 2 Alstom low-pressure turbines. However, missile anal yses are still provided for the (removed) original General Electric and Brown Boveri turbines, as these analyses are included in structural design criteria as shown in Table 5.1-1.
4. In spite of the extremely low probability of failure, an analysis of a hypothetical failure was made and the results indicate that large pieces with significant energy could be thrown b y the turbine. For the original General Electric and Brown Boveri turbines, the safe and conservative approach was taken and the plant designed to prevent these hypothetical turbine missiles from endangering the reactor and associated Seismic Class I nuclear s ystems. This section deals only with the source of potential turbine missiles.

The probability of a gross failure of the rotating elements of the main turbine-generators, which could result in external missiles and flying pieces, is extremely remote. This confidence is based on the use of:

1. Conservative turbine design criteria.
2. Careful manufacturing and inspection techniques.
3. Turbine controls and safety devices which meet the intent of the redundancy requirements of IEEE Criteria 279, "Nuclear Power Plant Protection Systems",

although not specificall y designed for this.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 70 of 83

The confidence in design, inspection and manufacturing techniques, (1) and (2) above, stems from the work of a special task force of the American Society of Testing and Materials (ASTM) formed in 1955 to study the "Cause of Brittle Fracture in Steel Forgings with the Aim of Establishing a Criterion by Means of which the Tendency of a Material to fracture in a Brittle Manner may be Appraised, and to Discover the Causes of Brittle fracture and its Cure".

Careful control of chemistry and heat treating cycles has greatly improved the mechanical properties of the rotors and wheels. Transition temperatures (the temperature at which the character of a fracture in the steel changes from brittle to ductile) is reduced on the low temperature wheel and rotor applications for these turbines to well below startup temperatures, and hence the likelihood of a brittle failure is minimized.

On the large rotor forging for the Unit 1 high-pressure turbine, improved steel mill practices in vacuum pouring and alloy addition result in forgings which are much more uniform and defect free than ever before. Non-metallic defects in wheels are most likely to occur in a plane that would be harmless regarding rotating strength. More comprehensive tests by the steel mill and the turbine manufacturer involving improved ultrasonic and magnetic particle testing techniques are better able to discover surface and internal defects than in the past. Laborator y investigation has revealed some of the basic relationships between structural strength, material strength, transition temperature, defect size and location so that the reliability of the rotor forging as a structure has been significantl y improved since the inception of the task force.

A history of the special ASTM task force on large turbine and generator rotors was given in a paper presented at the 65th ASTM annual meeting entitled, "Significant Progress in the Development of Large Turbine and Generator Rotors."

The rotors for the Unit 1 and Unit 2 LP turbines are of the welded sectional type. In this type of design, which has been Alstom's standard practice for over 40 years, the rotors are built-up by circumferentially welding disc forgings together.

The forgings for the discs and shaft ends are fully tested using ultrasonic techniques in both the radial and axial directions. In addition, tensile and impact strength tests and a chemical analysis are made on samples of the disc forgings b y both the steel mill an d the turbine manufacturer. These tests are made before the sections are welded together to form the rotor. Any suspected or doubtful discs are rejected. The sections are welded together in purel y random orientation to eliminate the possibility of concentrating non-homogeneous material on one side of the rotor. Welding procedures are rigidly controlled and are of the highest standard. Visual check, magnetic particle crack detection, and ultrasonic tests are made on the finished weld. The manufacturer reports that there have been no known failures of their turbine rotors.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 71 of 83

Confidence in the reliability of the turbine controls and safet y devices, (3) above, stems from their redundancy. The prime function of the control systems is to control the speed and/or load of the machine by controlling the flow of steam and hence, energy into the turbine.

A review was made of the turbine controls and safety devices relating them to the Single Failure Criterion (4.2), Channel Integrity (4.5), Channel Independence (4.6) and Control and Protection System Interaction (4.7) sections of IEEE 279 "Proposed Criteria for Nuclear Power Plant Protection Systems," and the intent of these criteria are met. This is outlined as follows:

14.1.13.1.1 Unit 1 - Turbine

a. The turbine speed signal is obtained from two different t ypes (active and passive) of speed pickups. The passive type do not require power and the active type is powered. Speed pickup signals are input into the DCS and the IOPS (Independent Overspeed Protection System). The DCS and IOPS are diverse in their design and operation. The DCS and IOPS both have independent capability to initiate a turbine trip through the trip block assembl y based upon; turbine status, speed pickup health, and detected turbine speed. The operation and health of the speed pickups are monitored by the DCS and IOPS.
b. The DCS and IOPS are the two independent mechanisms for overspeed protection.

The DCS is considered the primary device and is configured to initiate a turbine trip prior to the IOPS. The DCS and IOPS are both configured to initiate a turbine trip through the trip block assembly prior to challenging the mechanical integrity of the turbine.

The operation of the back-up overspeed trip and the DCS trip devices can be tested and maintained during normal operation.

Note: In 2006, the Unit 1 General Electric low pressure turbines were replaced with turbines manufactured by the Siemens Westinghouse Power Corporation. In 2008, the Unit 1 turbine generator was damaged during a loss of blade event. Unit 1 was returned to service in a "short term design configuration" following repairs and modifications. A turbine missile probability anal ysis (Reference 1.4.11.14) was performed for the short term design configuration. In 2011, the Unit 1 Siemens low pressure turbines were retrofitted with low pressure turbines manufactured by Alstom Power, Inc. The Alstom turbine missile probability analysis (Reference 1.4.11.15) determined that the overspeed turbine missile

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 72 of 83

probability remains well below the NRC limits for an "unfavorably oriented" unit. The runaway turbine missile probability for a turbine missile due to a control system failure was previously calculated by the Siemens missile probability analysis (Reference 1.4.11.14). The control system was not modified between the Siemens and Alstom turbine configurations, thus the runaway turbine missile probability due a control system failure remains unchanged. The sum of the overspeed and runaway missile probabilities for Unit 1 remains well below the NRC limits which would require missile analysis (See Section 1.4.7-Criterion 40 Missile Protection). Therefore, no additional missile analysis is required for the Alstom low pressure turbines.

The information in this section is applicable before and after the low pressure turbine replacements. The turbine missile analysis is only provided for the (removed) General Electric low pressure turbine as this anal ysis bounds other Unit 1 rotating elements.

14.1.13.1.2 Unit No. 2 - Turbine The operating speed signal is obtained in the same manner described for Unit 1 using two different types (active and passive) of speed pickups.

Potential accidents or failures of the overspeed protection system have been considered and are seen to be in a fail-safe mode, that is, result in closure of the steam valves.

In 2016, the Unit 2 Brown Boveri HP & LP pressure turbines were retrofitted with turbines manufactured by Alstom Power, Inc. The Alstom turbine missile probability anal ysis (Reference 1.4.11.17) determined that the overspeed turbine missile probability remains well below the NRC limits for an "unfavorably oriented" unit. The runaway turbine missile probability for a turbine missile due to a control system failure was previously calculated by the Unit 1 turbine missile probability anal ysis (Reference 1.4.11.14) which has the same control s ystem as the Unit 2 turbine.

The control system was not modified between the Brown Boveri and Alstom turbine configurations, thus the runaway turbine missile probability due a control system failure remains unchanged. The sum of the overspeed and runaway missile probabilities for Unit 2 remains well below the NRC limits which would require missile anal ysis (See Section 1.4.7-Criterion 40 Missile Protection). Therefore, no additional missile analysis is required for the Alstom low pressure turbines. The information on failure of rotating elements is applicable before and after the low pressure turbine replacements. The turbine missile analysis is only provided for the (removed)

Brown Boveri low pressure turbine as this analysis bounds other Unit 2 rotating elements

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 73 of 83

Units 1 and 2 Each major steam line entering the turbine has two valves in series, providing two independent lines of defense. Additional safet y is provided by the reheat stop and intercept valves to interrupt the expansion of entrained steam approximately halfway through its expansion to the condenser.

The turbine valve locations are shown in Chapter 10. Control and protective devices operate these valves to avoid uncontrolled overspeeds. Other protective devices are the low vacuum trip, low bearing oil pressure trip, and thrust bearing failure trip. The main stop and control valves are tripped closed automatically, when required, by the protective devices. These valves do not regulate steam flow, but are either in the fully opened or fully closed positions. The reheat stop and intercept valves on the low pressure (L.P.) turbine inlet are also actuated by the protective devices and operate in a similar manner to the main stop and control valves, respectivel y.

Further details regarding the valves and protective devices are as follows:

1. The main stop and control and the reheat stop and intercept valves have a full closure test feature and closure tests will be performed at scheduled intervals to ensure that the valves are free to function in an emergency.
2. The speed sensing devices for the Programmable Logic Controller (PLC) and back-up overspeed trips are separate from each other.
3. The Programmable Logic Controller (PLC) and back-up overspeed trips can be tested during operation of the turbine and if any difference between test and specified settings or trip speeds are observed, these devices can be corrected on line.
4. Positive closing check valves are installed in those extraction lines where uncontrolled release of stored energy would increase the turbine overspeed potential during trip conditions. These valves are actuated by the Electro -H ydraulic Control (EHC) Trip Header and are designed for remote manual periodic tests to ensure proper operation. All of the above valves are given an impulse in the closing direction on loss of turbine hydraulic control pressure.
5. The manufacturers' service personnel review for proper techniques of installation, inspection and maintenance of the valves and protective devices with the responsible plant personnel prior to initial start-up.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 74 of 83

Rigorous starting and loading instructions are used to reduce the severity of surface and/or thermal stress cycles during service. These practices include:

1. Instruments to measure and record the metal temperature of the turbine.
2. Automatic control devices for acceleration and loading rate.
3. Guidance for station operators in the control of speed, acceleration and loading rates to minimize rotor thermal stresses.

In conclusion, progress in design, better material and quality control, more rigorous acceptance criteria and improved operating techniques, substantially minimize the likelihood of turbine-generator rotor failures.3

14.1.13.2 Failure of Turbine-Generator Rotating Elements A surve y of the literature indicates that there have been a few failures of turbine-generator rotating elements, which resulted in external missiles. These have been grouped into two general t ypes:

1. Failure of rotating components operating at or near normal operating speed.
2. Failure of components that control admission of steam to the turbine resulting in destructive shaft rotational speed.

Since the external missiles that could result from excessive overspeed are the most serious, the turbine manufacturers have made a study of the consequences of a turbine runaway.

The results of these studies of a hypothetical failure at destructive overspeeds indicate the following:

1. The high-pressure turbine rotors of both units can withstand, without failure, the maximum theoretical runaway speed of 200% of rated speed, i.e., 3600 rpm. If there is premature failure, thrown parts should be retained by the cast, heavy wall section of the bolted, high-pressure shells.
2. The original low-pressure turbine components, including large portions of the last stage wheels of the built-up rotors and blades (Unit 1 - General Electric4) or next-to-last stage discs and blades (Unit 2 - Brown Boveri) could pierce the casing and escape with considerable energy.

3 See Reference (3) 4 See note at end of Section 14.1.13.2

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 75 of 83

There are no calculated turbine missile energies for the Alstom LP turbines because their missile probability was below the NRC threshold that required additional mechanistic anal ysis.

3. The shrunk on-couplings (Unit 1 - General Electric4) and integral couplings (Unit
2) can withstand, without failure, the maximum theoretical runaway speed of 3600 rpm.
4. Generator field retaining ring parts of both units will be retained by the generator housing, which by construction, is an ideal energy absorber.
5. Small generator and exciter components of both units may be thrown during a hypothetical failure but are of much smaller mass and velocity than the low-pressure turbine parts4.
6. Small rotating parts of the feedpump turbines may be thrown during a h ypothetical failure but are also of much smaller mass and have less stored energy than the corresponding parts of the low-pressure turbine4.

The potential L.P. turbine missiles noted above and described more completely on the following pages are considered to be the "worst case" and are used to check the design of the structures which protect Seismic Class I equipment against postulated turbine missiles.

Note: In 2006, the Unit 1 General Electric low pressure turbines were replaced with turbines manufactured by the Siemens Westinghouse Power Corporation. In 2008, the Unit 1 turbine generator was damaged during a loss of blade event. Unit 1 was returned to service in a "short term design configuration" following repairs and modifications. A turbine missile probability anal ysis (Reference 1.4.11.14) was performed for the short term design configuration.

In 2011, the Unit 1 Siemens low pressure turbines were retrofitted with low pressure turbines manufactured by Alstom Power, Inc. In 2016, the Brown-Boveri turbines were retro-fitted with turbines manufactured b y Alstom Power, Inc. The Alstom turbine missile probability analysis (Reference 1.4.11.15 and 1.4.11.16) determined that the overspeed turbine missile probability remains well below the NRC limits for an "unfavorably oriented" unit. The runaway turbine missile probability for a turbine missile due to a control system failure was previously calculated by the Siemens missile probability analysis (Reference 1.4.11.14). The control system was not modified for the Alstom turbine configurations, thus the runaway turbine missile probability due a control system

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 76 of 83

failure remains unchanged. The sum of the overspeed and runaway missile probabilities for Unit 1 and Unit 2 remain well below the NRC limits which would require missile analysis (See Section 1.4.7-Criterion 40 - Missile Protection). Therefore, no additional missile analysis is required for the Alstom lo w pressure turbines.

The mechanistic turbine missile analysis that calculated energies is provided for the (removed) original General Electric and Brown-Boveri low pressure turbine as these anal yses are included in structural design criteria as shown in Table 5.1-1.

14.1.13.2.1 Unit 1 (General Electric 4)

For the original General Electric turbine the extreme hypothetical condition of runaway to failure, the calculations indicate failure of the vane portion of the last stage blades at 174% of rated speed.

The bursting speed of the last stage wheel of the built up rotors of Unit 14 has been estimated to be 177% rated speed. For these conditions, fragment properties are given in Table 14.1.13-1.

The energy values given in Table 14.1.13-1 are believed to be the upper limits for a number of reasons:

1. In none of the past accidents are the turbines known to have attained speeds more than 160- 170% of rated speed. The majority of accidents have occurred rather close to running speed.
2. The obstacles in the path of any of these pieces tend to cause more ricocheting internal to the turbine casing before escape and more energy absorption than is taken credit for.
3. The experimental data on penetration energy required by a missile has been obtained on highl y specialized specimens. It is believed that the generall y "blunt" parts have a more difficult time escaping these casings.

For Unit 14, the original manufacturer has based the calculations, including the energy absorbed in penetrating the turbine casings on the "Analysis of Turbine Missiles Resulting from Last Stage Wheel Failure" b y E. E. Zwick y, Jr., prepared b y the General Electric Company as report TR67-SL-211, October 1967. Seven references are listed in that report.

Unit 14 included one low-pressure monoblock rotor, which was functionally identical to the original rotors, however, the rotor bod y was machined from a single one-piece monoblock forging, as opposed to the original built-up design where individual wheels are shrunk on to and keyed to a central shaft. The rotor body exterior dimensions were identical except in the seal area of the second stage diaphragm where the larger diameter of the monoblock rotor required modification

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 77 of 83

to the diaphragm prior to the installation of the rotor. Calculations of the Cook Unit 14 maximum potential overspeed and monoblock rotor burst speed performed by General Electric, the monoblock rotor manufacturer, have concluded that the monoblock rotor will never experience an overspeed condition that would exceed the rotor materials capability to tolerate it. [4,5] Therefore, the only potential missiles from the monoblock low pressure turbine rotor were the vane portions of the last stage blades, which are identical to the blades used in the built-up rotors.

The following paragraphs give some of the details of the assumptions made in arriving at the values shown in Table 14.1.13-1.

14.1.13.2.1.1 Vane of Last-Stage Blade - Unit No. 1 (See Figure 14.1.13-4)4 For the hypothetical failure, the last stage blade vane fails at 174% speed.

With a vane weight of 50.3 lbs., and assuming the vane center of gravity is at the pitch diameter, the initial velocity of the vane is 1648 ft/sec. This results in an initial kinetic energy of 2.1 x 106 ft-lb.

Based on experience with previous vane failure there is a good probability that the inner casing and hood structure is able to contain the vane.

If the worst were to happen, the vane would ricochet and escape through the 1-1/4" thick plate toward the end of the hood. It is judged that in any case not more than 1/2 of the initial energy is retained and that the 50.3 lbs. fragment leaves the turbine with 1 million ft-lb of energy.

14.1.13.2.1.2 Fragment of Last Stage Wheel - Unit 14 The last stage wheel of the built up rotors was approximately 89 inches in rim diameter, and had a 31.5 inch bore with an average thickness of 15 inches. The total wheel weight was approximatel y 24,500 lbs. Postulating that the extreme overspeed is reached, and the last stage wheels failed, the fragments would tend to be thrown radially from the turbine.

The segment of this disc with largest kinetic energy on failure had an arc of 120° and weighed approximately 8264 lbs. Its initial linear velocity at the segment's center of gravity was 676 ft/sec at 177% overspeed. Energy distribution before and after inner turbine casing impact is shown in Figure 14.1.13-6.

Failure speed was assumed to be high enough so that all of the last stage blades had failed near their roots before wheel burst occurred. However, the failure speed, based on the minimum

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 78 of 83

specification tensile strength and no undiscovered bore defects, includes the effect of the last stage blades.

Rigorous analysis (Reference 1) indicates that a significant portion of this energy is absorbed as the fragments pass through the inner casing and exhaust hood. This is summarized as follows:

a. The cast iron diaphragm web is ignored.
b. The wheel rim is assumed to strike the outer diaphragm ring in the original plane of the wheel.
c. The three wheel fragments impact on the inner casing simultaneously.
d. The inner casing ring was treated as a rigid body for calculating the effects of frictional (tangential) forces.
e. The effective ring mass for radial forces was taken as 25% of the total ring mass of each fragment.
f. Local elastic distortions were neglected.
g. Available deformation energy in the ring was calculated from (volume of steel parts) x (minimum specification tensile strength) x (minimum specification elongation).
h. Outer hood penetration energy loss was calculated by the "Stanford Formula."
i. Fragment rotation is ignored in outer casing penetration since its residual rotational energy is estimated to be only 2.5% of its total energy after inner casing impact.
j. Damage to the outer hood by the ring fragments is ignored.

The resulting 8,264 pound missile leaves the turbine with 21.5 x 106 ft -lbs of energy.

14.1.13.2.2 Unit 2 (Brown-Boveri)4 For the original Brown-Boveri turbine the extreme hypothetical condition of runaway to failure, the calculations indicate failure of the vane portion of the last stage blades at 169% of normal speed. In the case of Unit 24, the next to the last stage disc is the most highly stressed and it is estimated to burst at a maximum of 176% of normal speed. For these conditions, fragment properties are given in Table 14.1.13-1.

Calculations by the manufacturer for Unit 2 4 indicate that the disc under the next-to-last stage (Disc 3) would be the first to fail on excessive overspeed. Its failure would prevent a further speed increase of the LP rotor and, hence, the other discs would not fail.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 79 of 83

When Disc 3 reaches its calculated maximum bursting speed, the last stage disc (Disc 4) is subject to only 74% of its bursting stress and Discs 1 and 2 are subject to only 81% of their bursting stress.

This is shown graphically in Figure 14.1.13-2, which plots tangential stress at 176% speed as a function of disc radius.

All of the discs are of such size that manufacturing flaws are detected b y non-destructive testing.

Any doubtful discs are immediately scrapped by the manufacturer without any attempt to repair.

Based on the acceptable tolerance in material properties, the following range of burst speeds have been calculated:

% of Rated Speed Fro m To Disc 1 185 202 Disc 2 182 200

Disc 3 (next-to-last stage) 164 176 Disc 4 194 212

This calculated range of burst speeds, shown on Figure 14.1.13-3, shows that Disc 3 would be the first to fail. This applies even if the material of Disc 3 was at its upper limit of yield strength and the other discs were at their lower limit.

If no additional losses are taken into account, the theoretical runaway speed would reach 200% of rated speed. Because of extra bearing friction and rubbing of the rotor against the stationary blade carriers after failure of Disc 3, the speed will not exceed 190% of rated speed.

Nonetheless, in the extremely unlikel y event that Disc 3 fails at 176% rated speed and b y so doing precipitates premature failure of any of the other discs, the energy of their fragments has been determined and this information is included in Table 14.1.13-1. The energy lost by the fragments in penetrating the ductile steel outer -casing has been calculated as though each disc failed independentl y. A simultaneous failure of more than one disc is not considered credible. However, for added conservatism, the segment of the last stage disc (highest energy missile) was considered as a missile and the plant design was reviewed to assure that it would not cause a LOCA or preclude safe shutdown of the unit.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 80 of 83

The energy values given in Table 14.1.13-1 are believed to be the upper limits for a number of reasons:

1. In none of the past accidents are the turbines known to have attained speeds more than 160- 170% of rated speed. The majority of accidents have occurred rather close to running speed.
2. The obstacles in the path of any of these pieces tend to cause more ricocheting internal to the turbine casing before escape and more energy absorption than is taken credit for.
3. The experimental data on penetration energy required by a missile has been obtained on highl y specialized specimens. It is believed that the generall y "blunt" parts have a more difficult time escaping these casings.

For Unit No. 24, the manufacturer has based the calculations on two reports, "Turbine Rotor Failure Analysis," issued by the Brown-Boveri Company as report DK-1090, February 1968. Nine references are listed in that report.

The following paragraphs give some of the details of the assumptions made in arriving at the values shown in Table 14.1.13-1.

14.1.13.2.2.1 Vane of Last Stage Blade - Unit No. 2 (See Figure 14.1.13-5)

If the unit reached 160% of rated speed, the last stage blades will have lengthened plastically so that the tips will rub on the stationary parts. However, the hypothetical failure speed is at 169%

of rated speed at which time the center of gravity of the 168 pound blade fragment is moving at 1820 ft/sec with a kinetic energy of 8.65 x 106 ft -lbs.

The blade fragment would then hit the stationary inner shell and be deflected in the direction of the exhaust. The exhaust steam guide vanes are mounted in such a way that the blade fragments will hit the guide vanes and lose some of their energy as a result of impact losses and the rotation of the blade in flight after impact.

It has been assumed for calculation that the blades will lose 50% of their kinetic energy on impact with the guide vanes. This assumption is conservative considering the high deformation abilit y of the vanes and that the flight path of the blades is obstructed by both the guide vanes and their supports.

If the blade reaches the exhaust hood in the most dangerous orientation, that is, end on, it will penetrate the 1-1/2" thick steel plate. The loss of energy b y penetration has been calculated b y the

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 81 of 83

"Stanford Formula" with the result that, at worst, the 168 pound blade fragment leaves the turbine with 3.4 x 106 ft -lbs. of energy.

14.1.13.2.2.2 Fragment of Next to Last Stage Disc - Unit 24 T h e LP-rotors are designed in such a way that the discs under the next to the last stage (Disc 3) are the most highly stressed and on runaway, this disc would fail first.

If the rotor overspeeds excessively, Disc 3 will be plasticall y deformed from the center outwards.

It will rupture when the mean tangential stress is between the yield point and ultimate tensile strength of the material concerned. Theoretically, the burst occurs when the whole disc area becomes full y plastic.

From these considerations, it has been calculated that Disc 3 will possibly burst at a maximum of 176% of the operating speed. Although experience shows that discs can break into four parts, calculations are made on the assumption of three segments of 120° each since this results in the maximum kinetic energy. Before inner turbine casing impact, each fragment contains 42.5 x 106 ft-lbs of rotational energy and 84.5x106 ft -lbs of translational energy for a total of 127 x 106 ft -lbs of kinetic energy.

In order to escape from the turbine, (See Figure 14.1.13-5), the disc fragments must penetrate the blade carrier and the welded LP inner and outer casing. There will be an energy loss as a result of:

a. The disc fragments hitting the blade carrier, giving an impulse which will result in a sliding of the blade carrier in the hangers, deforming the hangers themselves.

This loss of impulse is equal to the ratio of the masses of the colliding parts.

Calculations show that this loss is more than 25%, as the mass of the blade carrier is greater than that of the exploded disc.

However, for the calculation of energy loss, a reduction of only 25% of the impact force will be made.

b. After the collision, the disc has to penetrate the blade carrier, inner and outer casings. As with the last stage blade, the two extreme possibilities of end -on or side-on penetration will apply to the disc fragment. Calculations are based on the worst case of end-on penetration.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 82 of 83

Results show that, at worst, the 8360 pound disc segment leaves the turbine with 39.40 x 106 ft-lbs of energy. A similar analysis of the other discs resulted in the fragment properties shown in Table 14.1.13-1.

14.1.13.2.3 Generator Retaining Ring and Other Parts - Units 1 and 2 Based on the evidence of the previous generator failures, it appears unlikel y that major fragments of retaining rings or other parts escape the generator casing.

Although shaft segments and collector parts have been thrown, it is calculated that these fragments have less energy than the turbine parts described above. In general, the generator stator is an almost ideal energy absorber and "parts catcher."

The exciter components have less kinetic energy than the turbine components analyzed above.

14.1.13.2.4 High Pressure Turbine - Units 1 and 2 The high pressure turbine rotor is surrounded by heavy cast steel shells. Based on the several overspeed accidents, which have taken place at other power plants, it is believed that even with severe troubles, few fragments can be released, and that the y are of lower speed and mass than the pieces alread y discussed in the low pressure turbine4.

Effect of the Replacement Steam Generators on Unit 1 The effect of the RSGs on the results of the turbine-generator safet y anal ysis has been evaluated.

The RSGs operate within the original design envelope of the original steam generator (OSGs) with respect to steam pressure and flow. Therefore, the process conditions and operation of the turbine is not affected by use of the RSGs. Therefore, the licensing basis for this event is equally applicable to operation of Unit 1 with either OSGs or RSGs.

Unit 1 INDIANA MICHIGAN POWER Revised: 30.0 D. C. COOK NUCLEAR PLANT Section: 14.1 UPDATED FINAL SAFETY ANALYSIS REPORT Page: 83 of 83

14.1.13.3 References for Section 14.1.13

1. Zwicky, Jr., E. E., "An Analysis of Turbine Missiles Resulting from Last Stage Wheel Failure", Report No. TR-67-Sl-211 - General Electric Company, October, 1967.
2. Brown-Boveri Company, "Turbine Rotor Failure Analysis", Report No. DK-1190, February, 1968.
3. Letter No. AEP:NRC:0344A, John E. Dolan (AEP) to H. R. Denton (NRC), dated June 16, 1980.
4. Letter #85-62 L. G. Knutson (GE) to J. D. Benes (AEPSC), dated August 20, 1985.
5. Letter #85-93 L. G. Knutson (GE) to J. D. Benes (AEPSC), dated December 9, 1985.
6. Siemens Report CT-27456, Revision 0, Missile Probability Anal ysis, Short Term Solution, dated 04/16/2009.
7. D.C. Cook 1 LP Retrofit-Missile Analysis, Alstom Report STD0013760, dated January 13, 2011.
8. D.C. Cook Unit 2 Retrofit - Missile Analysis, Alstom Report HTCZ591309, dated April 22, 2014.

Unit 1

Retrieved from "https://kanterella.com/w/index.php?title=ML24159A176&oldid=3689346"