ML24159A178

Updated Final Safety Analysis Report (Ufsar), Revision 32, Chapter 14, Section 14.2, Standby Safeguards Analysis (Unit 1)

ML24159A178
Person / Time
Site:	Cook
Issue date:	05/30/2024
From:	Indiana Michigan Power Co
To:	Office of Nuclear Reactor Regulation
Shared Package
ML24159A261	List: AEP-NRC-2024-20, Updated Final Safety Analysis Report (Ufsar), Revision 32, Chapter 3, Reactor (Unit 2) ML24159A163 ML24159A164 ML24159A165 ML24159A166 ML24159A167 ML24159A168 ML24159A169 ML24159A170 ML24159A171 ML24159A172 ML24159A173 ML24159A174 ML24159A175 ML24159A176 ML24159A177 ML24159A178 ML24159A179 ML24159A180 ML24159A181 ML24159A182 ML24159A183 ML24159A184 ML24159A185 ML24159A186 ML24159A187 ML24159A188 ML24159A189 ML24159A190 ML24159A191 ML24159A192 ML24159A193 ML24159A194 ML24159A195 ML24159A196 ML24159A198 ML24159A199 ML24159A200 ML24159A201 ML24159A202 ML24159A203 ML24159A204 ML24159A205 ML24159A206 ML24159A207 ML24159A208 ML24159A209 ML24159A210 ML24159A211 ML24159A212 ... further results
References
AEP-NRC-2024-20
Download: ML24159A178 (1)

Text

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page:

i of iii Unit 1 14.2 STANDBY SAFEGUARDS ANALYSIS............................................. 1 14.2.1 Fuel Handling Accident............................................................ 2 14.2.1.1 Introduction...................................................................................... 2 14.2.1.2 Missile Protection............................................................................ 2 14.2.1.3 Shock Absorbing Characteristics.................................................... 3 14.2.1.4 Auxiliary Building Accident.............................................................. 4 14.2.1.5 Containment Building Accident....................................................... 5 14.2.1.6 Radiological Consequence Analysis............................................... 6 14.2.2 Accidental Release of Radioactive Liquids............................ 7 14.2.2.1 Waste Evaporator Condensate and Monitor Tanks........................ 7 14.2.2.2 Condensate Storage Tank, Primary Water Storage Tank, and Refueling Water Storage Tank........................................................ 8 14.2.2.3 Auxiliary Building Liquid Waste Storage Tanks............................... 9 14.2.2.4 Piping.............................................................................................. 9 14.2.3 Accidental Waste Gas Release................................................ 9 14.2.3.1 Volume Control Tank..................................................................... 10 14.2.3.2 Gas Decay Tanks.......................................................................... 10 14.2.4 Steam Generator Tube Rupture............................................. 12 14.2.4.1 General.......................................................................................... 12 14.2.4.2 Description of Accident.................................................................. 12 14.2.4.3 Recovery Procedure...................................................................... 13 14.2.4.4 Analysis and Results..................................................................... 16 Effect of the Replacement Steam Generators on Unit 1..................................... 17 Effect of the RTD Bypass Elimination................................................................. 17 Effect of the MUR Program on Unit 1................................................................. 17 14.2.4.5 Radiological Consequence Analysis............................................. 17 14.2.4.6 Conclusion..................................................................................... 18 UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page:

ii of iii Unit 1 14.2.4.7 References for Section 14.2.4....................................................... 19 14.2.5 Rupture of a Steam Pipe........................................................ 19 14.2.5.1 Method of Analysis........................................................................ 20 14.2.5.2 Results.......................................................................................... 23 Effect of the Replacement Steam Generators on Unit 1..................................... 25 Effect of the MUR Program on Unit 1................................................................. 25 Effect of the Return to RCS NOP/NOT Program on Unit 1................................. 25 14.2.5.3 Radiological Consequence Analysis............................................. 25 14.2.5.4 Rupture of a Steam Pipe at Full Power......................................... 27 14.2.5.4.1 Method of Analysis............................................................................ 28 14.2.5.4.2 Results.............................................................................................. 29 14.2.5.5 Conclusions................................................................................... 30 14.2.5.6 References for Section 14.2.5....................................................... 30 14.2.6 Rupture of a Control Rod Drive Mechanism Housing (RCCA Ejection).................................................................................. 31 14.2.6.1 Description of Accident.................................................................. 31 14.2.6.2 Design Precautions and Protection............................................... 31 14.2.6.3 Mechanical Design........................................................................ 31 14.2.6.4 Nuclear Design.............................................................................. 32 14.2.6.5 Reactor Protection......................................................................... 32 14.2.6.6 Effects on Adjacent Housings....................................................... 33 14.2.6.7 Limiting Criteria............................................................................. 33 14.2.6.8 Method of Analysis........................................................................ 34 14.2.6.9 Average Core Analysis.................................................................. 34 14.2.6.10 Hot Spot Analysis.......................................................................... 35 14.2.6.11 System Overpressure Analysis..................................................... 35 14.2.6.12 Calculation of Basic Parameters................................................... 36 UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: iii of iii Unit 1 14.2.6.13 Ejected RCCA Worth and Hot Channel Factors........................... 36 14.2.6.14 Reactivity Feedback Weighting Factors........................................ 36 14.2.6.15 Moderator and Doppler Coefficient............................................... 37 14.2.6.16 Delayed Neutron Fraction, eff....................................................... 37 14.2.6.17 Trip Reactivity Insertion................................................................. 37 14.2.6.18 Results.......................................................................................... 38 14.2.6.18.1 Pressure Surge................................................................................. 39 14.2.6.18.2 Lattice Deformations......................................................................... 40 14.2.6.19 Effect of the Replacement Steam Generators on Unit 1............... 40 14.2.6.20 Effect of the MUR Program on Unit 1............................................ 41 Effect of the Return to RCS NOP/NOT Program on Unit 1................................. 41 14.2.6.21 Radiological Consequence Analysis............................................. 41 14.2.6.22 Conclusions................................................................................... 43 14.2.6.23 References for Section 14.2.6....................................................... 43 14.2.7 Environmental Consequences Following Secondary System Accidents................................................................................ 44 14.2.7.1 Operational Off-Site Doses........................................................... 44 14.2.7.2 Incident Off-Site Doses................................................................. 45 14.2.7.3 Accident Off-Site Doses................................................................ 46 14.2.8 Major Rupture of a Main Feedwater Pipe.............................. 46 UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 1 of 46 Unit 1 14.2 STANDBY SAFEGUARDS ANALYSIS The analyses presented in this section demonstrate that adequate provisions are included in the design of the plant and its engineered safeguards which restrict potential exposures to below the appropriate limits for the fault conditions resulting in the fission product release to the environment listed as follows:

1.

Fuel Handling Accident

2.

Accidental Release of Radioactive Fluids

3.

Accidental Waste Gas Release

4.

Steam Generator Tube Rupture

5.

Rupture of a Steam Pipe

6.

Rupture of Control Rod Mechanism Housing - (RCCA Ejection)

7.

Environmental Consequences following Secondary System Accidents UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 2 of 46 Unit 1 14.2.1 Fuel Handling Accident 14.2.1.1 Introduction The possibility of a fuel handling accident is very remote because of the many administrative controls and physical limitations imposed on the fuel handling operations. All refueling operations are conducted in accordance with prescribed procedures under direct surveillance of a supervisor technically trained in handling fuel and nuclear safety. When transferring irradiated fuel from the core to the spent fuel pool for storage, the reactor cavity and refueling canal are filled with borated water at a boron concentration equal to that in the spent fuel pool which ensures subcritical conditions in the core, even if all rod cluster control assemblies are withdrawn. After the reactor head and rod cluster control drive shafts are removed, fuel assemblies are lifted from the core, transferred vertically to the refueling cavity, placed horizontally on a conveyor car and pulled through the transfer tube and canal, upended and transferred through the pool gate, then lowered into steel racks for storage in the spent fuel pool in a pattern which prevents any possibility of a criticality accident. Fuel handling manipulators and hoists are designed so that fuel cannot be raised above a position that provides an adequate water depth shield for radiation protection of operating personnel.

The protection against a spent fuel pool or refueling canal drain-down due to reactor cavity seal failure or other drain path is reviewed in Section 9.7.

14.2.1.2 Missile Protection The containment, auxiliary building, refueling cavity, canal, and spent fuel pool are Seismic Class I designed which prevents the structures themselves from failing in the event of an earthquake.

They are also designed to prevent any credible external missile from entering the buildings and reaching the stored irradiated fuel, and any internal missile from penetrating the walls of these structures. The fuel handling manipulators, cranes, trolleys, bridges, and associated equipment above the water cavities through which the fuel assemblies move are designed to prevent this equipment from generating missiles and damaging the fuel. The construction of the fuel assemblies precludes damage to the fuel should portable or hand tools drop on an assembly.

The only time a fuel handling accident could occur is during the handling of a fuel assembly. The facility is designed so that heavy objects such as the fuel cask cannot be carried over the irradiated fuel stored in the spent fuel racks. During dry cask loading operations, heavy loads, such as a Multi-Purpose Canister lid, may be moved over spent fuel in the MPC as long as the single failure-proof crane is used and the lifts are performed in accordance with the Control of Heavy Lifts UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 3 of 46 Unit 1 Program requirements described in Section 12.2.1. Furthermore, fuel movement is limited by the equipment configuration of the spent fuel pool and refueling canal. The fuel handling equipment is designed such that a fuel assembly in the auxiliary building could be moved at the same time as a fuel assembly inside containment. The fuel handling accident analysis however assumes only a single fuel assembly is damaged in the event. This is acceptable because initiation of a fuel handling accident in either location requires a malfunction of equipment. It is not credible to assume that multiple malfunctions will occur simultaneously.

Movement of equipment handling the fuel is kept at low speeds while exercising caution that the fuel does not strike another object or structure during transfer from the core to its storage position.

In the unlikely occurrence that an assembly become stuck in the transfer tube, natural convection will maintain adequate cooling.

14.2.1.3 Shock Absorbing Characteristics The design of the fuel assembly is such that the fuel rods are restrained by grid clips which provide a total restraining force of approximately 60 pounds on each fuel rod. If the fuel rods are in contact with the bottom plate of the fuel assembly, any force transmitted to the fuel rods is limited due to the restraining force of the grid clips. The force transmitted to the fuel rods during fuel handling is not of a magnitude great enough to breach the fuel rod cladding.

If the fuel rods are not in contact with the bottom plate of the assembly, the rods would have to slide against the 60-pound friction force. This would have the effect of absorbing a shock and thus limit the force on the individual fuel rods. After the reactor is shut down, the fuel rods contract during the subsequent cooldown, and would not be in contact with the bottom plate of the assembly.

Considerable deformation would have to occur before the rod would make contact with the top plate and apply any appreciable load on the fuel rod. Based on the above, it is felt that it is unlikely that any damage would occur to the individual fuel rods during handling. If one assembly is lowered on top of another, no damage to the fuel rods would occur that would breach the integrity of the cladding.

If during handling the fuel assembly strikes against a flat surface, the loads would be distributed across the fuel assemblies and grid clips and essentially no damage would be expected in any fuel rods. If the fuel assembly were to strike a sharp object, it is possible that the sharp object might damage the fuel rods with which it comes in contact but breaching of the cladding is not expected.

UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 4 of 46 Unit 1 Analyses have been made assuming the extremely remote situation where a fuel assembly is dropped on another, and where one assembly strikes a sharp object. The analysis of a fuel assembly assumed to be dropped and striking a flat surface considered the stresses the fuel cladding was subjected to and any possible buckling of the fuel rods between the grid clip supports.

The results showed that the buckling load at the bottom section of the fuel rod, which would receive the highest loadings, was below the critical buckling load and the stresses were relatively low and below the yield stresses. For the case where one assembly is dropped on top of another fuel assembly, the loads will be transmitted through the end plates and the RCC guide tubes of the struck assembly before any of the loads reach the fuel rods.

The end plates and guide thimbles absorb a large portion of the kinetic energy as a result of bending in the lower plate of the falling assembly. Also, energy is absorbed in the struck assembly top end plate before any load can be transmitted to the fuel rods. The results of this analysis indicated that the buckling load on the fuel rods was below the critical buckling loads, and that the stresses in the cladding were relatively low and below yield.

The refueling operation experience that has been obtained with Westinghouse reactors has verified the fact that no fuel cladding integrity failures are expected to occur during fuel handling operations. However, the above analysis indicates that if the unlikely event of a fuel accident could occur, it would result from the dropping of a fuel assembly either in the containment or auxiliary buildings.

14.2.1.4 Auxiliary Building Accident In the auxiliary building a fuel assembly could be dropped in the transfer canal or the spent fuel pool. However, supply air for the spent fuel pool area enters from both ends of the auxiliary building, is swept across the fuel pool and transfer canal, exhausted at the side of the fuel pool near the pool elevation, and then discharged through the Unit No. 1 vent.

Doors in the auxiliary building are administratively controlled to maintain controlled leakage characteristics in the spent fuel pool region during refueling operations involving irradiated fuel.

Should a fuel assembly be dropped in the canal or in the pool and release radioactivity above a prescribed level in the spent fuel pool area, the spent fuel pool radiation monitor sounds an alarm and automatically shuts down the forced air supply system in this area and channels the spent fuel pool ventilation exhaust air through a charcoal filter to remove most of the halogens prior to discharging it to the unit vent. Since the area radiation monitors in the Fuel Handling Area do not actuate on a high radiation signal fast enough to preclude the discharge of radioactive gases to the UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 5 of 46 Unit 1 unit vent, a charcoal filter in the Fuel Handling Area Ventilation System is manually placed in service prior to irradiated fuel movement.

Any movement of the fuel cask in the spent fuel pool area is under administrative control.

Interlocks prevent the crane from moving the cask over stored irradiated fuel and limit cask movement to one corner of the spent fuel pool away from the fuel assemblies. Interlocks prevent movement of the crane hook over any other portion of the spent fuel pool1 at any other time except when it is absolutely necessary to service the pool and its equipment and instrumentation, and to add or remove any equipment associated with spent fuel handling, storage, or inspection. The crane hook is limited to section 9.7.2 load values with the entire operation under strict administrative control.

The probability of a fuel handling accident is very low because of the safety features, administrative controls, and design characteristics of the facility as previously mentioned. The shock absorbing analyses presented above indicate that in most incidents where an assembly is struck against another object, the outer row of fuel rods would experience greater loads and stresses than the inner rows. Therefore, if a fuel assembly is dropped it does not necessarily mean that all the fuel rods break. Nevertheless, for the fuel handling accident analysis, involving fuel recently removed from the reactor, the assumption is made that the cladding of all the fuel rods in one fuel assembly break suddenly, releasing all the gaseous fission products in the voids between the pellets. The postulated fuel handling accident during dry cask loading operations conservatively assumes damage to two fuel assemblies. Evaluation has demonstrated that the extended decay time required for fuel assembly eligibility for dry cask loading makes this a non-limiting event.

14.2.1.5 Containment Building Accident During fuel handling operations, the containment is kept in an isolated condition with all penetrations to the outside atmosphere either closed or capable of being closed on an alarm signal from a radiation monitor indicating that radioactivity is above prescribed limits. During core alterations, one containment airlock door shall be closed or, appropriate administrative controls shall be in place to allow both airlock doors to remain open.

There are two, independent, redundant, train-oriented radiation monitor sets, each of which is capable of automatically isolating seven containment purge and exhaust valves. That is, the train A device will be capable of isolating the seven inboard purge and exhaust valves and the train B 1 The main hoist load block of either auxiliary building crane and the auxiliary hoist load block of the east crane may be moved over the spent fuel pool if no load is being carried.

UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 6 of 46 Unit 1 device will be capable of isolating the seven outboard valves. Should a fuel assembly be dropped and release activity above a prescribed level, an alarm will be sounded, the containment isolated, and personnel evacuated.

14.2.1.6 Radiological Consequence Analysis For a fuel handling accident in the auxiliary building, the accident analysis postulates that a spent fuel assembly is dropped onto the racks in the spent fuel pool or on the floor of the spent fuel pool or transfer canal, rupturing the cladding of all the fuel rods despite the administrative controls and physical limitations imposed on the fuel handling operations. When the auxiliary building boundary is closed, credit is taken for the Fuel Handling Area Exhaust Ventilation System, and radioactivity is released through the unit vent. As an alternative, technical specifications allow the auxiliary building boundary to be opened intermittently under administrative controls. In particular, the roll up door and the south door of the crane bay may be open. Administrative controls for these doors consist of stationing a dedicated individual at the opening who is in continuous communication with the control room. This individual has a method to rapidly close the opening when a need for auxiliary building isolation is indicated.

For a fuel handling accident in the containment building, the accident analysis postulates that a spent fuel assembly is dropped onto the reactor core or on the floor of the reactor cavity pool, rupturing the cladding of all the fuel rods despite the administrative controls and physical limitations imposed on the fuel handling operations. The containment building may be closed or open. This accident analysis is performed for the containment building being open. Radioactivity is assumed to be released through the open containment penetration(s). No credit is taken for ventilation or for isolation of the open containment penetration(s).

The assembly inventory is determined assuming maximum full power operation at the end of core life immediately preceding shutdown. The gap model discussed in Regulatory Guide 1.183 for halogens and noble gases is used to determine the fuel cladding gap activities. Thus, 5 percent of the total assembly halogens and noble gases, except for 8 percent for I-131 and 10 percent for Kr-85, are assumed to be in the fuel cladding gap. In addition, the highest rated fuel assembly at the time of the reactor shutdown is the assembly assumed to be dropped. The radial peaking factor used to determine the fission product inventory is 1.65. Table 14.A.2-1 lists the fission product inventory in the fuel cladding gap of the highest rated fuel assembly at shutdown.

The fuel handling accident is assumed to occur 120 hours0.00139 days <br />0.0333 hours <br />1.984127e-4 weeks <br />4.566e-5 months <br /> after shutdown when spent fuel is first being transferred from the reactor to the spent fuel pool. The fuel cladding gap activities are reduced by radiological decay which occurs during the minimum 120-hour period between reactor UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 7 of 46 Unit 1 shutdown and the time the fuel handling accident occurs. It is assumed that the highest rated fuel assembly is dropped, breaking all the fuel rods in the dropped assembly and suddenly releasing the entire fission product inventory in the fuel cladding gap to the water.

The radiological consequence analysis is performed using Regulatory Guide 1.183 for the alternative source term. Parameters used in this analysis are listed in Table 14.2.1-2. The control ventilation system is assumed to be manually realigned to the emergency mode of operation after 20 minutes. Atmospheric dispersion factors for the control room are based upon Regulatory Guide 1.194, and the offsite X/Qs are developed using the guidance of Regulatory Guide 1.145. For the release locations identified in Table 14.2.1-2, the atmospheric dispersion factors are provided in Tables 2.2-11 and 2.2-12.

The resulting dose consequences are listed below:

EAB (rem TEDE)

LPZ (rem TEDE)

Control Room (rem TEDE)

Containment Release 3.57 0.67 4.49 Auxiliary Building Release 0.68 0.14 0.27 Acceptance Criteria 6.3 6.3 5

The offsite dose consequences meet the acceptance criteria of Reg. Guide 1.183, and the control room dose is within the limit established by 10 CFR 50.67. Therefore, the accidental release of radioactivity caused by dropping a spent fuel assembly would result in no undue risk to the health and safety of the public.

14.2.2 Accidental Release of Radioactive Liquids The inadvertent release of radioactive liquid to the environment is not considered a credible accident. Any radioactive liquids must ultimately be diverted to the monitor tanks, and any tritium from the CVCS to the monitor tanks also, prior to discharge. (Liquids from these tanks are sampled and monitored for acceptable radioactive levels before being released to the lake.) Erroneous sampling and malfunction of the radiation monitor would have to occur sequentially to discharge radioactive liquid inadvertently, and this series of events is not considered credible.

14.2.2.1 Waste Evaporator Condensate and Monitor Tanks Any spillage of radioactive fluid due to equipment leaks or ruptures would drain directly to either the sump tank or waste holdup tanks, or would accumulate in the area sumps prior to being pumped UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 8 of 46 Unit 1 to the waste holdup tanks. Radioactive liquids to be processed by the waste disposal system are ultimately stored in the waste holdup tanks.

Periodically the contents of the waste holdup tanks and the laundry tanks are analyzed and if the radioactive level is within discharge limits, the liquid is transferred to the waste evaporator condensate tanks and then to the monitor tanks for release.

Effluents from the waste disposal system and monitor tanks 3 and 4 are released, not recycled.

Distillate from the CVCS boric acid evaporator is discharged to monitor tanks. The contents of monitor tanks 1 and 2 are analyzed before being pumped to the primary water storage tanks.

Occasionally it may be necessary to dispose of some of the boric acid distillate for tritium control.

(If analysis of the contents of the monitor tank is within prescribed limits for discharge to the environment, the liquid is pumped directly to the waste liquid discharge line after the normally locked or sealed closed valve in this line is opened.) The radiation monitor downstream prevents discharge of fluids above prescribed levels as explained in the preceding paragraph.

A representative sample is obtained from the monitor tank to determine appropriate release setpoints. Administrative clearance must be granted to open a locked or sealed closed valve. In the highly unlikely event that the locked or sealed closed valve is opened and the tank contents are inadvertently pumped to the discharge tunnel for release to the lake without being previously analyzed for activity, the radiation monitors setpoint is set such that the release will not exceed release limits. If it did, the radiation monitor would trip the second valve downstream of the monitor and terminate the release. Therefore, a pumping accident having radiological consequences is not considered credible.

14.2.2.2 Condensate Storage Tank, Primary Water Storage Tank, and Refueling Water Storage Tank The condensate storage tank and the primary water storage tank are essentially free from radionuclides. The refueling water storage tank contains a relatively low level of radioactivity.

These tanks are not connected to the radwaste system. In the unlikely event of loss of water from any of these tanks the water will percolate down the underground water table, which is estimated to be at elevation 590', that is, about 20 feet below ground level. The hydraulic gradient of the ground is very low; less than 4%. Our studies show a minimum of 50 years would be required for the water to reach the nearest ground water well. The spilled water would preferentially follow the very small natural ground gradient toward the lake and would be eventually diluted in the lake water. By the time any radioactive materials reach the nearest drinking water intake from the lake, UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 9 of 46 Unit 1 which is Lake Township 0.6 miles away from the plant discharge, the resultant dilution, dispersion, and radioactive decay will have reduced the radiological consequences to an insignificant level.

14.2.2.3 Auxiliary Building Liquid Waste Storage Tanks The inadvertent release of radioactive liquid waste to the environment is not considered a credible accident. Any spillage of radioactive fluid due to equipment leaks or ruptures would drain directly to either sumps or waste holdup tanks. Radioactive liquid wastes are diverted to tanks to be processed for release. Tanks are sampled and analyzed to determine that the concentration of radioactive nuclides can be released within discharge limits. The release must pass through a normally locked or sealed closed valve, a radiation monitor and another valve in series prior to reaching the discharge tunnels for release to the lake. Administrative clearance must be granted to open the locked or sealed closed valve. In the highly unlikely event that the locked or sealed closed valve is opened and the tank contents are inadvertently pumped to the discharge tunnel for release to the lake without being previously analyzed for activity, the radiation monitors setpoint is set such that the release will not exceed release limits. If it did, the radiation monitor would trip the second valve downstream of the monitor and terminate the release. Therefore, a pumping accident involving radioactive waste releases having radiological consequences is not considered credible.

14.2.2.4 Piping The pipes running from the refueling water storage tank, the primary water storage tank, and the condensate storage tank to the auxiliary building are installed in a pipe tunnel. In case of a break in any of these pipes, the water will enter the auxiliary building sump, from where it will be processed as described in the Auxiliary Building liquid waste tanks. No pipes from these tanks are directed toward the containment building.

14.2.3 Accidental Waste Gas Release Radioactive gases are introduced into the reactor coolant by the escape of fission products if defects and contamination existed in the fuel cladding. The processing of the reactor coolant by auxiliary systems results in the accumulation of radioactive gases in various tanks. The two main sources of any significant gaseous radioactivity that could occur would be the volume control tank (VCT) and the gas decay tanks. These tanks, located in the lower elevations of the auxiliary building which is a seismically designed structure, are also designed to withstand a seismic event (DBE) without failure. For the purposes of an accidental waste gas release analysis, it is assumed UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 10 of 46 Unit 1 that a tank ruptures by an unspecified mechanism after the reactor has been operating for one core cycle with 1% defects in the fuel cladding.

14.2.3.1 Volume Control Tank Noble gases in the reactor coolant accumulate in the volume control tank throughout a core cycle by the stripping action of the entering spray. Gases retained in this tank are vented to the gas decay tanks when the reactor is shutdown for refueling. A rupture of the volume control tank just prior to venting would release all the accumulated noble gases in the liquid and gas phases, plus that amount in the flow from the letdown line which is assumed to continue flowing up to fifteen minutes until isolation is accomplished. The equilibrium activities which are associated with a release of the gases at this time are based on 1% defects in the fuel cladding, and are listed in Tables 14.A.5-1A and 14.A.5-1B. The total represents 26,410 curies (offsite) and 89,615.4 curies (control room) equivalent Xe-133.

The radiological consequence analysis is performed based upon Standard Review Plan Branch Technical Position 11-5 (July 1981). Atmospheric dispersion factors for the control room are based upon Regulatory Guide 1.194, while offsite X/Qs are developed using the guidance of Regulatory Guide 1.145. Release locations correspondence to the Auxiliary Building ventilation supply vents.

The applicable atmospheric dispersion factors are listed in Tables 2.2-11 and 2.2-12. For the offsite dose consequence analysis, the resulting maximum whole body dose at the site boundary during passage of escaped gases is 0.153 rem. The control room habitability analysis results in dose consequences of 0.13 rem TEDE.

It is, therefore, concluded from the above analysis that an unlikely event of an accidental waste gas release from a volume control tank rupture would present no hazard to the health and safety of the public, since the maximum whole body dose at the site boundary is less than the 0.5 rem criterion in Standard Review Plan Branch Technical Position 11-5 and the control room dose remains less than the 5 rem TEDE limit from 10 CFR 50.67.

14.2.3.2 Gas Decay Tanks The gas decay tanks accumulate radioactive gases from three major sources processed by the waste disposal system: the gas stripper, the liquid holdup tanks, and the volume control tank. Of these three, only the volume control tank is capable of introducing large amounts of activity to the gas decay tanks in a relatively short period of time. After shutting down the reactor for refueling, the reactor coolant system is purified and degassed. The gases accumulated in the volume control UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 11 of 46 Unit 1 tank are periodically vented to the waste gas compressor prior to being stored in the gas decay tanks.

For an accident analysis, it is assumed that the entire equilibrium inventory of noble gases contained in a single gas decay tank (offsite) or the RCS (control room) is released after rupture.

The maximum activity available for release is restricted by a technical requirements manual curie limit set on a tank. This limit is 43,800 curies dose equivalent Xe-133.

The maximum activity available for release in the control room habitability dose consequence analysis is shown in Table 14.A.5-2.

The radiological consequence analysis is performed based upon Standard Review Plan Branch Technical Position 11-5 (July 1981). Atmospheric dispersion factors for the control room are based upon Regulatory Guide 1.194, while the offsite X/Qs are developed using the guidance of Regulatory Guide 1.145. Release locations correspond to the Auxiliary Building ventilation supply vents. The applicable atmospheric dispersion factors are listed in Tables 2.2-11 and 2.2-12.

Restricting the quantity of activity contained in a single decay tank assures that the resulting whole body dose at the nearest site boundary will not exceed 0.5 rem. This is consistent with Standard Review Plan 15.7.1, Waste Gas System Failure. The control room habitability analysis results in dose consequences of 0.09 rem TEDE It is, therefore, concluded from the above analysis that an unlikely event of an accidental waste gas release from a gas decay tank rupture would present no hazard to the health and safety of the public, since the maximum whole body dose at the site boundary will not exceed the 0.5 rem criterion in Standard Review Plan Branch Technical Position 11-5. In addition, the maximum dose to operators in the control room meets the 5 rem criterion from 10 CFR 50.67.

UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 12 of 46 Unit 1 14.2.4 Steam Generator Tube Rupture 14.2.4.1 General The accident examined is the complete severance of a single steam generator tube (SGTR). The accident is assumed to take place with the reactor coolant contaminated with fission products corresponding to continuous operation with a limited amount of defective fuel rods. The accident leads to an increase in contamination of the secondary system due to leakage of radioactive coolant from the reactor coolant system. In the event of a coincident loss of offsite power, or failure of the condenser steam dump system, discharge of activity to the atmosphere takes place via the steam generator power operated relief valves (and safety valves if their setpoint is reached).

The steam generator tube material is Inconel 690 and, as the material is highly ductile, it is considered that the assumption of a complete severance is somewhat conservative. The more probable mode of tube failure would be one or more minor leaks of undetermined origin. Activity in the steam and power conversion system is subject to continual surveillance and an accumulation of minor leaks which exceed the Technical Specification limits is not permitted during unit operation.

The operator is expected to determine that a steam generator tube rupture (SGTR) has occurred, to identify and isolate the ruptured steam generator, and to complete the required recovery actions to stabilize the plant and terminate the primary to secondary break flow. These actions should be performed on a restricted time scale in order to minimize the contamination of the secondary system and ensure termination of radioactive release to the atmosphere from the ruptured steam generator. Consideration of the indications provided at the control board, together with the magnitude of the break flow, leads to the conclusion that the recovery procedure can be carried out on a time scale that ensures that break flow to the ruptured steam generator is terminated before the water level in the affected steam generator rises into the main steam pipe. Sufficient indications and controls are provided to enable the operator to carry out these functions satisfactorily.

14.2.4.2 Description of Accident Assuming normal operation of the various plant control systems, the following sequence of events is initiated by a tube rupture:

1.

Pressurizer low pressure and low level alarms are actuated, and prior to plant trip, charging pump flow increases in an attempt to maintain pressurizer level. On the secondary side there is a steam flow/feedwater flow mismatch before trip, as UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 13 of 46 Unit 1 feedwater flow to the affected steam generator is reduced due to the additional break flow which is now being supplied to that steam generator.

2.

Loss of reactor coolant inventory leads to falling pressure and level in the pressurizer until a reactor trip signal is generated by low pressurizer pressure or overtemperature T. A safety injection signal, initiated by low pressurizer pressure follows soon after the reactor trip. The safety injection signal automatically terminates normal feedwater supply and initiates auxiliary feedwater addition.

3.

The steam generator blowdown liquid monitor and the steam jet air ejector radiation monitor will alarm, indicating a sharp increase in radioactivity in the secondary system.

4.

The reactor trip automatically trips the turbine, and if outside power is available, the steam dump valves open, permitting steam dump to the condenser. In the event of a coincident loss of offsite power, the steam dump valves would automatically close to protect the condenser. The steam generator pressure would rapidly increase, resulting in steam discharge to the atmosphere through the steam generator power operated relief valves (and the steam generator safety valves if their setpoint is reached).

5.

Following reactor trip and safety injection actuation, the continued action of auxiliary feedwater supply and borated safety injection flow (supplied from the refueling water storage tank (RWST)) provide a heat sink. Thus, steam bypass to the condenser, or in the case of loss of outside power, steam relief to atmosphere, is attenuated during the time in which the recovery procedure leading to isolation is being carried out.

6.

Safety injection flow results in restoration of pressurizer water level.

14.2.4.3 Recovery Procedure In the event of an SGTR, the plant operators must diagnose the SGTR and perform the required recovery actions to stabilize the plant and terminate the primary to secondary leakage. The operator actions for SGTR recovery are provided in the Emergency Operating Procedures (EOPs).

The EOPs are based on guidance in the Westinghouse Owner's Group Emergency Response Guidelines (Reference 1) which addresses the recovery from a SGTR with and without offsite power available. The major operator actions include identification and isolation of the ruptured UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 14 of 46 Unit 1 steam generator, cooldown and depressurization of the RCS to restore inventory, and termination of SI to stop primary to secondary leakage. These operator actions are described below.

1.

Identify the ruptured steam generator.

High secondary side activity, as indicated by the secondary side radiation monitors will typically provide the initial indication of an SGTR event. The ruptured steam generator can be identified by an unexpected increase in steam generator level, in conjunction with a high radiation indication on the main air ejector monitor, or from the steam generator blowdown liquid monitor. For an SGTR that results in a reactor trip at high power, the steam generator water level will decrease off-scale on the narrow range for all of the steam generators. The auxiliary feedwater flow will begin to refill the steam generators, distributing approximately equal flow to each of the steam generators. Since primary to secondary leakage adds additional liquid inventory to the ruptured steam generator, the water level will return to the narrow range earlier in that steam generator and will continue to increase more rapidly.

This response, as indicated by the steam generator water level instrumentation, provides confirmation of an SGTR event and also identifies the ruptured steam generator.

2.

Isolate the ruptured steam generator from the intact steam generators and isolate feedwater to the ruptured steam generator.

Once a tube rupture has been identified, recovery actions begin by isolating steam flow from and stopping feedwater flow to the ruptured steam generator. In addition to minimizing radiological releases, this also reduces the possibility of overfilling the ruptured steam generator with water by 1) minimizing the accumulation of feedwater flow and 2) enabling the operator to establish a pressure differential between the ruptured and intact steam generators as a necessary step toward terminating primary to secondary leakage.

3.

Cool down the RCS using the intact steam generators.

After isolation of the ruptured steam generator, the RCS is cooled as rapidly as possible to less than the saturation temperature corresponding to the ruptured steam generator pressure by dumping steam from only the intact steam generators. This ensures adequate subcooling in the RCS after depressurization to the ruptured steam generator pressure in subsequent actions. If offsite power is available, the normal UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 15 of 46 Unit 1 steam dump system to the condenser can be used to perform this cooldown.

However, if offsite power is lost, the RCS is cooled using the power operated relief valves (PORVs) on the intact steam generators. Nitrogen is available to support Steam Generator PORV operation in the event that control air is unavailable.

4.

Depressurize the RCS to restore reactor coolant inventory.

When the cooldown is completed, SI flow will increase RCS pressure until break flow matches SI flow. Consequently, SI flow must be terminated to stop primary to secondary leakage. However, adequate reactor coolant inventory must first be assured. This includes both sufficient reactor coolant subcooling and pressurizer inventory to maintain a reliable pressurizer level indication after SI flow is stopped.

The RCS depressurization is performed using normal pressurizer spray if the reactor coolant pumps (RCPs) are running. However, if offsite power is lost or the RCPs are not running, normal pressurizer spray is not available. In this event, RCS depressurization can be performed using a pressurizer PORV or auxiliary pressurizer spray.

5.

Terminate SI to stop primary to secondary leakage.

The previous actions will have established adequate RCS subcooling, a secondary side heat sink, and sufficient reactor coolant inventory to ensure that SI flow is no longer needed. When these actions have been completed, SI flow must be stopped to terminate primary to secondary leakage. Primary to secondary leakage will continue after SI flow is stopped until the RCS and ruptured steam generator pressures equalize. Charging flow, letdown, and pressurizer heaters will then be controlled to prevent repressurization of the RCS and reinitiation of leakage into the ruptured steam generator.

Following SI termination, the plant conditions will be stabilized, the primary to secondary break flow will be terminated and all immediate safety concerns will have been addressed. At this time a series of operator actions are performed to prepare the plant for cooldown to cold shutdown conditions. Subsequently, actions are performed to cooldown and depressurize the RCS to cold shutdown conditions and to depressurize the ruptured steam generator.

UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 16 of 46 Unit 1 14.2.4.4 Analysis and Results In estimating the mass transfer from the reactor coolant system through the broken tube, the following assumptions were made:

a.

Plant trip occurs automatically as a result of low pressurizer pressure.

b.

Following the initiation of the safety injection signal, both centrifugal charging pumps are actuated and continue to deliver flow.

c.

After reactor trip the break flow equilibrates to the point where incoming safety injection flow is balanced by outgoing break flow. In the accident analysis to determine the steam releases for dose considerations, the equilibrium break flow is assumed to persist for the first 30 minutes after the accident initiation.

d.

The termination of break flow occurs before the steam generator would overfill into the main steam piping. A specific overfill calculation was not included in the original analysis; however, a more recent analysis described below confirms the continued validity of this assumption.

The above assumptions lead to a conservative upper bound of 162,000 pounds for the total amount of reactor coolant transferred to the ruptured steam generator and 73,000 pounds for the total amount of steam released to the atmosphere via the ruptured steam generator as a result of the steam generator tube rupture accident.

Demonstration that the ruptured steam generator does not overfill during the accident has more recently been performed by utilizing an NRC-approved thermal hydraulic analysis code.

Reference 2 includes the NRCs approval of the break flow model contained within the LOFTTR2 computer code that has been used for the Cook unit-specific supplemental overfill analysis. The approved code simulates the plant response, and models specific operator actions. Thus, a more realistic representation of the break flow during the accident is obtained. The supplemental analysis demonstrates that break flow following the complete severance of a steam generator tube is terminated within 52 minutes after initiation of the tube rupture and overfill of the steam generator does not occur. The resultant mass release data from this recent analysis has been confirmed to remain bounded by the mass release data calculated with the current licensing basis analysis methodology, which assumes break flow persisting for 30 minutes from the initiation of the accident. The current mass release and consequent dose analysis were not revised as a result of the supplemental analysis.

UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 17 of 46 Unit 1 Effect of the Replacement Steam Generators on Unit 1 The secondary volume of the RSGs is smaller than that of the original steam generators (OSGs).

However, the available RSG volume is sufficient to accommodate the integrated leakage during this event. Therefore, steam generator overfill with the RSGs will not occur.

Effect of the RTD Bypass Elimination Evaluation performed to support RTD Bypass Elimination demonstrates that the conclusions of the accident analysis remain valid.

Effect of the MUR Program on Unit 1 The effect of the MUR program on the results of the steam generator tube rupture analysis was evaluated for the MUR. The SGTR thermal hydraulic analysis calculates the primary-to-secondary break flow for Margin To Overfill (MTO) and the steam released to the environment for dose calculations. For the Unit 1 onsite and offsite dose consequences of the SGTR event, the pre-MUR analysis of record considered power levels that bound the MUR uprated condition. In addition, a supplemental MTO analysis was performed using the LOFTTR2 computer code assuming the MUR power level. The analysis confirmed the existing licensing basis analysis remains conservative at MUR conditions. The higher power level will have a slight increase on break flow rate; however, the effects are offset by the lower initial water mass in the SG at the higher power level.

Since the power uprate has a negligible effect on the MTO and the thermal hydraulic conditions of the uprate are bounded by the existing analysis, the conclusions presented for the SGTR event remain valid for the MUR program conditions.

14.2.4.5 Radiological Consequence Analysis The steam generator tube rupture accident analysis postulates that the complete severance of a single steam generator tube leads to an increase in the amount of reactor coolant transferred to the secondary system. Offsite power is assumed to be lost, and main steam condensers are assumed to be unavailable for steam dump. Twenty-four (24) hours after the accident the residual heat removal system is assumed to be in service, RCS temperature is assumed to be 212°F and steam and activity are no longer assumed to be released to the environment.

The radiological consequence analysis is performed based on Regulatory Guide 1.183 for the alternative source term. Parameters used in this analysis are listed in Table 14.2.4-1. For the release location identified in Table 14.2.4-1, atmospheric dispersion factors are provided in Tables 2.2-11 and 2.2-12.

UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 18 of 46 Unit 1 Prior to the accident, the primary and secondary coolant activities and the primary-to-secondary leakage correspond to the limits in technical specifications. The reactor coolant fission product inventory and iodine appearance rates during normal power operation are listed in Table 14.A.3-3 and Table 14.A.3-5, respectively. The secondary coolant activity and primary-to-secondary leakage are listed in Table 14.2.4-1.

Two cases of reactor coolant iodine spiking are analyzed: a pre-accident iodine spike case and a concurrent iodine spike case. For the pre-accident iodine spike case, a reactor transient is assumed to have occurred prior to the postulated steam generator tube rupture and to have raised the reactor coolant iodine concentration to the maximum value permitted by technical specifications, i.e., 60 Ci/gm dose equivalent I-131. For the concurrent iodine spike case, the steam generator tube rupture transient causes an iodine spike in the reactor coolant system. The iodine release rate from the fuel rods to the reactor coolant increases to a value that is 335 times greater than the iodine appearance rate during normal power operation. The assumed duration for this spike is 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

The dose consequences for this event are shown below.

EAB (rem TEDE)

LPZ (rem TEDE)

Control Room (rem TEDE)

Pre-Accident Spike 4.16 0.76 3.96 Acceptance Limit 25 25 5

EAB (rem TEDE)

LPZ (rem TEDE)

Control Room (rem TEDE)

Concurrent Accident Spike 2.50*

0.47 2.26 Acceptance Limit 2.5 2.5 5

• Calculated value is 2.497 rem which is rounded up to 2.50 14.2.4.6 Conclusion A steam generator tube rupture will cause no subsequent damage to the RCS or the reactor core.

An orderly recovery from the accident can be completed, even assuming a simultaneous loss of offsite power such that liquid does not enter the steam piping space. The control room dose is within the 5 rem TEDE 10 CFR 50.67 limit. The offsite dose consequences meet the acceptance criteria of Regulatory Guide 1.183.

UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 19 of 46 Unit 1 14.2.4.7 References for Section 14.2.4

1.

Westinghouse Owners Group; Emergency Response Guidelines, Published by Westinghouse Electric Corporation for the Westinghouse Owners Group.

2.

Charles E. Rossi, NRC, to Alan E. Ladieu, WOG SGTR Subgroup Chairman, Acceptance for Referencing of Licensing Topical Report WCAP-10698 SGTR Analysis Methodology to Determine the Margin to Steam Generator Overfill, December 1984, March 30, 1987.

14.2.5 Rupture of a Steam Pipe A rupture of a steam pipe results in an uncontrolled steam release from a steam generator. The steam release results in an initial increase in steam flow, which decreases during the accident as the steam pressure falls. The energy removal from the reactor coolant system causes a reduction of coolant temperature and pressure. In the presence of a negative coolant temperature coefficient, the cooldown results in a reduction of core shutdown margin. If the most reactive RCCA is assumed stuck in its fully withdrawn position, there is an increased possibility that the core will become critical and return to power. A return to power following a steam pipe rupture is a potential problem mainly because of the high hot channel factors which exist when the most reactive assembly is assumed stuck in its fully withdrawn position. The core is ultimately shut down by boric acid delivered by the emergency core cooling system.

The analysis of a steam pipe rupture is performed to demonstrate that:

Assuming a stuck assembly, with or without offsite power, and assuming a single failure in the engineered safety features, there is no consequential damage to the primary system and the core remains in place and intact.

Although DNB and possible clad perforation following a steam pipe rupture are not necessarily unacceptable, the following analysis, in fact shows that no DNB occurs for any rupture assuming the most reactive assembly stuck in its fully withdrawn position.

An analysis of the core response is performed for the rupture of a steam pipe event initiated from both hot zero power (subsections 14.2.5.1 and 14.2.5.2) and hot full power (subsection 14.2.5.4).

The radiological consequences analysis is presented in subsection 14.2.5.3.

UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 20 of 46 Unit 1 14.2.5.1 Method of Analysis The analysis of the steam pipe rupture has been performed to determine:

A.

The core heat flux and RCS temperature and pressure resulting from the cooldown following the steam line break. The LOFTRAN Code, described in Section 14.1, has been used.

B.

The thermal and hydraulic behavior of the core following a steam line break. A detailed thermal and hydraulic digital-computer code, THINC, described in Section 14.1, has been used to determine if DNB occurs for the core conditions computed in item A above.

The following conditions were assumed to exist at the time of a main steam line break accident:

A.

End-of-life shut down margin (1.30% k/k) at no load, equilibrium xenon conditions, and the most reactive RCCA stuck in its fully withdrawn position.

Operation of the RCCA banks during core burnup is restricted in such a way (to not violate the rod insertion limits presented in the Technical Specifications) that addition of positive reactivity in a steam line break accident will not lead to a more adverse condition than the case analyzed.

B.

A negative moderator coefficient of reactivity corresponding to the end-of-life rodded core with the most reactive RCCA in the fully withdrawn position. The variation of the coefficient with temperature and pressure has been included. The keff versus temperature at 1050 psia corresponding to the negative moderator temperature coefficient used is shown in Figure 14.2.5-1. The Doppler power feedback assumed for this analysis is presented in Figure 14.2.5-2.

The core properties associated with the sector nearest the affected steam generator and those associated with the remaining sector were conservatively combined to obtain average core properties for reactivity feedback calculation. Further, it was conservatively assumed that the core power distribution was uniform. These two conditions cause underprediction of the reactivity feedback in the high power region near the stuck rod. To verify the conservatism of this method, the reactivity as well as the power distribution was checked for the limiting conditions for the cases analyzed. This core analysis considered the Doppler reactivity from the high fuel temperature near the stuck RCCA, moderator feedback from the high water enthalpy near the stuck RCCA, power redistribution and non-uniform core inlet UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 21 of 46 Unit 1 temperature effects. For cases in which steam generation occurs in the high flux regions of the core, the effect of void formation was also included. It was determined that the reactivity employed in the kinetics analysis was always larger than the reactivity calculated including the above local effects for the statepoints.

These results verify conservatism; i.e., underprediction of negative reactivity feedback from power generation.

C.

Minimum capability for injection of boric acid (2400 ppm) solution corresponding to the most restrictive single failure in the safety injection system. The emergency core cooling system (ECCS) consists of the following systems: (1) the passive accumulators, (2) the low head safety injection (residual heat removal) system, (3) the intermediate head safety injection system, and (4) the high head safety injection (charging) system. Only the high head safety injection (charging) system and the passive accumulators are modeled for the steam line break accident analysis.

The modeling of the safety injection system in LOFTRAN is described in Reference 1. Figure 14.2.5-3 presents the safety injection flow rates as a function of RCS pressures assumed in the analysis. The flow corresponds to that delivered by one charging pump delivering its full flow to the cold leg header. No credit has been taken for the low concentration borated water, which must be swept from the lines downstream of the boron injection tank isolation valves prior to the delivery of boric acid to the reactor coolant loops. For the analysis, a boron concentration of 0 ppm for the boron injection tanks is assumed.

For the cases where offsite power is assumed, the sequence of events in the safety injection system is the following. After the generation of the safety injection signal (appropriate delays for instrumentation, logic, and signal transport included), the appropriate valves begin to operate and the high head safety injection pump starts.

In 27 seconds, the valves are assumed to be in their final position and the pump is assumed to be at full speed and to draw suction from the RWST. The volume containing the low concentration borated water is swept into core before the 2400 UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 22 of 46 Unit 1 ppm borated water reaches the core. This delay, described above, is inherently included in the modeling.

In cases where offsite power is not available, an additional 10-second delay is assumed to start the diesel generators and to commence loading the necessary safety injection equipment onto them.

D.

Design value of the steam generator heat transfer coefficient including allowance for fouling factor.

E.

Four combinations of break sizes and initial plant conditions have been considered in determining the core power transient which can result from large area pipe breaks.

a.

Complete severance of a pipe downstream of the steam flow restrictor with the plant initially at no load conditions and all reactor coolant pumps running.

b.

Complete severance of a pipe inside the containment at the outlet of the steam generator with the same plant conditions as above.

c.

Case (a) above with loss of off-site power simultaneous with the generation of the safety injection signal (loss of A.C. power results in coolant pump coastdown).

d.

Case (b) above with the loss of off-site power simultaneous with the safety injection signal.

A fifth case was analyzed consistent with the criterion stated earlier that the DNBR remains above the limit value in the event of the spurious opening of a steam dump or relief valve.

e.

A break equivalent to a steam flow of 247 lbs per second at 1100 psi from one steam generator with off-site power available.

F.

Power peaking factors corresponding to one stuck RCCA and non-uniform core inlet coolant temperatures are determined at end of core life. The coldest core inlet temperatures are assumed to occur in the sector with the stuck rod. The power peaking factors account for the effect of the local void in the region of the stuck control assembly during the return to power phase following the steam line break.

This void in conjunction with the large negative moderator coefficient partially UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 23 of 46 Unit 1 offsets the effect of the stuck assembly. The power peaking factors depend upon the core power, temperature, pressure, and flow, and thus are different for each case studied.

The analyses assumed initial hot shutdown conditions at time zero since this represents the most pessimistic initial condition. Should the reactor be just critical or operating at power at the time of a steam line break, the reactor will be tripped by the normal overpower protection system when power level reaches a trip point.

Following a trip at power the reactor coolant system contains more stored energy than at no-load, the average coolant temperature is higher than at no-load and there is appreciable energy stored in the fuel. Thus, the additional stored energy is removed via the cooldown caused by the steam line break before the no-load conditions of RCS temperature and shutdown margin assumed in the analyses are reached. After the additional stored energy has been removed, the cooldown and reactivity insertions proceed in the same manner as in the analysis which assumes no-load condition at time zero.

G.

In computing the steam flow during a steam line break, the Moody Curve (Reference 2) for f1/D = 0 is used.

H.

The fast acting steam line isolation valves are assumed to close in less than eleven seconds from receipt of actuation signal. For breaks downstream of the isolation valves, closure of all valves would completely terminate the blowdown. For any break, in any location, no more than one steam generator would experience an uncontrolled blowdown even if one of the isolation valves fails to close.

14.2.5.2 Results The limiting case of cases a through e was shown to be the double-ended rupture located downstream of the flow restrictor with offsite power available. Table 14.2.5-1 lists the limiting statepoints for this worst case. The results presented are a conservative indication of the events which would occur assuming a steam line rupture since it is postulated that all of the conditions described above occur simultaneously. The sequence of events for this transient is presented in Table 14.2.5-2.

Figures 14.2.5-4 through 14.2.5-7 show the RCS transient and core heat flux following a main steam line rupture (complete severance of a pipe at the exit of the steam generator nozzle) at initial no-load condition.

UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 24 of 46 Unit 1 Offsite power is assumed available so that full reactor coolant flow exists. The transient shown assumes an uncontrolled steam release from only one steam generator. Should the core be critical at near zero power when the rupture occurs the initiation of safety injection by high differential pressure between any steam line and the remaining steam lines or low steam line pressure or low pressurizer pressure or high containment pressure will trip the reactor. Steam release from more than one steam generator will be prevented by automatic trip of the fast acting isolation valves in the steam lines by high-high containment pressure signals or low steam line pressure or high steam flow coincident with low-low Tavg. Even with the failure of one valve, release is limited to approximately 13 seconds for the other steam generators while the one generator blows down.

Steamline isolation is complete 11 seconds after the setpoint is reached. The isolation time allows 8 seconds for valve closure plus three seconds for electronic delays and signal processing.

As shown in Figure 14.2.5-7, the core attains criticality with the RCCAs inserted (with the design shutdown assuming one stuck RCCA) before boron solution at 2400 ppm enters the RCS. A peak core power less than the nominal full power value is attained.

The calculation assumes the boric acid is mixed with, and diluted by the water flowing in the RCS prior to entering the reactor core. The concentration after mixing depends upon the relative flow rates in the RCS and in the safety injection system. The variation of mass flow rate in the RCS due to water density changes is included in the calculation as is the variation of flow rate in the safety injection system due to changes in the RCS pressure. The safety injection system flow calculation includes the line losses in the system as well as the pump head curve.

The assumed steam release for an accidental depressurization of the main steam system (Case e) is the maximum capacity of any single steam dump, relief, or safety valve. Safety injection is initiated automatically by low pressurizer pressure. Operation of one centrifugal charging pump is assumed. Boron solution at 2400 ppm enters the RCS providing sufficient negative reactivity to prevent core damage. The transient is quite conservative with respect to cooldown, since no credit is taken for the energy stored in the system metal other than that of the fuel elements or the energy stored in the other steam generators. Since the transient occurs over a period of about five minutes, the neglected stored energy is likely to have a significant effect in slowing the cooldown.

The DNB transient is bounded by the limiting case for a steam line rupture.

The DNB analysis for the limiting case (double-ended rupture located downstream of the flow restrictor) showed that the minimum DNBR remained above the limit value.

UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 25 of 46 Unit 1 Effect of the Replacement Steam Generators on Unit 1 The effect of the RSGs on the results of the rupture of steam pipe accident has been evaluated.

The critical parameters that affect the system and core responses to the steam line break are the break size and the heat transfer capacity. The heat transfer capacities of the steam generators are equivalent. Therefore, the RSG does not alter the primary response relative to the original steam generator (OSG) when considering steam generator heat transfer characteristics. The maximum break size is reduced from 4.7 ft2 with the OSG to 1.6 ft2 with the RSG, which reduces overcooling, and the attendant return to power. Also, the primary side flows are slightly larger for the RSG at zero percent tube plugging. Changes in both the maximum break size and the RCS flow are in the beneficial direction with respect to minimum DNB. Consequently, the margin to DNB increases with the RSGs.

Effect of the MUR Program on Unit 1 The effect of the MUR program on the results of the rupture of a steam pipe was evaluated.

Because this analysis is analyzed at hot zero power conditions, the increase in nominal power level does not affect the results of the analysis. The current analysis of record therefore supports operation at the MUR program power conditions.

Based upon this evaluation, the conclusions presented for the rupture of a steam pipe remain valid for the MUR program conditions.

Effect of the Return to RCS NOP/NOT Program on Unit 1 An evaluation of the Rupture of a Steam Pipe event initiated from no-load conditions was performed to support the Return to RCS NOP/NOT program. The evaluation demonstrated that the analysis would realize additional margin to the DNB acceptance criterion through modeling the increased primary pressure of the Return to RCS NOP/NOT conditions. Therefore, the conclusions for the Rupture of a Steam Pipe analysis of record for the case initiated from no-load conditions are applicable and remain valid for the Return to RCS NOP/NOT program.

14.2.5.3 Radiological Consequence Analysis The main steam line break accident analysis postulates that a steam pipe outside containment ruptures resulting in an uncontrolled steam release from the affected steam generator. Offsite power is assumed to be lost, and main steam condensers are assumed to be unavailable for steam dump. Twenty-four (24) hours after the accident the residual heat removal system is assumed to be in service, RCS temperature is assumed to be 212°F and steam and activity are no longer assumed to be released to the environment.

UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 26 of 46 Unit 1 Steam line breaks which occur outside of containment may occur either upstream or downstream of the main steam isolation valves (MSIV). Based upon the steam line piping configuration, the steam released from breaks upstream of the MSIV on the faulted steam generator will enter the environment from the main steam enclosures. For these breaks, the release is unmitigated for the duration of the event. For breaks downstream of the MSIV, the steam can enter the atmosphere from the turbine building. Releases from downstream breaks can be mitigated by closure of the MSIV on the faulted steam generator. To conservatively address the broad spectrum of release locations, a single, bounding break scenario is analyzed which does not take credit for isolation of the faulted steam generator and applies the atmospheric dispersion factors from the most limiting release location.

The radiological consequence analysis is performed based on Regulatory Guide 1.183 for the alternative source term. Parameters used in this analysis are listed in Table 14.2.5-3. For the release locations identified in Table 14.2.5-3, atmospheric dispersion factors are provided in Tables 2.2-11 and 2.2-12..

Prior to the accident, the primary and secondary coolant activities and the primary-to-secondary leakage correspond to the limits in technical specifications. The reactor coolant fission product inventory and iodine appearance rates during normal power operation are listed in Table 14.A.3-3 and Table 14.A.3-5, respectively. The secondary coolant activity and primary-to-secondary leakage are listed in Table 14.2.5-3.

Two cases of reactor coolant iodine spiking are analyzed for each pipe break location: a pre-accident iodine spike case and a concurrent iodine spike case. For the pre-accident iodine spike case, a reactor transient is assumed to have occurred prior to the postulated main steam line break and to have raised the reactor coolant iodine concentration to the maximum value permitted by technical specifications, i.e., 60 Ci/gm dose equivalent I-131. For the concurrent iodine spike case, the main steam line break transient causes an iodine spike in the reactor coolant system. The iodine release rate from the fuel rods to the reactor coolant increases to a value that is 500 times greater than the iodine appearance rate during normal power operation. The assumed duration for this spike is 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

This event results in the following dose consequences:

UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 27 of 46 Unit 1 EAB (rem TEDE)

LPZ (rem TEDE)

Control Room (rem TEDE)

Pre-Accident Spike 0.25 0.10 1.38 Acceptable Limit 25 25 5

EAB (rem TEDE)

LPZ (rem TEDE)

Control Room (rem TEDE)

Concurrent Accident Spike 0.84 0.29 2.99 Acceptable Limit 2.5 2.5 5

14.2.5.4 Rupture of a Steam Pipe at Full Power A rupture in the main steam system piping from an at-power condition creates an increased steam load, which extracts an increased amount of heat from the RCS via the steam generators. This results in a reduction in RCS temperature and pressure. In the presence of a strong negative moderator temperature coefficient, typical end-of-cycle life conditions, the colder core inlet coolant temperature causes the core power to increase from its initial level due to the positive reactivity insertion. The power approaches a level equal to the total steam flow. Depending on the break size, a reactor trip may occur due to overpower conditions or as a result of a steam line break protection function actuation.

The rupture of a steam pipe accident analysis described in subsection 14.2.5 is performed assuming a hot zero power initial condition with the control rods inserted in the core, except for the most reactive rod in the fully withdrawn position. That condition could occur while the reactor is at hot shutdown at the minimum required shutdown margin or after the plant has been tripped manually or by the reactor protection system following a steamline break from an at-power condition. For an at-power break, the analysis of subsection 14.2.5 represents the limiting condition with respect to core protection for the time period following reactor trip. The purpose of this section is to describe the analysis of a steam system piping failure occurring from an at-power initial condition, to demonstrate that core protection is maintained prior to and immediately following reactor trip.

UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 28 of 46 Unit 1 The analysis of a steam pipe rupture is performed to demonstrate that:

There is no consequential damage to the primary system and the core remains in place and intact.

Although DNB and possible clad perforation following a steam pipe rupture are not necessarily unacceptable, the following analysis shows that no DNB occurs for any rupture assuming the most reactive assembly stuck in its fully withdrawn position.

As discussed in subsection 14.1.0.3 pertaining to the OTT and OPT setpoints, a T value restricted to a maximum value 13.3°F below the maximum full power vessel average temperature had previously justified overpower protection. However, with the Return to NOP/NOT conditions, the restriction of T below the maximum full power vessel average temperature was removed and an explicit analysis demonstrating overpower protection from the OPT protection function was required.

14.2.5.4.1 Method of Analysis The analysis of the rupture of a steam pipe at full power was performed as follows:

1.

A detailed analysis using the LOFTRAN computer code (Reference 1) is performed to determine the plant transient conditions following a main steamline rupture at HFP conditions. The code computes pertinent variables, including the core power, RCS temperature, and pressure. A spectrum of break sizes is analyzed, and a limiting case is determined based on the maximum peak core heat flux calculated.

2.

Statepoints for the limiting case consisting of nuclear power, RCS loop inlet temperatures, pressures, and core flow, along with additional inputs from the nuclear core model analyzed using the ANC code (Reference 4), are used as input to the detailed thermal and hydraulic digital computer code VIPRE (Reference 3) to determine if the DNBR design basis is satisfied for the limiting time in the transient. Additionally, the nuclear core model analyzed using the ANC code determines if the maximum peak linear heat generation rate limit (expressed in kW/ft) is violated.

This accident was analyzed with the Revised Thermal Design Procedure as described in Reference

5. Plant characteristics and initial conditions are presented in Table 14.1-3.

The following assumptions were made in the transient analysis:

UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 29 of 46 Unit 1

1.

Initial conditions - The initial core power, reactor coolant temperature, and RCS pressure are assumed to be at their nominal full-power values. The full power condition is more limiting than part-power in terms of DNBR and peak linear heat generation rate. The RCS Minimum Measured Flow is used. Uncertainties in initial conditions are included in the DNBR limit as described in Reference 5. A steam generator tube plugging (SGTP) level of 0% is assumed to maximize the primary-to-secondary heat transfer rate. Initial conditions are presented in Table 14.1-3.

2.

Break size - A spectrum of break sizes were analyzed. The analysis assumes up to a complete severance of a main steam pipe with the plant initially at full-power conditions. Since the BWI Model 51 SGs are equipped with integral flow restrictors with a 1.4 ft2 throat area, any steamline rupture with a break area greater than this size, regardless of the location, would have the same effect on the reactor as a 1.4 ft2 break.

3.

Break flow - In computing the steam flow during a steamline rupture, the Moody Curve for f(L/D) = 0 is used.

4.

Reactivity coefficients - The analysis assumed maximum moderator reactivity feedback and minimum Doppler power feedback to maximize the power increase following the break.

5.

Protection system - The protection system feature that mitigates the effects of a SLB initiated from HFP is a reactor trip, if necessary (specifically, OPT and low steam pressure - safety injection (SI)).

6.

Control systems - Pressurizer heaters are not credited. This assumption conservatively yields a higher rate of pressure decrease. The pressurizer power-operated relief valves (PORVs) are modeled to reduce RCS pressure, resulting in a conservative calculation of the margin to the departure from nucleate boiling ratio (DNBR) limit.

14.2.5.4.2 Results The most limiting HFP SLB case is the largest break size for which a reactor trip on OPT is predicted.

This is because for the cases assuming smaller break sizes, no reactor trip is predicted and the power reaches a non-limiting equilibrium at the higher steam load, and for the cases assuming UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 30 of 46 Unit 1 larger break sizes, the reactor trips relatively quickly on a SI signal due to low steamline pressure, making the larger break sizes less limiting due to the reactor trip occurring before a significant power excursion can occur. Based on this, the limiting case for NOP/NOT conditions is a 0.89 ft2 break. As statepoints for the limiting case were analyzed using the ANC and VIPRE codes and it was determined that the DNBR design basis was satisfied and the maximum peak linear heat generation rate remained below the level that would result in fuel centerline melt.

The statepoint values and sequence of events for the limiting case are shown in Tables 14.2.5-1 and 14.2.5-2, respectively. Figures 14.2.5-8 through 14.2.5-11 show the transient results.

14.2.5.5 Conclusions The analysis has shown that the criteria stated earlier are satisfied.

Although DNB and possible clad perforation following a steam pipe rupture are not necessarily unacceptable and not precluded by the criteria, the above analysis, in fact, shows that no DNB occurs for the rupture (or an accidental depressurization of the main steam system) assuming the most reactive RCCA stuck in its fully withdrawn position.

The control room dose is within the 5 rem TEDE 10 CFR 50.67 limit. The offsite dose consequences meet the acceptance criteria of Regulatory Guide 1.183.

14.2.5.6 References for Section 14.2.5

1.

Burnett, T. W. T., et. al., "LOFTRAN Code Description," WCAP-7907-A, April 1984

2.

Moody, F. S., "Transactions of the ASME Journal of Heat Transfer," Figure 3, Page 134, February 1965

3.

Y. X. Sung, et al., "VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis," WCAP-14565-P-A (Proprietary) /WCAP-15306-NP-A (Non-Proprietary), October 1999.

4.

Y. S. Liu, et al., "ANC: A Westinghouse Advanced Nodal Computer Code,"

WCAP-10965-P-A, September 1986.

5.

Friedland, A. J. Ray, S., "Revised Thermal Design Procedure," WCAP-11397-P-A, April 1989.

UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 31 of 46 Unit 1 14.2.6 Rupture of a Control Rod Drive Mechanism Housing (RCCA Ejection) 14.2.6.1 Description of Accident This accident is a result of an extremely unlikely mechanical failure of a control rod drive mechanism pressure housing such that the reactor coolant system pressure would then eject the related RCCA and drive shaft. The consequence of this mechanical failure, in addition to being a minor loss-of-coolant accident, is a rapid reactivity insertion together with an adverse core power distribution, possibly leading to localized fuel rod damage for severe cases. The resultant core thermal power excursion is limited by the Doppler reactivity effect of the increased fuel temperature, and terminated by reactor trip actuated by high neutron flux signals.

14.2.6.2 Design Precautions and Protection Certain features in Westinghouse pressurized water reactors are intended to preclude the possibility of an RCCA ejection accident, or to limit the consequences if the accident were to occur. These include a sound, conservative mechanical design of the rod housings, together with a thorough quality control (testing) program during assembly, and a nuclear design which lessens the potential ejection worth of RCC assemblies and minimizes the number of assemblies inserted at high power levels.

14.2.6.3 Mechanical Design The mechanical design is discussed in Chapter 3. An evaluation of the mechanical design and quality control procedures indicates that a failure of a control rod mechanism housing sufficient to allow an RCCA to be rapidly ejected from the core should not be considered credible for the following reasons:

1.

Each control rod drive mechanism housing is completely assembled and shop-tested at 3110 psig (Unit 1).

2.

The mechanism housings are individually hydro tested after they are installed to the head adapters in the reactor vessel head, and checked during the hydro test of the completed reactor coolant system (Unit 2). For the replacement Unit 1 CRDM housings, the pressure housings are shop hydro tested. The lower latch housing to nozzle connection is shop hydro tested with the replacement RVCH.

3.

Stress levels in the mechanism are not affected by anticipated system transients at power, or by the thermal movement of the coolant loops. Moments induced by the UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 32 of 46 Unit 1 design earthquake can be accepted within the allowable primary working stress range specified by the ASME Code,Section III, for Class A components.

4.

The latch mechanism housing and rod travel housing are each a single length of stainless steel. This material exhibits excellent notch toughness at all temperatures that will be encountered.

A significant margin of strength in the elastic range together with the large energy absorption capability in the plastic range gives additional assurance that gross failure of the housing will not occur. The joints between the latch mechanism housing and head adapter, and between the latch mechanism housing and rod travel housing, are threaded joints reinforced by canopy type rod welds. Administrative regulations require periodic inspections of these (and other) welds.

14.2.6.4 Nuclear Design Even if a rupture of the control rod mechanism housing is postulated, the operation of a chemical shim plant is such that the severity of an ejected RCCA is inherently limited. In general, the reactor is operated with RCCAs inserted only far enough to permit load follow. Reactivity changes caused by core depletion and xenon transients are compensated by boron changes. Further, the location and grouping of control rod banks are selected during nuclear design to lessen the severity of an ejected RCCA. Therefore, should an RCCA be ejected from the reactor vessel during normal operation, there would probably be no reactivity excursion - since most of the RCCAs are fully withdrawn from the core - or a minor reactivity excursion if an inserted RCCA is ejected from its normal position.

However, it may be occasionally desirable to operate with larger than normal insertions. For this reason, a rod insertion limit is defined as a function of power level. Operation with the RCCAs above this limit guarantees adequate shutdown capability and acceptable power distribution. The position of all RCCAs is continuously indicated in the control room. An alarm will occur if a bank of RCCAs approaches its insertion limit or if one RCCA deviates from its bank. There are low and low-low level insertion monitors with visual and audio signals. Operating instructions require boration at low level alarm and emergency boration at the low-low alarm. The RCCA position monitoring and alarm systems have been described in detail in Chapter 7.

14.2.6.5 Reactor Protection Reactor protection for an RCCA ejection is provided by high neutron flux trip (high and low setting) and high rate of neutron flux increase trip. These protection functions are part of the UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 33 of 46 Unit 1 reactor trip system. No single failure of the reactor trip system will negate the protection functions required for the RCCA ejection accident, or adversely affect the consequences of the accident.

The reactor protection in the event of an RCCA ejection accident has been further described in WCAP-7306. (Reference 1)

The reactor protection modeled in the analysis reported in this section was only the high neutron flux trip (high and low setting).

14.2.6.6 Effects on Adjacent Housings Disregarding the remote possibility of the occurrence of a control rod mechanism housing failure, investigations have shown that failure of a control rod housing due to either longitudinal or circumferential cracking would not cause damage to adjacent housings that would increase the severity of the initial accident.

14.2.6.7 Limiting Criteria Due to the extremely low probability of an RCCA ejection accident, some fuel damage could be considered an acceptable consequence, provided there is no possibility of the off-site or control room consequences exceeding the limits specified in Regulatory Guide 1.183 and 10 CFR 50.67.

Although severe fuel damage to a portion of the core may in fact be acceptable, it is difficult to treat this type of accident on a sound theoretical basis. For this reason, criteria for the threshold of fuel failure are established, and it is demonstrated that this limit will not be exceeded.

Comprehensive studies of the threshold of fuel failure and of the threshold of significant conversion of the fuel thermal energy to mechanical energy have been carried out as part of the SPERT project by the Idaho Nuclear Corporation (Reference 2). Extensive tests of UO2 -

Zirconium clad fuel rods representative of those in PWR type cores have demonstrated failure thresholds in the range of 240 to 257 cal/gm. However, other rods of a slightly different design have exhibited failures as low as 225 cal/gm. These results differ significantly from the TREAT (Reference 3) results, which indicated a failure threshold of 280 cal/gm. Limited results have indicated that this threshold decreases by about 10% with fuel burnup. The clad failure mechanism appears to be melting for zero burnup rods and brittle fracture for irradiated rods. Also important is the conversion ratio of thermal to mechanical energy. This ratio becomes marginally detectable above 300 cal/gm for unirradiated rods and 200 cal/gm for irradiated rods; catastrophic failure, (large fuel dispersal, large pressure rise) even for irradiated rods, did not occur below 300 cal/gm.

In view of the above experimental results, criteria are applied to ensure that there is little or no possibility of fuel dispersal in the coolant, gross lattice distortion, or severe shock waves.

UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 34 of 46 Unit 1 The limiting criteria is described in Reference 4 and summarized below:

A.

Average fuel pellet enthalpy at hot spot below 200 cal/gm for irradiated or unirradiated fuel (Reference 6).

B.

Peak reactor coolant pressure less than that which could cause stresses to exceed the faulted condition stress limits.

C.

Fuel melting will be limited to less than ten percent (10%) of the fuel volume at the hot spot even if the average fuel pellet enthalpy is below the limits of criterion A above.

It should be noted that the original FSAR includes an additional criterion that the average clad temperature at the hot spot must remain below 2700 °F. The elimination of the clad temperature criterion for RCCA ejection accident is consistent with the revised Westinghouse acceptance criteria for this event, as discussed in Reference 6.

14.2.6.8 Method of Analysis The calculation of the RCCA ejection transient is performed in two stages, first an average channel core calculation and then a hot region calculation. The average core calculation is performed using spatial neutron kinetics methods to determine the average power generation with time, including the various total core feedback effects, i.e., Doppler reactivity and moderator reactivity. Enthalpy and temperature transients in the hot spot are then determined by multiplying the average core energy generation by the hot channel factor and performing a fuel rod transient heat transfer calculation. The power distribution calculated without feedback is pessimistically assumed to persist throughout the transient. A detailed investigation using this method, and a demonstration of the conservativeness of the calculation compared to three-dimensional spatial kinetics, is presented in WCAP-7588. (Reference 4) 14.2.6.9 Average Core Analysis The spatial kinetics computer code, TWINKLE, is used for the average core transient analysis.

This code solves the two group neutron diffusion theory kinetic equation in one, two or three spatial dimensions (rectangular coordinates) for six delayed neutron groups and up to 2000 spatial points.

The computer code includes a detailed multi-region, transient fuel-clad-coolant heat transfer model for calculation of pointwise Doppler and moderator feedback effects. In this analysis, the code is used as a one dimensional axial effects code since it allows a more realistic representation of the UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 35 of 46 Unit 1 spatial kinetics of axial moderator feedback and RCCA movement. However, since the radial dimension is missing, it is still necessary to employ very conservative methods (described below) of calculating the ejected rod worth and hot channel factor. Further description of TWINKLE appears in Section 14.1.

14.2.6.10 Hot Spot Analysis In the hot spot analysis, the initial heat flux is equal to the nominal times the design hot channel factor. During the transient, the heat flux hot channel factor is linearly increased to the transient value in 0.1 second, the time for full ejection of the RCCA. Therefore, the assumption is made that the hot spot before and after ejection are coincident. This is very conservative since the peak after ejection will occur in or adjacent to the fuel assembly with the ejected RCCA, and prior to ejection the power in this region will necessarily be depressed.

The hot spot analysis is performed using the detailed fuel and clad transient heat transfer computer code, FACTRAN. This computer code calculates the transient temperature distribution in a cross section of a metal clad UO2 fuel rod, and the heat flux at the surface of the rod, using as input the nuclear power versus time and the local coolant conditions. The zirconium-water reaction is explicitly represented, and all material properties are represented as functions of temperature. A conservative radial power distribution is used within the fuel rod.

FACTRAN uses the Dittus-Boelter or Jens-Lottes correlation to determine the film heat transfer before DNB, and the Bishop-Sandburg-Tong correlation (see Reference 5) to determine the film boiling coefficient after DNB. The Bishop-Sandburg-Tong correlation is conservatively used assuming zero bulk fluid quality. The DNB ratio is not calculated, instead the code is forced into DNB by specifying a conservative DNB heat flux. The gap heat transfer coefficient can be calculated by the code; however, it is adjusted in order to force the full power steady-state temperature distribution to agree with the fuel heat transfer design codes. Further description of FACTRAN appears in Section 14.1.

14.2.6.11 System Overpressure Analysis Because safety limits for fuel damage specified earlier are not exceeded, there is little likelihood of fuel dispersal into the coolant. The pressure surge may therefore be calculated on the basis of conventional heat transfer from the fuel and prompt heat generation in the coolant.

The pressure surge is calculated by first performing the fuel heat transfer calculation to determine the average and hot spot heat flux versus time. Using this heat flux data, a THINC calculation is conducted to determine the volume surge. Finally, the volume surge is simulated in the LOFTRAN UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 36 of 46 Unit 1 computer code. This code calculates the pressure transient taking into account fluid transport in the RCS and heat transfer to the steam generators. No credit is taken for the possible pressure reduction caused by the assumed failure of the control rod pressure housing.

14.2.6.12 Calculation of Basic Parameters Input parameters for the analysis are conservatively selected on the basis of values calculated for this type of core. The more important parameters are discussed below. Table 14.2.6-1 presents the parameters used in this analysis.

14.2.6.13 Ejected RCCA Worth and Hot Channel Factors The values for ejected RCCA worths and hot channel factors are calculated using either three dimensional static methods or by a synthesis method employing one-dimensional and two-dimensional calculations. Standard nuclear design codes are used in the analysis. No credit is taken for the flux flattening effects of reactivity feedback. The calculation is performed for the maximum allowed bank insertion at a given power level, as determined by the rod insertion limits.

Adverse xenon distributions are considered in the calculation to provide worst case results.

Appropriate margins are added to the ejected RCCA worth and hot channel factors to account for any calculational uncertainties.

Power distribution before and after ejection for a "worst case" can be found in Reference 4. Startup physics testing validates the analytical models used in the design and analysis, which inherently validates the ejected RCCA worths and power peaking factors used in the analysis. Experience has shown that the ejected RCCA worth and power peaking factors are consistently overpredicted in the analysis.

14.2.6.14 Reactivity Feedback Weighting Factors The largest temperature rises, and hence the largest reactivity feedbacks occur in channels where the power is higher than average. Since the weight of a region is dependent on flux, these regions have high weights. This means that the reactivity feedback is larger than that indicated by a simple channel analysis. Physics calculations have been carried out for temperature changes with a flat temperature distribution, and with a large number of axial and radial temperature distributions.

Reactivity changes were compared and effective weighting factors determined. These weighting factors take the form of multipliers which, when applied to single channel feedbacks, correct them to effective whole core feedbacks for the appropriate flux shape. In this analysis, since a one dimensional (axial) spatial kinetics method is employed, axial weighting is not necessary if the UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 37 of 46 Unit 1 initial condition is made to match the ejected RCCA configuration. In addition, no weighting is applied to the moderator feedback. A conservative radial weighting factor is applied to the transient fuel temperature to obtain an effective fuel temperature as a function of time accounting for the missing spatial dimension. These weighting factors have also been shown to be conservative compared to three dimensional analysis.

14.2.6.15 Moderator and Doppler Coefficient The critical boron concentrations at the beginning of life and end of life are adjusted in the nuclear code in order to obtain moderator density coefficient curves which are conservative compared to actual design conditions for the plant. As discussed above, no weighting factor is applied to these results. The resulting moderator temperature coefficient is at least +5 pcm/°F at the appropriate zero or full power nominal average temperature, and becomes less positive for higher temperatures. This is necessary since the TWINKLE computer code utilized in the analyses is a diffusion-theory code rather than a point-kinetics approximation and the moderator temperature feedback cannot be artificially held constant with temperature.

The Doppler reactivity defect is determined as a function of power level using a one dimensional steady-state computer code with a Doppler weighting factor of 1.0. The Doppler weighting factor will increase under accident conditions, as discussed above.

14.2.6.16 Delayed Neutron Fraction, eff Calculations of the effective delayed neutron fraction (eff) typically yield values no less than 0.70% at beginning of life and 0.50% at end of life. The accident is sensitive to eff if the ejected RCCA worth is equal to or greater than eff as in zero power transients. In order to allow for future cycles, pessimistic estimates of eff of 0.50% at beginning of cycle and 0.40% at end of cycle were used in the analysis.

14.2.6.17 Trip Reactivity Insertion The trip reactivity insertion assumed is given in Table 14.2.6-1 and includes the effect of one stuck RCCA adjacent to the ejected RCCA. These values are reduced by the ejected RCCA reactivity.

The shutdown reactivity was simulated by dropping an RCCA of the required worth into the core.

The start of RCCA motion occurred 0.5 seconds after the high neutron flux trip point is reached.

A curve of rod insertion versus time was used which assumed that insertion to the dash-pot entry does not occur until 2.4 seconds after the start of fall. The choice of such a conservative insertion rate means that there is over 1 second after the trip point is reached before significant shutdown UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 38 of 46 Unit 1 reactivity is inserted into the core. This is particularly important conservatism for hot full power accidents.

The minimum design shutdown margin available for this plant at hot zero power (HZP) may be reached only at end of life in the equilibrium cycle. This value includes an allowance for the worst stuck RCCA, an adverse xenon distribution, conservative Doppler and moderator defects, and an allowance for calculational uncertainties. Physics calculations have shown that the effect of two stuck RCCAs (one of which is the worst ejected RCCA) is to reduce the shutdown by about an additional 1% k/k. Therefore, following a reactor trip resulting from an RCCA ejection accident, the reactor will be subcritical when the core returns to HZP.

Depressurization calculations have been performed assuming the maximum possible size break (2.75 inch diameter) located in the reactor pressure vessel head. The results show a rapid pressure drop and a decrease in system water mass due to the break. The emergency core cooling system (ECCS) is actuated on low pressurizer pressure within one minute after the break. The RCS pressure continues to drop and reaches saturation (1100 to 1300 psi depending on the system temperature) in about two to three minutes. Due to the large thermal inertia of primary and secondary system, there has been no significant decrease in the RCS temperature below noload by this time, and the depressurization itself has caused an increase in shutdown margin by about 0.2%

k/k due to the pressure coefficient. The cooldown transient could not absorb the available shutdown margin until more than 10 minutes after the break. The addition of borated safety injection flow (supplied from the RWST) starting one minute after the break is much more than sufficient to ensure that the core remains subcritical during the cooldown.

14.2.6.18 Results Table 14.2.6-1 summarizes the results. Cases are presented for both beginning and end of life at zero and full power.

A.

Beginning of Cycle, Full Power Control Bank D was assumed to be inserted to its insertion limit. The worst ejected RCCA worth and hot channel factor were conservatively calculated to be 0.15%

k/k and 6.8 respectively. The peak clad average temperature was 2299°F. The UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 39 of 46 Unit 1 peak spot fuel center temperature reached melting, conservatively assumed at 4900°F. However, melting was restricted to less than 10% of the pellet.

B.

Beginning of Cycle, Zero Power For this condition, Control Bank D was assumed to be fully inserted and banks B and C were at their insertion limits. The worst ejected rod is located in Control Bank D and has a worth of 0.65% k/k and a hot channel factor of 12.0. The peak clad average temperature reached 2130°F, the fuel center temperature was 3120°F.

C.

End of Cycle, Full Power Control Bank D was assumed to be inserted to its insertion limit. The ejected rod worth and hot channel factors were conservatively calculated to be 0.19% k/k and 7.1 respectively. This resulted in a peak clad average temperature of 2245°F. The peak hot spot fuel center temperature reached melting at 4800°F. However, melting was restricted to less than 10% of the pellet.

D.

End of Cycle, Zero Power The ejected rod worth and hot channel factor for this case was obtained assuming Control Bank D to be fully inserted and banks B and C at their insertion limits. The results were 0.75% k/k and 19.0 respectively. The peak clad average and fuel center temperatures were 2322°F and 3258°F. The Doppler weighting factor for this case is significantly higher than for other cases due to the very large transient hot channel factor.

For all the cases analyzed, average fuel pellet enthalpy at the hot spot remains below 200 cal/gm.

The nuclear power and hot spot fuel and clad temperature transients for two cases (end of life zero power and end of life full power) are presented in Figures 14.2.6-1 through 14.2.6-4.

The ejection of an RCCA constitutes a break in the RCS, located in the reactor pressure vessel head. The effects and consequences of loss of coolant accidents (LOCA) are discussed in Section 14.3.1 and 14.3.2. Following the RCCA ejection, the operator would follow the same emergency instructions as for any other LOCA to recover from the event.

14.2.6.18.1 Pressure Surge A detailed calculation of the pressure surge for an ejection worth of one dollar at beginning of life, hot full power, indicates that the peak pressure does not exceed that which would cause stress to UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 40 of 46 Unit 1 exceed the faulted condition stress limits. (Reference 4) Since the severity of the present analysis does not exceed the "worst case" analysis, the accident for this plant will not result in an excessive pressure rise or further damage to the RCS.

14.2.6.18.2 Lattice Deformations A large temperature gradient will exist in the region of the hot spot. Since the fuel rods are free to move in the vertical direction, differential expansion between separate rods cannot produce distortion. However, the temperature gradients across individual rods may produce a differential expansion tending to bow the midpoint of the rods toward the hotter side of the rod. Calculations have indicated that this bowing would result in a negative reactivity effect at the hot spot since Westinghouse cores are under-moderated, and bowing will tend to increase the under-moderation at the hot spot. In practice, no significant bowing is anticipated, since the structural rigidity of the core is more than sufficient to withstand the forces produced. Boiling in the hot spot region would produce a net flow away from that region. However, the heat from the fuel is released to the water relatively slowly, and it is considered inconceivable that cross flow will be sufficient to produce significant lattice forces. Even if massive and rapid boiling, sufficient to distort the lattice, is hypothetically postulated, the large void fraction in the hot spot region would produce a reduction in the total core moderator to fuel ratio, and a large reduction in this ratio at the hot spot. The net effect would therefore be a negative feedback. It can be concluded that no conceivable mechanism exists for a net positive feedback resulting from lattice deformation. In fact, a small negative feedback may result. The effect is conservatively ignored in the analysis.

14.2.6.19 Effect of the Replacement Steam Generators on Unit 1 The effect of the RSGs on the results of the RCCA ejection event has been evaluated. The parameters that affect the RCS pressure, fuel pellet enthalpy/temperature, and centerline fuel melting are time in core life, ejected rod worth, and Doppler reactivity coefficient. These parameters are not affected by generator replacement.

The analysis of record also assesses the number of pins that experience DNB, which is a function of RCS flow. The RCS flow with the RSGs is slightly larger than flow with the original steam generators (OSGs) at zero percent plugging, and significantly larger at the maximum tube plugging levels. Because RCS pressure, fuel pellet enthalpy/temperature, and centerline fuel melting are unaffected by generator replacement, and the RCS flow increases with the RSGs, the conclusions of the RCCA ejection analysis of record are applicable, and all acceptance criteria are met for the RSGs.

UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 41 of 46 Unit 1 14.2.6.20 Effect of the MUR Program on Unit 1 The HFP analysis is performed at 102% of 3250 MWt core power. As such, the increase in core power, combined with the reduction in the power uncertainty, is equivalent to the current assumption in the analysis. The TWINKLE analysis yields normalized nuclear power versus time for use in the FACTRAN analysis. The FACTRAN analysis is based upon 102% of 3250 MWt core power and; therefore, is still bounding with respect to the MUR uprating. Therefore, for the full power cases, the conclusions remain applicable.

For the HZP analysis, the transient results would not be expected to change as a result of the core power uprating. However, because the hot spot analysis uses the nominal (uprated) core heat flux, the fuel temperature results could change. This was evaluated and it was determined that the increased Doppler power defect due to the power uprating would offset the increased nominal heat flux, thus the current analysis results remain bounding and the conclusions remain applicable.

The effect of the power increase on the reactor trip time was also considered. The reactor trip is modeled in the TWINKLE portion of the HZP and HFP Rod Ejection analyses. The trip setpoint modeled in these analyses is 35% and 118% for the HZP and HFP cases, respectively. The power level increases at a very rapid rate in this transient, such that the delay in reaching 35% (or 118%)

of the uprated power versus 35% (or 118%) of the current power level would have an insignificant impact on the results.

Based upon this evaluation, the conclusions of the RCCA ejection analysis presented in Section 14.2.6.19 are applicable, and all acceptance criteria are met for the MUR Program.

Effect of the Return to RCS NOP/NOT Program on Unit 1 An evaluation of the RCCA Ejection event was performed to support the Return to RCS NOP/NOT program. The evaluation demonstrated that, based on existing analyses and sensitivities, the analysis would realize additional margin to the applicable acceptance criterion through modeling the increased primary pressure and decreased vessel average temperature (for the hot full power cases, relative to the maximum vessel average temperature for the Rerating program modeling in the analysis of record) of the Return to RCS NOP/NOT conditions. Therefore, the conclusions for the RCCA Ejection analysis of record are applicable and remain valid for the Return to RCS NOP/NOT program.

14.2.6.21 Radiological Consequence Analysis The radiological consequence analysis is performed based on Regulatory Guide 1.183 for the alternative source term. Parameters used in this analysis are listed in Table 14.2.6-2. Atmospheric UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 42 of 46 Unit 1 dispersion factors are provided in Tables 2.2-11 and 2.2-12 for release locations identified in Table 14.2.6-2.

The rod ejection accident analysis assumes that 10% of the fuel rods in the core experience a departure from nucleate boiling and cladding failure to such an extent that the entire fission product inventory in the cladding gaps of these rods is released. The gap activity consists of 10% of the core inventory of noble gases, iodines and alkali metals. In addition, 50% of the fuel rods experiencing a departure from nucleate boiling are conservatively assumed to experience fuel melting. Of the fuel rods experiencing fuel melting, melting is assumed to occur over 50% of their axial length and 10% of their radial volume. Therefore, the fraction of fuel melting is 0.25% of the core. The core inventory is listed in Table 14.A.1-1.

Two fission product release pathways to the environment are analyzed independently: a containment leakage pathway and a secondary system pathway. For the containment leakage pathway, no credit is taken for the containment spray system. For the secondary system pathway, main steam condensers are assumed to be unavailable for steam dump, since offsite power is assumed to be lost. Twenty-four (24) hours after the accident the residual heat removal system is assumed to be in service, RCS temperature is assumed to be 212°F and steam and activity are no longer assumed to be released to the environment.

For the containment leakage pathway, of the fuel rods experiencing fuel melting, 100% of the noble gases and 25% of the iodines in the melted fuel are assumed to be available for release. The fission product inventory in the gap of the damaged fuel rods and available for release from the melted fuel is released throughout the containment atmosphere. For the secondary system pathway, of the fuel rods experiencing fuel melting, 100% of the noble gases and 50% of the iodines in the melted fuel are assumed to be available for release. The fission product inventory in the gap of the damaged fuel rods and available for release from the melted fuel is dissolved in the reactor coolant and available for release from the secondary system due to primary-to-secondary leakage.

The dose consequences for this event are shown below:

EAB LPZ Control Room UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 43 of 46 Unit 1 (rem TEDE)

(rem TEDE)

(rem TEDE)

Secondary Release 2.84 1.20 3.42 Containment Release 4.07 2.72 1.75 Acceptance Limit 6.3 6.3 5

14.2.6.22 Conclusions Even on a pessimistic basis, the analyses indicate that the described fuel and clad limits are not exceeded. It is concluded that there is no danger of sudden fuel dispersal into the coolant. Since the peak pressure does not exceed that which would cause stresses to exceed the faulted condition stress limits, it is concluded that there is no danger of further consequential damage to the RCS.

The analyses have demonstrated the fission product release as a result of fuel rods entering DNB is limited to less than 10% of the fuel rods in the core.

The control room dose is within the 5 rem TEDE 10 CFR 50.67 limit. The offsite dose consequences meet the acceptance criteria of Regulatory Guide 1.183.

14.2.6.23 References for Section 14.2.6

1.

Burnett, T. W. T., "Reactor Protection System Diversity in Westinghouse Pressurized Water Reactor," WCAP-7306, April 1969.

2.

Taxelius, T. G., ed. "Annual Report - Spert Project, October 1968 September 1969,"

Idaho Nuclear Corporation TID-4500, June 1970.

3.

Liimatainen, R. C. and Testa, F. J., "Studies in TREAT of Zircaloy-2-Clad, UO2-Core Simulated Fuel Elements," Argonne National Laboratory Chemical Engineering Division Semi-Annual Report, ANL-7225, January-June 1966.

4.

Risher, D. H., "An Evaluation of the Rod Ejection Accident in Westinghouse PWR's Using Spatial Kinetics Methods," WCAP-7588, Revision 1A.

5.

Bishop, A. A., Sandberg, R. O., and Tong, L. S., "Forced Convection Heat Transfer at High Pressure After the Critical Heat Flux," ASME 65-HT-31, August 1965.

6.

NS-NRC-89-3466, Use of 2700 deg.F PCT Acceptance Limit in NON-LOCA Accidents, Letter from W.J. Johnson (Westinghouse) to Mr. Robert C. Jones (NRC), October 23, 1989.

UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 44 of 46 Unit 1 14.2.7 Environmental Consequences Following Secondary System Accidents The postulated accidents involving release of steam from the secondary system will not result in a release of radioactivity unless there is leakage from the reactor coolant system to the secondary system in the steam generators. Conservative analyses of the potential off-site doses resulting from these accidents, as well as normal releases of radioactive isotopes from the secondary system, are presented with steam generator leakage as a parameter. These analyses incorporate one percent defective fuel clad, and steam generator leakage prior to the release for a time sufficient to establish equilibrium specific activity levels in the secondary system. The calculated doses are well below the guidelines of 10 CFR 50.67.

The assumptions used to determine the equilibrium concentrations of radioactive isotopes in the secondary system are as follows:

1.

The primary to secondary leakage in the steam generators occurs when the reactor starts up, and the leakage remains constant during plant operation.

2.

The primary to secondary leakage is evenly distributed in the steam generators.

3.

Primary coolant specific activity level is associated with 1% defective fuel clad.

4.

The iodine partition factor liquid mass unit iodine/

of amount steam mass unit iodine/

of amount is 0.1 in the steam generators and the blowdown tank.

The iodine partition factor liquid unit vol.

iodine/

of amount gas unit vol.

iodine/

of amount is 10-4 in the condenser.

5.

No noble gasses are dissolved or contained in the steam generator water.

6.

The blowdown rate from the steam generators is continuous.

14.2.7.1 Operational Off-Site Doses Assuming that primary to secondary leakage exists, the assumptions given above were used to compute the equilibrium concentrations of iodine isotopes and noble gases in the secondary system and the activity releases through the air ejectors and the blowdown tank vent. The annual operational doses were calculated using these activity releases with the annual average UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 45 of 46 Unit 1 atmospheric dispersion factor 1.5 x 10-6 (/Q sec/m3) at the site boundary and 7.4 x 10-8 at the outer boundary of the low population zone. The annual breathing rate was assumed to be 2.32 x 10-4 (m3/sec).

The annual operational whole body and thyroid doses are small and are shown as a function of primary to secondary leak rate at the site boundary and at the outer boundary of the low population zone in Figures 14.2.7-1 through 14.2.7-4.

14.2.7.2 Incident Off-Site Doses The following assumptions and parameters were used to calculate the activity releases and integrated off-site doses for (1) the loss of all A.C. power to the plant auxiliaries, (2) the loss of external electrical load, and (3) the loss of normal feedwater:

1.

Prior to the incident, an equilibrium activity of fission products exists in both the primary and secondary systems due to a primary to secondary leakage in the steam generators.

2.

Off-site power is lost; main steam condensers are not available for steam dump.

3.

Eight hours after the incident the residual heat removal system starts operation to cool down the plant.

4.

The primary to secondary leakage is evenly distributed in the steam generators.

5.

Defective fuel clad is 1%.

6.

After eight hours following the incident, no steam and activity are released to the environment.

7.

No air ejector release and no steam generator blowdown occur during the accident.

8.

No noble gases are dissolved or contained in the steam generator water.

9.

The iodine partition factor liquid mass unit iodine/

of amount steam mass unit iodine/

of amount is 0.1 in the steam generators.

10.

The steam release for cooling down the plant is equally contributed by all steam generators.

UFSAR Revision 32.0

INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised: 30.0 Section: 14.2 Page: 46 of 46 Unit 1

11.

The atmospheric dispersion factors (/Q) at the site boundary and at the outer boundary of the low population zone are 3.1 x 10-4 and 7.5 x 10-5 (sec/m3),

respectively, for 0-8 hours. The breathing rate is 3.47 x 10-4 (m3/sec) for 0-8 hours.

The steam release for the loss of A.C. power to the plant auxiliaries is given in Table 14.2.7-1.

The release for both the loss of external electrical load and for the loss of normal feedwater are equivalent to that for loss of A.C. power to the plant auxiliaries.

The thyroid and whole body doses at the site boundary and at the outer boundary of the low population zone for the loss of A.C. power to the plant auxiliaries are given as a function of primary to secondary leak rate in Figures 14.2.7-5 and 14.2.7-6. The dose curves in these figures are applicable to the loss of external electrical load and to the loss of normal feedwater.

14.2.7.3 Accident Off-Site Doses See Section 14.2.5 for the offsite dose analysis of a main steam line break accident. See Section 14.2.4 for the offsite dose analysis of a steam generator tube rupture accident.

14.2.8 Major Rupture of a Main Feedwater Pipe This event is not part of the Unit 1 license basis. Formerly, an informational purpose only analysis summary of this event had been included in Unit 1 Section 14.2.8.

UFSAR Revision 32.0