ML21125A560
Text
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page:
i of iii 6.0 ENGINEERED SAFETY FEATURES................................... 1 6.1 APPLICATION OF ESF DESIGN CRITERIA..................................... 3 6.2 EMERGENCY CORE COOLING SYSTEMS...................................... 8 6.2.1 Application of Plant Design Criteria........................................ 8 Codes and Classifications.................................................................................... 9 Service Life Under Accident Conditions............................................................... 9 6.2.2 System Design and Operation................................................. 9 System Description............................................................................................... 9 Injection Phase.................................................................................................. 10 Recirculation Phase............................................................................................ 12 Change-Over from Injection Phase to Recirculation Phase................................ 14 Steam Break Protection...................................................................................... 16 Components....................................................................................................... 16 Accumulators
.................................................................................................. 16 Boron Injection Tank........................................................................................... 17 Refueling Water Storage Tank........................................................................... 17 Containment and Recirculation Sump................................................................ 18 Debris Interceptors............................................................................................. 20 Pumps
.................................................................................................. 21 Heat Exchangers................................................................................................ 22 Valves
.................................................................................................. 23 Motor Operated Valves....................................................................................... 24 Manual Valves.................................................................................................. 25 Accumulator Check Valves................................................................................. 26 Accumulator Relief Valves.................................................................................. 27 Leakage Limitations............................................................................................ 27 Piping
.................................................................................................. 28 Pump and Valve Motors..................................................................................... 30 UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page:
ii of iii 6.2.3 Design Evaluation.................................................................. 30 Design Features................................................................................................. 30 Range of Core Protection................................................................................... 31 System Response.............................................................................................. 32 Failure Analysis.................................................................................................. 33 Emergency Flow to the Core.............................................................................. 34 6.2.4 Safety Limits and Conditions................................................ 34 Limiting Conditions for Operation....................................................................... 34 Limiting Conditions for Maintenance................................................................... 34 6.2.5 Tests and Inspections............................................................ 34 Components Testing.......................................................................................... 35 System Testing.................................................................................................. 35 Operational Sequence Testing........................................................................... 36 6.2.6 Programmatic Controls.......................................................... 36 6.2.7 References for Section 6.2..................................................... 38 6.3 CONTAINMENT SPRAY SYSTEMS............................................... 40 6.3.1 Application of Design Criteria.............................................. 40 6.3.2 System Design........................................................................ 41 System Description............................................................................................. 41 Components
.................................................................................................. 44 Pumps
.................................................................................................. 44 Heat Exchangers................................................................................................ 44 Spray Nozzles.................................................................................................. 45 Recirculation Sump............................................................................................ 45 Spray Additive Tank.......................................................................................... 45 Eductors
.................................................................................................. 46 Instrumentation and Control............................................................................... 46 6.3.3 Design Evaluation.................................................................. 46 UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page:
iii of iii 6.3.3.1 Materials Compatibility.................................................................. 47 UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page:
1 of 47 6.0 ENGINEERED SAFETY FEATURES The central safety objective in the reactor design and operation is the control of reactor fission products. The methods used to ensure this central safety objective are:
- a.
Design of the reactor core in conjunction with the reactor control and protection systems to preclude the release of fission products from the fuel (Chapters 3 and 7).
b.
Retention of fission products in the reactor coolant pressure boundary for whatever fuel leakage occurs (Chapters 4 and 6).
- c.
Retention of fission products by the containment for operational and accidental releases beyond the reactor coolant pressure boundary (Chapters 5 and 6).
d.
Limiting fission product dispersal to minimize population exposure for an accidental release beyond the containment (Chapters 2 and 11).
- e.
The Engineered Safety Features (ESF) are the provisions in the plant, which embody methods b and c above, to prevent the occurrence or to mitigate the effects of serious accidents.
The Engineered Safety Features in the plant are:
- 1.
The Containment Structure (See Sub-chapter 5.2), which is designed and constructed to maintain containment integrity when subjected to accident temperatures and pressure, and the postulated earthquake conditions.
2.
The Ice Condenser, discussed in Sub-chapter 5.3, which prevents high pressure in the containment and thus reduces the potential for the escape of fission products from the containment. This low temperature heat sink consists of a suitable quantity of borated ice in a cold storage compartment.
3.
The Emergency Core Cooling System (ECCS) (See Sub-chapter 6.2), which provides borated water to cool the core in the event of an accidental depressurization of the Reactor Coolant System (RCS).
- 4.
The Containment Spray System (See Sub-chapter 6.3), which provides adequate containment pressure control and iodine removal.
Evaluations of techniques and equipment used to accomplish the central safety objective, including accident cases, are detailed in Chapters 5, 6 and 14.
UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page:
2 of 47 The Technical Specifications specify the limiting conditions for operation to be met by the Engineered Safety Features components and other components important to plant safety.
Maintenance on a component during plant operation is permitted if the remaining (i.e. redundant) components meet the limiting conditions for operation.
The design philosophy with respect to active components in the Engineered Safety Features is to provide redundant components so that maintenance is possible during operation without impairment of the safety function of the ESF. Routine servicing and maintenance of equipment of this type would generally be scheduled for periods of refueling and maintenance outages.
UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page:
3 of 47 6.1 APPLICATION OF ESF DESIGN CRITERIA The dynamic effects of a double-ended guillotine break of the reactor coolant piping are bounded by the leak-before-break criteria (See Sub-chapter 14.3.3 for Unit No. 2 for details).
The release of fission products from the containment is limited in three ways:
1.
Blocking the potential leakage paths from the containment. This is accomplished by:
- a.
The containment design, presented in Chapter 5, which provides a highly reliable barrier against the escape of fission products. The design incorporates a large mass of borated ice as a passive heat sink. This results in a lower maximum containment pressure and a rapid reduction in pressure. Both of these effects reduce the potential for containment leakage.
b.
Isolation of process lines by the Containment Isolation System (See Sub-chapter 5.4) which imposes double barriers in each line, which penetrates the containment.
2.
Reducing the fission product concentration in the containment atmosphere. This is accomplished by the Containment Spray System (See Sub-chapter 6.3) which uses a chemically treated spray to remove elemental iodine from the containment atmosphere by a washing action.
3.
Maintaining low containment pressure and thereby limiting the driving potential for fission product leakage. This is accomplished by cooling of the containment atmosphere by the Containment Spray System (See Sub-chapter 6.3), which provides for long-term cooling of the containment.
The initial performance tests of individual components, the integrated test of the system as a whole and the periodic tests complement each other to assure the performance of the ESF as designed and to prove proper operation of the actuation circuitry and the mechanical components.
Existing circuits can accommodate online testing of the diesel generators sequence loading timers and associated circuitry. Testing can be initiated from the safeguards online test cabinet, and test switch panels and results in the timed starting of the affected equipment.
Routine periodic testing of the Engineered Safety Features components is performed. In the event that one of the two or more redundant components should require maintenance as a result UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page:
4 of 47 of failure to perform during the test, according to prescribed limits, the necessary corrective actions are made and the unit retested in a timely manner. Satisfactory performance of the remaining redundant component(s) provides assurance of the availability of that engineered safety feature.
Portions of the missile protection criteria stated in Sub-chapter 1.4 apply to the applicable Seismic Class I equipment in this Chapter (See also Sub-chapter 2.9).
During the injection phase, any single active failure will not prevent the accomplishment of the ECCS objectives as stated in Section 6.2.1.
During the recirculation phase the ECCS is capable of accepting one active or passive failure, but not in addition to a single active failure during the injection phase. One active or passive failure in the systems required for long-term ECCS operation will not prevent the accomplishment of the ECCS objectives as stated in Section 6.2.1, nor cause the total off-site dose to exceed Regulatory Guide 1.183 and 10 CFR 50.67 guidelines, with credit taken for leakage detection and isolation by operator action.
The general design criteria for leakage detection and isolation in the ESF required during long-term recirculation following a loss-of-coolant accident (LOCA) are:
- a.
Each safety system shall be capable of accepting a passive failure, occurring anywhere within the system, without losing overall design function.
- b.
The time required for detection and isolation of leakage in the affected safety system shall not result in flooding of safety equipment required during recirculation.
- c.
Sufficient cooling water shall be retained in the recirculation sump and recirculation system to assure long-term cooling of the core and operation of the Containment Spray System (See Sub-chapter 6.3).
These leakage detection and isolation criteria apply to the following safety systems:
1.
Emergency Core Cooling (Sub-chapter 6.2)
- 2.
Residual Heat Removal (Sub-chapter 9.3)
- 3.
Containment Spray (Sub-chapter 6.3)
- 4.
Essential Service Water (Section 9.8.3)
- 5.
Component Cooling Water - only for ECCS support functions (Sub-chapter 9.5)
Criterion (a) is basically met in the inherent design of redundant safety systems and by maintaining the appropriate separation or isolation capability of each safety system.
UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page:
5 of 47 Criteria (b) and (c) are met by the specific design of each individual safety system.
An increase in the level of fluid in the auxiliary building sump and waste holdup tank area will serve as indication that a large passive failure has occurred in one of the safety systems.
Inspection of flow meters, radiation alarms, individual compartment sump alarms, system pressure and motor current instrumentation will indicate to the operator which redundant safety system train has sustained the failure.
Leakage of a lesser magnitude is handled in a different manner. In general, the operator is relied upon to detect and isolate a small leak. Basically, this is accomplished by provision, wherever possible, of a collection system, which cascades drains from equipment room sumps and pipe chases to a series of sumps for each ESF train. Appropriate alarms are provided to alert the operator to a rising water level in each of these sumps, indicative of a leak.
Each sump has appropriate level alarms to indicate leakage rates from 5 to 150 gpm, amply bracketing the maximum credible leak rate of 50 gpm; plus an additional alarm which will indicate leakage of even greater magnitude.
The provisions described above will enable the operator to isolate the portions of the safety system which are affected in sufficient time to meet criteria (b) and (c) above.
In the particular case of a pump being out for maintenance, an additional active or passive failure is not considered. The maximum period that operation would be continued with one pump out for maintenance is specified in the Technical Specifications.
The Emergency Core Cooling System and related pumps which must operate following the Design Basis Accident (DBA) include the residual heat removal (RHR), safety injection, centrifugal charging, containment spray, component cooling water, and essential service water pumps.
The minimum Net Positive Suction Head available (NPSHa) for the safety injection, residual heat removal, centrifugal charging, and containment spray pumps have been calculated when all are taking suction from the refueling water storage tank (RWST) during the injection phase immediately following the DBA, as well as for the RHR and containment spray pumps taking suction from the recirculation sump during the recirculation phase. The analysis determined that there is sufficient NPSH margin available to satisfy the required NPSH for all ECCS pumps under worst case analyzed conditions. The NPSHr (required) and minimum NPSHa (available) for each of these pumps is shown in Table 6.1-1. The NPSHa has been determined by This is a double-ended guillotine break of the largest reactor coolant piping.
UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page:
6 of 47 establishing the minimum water level in the recirculation sump at the analyzed vortex limit of 601'-6".
The ECCS system is designed such that adequate NPSH is provided to system pumps assuming maximum expected temperatures of pumped fluids, and no increase in containment pressure from that present prior to the postulated loss-of-coolant accident. The RWST temperature is 105° F for both units.
The recirculation sump temperature is 190° F for both units for purposes of calculating NPSHa.
The modeling methodology is conservative for NPSH analysis, resulting in a lower NPSHa due to higher hydraulic resistance in pump suction piping at maximum flows anticipated.
The containment spray and RHR pumps take suction during the recirculation phase from the recirculation sump. For the NPSH analysis, containment pressure is set at 12.9 psia (14.4 - 1.5 psi) for injection and recirculation phases. This pressure is based on the Tech Spec requirements, which is the conservative containment pressure that is present prior to the postulated loss-of-coolant accident. For the recirculation phase, the NPSHa is determined from the minimum recirculation sump water level of 601'-6".
Evaluations of the containment spray and ECCS systems have also been performed for the recirculation mode considering the predicted wear in the pumps and the systems from operation with debris-laden fluid. Further discussion of downstream effects is contained in Section 14.3.9.6.2.
The reactor is maintained subcritical following a LOCA. Introduction of borated cooling water into the core results in a net negative reactivity addition. The RCCAs insert and remain inserted, although credit is not taken in the large break LOCA peak cladding temperature analysis, or criticality control during cold leg recirculation analysis. However, RCCA insertion credit is assumed to maintain subcriticality at the time of hot leg switchover following a cold leg LOCA (See Section 14.3.1.5 (Unit 1) and Section 14.3.1.1.2 (Unit 2).
The supply of water by the Emergency Core Cooling System to cool the core cladding does not produce significant water-metal reaction (See Section 14.3). The delivery of cold emergency core cooling water to the reactor vessel following a LOCA does not cause further loss of integrity of the reactor coolant system pressure boundary. Accumulator actuation, including possible nitrogen addition is evaluated in Chapter 14 and is shown not to aggravate any loss-of-coolant accident (LOCA). The accumulation of debris and chemical precipitate on the fuel cladding during recirculation cooling does not result in degradation of the core cladding (See Section 14.3.9.6.2).
UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page:
7 of 47 Instrumentation, motors, cables and penetrations located inside the containment which are required to function are selected to meet the most adverse accident conditions to which they may be subjected (Chapter 5 and 7). These items are either protected from containment accident conditions or are designed to withstand, without failure, exposure to the effects of radiation, temperature, pressure, and humidity expected during the required operational period for individual specific accident conditions.
Protection, in the form of restraints, supports and physical separation has been provided for the ECCS to assure no loss of core cooling capability.
For shared systems and/or components, analyses confirm that there is no interference with basic function and operability of these systems due to sharing, and hence no undue risk to the health and safety of the public results.
The residual heat removal pumps and heat exchangers serve dual functions. Although the normal duty of the residual heat removal heat exchangers and residual heat removal pumps is performed during periods of reactor shutdown, during all plant operating periods this equipment is aligned to perform the low head safety injection function of the emergency core cooling system. During the recirculation phase of the LOCA, the same train containment spray pump and the RHR pump share the same recirculation pump suction header. Surveillance testing of the system provides assurance of correct system alignment for the safety function of the components.
During the recirculation phase of the LOCA, if Reactor Coolant System pressure stays high due to a small break LOCA, suction to the intermediate head safety injection and high head centrifugal charging pumps is provided by the residual heat removal pumps.
The ability of the above systems to perform their dual function is discussed in Section 6.2 and in Chapters 9 and 14.
UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page:
8 of 47 6.2 EMERGENCY CORE COOLING SYSTEMS 6.2.1 Application of Plant Design Criteria The primary purpose of the ECCS is to automatically deliver cooling water to the reactor core in the event of a loss-of-coolant accident. This limits the fuel clad temperature and thereby ensures that the core will remain substantially intact and in place, with its essential heat transfer geometry preserved. This protection is afforded for:
- a.
All pipe break sizes and locations up to and including the hypothetical instantaneous circumferential rupture of a reactor coolant loop, assuming unobstructed discharge from both ends.
b.
A loss-of-coolant associated with the rod ejection accident.
- c.
A steam generator tube rupture.
The basic design criteria for loss-of-coolant accident evaluations are defined in Chapter 14.
For any rupture of any steam line or feedwater line and the associated rapid heat removal from the core, the ECCS adds shutdown reactivity so that 1) with a stuck rod, 2) with no off-site power and 3) with minimum engineered safety features, there is no consequential damage to the Reactor Coolant System and the core remains in place and intact.
During the recirculation phase of a loss-of-coolant accident, the system is tolerant of one active or passive failure but not in addition to a single failure in the injection phase. This is assured by backup alternate flow path capability.
Redundancy and segregation of instrumentation and components is incorporated into the design to assure that postulated malfunctions will not impair the ability of the system to meet the design objectives. The system is effective in the event of loss of normal station auxiliary power coincident with the loss-of-coolant, and is tolerant of failures of any single component or instrument channel to respond actively in the system.
The accumulator tank pressure and level are continuously monitored during plant operation and discharge flowpath availability can be checked at anytime by noting the outlet isolation valve position indication on the main control board.
The accumulators and the safety injection pipe up to the final isolation valve are maintained full of borated water at refueling water concentration while the plant is in operation. The accumulators and injection lines will be refilled with borated water as required by using the safety injection pumps. Small fill and drain lines are provided for this purpose.
UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page:
9 of 47 Flows in each of the centrifugal charging and safety injection pump discharge headers and in the main flow lines for the residual heat removal pumps are monitored by flow indicators. Pressure instrumentation is also provided for the main flow paths of the safety injection pump and centrifugal charging pump headers and residual heat removal pumps. Level and pressure instrumentation are provided for each accumulator tank.
Codes and Classifications Table 6.2-1 tabulates the codes and standards to which the Emergency Core Cooling System components are designed.
Service Life Under Accident Conditions Portions of the system located within the containment are designed to operate under the most adverse accident conditions without benefit of maintenance and without loss of functional performance for the duration of time the component is required following the accident.
6.2.2 System Design and Operation
System Description
The Emergency Core Cooling System is shown in Figures 6.2-1 and 6.2-1A, and 9.3-1. These figures illustrate the redundancy of components and piping systems.
The operation of the Emergency Core Cooling System, following a loss-of-coolant accident, can be divided into two distinct phases: 1) the injection phase in which any reactivity increase attending the accident is terminated, initial cooling of the core is accomplished, and coolant lost from the primary system is replenished, and 2) the recirculation phase in which long term core cooling is provided during the accident recovery period. A discussion of each phase is given below. Accidents analyzed in Chapter 14 assume pump head degradation from vendor curves of 10% for centrifugal charging pumps, 15% for safety injection pumps and 10% (14% in Unit 2) for residual heat removal pumps.
UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 10 of 47 Injection Phase The major equipment involved in the injection phase includes:
- a.
Two centrifugal charging pumps (a third, positive displacement, charging pump is not involved in the injection system).
b.
Two safety injection pumps
- c.
Two residual heat removal pumps d.
Four accumulators (one for each loop)
- e.
Refueling water storage tank (RWST)
The relative importance of the various pieces of injection equipment is dependent upon the size and location of the primary system break. For a large break, the accumulators represent the principle injection mechanism in the sense that they are the first piece of equipment to be effective. For further details see Chapter 14, and Figures 6.2-2 and 6.2.3.
The accumulators, utilizing a compressed nitrogen cover gas, inject borated water into the cold legs of the reactor coolant piping when the primary system pressure falls below nominal 600 psig. One accumulator is provided for each cold leg of the Reactor Coolant System. They are located inside the containment but outside the missile barrier, and are therefore protected against credible missiles. Accumulator water level can be adjusted remotely during normal power operation after opening a manually operated drain valve. Borated makeup water from the refueling water storage tank is added using a safety injection pump. Water level is reduced by draining to the reactor coolant drain tank. Samples of the solution in the accumulator tanks are taken in the sampling station for periodic checks of boron concentration. Provisions are also included for remote nitrogen makeup. The accumulators are passive components of the injection system because they require no external source of power or signal in order to function. The remaining major pieces of equipment comprising the emergency core cooling system are active components which are actuated by any of the Safety Injection Signals:
- a.
Low steam line pressure in 2 of 4 steam lines. (Possible steam line break).
- b.
High differential pressure between any two steam generators (Possible steam line break).
- c.
Low pressurizer pressure (Possible LOCA).
- d.
High containment pressure (Possible LOCA or steam line break).
- e.
Manual actuation (the Control Panel includes a switch for each train).
UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 11 of 47 The safety injection signal initiates a reactor trip (this may have already occurred), starts the diesel generators, opens the boron injection tank isolation valves and the charging pump refueling water storage tank suction valves, and starts the centrifugal charging pumps, the safety injection pumps, and the residual heat removal pumps. In addition, isolation valves on the volume control tank discharge, charging line, and centrifugal charging pump minimum flow lines close. A safety injection signal will also initiate main feedwater isolation, actuate the auxiliary feedwater system, isolate control room ventilation, actuate an essential service water pump, initiate containment ventilation isolation and produce a phase A containment isolation signal which results in the closure of the majority of the automatic containment isolation valves, isolating all non-essential process lines. (See Section 5.4)
The active components serve three functions during the injection phase:
- a.
Provide rapid injection of borated water.
b.
Complete the reflooding process for large area ruptures where the initial refill is accomplished by the accumulators.
- c.
Provide injection for small area ruptures where the primary coolant pressure does not drop below the accumulator pressure for an extended period of time after the accident. Accumulator injection commences when RCS pressure reaches a nominal 600 psig.
During the injection phase all emergency core cooling pumps take their suction from the refueling water storage tank.
During safety injection, the centrifugal charging pumps take suction from the RWST and deliver borated water to the four cold legs of the reactor coolant system. The injection points are separate from those used by the accumulators. The centrifugal charging pumps can deliver borated water to the primary system up to about 2660 psig at shutoff. Previously, a high concentration of boric acid solution (12% by weight) was contained in the boron injection tank located at the pumps discharge header. Analysis has determined that this high concentration is not required for reactivity control. The boron injection tank is now filled with water with a boron concentration between 0 and 2600 ppm,and provides solely a pressure boundary function.
For conservatism, the accident analyses were analyzed assuming the borated water in the boron injection tank at 0 ppm of boric acid. The nominal RWST boric acid concentration is sufficient for providing shutdown reactivity at the onset of an accident. Flow is directed through the tank which is normally isolated on both the suction and discharge lines by parallel motor operated gate valves. These valves open upon receipt of a safety injection signal and the discharge from UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 12 of 47 the centrifugal charging pumps flows through the tank into the reactor coolant system. The safety injection signal also operates motor operated valves which transfer the suction of the centrifugal charging pumps from the volume control tank to the refueling water storage tank.
The safety injection pumps take suction from the refueling water storage tank and deliver borated water to four cold leg connections via the accumulator discharge lines. These pumps develop a maximum discharge pressure of about 1560 psig at shutoff, and as a result, deliver to the primary system only after its pressure is reduced below this value. Under the high pressure condition, the pumps operate on their minimum flow system pumping back to the RWST.
The limitation on discharge pressure does not significantly reduce the effectiveness of the safety injection pumps since any break of sufficient size to require safety injection will reduce the coolant pressure below 1500 psig and allow flow from the safety injection pumps to the primary system.
In the safety injection mode the residual heat removal pumps take suction from the refueling water storage tank and deliver borated water to the same four cold leg connections used by the safety injection pumps via the accumulator discharge lines. The residual heat removal pumps deliver only when the reactor coolant system is depressurized to below about 210 psig.
Each of the two safety injection pump trains is piped into all four cold legs and all four hot legs.
The charging pumps are piped via single headers to the four high pressure injection cold legs which are separate from RHR and SI pump cold and hot injection lines. Either safety injection pump or both can deliver water to all four cold leg injection lines or all four hot leg injection lines. All active components of the safety injection system which operate during the injection phase of a loss-of-coolant accident are located outside the containment system. The safety injection pumps, centrifugal charging pumps, and residual heat removal pumps are located in the auxiliary building.
Recirculation Phase Spilled coolant, injection water and ice melt is collected in the containment and recirculation sumps and is available for use by the Residual Heat Removal and Containment Spray Systems.
Following the injection phase, this fluid is recirculated back to the reactor coolant system by the residual heat removal pumps. The reactor coolant system is supplied directly from the discharge of the residual heat removal heat exchangers, and from each of the heat exchanger outlets to the suction of the centrifugal charging and safety injection pumps which in turn pump into the UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 13 of 47 coolant system. The containment spray pump suction is also supplied directly from the recirculation sump.
The recirculation phase of operation has two modes, cold leg recirculation and hot leg recirculation. Initially, the discharge from the RHR pumps flows directly, and via the safety injection and charging pumps, to the same cold leg injection points used during the injection phase of operation. Later in recirculation, the discharge of each safety injection pump is, along with the RHR pump discharge, switched to two individual hot leg injection points. The switch to hot leg recirculation is made in order to minimize the potential for boron precipitation.
Hot leg injection may begin during the recirculation phase of operation whenever the reactor coolant system and secondary coolant system are cooled down. The changeover to hot leg injection is specified to occur no later than 7.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after the accident. At this time the residual heat generation rate has decayed to less than 1% of the nominal, the sensible heat in the steam generator secondary side will have been removed and the containment atmosphere and recirculation sump liquid temperature will have been reduced.
Since the injection phase of the accident is terminated before the refueling water storage tank is completely empty, all pipes are kept filled with water before recirculation is initiated. Water level indication and alarms on the refueling water storage tank inform the operator that sufficient water has been injected into the containment to allow initiation of recirculation with the residual heat removal pumps and to provide ample warning to terminate the injection phase while the operating pumps still have adequate net positive suction head.
The redundant upper range containment water level instrumentation (for detail description, see Section 7.5.2, Containment Water Level) provides additional indication that injection can be terminated and recirculation initiated.
Power operated valves of the emergency core cooling system have their positions indicated on a common portion of the control board. At any time during operation when one of these valves is not in the ready position for injection, it is shown visually on the board.
Redundancy in the external recirculation loop is provided for by the inclusion of one residual heat removal pump and one residual heat removal heat exchanger in each loop. Each pump takes suction through an independent line from the recirculation sump and discharges through its heat exchanger to the reactor coolant system through independent lines.
The recirculation sump design, which is functionally described in detail in Section 14.3.9.4, provides sufficient flow area over the main strainer support base ahead of the recirculation sump and adequate NPSH for the residual heat removal and containment spray pumps to operate in the UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 14 of 47 recirculation mode. The water level in the recirculation sump, at the time of switchover from the injection phase to the recirculation phase, has been established to ensure sufficient submergence to preclude any vortexing or air entrainment. Water flowing into the recirculation sump passes through the main and remote strainers and down under the crane wall. The flow then turns upwards and enters the twin recirculation pipes connecting the recirculation sump to the RHR and CTS pumps. The minimum water level in the containment sump is sufficient to provide the necessary driving head for flow through the debris-laden recirculation sump strainers while ensuring the minimum level inside the recirculation sump is sufficient to prevent vortexing or air entrainment.
Each recirculation line from the recirculation sump is run outside the containment to a sump isolation valve. This valve is surrounded with a leak tight steel enclosure and the section of piping joining it to the recirculation sump is run within a guard pipe welded to the valve enclosure. Any leakage from the recirculation sump piping or valve body will be contained and cannot leak into the atmosphere or cause a loss of recirculation fluid. The pressure relief for each valve enclosure is routed to the associated residual heat removal pump room sump. The relief valve set point is 35 psig, which is also the design pressure for the valve enclosure. The drain lines from the enclosures to the RHR pump room sumps are normally closed. The enclosures are ASME Section III Class B vessels which require pressure relief provision.
The sump isolation valves are interlocked with the RHR pump suction supply valves from the RWST so that the supply line(s) from the sump cannot be opened until the RHR pump suction valve(s) is (are) fully closed. These interlocks are train oriented and will prevent air from getting into the RHR pump suction. Any excessive leakage or passive failure downstream of the sump valves can be controlled and isolated by closure of the sump valve in the affected train.
Within the containment, continuity of the liner is assured by welding of the recirculation sump discharge piping to the liner plate and fitting of a weld test channel over the seal weld. The liner extends under the recirculation sump area to ensure containment integrity (see Chapter 5).
Change-Over from Injection Phase to Recirculation Phase The general sequence, from the time of the safety injection signal, for the changeover from the injection to the recirculation phase is as follows:
- a.
First, sufficient water is delivered to the containment to provide adequate net positive suction head (NPSH) for the residual heat removal pumps and containment spray pumps. This occurs when at least 280,000 gallons has been UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 15 of 47 delivered from RWST to containment and is verified by checking RWST level at a value that reflects this transfer of water. Containment water level is also checked to ensure sufficient water to support both RHR and CTS pumps in recirculation mode.
b.
Second, the operator initiates transfer to recirculation. Both RHR pumps and both containment spray pumps are aligned to take suction from the recirculation sump.
Both sets of high head pumps (centrifugal charging pumps and safety injection pumps) continue to take suction from the RWST.
- c.
Third, when the RWST has decreased to a level indicating at least 314,000 gallons has been transferred to containment, the operator aligns the suction of the centrifugal charging pumps and the safety injection pumps to the RHR pump(s) that are aligned to the recirculation sump.
d.
Finally, the operator completes the switchover operation by isolating the RWST from the ECCS and containment spray system.
The emergency operating procedures provide detailed sequence for the changeover from injection to recirculation.
The operator in the control room implements the changeover from injection to recirculation via a series of manual switching operations. An automatic pump trip will occur once the refueling water storage tank (RWST) reaches lo-lo level. This protects the residual heat removal pumps aligned to the RWST from cavitation. The power supply for each pump trip is from an independent power source. The pump trip and associated circuitry are designed to be consistent with the remainder of the plant engineered safety features. Should there be a trip on lo-lo RWST level, the pump can be restarted by operator action once the RWST suction has been isolated and the recirculation sump suction opened. This automatic trip feature is a back-up to the manual switchover.
Following an accident the shortest time when the operator must take action to perform the necessary switchover results when both trains of ECCS and spray pumps are in operation at full runout conditions. This situation empties the RWST at the fastest possible rate, thus requiring the most rapid operator action to perform the switchover from injection to recirculation.
The valve stroke times for switchover to cold leg recirculation which are used in the Chapter 14 safety analysis are described in Unit 1, Section 14.1 of this UFSAR. Related information regarding the large break loss-of-coolant accident evaluation for a 5 minute interruption in RHR Flow may be found in Section 14.3.1.5 (Unit 1) and Section 14.3.1.1.2 (Unit 2).
UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 16 of 47 Steam Break Protection Following a steam line break, the reactor control system, in response to the apparent load, would tend to increase reactor power. For larger breaks, a reactor trip would occur. Continued secondary steam blowdown cools the reactor coolant causing a positive reactivity insertion.
Analyses described in Chapter 14 indicate that breaks large enough to produce a reactivity insertion sufficient to cause a return to criticality also produce sufficient depressurization and shrinkage of the primary coolant to initiate safety injection. The high pressure delivery of boric acid solution by the centrifugal charging pumps from the RWST then reestablishes adequate shutdown margin even for the case where the most reactive control rod is stuck in the fully withdrawn position.
Components Accumulators The accumulators are pressure vessels filled with borated water and pressurized with nitrogen gas. During normal plant operation each accumulator is isolated from the Reactor Coolant System by two check valves in series.
Should the Reactor Coolant System pressure fall below the accumulator pressure, the check valves open and borated water is forced into the Reactor Coolant System. Mechanical operation of the swing-disc check valves is the only action required to open the injection path from the accumulators to the core via the cold legs.
The accumulators are passive engineered safety features because the gas forces injection; no external source of power or signal transmission is needed to obtain fast-acting, high-flow capability when the need arises. One accumulator is attached to each of the cold legs of the Reactor Coolant System.
The design capacity of the accumulators is based on the assumption that the contents of one of the accumulators spills onto the containment floor through the ruptured loop, and the contents of the remaining accumulators provides sufficient water to fill the volume outside of the core barrel below the nozzles, the bottom plenum, and a portion of the core.
The accumulators are carbon steel, clad with stainless steel and designed to ASME B&PV Code Section III, Class C. Connections for remotely draining or filling the fluid space, during normal plant operation, are provided. The accumulator design parameters are given in Table 6.2-2.
UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 17 of 47 The margin between the minimum operating pressure and design pressure provides a band of acceptable operating conditions within which the accumulator system meets its design core cooling objectives. The band is sufficiently wide to permit the operator to minimize the frequency of adjustments in the amount of contained gas or liquid to compensate for leakage.
See Table 6.2-8.
Boron Injection Tank The boron injection tank, constructed of carbon steel clad with stainless steel, is located in the auxiliary building and contains water with a boron concentration between 0 and 2600 ppm. The tank design parameters are given in Table 6.2-3. The originally supplied tank heaters, pipe heat tracing and recirculation lines have been disconnected. These support systems to the tank are no longer required as a high concentration of boric acid solution is no longer maintained in the boron injection tank.
Refueling Water Storage Tank The Cook Nuclear Plant is equipped with two (2) refueling water storage tanks, one for each unit.
The function of the refueling water storage tank is:
1.
To provide a source of borated water to support the borated water needs for plant operation including sufficient volume to fill the refueling cavity for refueling operations.
2.
To provide sufficient volume of borated water for emergency (post-accident) operations. This includes the ability to maintain the core subcritical during the long term cooling phase of a LOCA, even in the unlikely event that the control rods do not drop into the core. Credit is not taken in the large break LOCA peak cladding temperature analysis, or criticality control during cold leg recirculation analysis. However, RCCA insertion credit is assumed to maintain subcriticality at the time of hot leg switchover following a cold leg LOCA (See Unit 1 Section 14.3.1.5 and Unit 2 Section 14.3.1.1.2).
- 3.
To ensure that the ECCS pumps are provided with adequate NPSH.
An adequate amount of water is maintained to ensure delivery to the containment sump before the operators begin switching from the injection mode to the sump recirculation mode of UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 18 of 47 operation. The switchover is initiated upon receipt of a low level alarm which indicates that the tank level has drained down to a level which is (nominal) 6 feet 1 3/4 inches above the bottom of the discharge pipe.
A high level alarm is provided to alert the operator of potential overflow conditions. A minimum level alarm is provided to assure that 375,500 gallons of usable water are in the RWST.
The Unit No. 1 refueling water storage tank is heated by means of two 100% capacity heat-tracing circuits with separate thermostatic controls. The tank is insulated with 2-inch thick fiberglass insulation. A temperature sensor attached to the outside of the tank will actuate a low temperature alarm in the control room in the event that the tank temperature falls below the alarm setpoint. The setpoint of the alarm is typically set approximately 5°F above the Technical Specifications minimum temperature.
The Unit No. 2 refueling water storage tank is heated by means of a 15 gpm pump which recirculates tank water through two electric heaters. The RWST heating pump operates continuously, when required, with the heaters energizing automatically on a low RWST temperature signal. The system is seismic category I with respect to protection of the tank boundary and is designed to maintain RWST at the minimum required temperature when outside ambient is -22°F. The Unit 2 RWST is insulated with 2-inch thick fiberglass insulation, and has a temperature sensor and alarm similar to that of the Unit 1 tank.
Each tank is equipped with an 8-inch vent, which has a 10-inch inlet and mesh screen. Each tank is also equipped with a 10-inch overflow line and a 3-inch return line. The overflow lines terminate in the pipe tunnel. The 8-inch vent and the 10-inch inlet/mesh screen provide sufficient venting area to prevent any adverse effect on the safety function of the tank. The 3-inch return line is routed internally in the tank to enhance mixing of the tank contents.
Missile protection is not provided for the RWST since in the event of tornado or turbine-missile damage to it; the unit can be safely shut-down without the RWST and can be maintained shut-down.
Containment and Recirculation Sump The containment sump is the area in lower containment outside the recirculation sump where water inventory accumulates from pipe break releases, ice melt, and containment spray actuation.
This area includes both the loop compartment and the annulus.
UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 19 of 47 The recirculation sump is the area in lower containment where water accumulates for direct suction by RHR and CTS pumps during the Recirculation Mode of operation. The recirculation sump, which is bounded by a main strainer in the loop compartment and a remote strainer in the annulus, extends below the 598 9 3/8 containment floor, under the crane wall extension, to its back chamber from which the RHR and containment spray pump suction lines draw. A duct-like waterway connects the outlet of the remote strainer to the recirculation sump through a penetration in the crane wall that empties filtered water from the annulus directly into the recirculation sump behind the main strainer. (See Figure 14.3.9-13)
The main and remote strainers are a vertically oriented, pocket type design that prevents materials larger than 2.4 mm (3/32") from entering the recirculation sump. The recirculation sump strainers are designed to 1) provide adequate filtration of expected debris generated by postulated accidents, thereby preventing unacceptable adverse effects on systems and equipment from water drawn from the recirculation sump by RHR or CTS pumps, and 2) ensure minimal head loss so the necessary water level inside the recirculation sump is maintained for vortex suppression and maintenance of the required RHR and CTS pumps NPSH. The main strainer has an effective surface area of 900 ft2 and the remote strainer has an effective surface area of 1,072 ft2. The large flow areas contribute to low entrance water velocities that minimize debris build-up on the strainers. Low velocities also make it unlikely that air bubbles will be carried into the pump suction area of the recirculation sump.
The main and remote strainers are fabricated of stainless steel and designed to AISC-69, 7th Edition. Design load combinations for the two strainers and associated waterway are provided in Table 6.2-10.
Redundant, Regulatory Guide 1.97, containment recirculation sump water level switches are installed inside the recirculation sump, providing indication to the control room when the water level in the recirculation sump approaches the vortexing limit. Indicating lights are provided in the control room along with an audible alarm. A white indicating light will illuminate when the water level inside the recirculation sump increases above the setpoint. A red indicating light will illuminate when the level subsequently drops below the setpoint, indicating possible recirculation sump blockage. An audible alarm will also sound when the red indicating light is illuminated.
See Table 7.8-1 for further information.
Performance of the recirculation sump during accident mitigation is described in Section 14.3.9.
The information contained in that section demonstrates that the recirculation sump satisfies the requirements of Generic Letter 2004-02, as applied to the Cook Plant in docketed correspondence with the NRC (Reference 6.2.7.2).
UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 20 of 47 Debris Interceptors Debris interceptors are installed at the drain openings to the CEQ fan rooms and the loop compartment side of the flood-up overflow wall holes to protect the necessary recirculation function flow paths. In addition, debris interceptors are provided at the inlets to the containment wide range water level instruments, NLI-320 and NLI-321, to ensure that these instruments continue to function when exposed to debris-laden sump water. All of the debris interceptors are designed to AISC-69, 7th Edition. For further information regarding these required flow paths, refer to Section 14.3.9.6.1, Upstream Effects.
The debris interceptors installed in the east and west CEQ fan rooms in upper containment are stainless steel boxes with perforated side plates and a solid top plate mounted over each rooms drain opening(s). These components prevent blockage of the flow path from the CEQ fan rooms to lower containment following an accident that leads to CTS actuation, thereby assuring that no large accumulation of spray water is held up in the fan rooms. This function is accomplished through the debris interceptor design that blocks large debris while allowing drainage flow through the perforated side plates which have a total open area far in excess of the free area of the drain hole opening in the floor.
The flood-up overflow wall is located between the loop compartment and the annulus in lower containment. The wall is attached to the crane wall at both ends and arranged to provide a flow path between the lower containment and reactor cavity, once water level in either compartment reaches the top of the overflow wall. The flood-up overflow wall contains five 10-inch diameter holes which allow free flow of water between the annulus and loop compartment. Four debris interceptors, installed on the loop side of the flood-up overflow wall, protect the five 10-inch holes. The debris interceptors consist of stainless steel members with perforated side plates and a solid top. The purpose of the debris interceptors is to ensure that large debris does not block flow at the five overflow wall openings and impede flow of post-accident coolant between the loop compartment and the annulus. This function is accomplished by a debris interceptor design that traps debris moving across the floor toward the five overflow wall holes against an inverted L shaped design, allows small debris to flow toward the overflow wall through 1/2 inch diameter openings in the side perforated plates, while blocking larger debris, and includes a top solid cover to prevent large debris from falling between the inverted L side plates and the flood-up overflow wall. The debris interceptors also have a six inch high open area above the inverted L side plates and the top cover plate that provides a flow area greater than the combined area of the flood-up overflow wall holes.
UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 21 of 47 The debris interceptors for the containment wide range level instruments NLI-320 and NLI-321 consist of stainless steel perforated plates having 1/2 inch diameter openings to prevent plugging the bottom opening of the stilling well piping for these instruments. The debris interceptors will prevent large accident-generated debris that may be swept across the loop compartment floor from blocking the lower elbow inlet, thereby maintaining the wide range level instruments functional.
Pumps Design parameters for the emergency core cooling system pumps are included in Table 6.2-5.
The two centrifugal charging pumps are horizontal, electric motor driven multistage pumps. All parts of the pump in contact with the pumped fluid are stainless steel or equivalent corrosion resistant material. A minimum flow bypass line is provided on each pump discharge to recirculate flow to the volume control tank or the pump suction manifold. This bypass is automatically isolated upon initiation of safety injection. The minimum flow motor operated valve reopens prior to the reactor coolant system pressure increasing above the calculated pressure at which flow through the most degraded charging pump can no longer be assured. The minimum flow valve opens to maintain cooling flow through the weakest charging pump in parallel operation with a strong charging pump.
The two safety injection pumps are horizontal, electric motor-driven, multistage pumps. All parts of the pump in contact with the pumped fluid are stainless steel or equivalent corrosion resistant material. A minimum flow bypass line is provided on each pump discharge to recirculate flow to the refueling water storage tank in the event that the reactor coolant system pressure is above the shutoff head of the pumps. This line is isolated during the recirculation mode of operation.
The two residual heat removal pumps are vertical, electric motor-driven, single-stage pumps. All parts of the pump in contact with the pumped fluid are stainless steel or of equivalent corrosion resistant material. Pump minimum flow bypass connection is located downstream of the residual heat exchanger and the bypass flow returns to the pump suction.
Pressure containing parts of the pumps were chemically and physically analyzed and the results are checked to assure conformance with the applicable ASTM or ASME specification. In addition, pressure containing parts of the pump are liquid penetrant inspected in accordance with Appendix IX of Section III of the ASME Boiler and Pressure Vessel Code. Additional UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 22 of 47 acceptance standards for the liquid penetrant test were provided in the Westinghouse equipment specifications.
Pump design was reviewed with special attention to the reliability and maintenance aspects of the working components. Specific areas include evaluation of the shaft seal and bearing design to determine that they are adequate for the specified service.
Where welding of pressure containing parts was necessary, a welding procedure including joint detail was submitted for review and approval by Westinghouse. This procedure includes evidence of qualification necessary for compliance with Section IX of the ASME Boiler and Pressure Vessel Code Welding Qualifications. This requirement also applied to any repair welding performed on pressure containing parts.
The pressure-containing parts of the pump were assembled and hydrostatically tested to 1.5 times the design pressure for thirty minutes.
Each pump was given a complete shop performance test in accordance with Hydraulic Institute Standards. The pumps were run at design flow and head, shut-off head and three additional points to verify performance characteristics. Where NPSH was critical, this value was established at design flow by means of adjusting suction pressure.
Heat Exchangers The two residual heat exchangers of the Residual Heat Removal System cool the water from the recirculation sump. These heat exchangers are sized for the cooldown of the Reactor Coolant System. Table 9.3-2 gives the design parameters of the RHR System and its heat exchangers, pumps, piping and valves. This table represents a consistent set of design parameters for each component based on a component cooling water supply temperature of 95°F and an essential service water supply temperature of 76°F.
The D.C. Cook design basis has been changed to an ESW pump discharge temperature of 87.0°F.
The CCW system has been designed and analyzed to:
- a.
Operate in the range of 60ºF to 105ºF except during periods of cooldown and post-LOCA operation, and
- b.
Operate at temperatures 120°F during cooldown and post-LOCA operation.
UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 23 of 47 The residual heat exchangers are designed to the ASME Boiler and Pressure Vessel Code, Sections III & VIII and conform to the requirements of TEMA (Tubular Exchanger Manufacturers Association) for Class R heat exchangers.
Additional design and inspection provisions include: confined-type gaskets, general construction and mounting brackets suitable for the plant seismic design requirements, tubes and tube sheet capable of withstanding full shell side pressure and temperature with atmospheric pressure on the tube side, ultrasonic inspection in accordance with Paragraph N-324.3 of Section III of the ASME Boiler and Pressure Vessel Code of all tubes before bending, penetrant inspection in accordance with Paragraph N-627 of Section III of the ASME Code of all welds and all hot or cold formed parts, a hydrostatic test duration of not less than thirty minutes, the witnessing of hydro and penetrant tests by a qualified inspector, a thorough final inspection of the unit for workmanship and the absence of any gouge marks or other scars that could act as stress concentration points, a review of the radiographs and of the certified chemical and physical test reports for all materials used in the unit.
The residual heat exchangers are conventional vertical shell and U-tube type units (tube sheet down). The tubes are seal welded to the tube sheet. The shell connections are flanged to facilitate shell removal for inspection and cleaning of the tube bundle. Each unit has a SA-515 GR70 carbon steel shell, SA-213 TP-304 stainless steel tubes, SA-240 Type 304 stainless steel channel, SA-240 Type 304 stainless steel channel cover and a tube sheet of forged steel SA-105 GR.II with 1/4-inch minimum TP-304 weld overlay.
Valves Parts of valves used in the safety injection system in contact with borated water are austenitic stainless steel or equivalent corrosion resistant material. All valves required for initiation of safety injection or isolation of the system have remote position indication in the control room.
Valving is specified for exceptional tightness. All valves, except those, which perform a control function, are provided with backseats, which are capable of limiting packing gland leakage.
Globe valves are installed with flow under the seat to prevent leakage of system fluid through the valve stem packing.
The check valves, which isolate the safety injection system from the reactor coolant system, are installed near the connection to the reactor coolant piping.
UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 24 of 47 The safety injection pump discharge piping is protected by a relief valve. The relieving capacity of this valve is several times greater than the expected leakage rate through the check valves.
The valve discharges to the pressurizer relief tank.
The RHR loop is protected by four relief valves:
- a.
1 on the header to the RCS from the pumps, b.
1 on each of the ECCS injection headers,
- c.
1 on the hot leg return header.
These relief valves discharge to the pressurizer relief tank.
Gas relief valves protect the accumulators from pressures in excess of the design value.
Specific codes and standards used in the original design are listed in the following sections.
However, repairs and replacements for pressure retaining components within the code boundary, and their supports, are in accordance with ASME Boiler and Pressure Vessel Code Section XI.
Motor Operated Valves The pressure containing parts (body, bonnet and discs) of the motor operated valves employed in the safety injection system are designed per criteria established by the ANSI B16.5 or MSS SP66 specifications. The materials of construction for these parts are procured per ASTM A182, F316 or A351, GR CF8M, or CF8. Material in contact with the primary fluid, except the packing, is austenitic stainless steel or equivalent corrosion resisting material. The pressure containing cast components are radiographically inspected as outlined in ASTM E-71 Class 1 or Class 2. The body, bonnet and discs are liquid penetrant inspected.
When a gasket is employed, the body-to-bonnet joint is designed per ASME Boiler and Pressure Vessel Code Section VIII or ANSI B16.5 with a fully trapped, controlled compression, spiral wound gasket with provisions for seal welding, or of the pressure seal design with provisions for seal welding.
The entire assembled valve unit is hydrotested as outlined in MSS SP-61. Any leakage is cause for rejection. The seating design of the gate valves is a parallel disc or a wedge gate (solid or flexible). These designs have the feature of releasing the mechanical holding force during the first increment of travel in the opening direction. Thereafter the motor operator must only overcome the frictional component of the hydraulic unbalance on the disc and the packing box friction. The discs are guided throughout the full disc travel to prevent chattering and provide UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 25 of 47 ease of gate movement. The seating surfaces are hard faced (Stellite No. 6 or equivalent) to prevent galling and reduce wear.
The stem material is of Haynes 25 alloy or ASTM A276 Type 316 condition B or precipitation hardened 17-4 pH stainless steel procured and heat treated to Westinghouse Specifications.
These materials are selected because of their corrosion resistance, high tensile properties, and resistance to surface scoring by the packing.
The motor operator incorporates a "hammer blow" feature that allows the motor to come to speed and to impact the discs away from the seat upon opening.
Each valve was assembled, hydrostatically tested, seat-leakage tested (fore and back),
operationally tested, cleaned and packaged per specifications.
"The design basis for each MOV is established by determining the maximum expected differential pressures and other system process fluid conditions under which the MOV will be required to open and/or close. Based upon these conditions, the requirement for minimum motor thrust and torque is determined. Certain valves must also be able to develop sufficient thrust and torque to overcome the additional wedging thrust imparted during a closing stroke. The maximum allowed close thrust is limited by MOV structure and by the maximum thrust that will permit unwedging. The motor gearing capability of an MOV with a safety related function is based on the most limiting degraded voltage available at the motor terminals as well as the maximum ambient area temperatures during design basis events. Limiting values of valve stroke times are determined according to the motor gearing that meets the limiting values of thrust and torque, and according to the actuation times assumed in accident analyses for the ECCS functions in which the valves are used."
Manual Valves The stainless steel manual globe, gate and check valves are designed and built in accordance with the requirements outlined in the motor operated valve description above.
The carbon steel valves are built to conform with ANSI B16.5. The materials of construction of the body, bonnet and disc conform to the requirements of ASTM A105 Grade II, A181 Grade II or A216 Grade WCB or WCC. The carbon steel valves pass only non-radioactive fluids and are subjected to hydrostatic test as outlined in MSS SP-61.
UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 26 of 47 Accumulator Check Valves The pressure containing parts of this valve assembly are designed in accordance with ASME Boiler & Pressure Vessel Code,Section III, 1968 Edition. Parts in contact with the operating fluid are of austenitic stainless steel or of equivalent corrosion resistant materials procured to applicable ASTM or WAPD specifications. The cast pressure-containing parts are radiographed in accordance with ASTM E-94 and the acceptance standard as outlined in ASTM E-71, E-186, or E-280, whichever is applicable. The cast pressure-containing parts, machined surfaces, finished hard facings, and gasket bearing surfaces are liquid penetrant inspected per ASME code Section III, App IX with the acceptance standard per code class N-10 of USAS B31.1. The finished valve is hydrotested per MSS SP-66. The seat leakage is conducted in accordance with the provisions of MSS SP-61 except that the acceptable leakage is 3cc/hr/in nominal pipe diameter.
The valve is designed with a low pressure drop configuration with all operating parts contained within the body, which eliminates those problems associated with packing glands exposed to boric acid. The clapper arm shaft bushings are manufactured from Stellite No. 6 material (or equivalent). The various working parts are selected for their corrosion resistant, tensile, and bearing properties.
The disc and seat rings are manufactured from a forging. The mating surfaces are hard faced with Stellite No. 6 (or equivalent) to improve the valve seating life.
The valves are intended to be operated in the closed position with a normal differential pressure across the disc of approximately 1600 psi. The valves remain in this position except for testing and required operation. Since the valves will not be required to normally operate in the open condition and hence be subjected to impact loads caused by sudden flow reversal, they perform their required functions without difficulty.
When the valve is required to operate, a differential pressure of less than 25 psi will shear any particles that may otherwise prevent the valve from functioning. Although the working parts are exposed to the boric acid solution contained within the reactor coolant loop, a boric acid "freeze up" is not expected with the low boric acid concentrations used.
The experience derived from the check valves employed in the Emergency Injection System of the Carolina - Virginia Test Reactor (CVTR) in a similar system indicates that the system is reliable and workable.
The CVTR Emergency Injection System, normally maintained at containment ambient conditions was separated from the main coolant piping by a single six-inch check valve. A leak UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 27 of 47 detection scheme was provided at a selected location by accumulating any leakage coming back through the check valve and utilizing a level alarm for a signal on excessive leakage. The pressure differential was 1500 psi and the system was stagnant. The valve was located 2 to 3 feet from the main coolant piping, which resulted in some heatup and cooldown cycling. The CVTR went critical late in 1963 and operated until 1967 during which time the level sensor in the leak detector never alarmed due to check valve leakage.
Accumulator Relief Valves The accumulator relief valves are sized to pass nitrogen gas at a rate in excess of the accumulator gas fill line delivery rate. The relief valves will also pass water in excess of the expected leak rate, but this is not necessary because the time required to fill the gas space gives the operator ample opportunity for corrective action if required. For an inleakage rate 15 times the manufacturing test rate, it would take more than 1000 days before water would reach the relief valves. However, level and pressure alarms are provided to indicate abnormal conditions.
The safety injection discharge line relief valve is provided to relieve any pressure above design that might build up in the high head safety injection piping.
Leakage Limitations Motor operated valves exposed to recirculation flow are periodically monitored to maintain leakage from systems outside containment to as low as practical levels.
The specified leakage across the valve disc required to meet the equipment specification and initial hydrotest requirements was as follows:
- a.
Conventional globe - 3 cc/hr/in. of nominal pipe size b.
Gate valves - 3 cc/hr/in. of nominal pipe size; 10 cc/hr/in for 300 and 150 pound ANI Standard
- c.
Motor-operated gate valves - 3 cc/hr/in. of nominal pipe size; 10 cc/hr/in for 300 and 150 pound ANI Standard
- d.
Check valves - 3 cc/hr/in. of nominal pipe size; 10 cc/hr/in for 300 and 150 pound ANI Standard
- e.
Accumulator check valves - 3 cc/hr/in. of nominal pipe size UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 28 of 47 Valves, which have a critical seat leakage requirement, are tested in accordance with the requirements of Appendix J to 10CFR50 in accordance with the applicable edition of the ASME Operation and Maintenance (OM) Code.
Piping Emergency Core Cooling System piping in contact with borated water is austenitic stainless steel. In general piping joints are welded except for the flanged connections at pumps, flow orifices and safety valves.
The piping beyond the accumulator stop valves is designed for Reactor Coolant System conditions.
The safety injection pump suction piping from the Refueling Water Storage Tank is designed for low friction losses to meet net positive suction head requirements of the pumps.
The safety injection pump and centrifugal charging pump high pressure branch lines are designed for high friction losses to limit the flow rate out of the branch line in the event of rupture at the connection to the reactor coolant loop.
The branch lines including throttling valves and restricting orifices provide the resistance required to ensure a break will not result in a violation of the design criteria for the Emergency Core Cooling System. The orifices are sized to preclude damaging cavitation at the throttle valves. The orifice sizing allows the throttle valves, when positioned to meet flow rates assumed in the accident analyses, to be sufficiently open to pass debris potentially drawn into the system through the recirculation sump strainers The piping is designed to meet the requirements set forth in the USAS B31.1, 1967 Edition, Code for Pressure Piping, including N-Code cases.
Pipe fitting materials were procured in conformance with all requirements of the ASTM and ANSI specifications in effect at the time of purchase. All materials are verified for conformance to specifications and documented by certification of compliance to ASTM material requirements.
Specifications impose additional quality control upon the suppliers of pipes and fittings as listed below.
- a.
Check analyses are performed on both the purchased pipe and fittings.
b.
Pipe branch lines between the reactor coolant pipes and the isolation valves conform to ASTM A376 and meet the supplementary requirement S6 covering an ultrasonic test, on 100 percent of the pipe wall volume.
UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 29 of 47
- c.
Pipe fittings 21/2-inch nominal size and larger conform to the requirements of ASTM A403; fittings 3-inch and above have requirements for UT inspection similar to S6 of A376.
Shop and field fabrication of piping subassemblies are performed by reputable firms in accordance with specifications which define and govern material procurement, detailed design, fabrication, cleaning, inspection, identification, packaging and shipment.
Welds for pipes sized 2-1/2" and larger are of the full penetration type. Reducing tees are used where the branch size exceed 1/2 of the header size. All welding is performed by welders and welding procedures qualified in accordance with the ASME Boiler and Pressure Vessel Code Section IX, Welding Qualifications.
High pressure piping butt welds containing radioactive fluid, at greater than 600oF temperature and 600 psig pressure or equivalent, were radiographed. The remaining piping butt welds are randomly radiographed. The technique and acceptance standards are those outlined in the paragraphs N-624.3 and N-624.4 of the ASME B&PV Code Section III. In addition, butt welds are liquid penetrant examined in accordance with ASME Section III-1968, IX-350 and IX-360.
The acceptance standard for liquid penetrant examination is set forth in the respective paragraphs of ASME Section III-1968, paragraphs N-626.3 and N-627.3 and as amended by the summer of 1969 Addenda.
A post-bending solution anneal heat treatment was performed on hot-formed stainless steel pipe bends. Completed bends were then completely cleaned of oxidation from all affected surfaces.
The Shop Fabricator was required to submit the bending, heat treatment and clean-up procedures for review and approval prior to release for fabrication.
General cleaning of completed piping subassemblies (inside and outside surfaces) is governed by basic ground rules set forth in the specifications. For example, these specifications prohibit the use of hydrochloric acid and limit the chloride content of service water and demineralized water.
Packaging of the piping subassemblies for shipment is done so as to preclude damage during transit and storage. Openings are closed and sealed with tight-fitting covers to prevent entry of moisture and foreign material. Flange facings and weld end preparations are protected from damage by use of wooden covers securely fastened in position. The packing arrangement proposed by the Shop Fabricator is subject to approval.
UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 30 of 47 Pump and Valve Motors Motor electrical insulation systems are supplied in accordance with USASI, IEEE and NEMA standards and are tested as required by such standards. Temperature rise design selection is such that normal long life is achieved even under accident loading conditions.
Criteria for motors of the Emergency Core Cooling System require that under normal plant operating conditions the motors operate below their nameplate rated horsepower, i.e. below a 1.0 service factor. For no other anticipated operating mode, including safeguards operation, do the motors exceed the maximum rating allowed by the nameplate, including their specified 1.15 service factor.
Environmental testing which demonstrate the adequacy of valve motor operators to be functional after exposure to high temperatures, pressures, and radiation, as applicable, is presented in Chapter 14.
The electrical supply for engineered safety system pump motors is taken from the 4Kv diesel generator buses. The voltage is stepped down to 600 volts from these buses through the 4160/600 volt transformers. The engineered safety system valve motors are fed from those 600 volt buses which are capable of being fed from the Emergency Diesel Generators. The electrical system is described fully in Chapter 8.
6.2.3 Design Evaluation Design Features Specific design features of the Emergency Core Cooling System assure its ability to meet single active failure during injection or a single active or passive failure during recirculation and to deliver dissolved chemical poison rapidly to the reactor. These features include:
1.
Inclusion of two charging pumps in the injection system which deliver into the four cold legs through 1.5-inch diameter lines. Accumulator injection into the cold legs employs completely independent piping and connections than those from the charging pumps. The two charging pumps will supply recirculation flow from the recirculation sump (via the RHR pump discharge/charging pump suction crosstie) to the four cold legs through the same lines.
2.
Inclusion of two safety injection pumps in the injection system which delivers to four cold leg injection points via the accumulator discharge lines during the injection phase and initial portion of the recirculation phase. Later in the UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 31 of 47 recirculation phase of operation, flow from each of these pumps is directed from the header to the four hot leg injection points in order to minimize the potential for boron precipitation.
Redundant headers are provided for this phase of operation to assure at least one pump can deliver even in the case of a passive failure in one line. During recirculation operation, the safety injection pumps (as well as the charging pumps mentioned previously) take suction from the recirculation sump via the RHR pump discharge or safety injection pump suction crosstie. This crosstie connection from the suction of the charging to the suction of the safety injection pumps assures that during recirculation with either a passive or an active failure, at least one charging and one safety injection pump will deliver flow.
3.
Inclusion of two residual heat removal pumps in the injection system which delivers to four cold leg injection points (one on each loop) via the accumulator discharge lines during the injection phase and initial portion of the recirculation phase of operation. During recirculation, the RHR pumps take suction from the recirculation sump and also provide flow to the suction of the charging and safety injection pumps. Later in the recirculation period, the injection flow provided directly by the RHR pumps will be redirected from the cold legs to four hot leg connections in order to complete subcooling of the core.
Thus, injection flow of borated water from the refueling water storage tank is provided to all four reactor coolant system (RCS) cold legs from the three pumping systems. During the recirculation phase of the accident, all three pumping systems are capable of providing recirculation sump fluid flow to all four cold legs with the low head pumps (RHR) providing flow to the safety injection and centrifugal charging pumps. The capability of long term recirculation flow to the RCS hot legs is provided from both the low head (RHR) and the safety injection pumps.
Range of Core Protection The measure of effectiveness of the Safety Injection System is its ability to fulfill the clad temperature and metal-water reaction criteria for any possible pipe break size at any location in the primary system. To demonstrate the adequacy of the system for this plant, a number of break sizes and locations were analyzed and the results are discussed in Chapter 14. Analysis of UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 32 of 47 various break sizes and locations were performed to demonstrate that the safety injection components meet the emergency core cooling requirements.
System Response To provide protection for large area ruptures of the Reactor Coolant System, the Emergency Core Cooling System must respond to rapidly refill and reflood the core following the depressurization and core voiding that is characteristic of large area ruptures. The accumulators act to perform the rapid refilling function with no dependence on the normal or emergency power sources, and also with no dependence on the receipt of an actuation signal. With three of the four available accumulators delivering their contents to the reactor vessel, the peak clad temperature is maintained within acceptable limits, as discussed in Chapter 14.
The function of the centrifugal charging, safety injection or residual heat removal pumps is to complete the reflood of the vessel and ultimately complete core recovery. However, the starting sequence of the emergency core cooling system pumps and the related emergency power equipment is designed so that these pumps will achieve full speed at about 25 seconds.
The starting sequence is discussed in detail in Chapter 8 and is summarized below.
Time (sec.)
Action 0
Initiation of safety injection signal.
0-10 Start diesel generators and attain rated speed and voltage.
10 Diesel up to speed, Energize motor control centers and apply opening /
closing signals to motor operated valves.
13 Start centrifugal charging pumps.
17 Start safety injection pumps.
21 Start residual heat removal pumps.
Thus the safety injection system is operational after an elapsed time of approximately 25 seconds, including time to bring the RHR pump up to full speed. The above times are approximate with respect to the delay times used in the loss-of-coolant accident analysis for large UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 33 of 47 and small breaks. The specific safety injection system delay times assumed in the design basis accident analyses are discussed in detail in Chapter 14.
Failure Analysis Separate single failure analyses were performed for both the injection and recirculation phases of an accident. Two basic types of failure were considered:
- 1.
Active failure, which is defined as the inability of any single dynamic component or instrument to perform its design function when called upon to do so by the proper actuation signal. Such functions include change of position of a valve or electrical breaker, operation of a pump, fan or diesel generator, action of a relay contact, etc.
- 2.
Passive failure which is defined as a failure affecting a device involved with the transport of fluid which limits its effectiveness in carrying out its design function.
Most passive failures involve the development of abnormal leakage in valve stem packings, pump seals, etc., although passive failures concerned with abnormal flow restriction in lines are also considered.
Table 6.2-6 summarizes the results of the single failure analysis applied during the injection phase. All failures during this phase are assumed to be active failures. It is during this phase that the pumps are starting and automatic isolation valves are required to move. All credible active failures are considered, and are included in the accident analyses described in Chapter 14.
The accumulators which are a principle factor of the injection system are not subject to active failure. The only moving parts in the accumulator injection train are the two check valves. The working parts of the check valves are exposed to fluid of relatively low boric acid concentration.
Even if some unforeseen deposition accumulated, calculations indicate that a reversed differential pressure of about 25 psi can shear any particles in the bearing surfaces that may tend to prevent valve functioning.
During normal operation the check valves are in the closed position with a nominal differential pressure across the disc of approximately 1600 psi. They remain in this position except when called upon to function. Since the valves normally operate in the closed position and are therefore not subject to the abuse of flowing operation or impact loads caused by sudden flow reversal and seating, their moving parts experience negligible wear and the valves can be expected to function as required.
UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 34 of 47 The check valves are leak tested on a refueling outage frequency with at least 150 psi differential across the valve. The test confirms the seating of the disc and provides a quantitative leakage rate measurement that can be compared with the results of earlier tests.
The accumulators can accept some leakage back from the Reactor Coolant System without compromising their availability. Table 6.2-8 indicates the frequency that the accumulator level would have to be readjusted as a function of leakage rate. Tables 6.2-6 and 6.2-7 summarize the single failure analyses of recirculation phase. For Historical information only, Table 6.2-9 summarizes the estimated leakage during recirculation.
Emergency Flow to the Core Special attention is given to factors that could adversely affect the accumulator and safety injection flow to the core. These factors are considered in Chapter 14.
6.2.4 Safety Limits and Conditions Limiting Conditions for Operation The limiting conditions for operation are detailed in the Technical Specifications. These conditions apply to both active and passive components, and tanks of the Emergency Core Cooling System.
Limiting Conditions for Maintenance The Technical Specifications also establish limiting conditions governing the maintenance of Emergency Core Cooling System components during plant operation. Maintenance on a component is permitted providing the redundant component is operable and capable of being powered from an emergency power source.
The design philosophy with respect to active components in the safety injection and residual heat removal systems is to provide duplicate equipment so that maintenance is possible during operation without impairment of the safety function of the systems.
6.2.5 Tests and Inspections All active and passive components of the Emergency Core Cooling System are inspected periodically to demonstrate system readiness.
UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 35 of 47 The pressure containing systems are inspected for leaks from pump seals, valve packing, and flanged joints during system testing.
In addition, to the extent practical, the critical parts of the injection nozzles, pipes, valves and safety injection pumps are inspected for erosion, corrosion, and vibration wear evidence.
Components Testing Pre-operational performance tests of the components were performed in the manufacturer's shop.
An initial system flow test demonstrates proper functioning of the system. Thereafter, tests are performed in accordance with the applicable edition of the ASME Operation and Maintenance (OM) Code.
System Testing Testing is conducted during plant shutdown to demonstrate proper automatic operation of the emergency core cooling system. A test signal is applied to initiate automatic action and verification made that the safety injection pumps attain required discharge heads. The test demonstrates the operation of the valves, pump circuit breakers, and automatic circuitry.
The periodic testing of pumps in the emergency core cooling and containment spray systems requires a flow of water from the refueling water storage tank. Demonstration of proper operation of these pumps will also demonstrate the operability of the line from the refueling water storage tank. Testing procedures are employed to assure that the motor operated isolation valves function normally.
The accumulator pressure and level are continuously monitored during plant operation.
The accumulators and their injection piping up to the accumulator isolation valve are maintained full of borated water while the plant is in operation. The boron concentration is checked periodically by sampling. The accumulators and injection lines are refilled with borated water as required by using the safety injection pumps. A small test line is provided for this purpose in each injection header.
The motor-operated valves in the recirculation suction lines from the recirculation sump to the RHR pumps are normally closed. These valves are containment isolation valves and are periodically leak tested and exercised in accordance with the approved plant programs. Flow in each of the main safety injection lines and in the main flow line for the residual heat removal UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 36 of 47 pumps is monitored by flow indicators on the main control board. Pressure instrumentation is also provided for the main flow paths of the safety injection and residual heat removal pumps.
Operational Sequence Testing After hot functional testing and prior to initial fuel loading, the Emergency Core Cooling System plus a portion of the Containment Spray System were operationally tested. These tests include individual pump full flow tests, accumulator operation and complete system operational flow tests, with the reactor head removed. Water was supplied from the refueling water storage tank.
Separate full flow tests were performed for a minimum of one hour to assure that all safety injection, residual heat removal and containment spray pumps are capable of sustained operation.
The containment spray pump discharge flow was piped directly to the recirculation sump via temporary piping. Water was returned to the refueling water storage tanks by the residual heat removal pumps.
The accumulators were tested by charging the tanks to 100 psig and normal water level with the isolation valves closed. With the reactor head removed, the isolation valves were opened and proper performance verified.
A complete operational flow test was performed including the simultaneous full flow operation of all safety injection pumps, containment spray pumps, residual heat removal pumps and charging pumps. The purpose of this test was to demonstrate the proper functioning of the instrumentation and actuation circuits and to evaluate the dynamics of placing the system in operation.
To initiate the test, the Emergency Core Cooling block switch was moved to the unblock position thereby allowing the automatic actuation of the Emergency Core Cooling System relays from the pressurizer low pressure signals. A simulated high containment pressure signal initiated operation of the Containment Spray System. Special test instrumentation and data obtained provided information to confirm valve operating times, pump motor starting times, and delivery rates of injection water to the reactor coolant system.
6.2.6 Programmatic Controls Plant programs, processes, and procedures exist to ensure ECCS and CTS functionality during post-accident sump recirculation in accordance with Cook Plant commitments to Generic Letter 2004-02. (Reference 6.2.7.2) Collectively, these administrative controls limit the introduction of UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 37 of 47 materials into containment which could adversely impact the recirculation function and they establish monitoring programs to ensure that containment conditions will continue to support the recirculation function. Controls include:
- a.
A station procedure that outlines the attributes of a containment recirculation sump protection program and associated personnel responsibilities.
b.
An engineering program that defines the containment recirculation sump function, as delineated in design documentation, and includes requirements for monitoring and assessing containment debris sources during refueling outages.
- c.
A design change control process that requires consideration and evaluation, as necessary, of prospective changes to SSCs inside containment or that are associated with the recirculation flow path to ensure no adverse impact on analyses inputs and/or assumptions described in Section 14.3.9.
d.
Containment access control requirements for evaluation of major maintenance activities which can create or introduce significant amounts of debris during periods when the recirculation function is required.
- e.
Foreign Material Exclusion (FME) programmatic controls which require documented accountability of items taken into and removed from containment during periods when containment Operability is required by Technical Specifications.
- f.
A safety related coatings program which requires extent of condition evaluations and determination of the probable failure mode(s) of identified failures of qualified coatings in containment.
- g.
Plant labeling requirements that prevent the introduction and use of unqualified labels in containment.
- h.
Containment inspection requirements which ensure that the latent debris burden inside containment, as defined in NEI 04-07, remains at or below the total quantity assumed in the recirculation sump strainer analyses described in Section 14.3.9.
- i.
Engineering design requirements that include requirements for materials in containment, consistent with the inputs and assumptions used for evaluation of the recirculation function described in Section 14.3.9.
UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 38 of 47
- j.
Procurement requirements which require that materials ordered for containment are identified and in conformance with approved engineering material specifications.
Plant programs, process, procedures, and Technical Specifications also exist to ensure ECCS and CTS are maintained sufficiently filled with water to enable all safety related functions to be accomplished in both the injection and recirculation modes of operation in accordance with Cook Plant commitments to Generic Letter 2008-01 (reference 6.2.7.3, 6.2.7.6, and 6.2.7.7) and in accordance with "Guidelines for Effective Prevention and Management of System Gas Accumulation" NEI 09-10 [Rev 1a-A] (reference 6.2.7.4) and AEP-15-46, "American Electric Power Donald C. Cook Units 1 and 2 Emergency Core Cooling System, Residual Heat Removal System and Containment Spray System Gas Accumulation Evaluation for D. C. Cook Units 1 and 2" (reference 6.2.7.5).
6.2.7 References for Section 6.2 1.
Appendix Q, Amendment 78 to Unit 2 FSAR, Question 212.36, October 1978.
2.
NRC Generic Letter 2004-02, Potential Impact of Debris Blockage on Emergency Recirculation During Design Basis Accidents at Pressurized-Water Reactors, dated September 13, 2004 and associated Cook Nuclear Plant responses.
3.
AEP:NRC:2008-43: Donald C. Cook Plant Unit 1 and Unit 2 Nine-month response to NRC Generic Letter 2008-01 issued pursuant to 10 CFR 50.54(f),
Managing Gas Accumulation in Emergency Core Cooling, Decay Heat Removal, and Containment Spray Systems.
4.
N El 09-10 [Rev 1 a-A], "Guidelines for Effective prevention and Management of System Gas Accumulation," dated April 2013.
- 5.
AEP-15-46, "American Electric Power Donald C. Cook Units 1 and 2 Emergency Core Cooling System, Residual Heat Removal System and Containment Spray System Gas Accumulation Evaluation for D. C. Cook Units 1 and 2."
- 6.
AEP-NRC-2016-07, DCCNP Unit 1 and Unit 2, License Amendment Request to Revise Technical Specifications to Adopt Technical Specifications Task Force-523, "Generic Letter 2008-01, Managing Gas Accumulation," Using the Consolidated Line Item Improvement Process UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 39 of 47 7.
A0816 DCCNP, Units 1 and 2, Issuance of Amendments to Revise Technical Specifications to Adopt Technical Specifications Task Force - 523, Generic Letter 2008-01, Managing Gas Accumulation.
UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 40 of 47 6.3 CONTAINMENT SPRAY SYSTEMS 6.3.1 Application of Design Criteria The primary purpose of the Containment Spray System is to spray cool water into the containment atmosphere in the event of a loss-of-coolant accident to prevent containment pressure from exceeding the design value. The design of the Containment Spray System is based on the conservative assumption that the core residual heat is released to the containment as steam. The heat removal capability of each Containment Spray System is sized to remove the reactor residual heat during cool down following a loss-of-coolant accident from operation at a calculated power level of 102% of 3413 MWt (3481 MWt, which bounds the MUR power uprate on either unit). The residual heat (during ice melt) plus an undefined energy margin of 50 x 106 BTU is absorbed by the operation of the Containment Spray System and Ice Condenser, respectively. The sizing of the Containment Spray Systems also provides for absorption of steam leaking through the operating deck at the maximum long term deck differential pressure (1/2 to 1 lb per square foot, the pressure required to open the Ice Condenser doors). Refer to Chapter 14.3 for Containment Integrity Analysis including Containment Spray System Modeling.
The secondary purpose of the Containment Spray System is the removal of fission products (radioactive iodine isotopes) from the containment atmosphere. The Containment Spray System is designed to deliver sufficient sodium hydroxide solution which, when mixed with water from the Refueling Water Storage Tank which contains approximately 1.5% by weight boric acid (2400 to 2600 ppm Boron), accumulator water, reactor coolant system water and the melted ice, results in the solution recirculated within containment after a LOCA having a pH in the range of 7.0 to 10.0. The performance of the Containment Spray System for iodine removal with a single Containment Spray Pump operating adequately fulfills the requirement of Regulatory Guide 1.183 and 10 CFR 50.67 as described in Chapter 14.
The Containment Spray Pumps (CTS) are equipped with two recirculation test loops to provide the capability of verifying full design flow of the CTS pumps. As illustrated in Figure 6.3-1, water is recirculated through the test loops by the Containment Spray pumps with a portion of the discharge being fed back to the pump suction and the remainder returned to the Refueling Water Storage Tank. Each recirculation test loop includes a flow meter to verify pump capacity during testing. The motor-operated valves in the RHR spray lines downstream of the RHR heat exchangers remain closed during testing of that portion of the RHR system which is a part of the spray system. Testing of this flow path is accomplished by a recirculation flow around the UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 41 of 47 Residual Heat Removal Heat Exchanger. This portion of the test loop may also be used for mixing water in the RWST to acquire a homogeneous solution for adjusting boron concentration.
The Spray Additive System is tested periodically to demonstrate the delivery capability of concentrated sodium hydroxide (NaOH) solution from the spray additive tank (SAT). A water test line from the RWST suction to the eductor inlet is used to simulate the SAT flow.
Acceptable eductor performance was derived using proportionality principles between test criteria and a prediction of actual system performance.
Test connections are provided downstream of the block valves for checking (with air) for unobstructed flow through the spray nozzles.
6.3.2
System Design
System Description Adequate containment pressure reduction and iodine removal are provided by the Containment Spray Systems whose components operate in sequential modes as follows:
- a.
'A' mode. Spraying a portion of the contents of the Refueling Water Storage Tank into the containment atmosphere using the Containment Spray Pumps. During this mode, the contents of the spray additive tank (sodium hydroxide solution) are mixed into the spray system to provide adequate iodine removal.
b.
'B' mode. Recirculation of water from the recirculation sump by the Containment Spray Pumps through Containment Spray Heat Exchangers and back to the containment after the Refueling Water Storage Tank has been isolated, but while there is still ice in the Ice Condenser. This spray reduces the containment atmosphere temperature and prolongs the effective life of the ice.
- c.
During the 'A' mode NaOH is metered into the spray solution by an eductor system, using the Containment Spray Pump discharge for motive water. If the Spray Additive Tank level decreases to the setpoint level during A mode, the eduction of NaOH is automatically terminated. Eduction of NaOH is manually terminated early in the B mode as soon as the Containment Spray Pumps have been restarted.
- d.
Diversion of a portion of the recirculation flow from the Residual Heat Removal System to additional redundant spray headers completes the containment spray system heat removal capability. This operation is initiated after the Ice Condenser UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 42 of 47 has been depleted and in the event that containment pressure rises above a predetermined limit.
The Containment Spray System arrangement is shown in Figure 6.3-1. The Containment Spray System consists of two full-size (maximum heat-removal capability) redundant trains. Each train consists of the following:
- a.
A Containment Spray Pump, a Containment Spray Heat Exchanger, valves, piping, necessary instrumentation and controls and spray headers in both the upper and lower containment volumes. The flow of this train provides 2,000 GPM to the upper volume, 1,000 GPM to the lower volume and 200 GPM total to the two fan rooms in the lower volume outer annulus.
- b.
A Residual Heat Removal Pump, Residual Heat Removal Heat Exchanger, piping, valves, necessary controls and instrumentation and an individual spray header in the upper containment volume with a capacity of at least 1890 gpm.
For the iodine removal function, NaOH is added to the suction of the Containment Spray Pumps by the entrainment and mixing action provided by eductors which are powered by the discharge pressure of their respective pump. During the time period that NaOH solution is added to the spray flow, a design inlet flow of 26-28 GPM (approx.) is diverted from the Containment Spray Pump discharge to serve as motive fluid for eductor operation.
The eductor draws a design suction flow of 11-63 GPM (approx.) from the spray additive tank which produces a solution in the recirculation sump suitable for iodine retention. The two eductor loops are served by a shared spray additive tank through the necessary valves and piping equipped with the necessary instrumentation. The Containment Spray System is tested periodically to demonstrate the delivery capability of the pumps and spray additive components as described in Section 6.3.1.
Containment Spray System operation is automatically initiated. Containment pressure is monitored by 4 sensors in the lower volume. The output of these sensors is the hi-hi containment pressure signals occurring at approximately 3.0 psig. These signals are fed into a safeguards logic cabinet which contains the 2/4 logic to actuate the spray (Spray Actuation). Spray Actuation starts the Containment Spray Pumps, opens the discharge valves to the spray headers and opens the valves associated with the spray additive tanks. Similarly, 1.2 psig produces the Hi Containment pressure signal, which, through the safeguards logic cabinet results in the 2/3 logic matrix required for the Safety Injection Actuation signal.
UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 43 of 47 Any system failure producing a rise in containment pressure to approximately 3.0 psig will result in actuation of the Containment Spray System.
If additional spray is required during the recirculation phase, a portion of the Residual Heat Removal System flow can be manually diverted to the spray mode.
The portions of the Containment Spray System located outside of the containment which are designed to circulate radioactively contaminated water collected in the recirculation sump as the result of an accident meet the following requirements:
- a.
Radiation exposure below Regulatory Guide 1.183 and 10 CFR 50.67 limits.
- b.
Means to restrict all system leakage (e.g., from pumps, seals, valve stems, etc.).
- c.
Means for isolation of any section under malfunction or failure conditions.
- d.
Means to detect and control radioactive leakage.
- e.
Provision of a leak detection system as described in Section 6.1.
Each of the spray trains provides complete backup for the other. The passive portions of the Containment Spray System located within the containment are designed to withstand the post-accident containment environment without loss of performance and to operate without maintenance. All active components of the Containment Spray System are located outside the containment, hence are not required to operate in the steam-air environment produced by an accident. All spray headers and supply pipes are missile shielded or are designed with enough separation so that system operation cannot be significantly impaired by any segment thereof being rendered inoperable by a missile. The spray headers located in the upper containment volume are separated from the reactor and reactor coolant loops by the operating deck and inner wall of the ice bed. These spray headers are therefore protected from missiles originating in lower containment. The spray headers for the lower containment spray nozzles are also protected from missiles originating in lower containment with the exception of the small feeder lines that serve no more than four spray nozzles each. A special leak rate limit has been established for the containment isolation valves in the containment spray supply headers. The limit ensures that the inventory of spray water resident in the containment spray headers inside the containment will not be depleted by leakage through the isolation check valve to a level which would expose the containment isolation valves to the post-LOCA containment environment, for a minimum of thirty days, in the event that a spray system is shut down.
The feeder lines are separated from each other so that they cannot be damaged by the same missile. A design criterion of the feeder lines is to control resistance in the piping system to the UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 44 of 47 nozzle, such that if one of the feeder lines is severed by a missile the effect on the system capability will be negligible.
Hydraulic analyses of the feeder line design indicates that flow increase due to an open-ended feeder line is approximately 5 gpm, which is less than 0.2% of the flow from a single Containment Spray Pump.
Components The Containment Spray System water is supplied from the Refueling Water Storage Tank during the injection phase and the Recirculation Sump during the recirculation phase.
Pumps The two Containment Spray Pumps are of the vertical-centrifugal, motor-driven type, provided with normal and emergency power sources.
The design head of the pumps is sufficient to deliver their rated capacity while taking suction from either the Refueling Water Storage Tank or the Recirculation Sump, against a head equivalent to the sum of the design pressure of the containment, the head to the uppermost nozzles and the line and nozzle pressure losses. The pump motors are direct-coupled and rated for the maximum power requirement of the pump. The material used in the fabrication of wetted parts is stainless steel or an equivalent corrosion resistant material suitable for use with mild boric acid solution and sodium borate solution. Design parameters are given in Table 6.3-1.
The system is designed to provide sufficient Net Positive Suction Head to assure unimpaired pump operation while taking suction from the Recirculation Sump after the Refueling Water Storage Tank has been isolated. Sufficient NPSH margin is provided with a conservatively estimated operating condition. This includes 190°F (for both units) sump liquid temperature at a pressure of 12.9 psia (14.4 - 1.5 psi) in the containment, plus a minimum Recirculation Sump water level of 601'-6". Additional information on CTS and ECCS pump NPSH, vortex analysis, and system design requirements, is presented in Sections 6.1 and 14.3.9.
Heat Exchangers The Containment Spray Heat Exchangers are shell and U-tube type with the tubes welded to the tube sheet. Borated water containing sodium hydroxide circulates through the tubes while water from the Essential Service Water System circulates through the shell side. These heat UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 45 of 47 exchangers are designed with a capacity to ensure adequate heat removal from the sump water during the recirculation mode. Design parameters are given in Table 6.3-2. The Residual Heat Removal Heat Exchangers are described in Section 6.2.2.
Spray Nozzles The ramp bottom design spray nozzles are not subject to clogging by particles less than 1/4-inch in maximum dimension, and are designed to produce a mean drop size of approximately 700 microns in diameter with the Containment Spray Pump operating at design conditions and the containment at design pressure. The nozzles (and headers) are so oriented as to maximize coverage of the total containment volume by a single Containment Spray train.
Recirculation Sump The recirculation sump is described in Section 6.2.2. The recirculation sump design includes main and remote strainers which prevent material capable of plugging the Containment Spray nozzles from entering the recirculation sump.
Spray Additive Tank The tank contains sufficient sodium hydroxide to ensure that, when mixed with the refueling water, accumulator water, reactor and melted ice in the containment, the solution recirculated from the recirculation sump after a LOCA has a pH between 7.0 and 10.0. This pH band minimizes the evolution of iodine and minimizes the effects of chloride and caustic stress corrosion on mechanical systems and components. The effects of pH values outside of this range for relatively short periods of time are considered as part of the analyses of post-LOCA electrical equipment environmental qualification. The tank is nitrogen blanketed to prevent dilution to the NaOH by absorption of moisture from the air. A safety valve, set at 10 psig, protects the tank from overpressure which could be caused only by failure of the nitrogen system reducing valve.
Release of the concentrated solution from the tank to the containment undiluted, is not feasible.
A Containment Spray Pump must be operating and a portion of its discharge is required as motive water to the eductor in order to introduce NaOH into the flow stream.
UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 46 of 47 Eductors The eductors are sized to meter the appropriate quantity of NaOH solution from the Spray Additive Tank into the suction of each Containment Spray Pump to provide a spray water pH that will be compatible with materials exposed to containment spray.
Instrumentation and Control All normally-closed pump, eductor and tank block valves are provided with automatic remote operators which open as a result of the initiation of the hi-hi containment pressure signal. Two spray additive tank block valves are provided in parallel. Position indication is provided in the Control Room for all remotely operated valves. The tank discharge valves as well as the motor operated valves in the motive water supply lines to the eductors, are closed automatically if the spray additive tank level reaches the low level. A lo-lo level alarm is also provided in the Control Room to warn the operator if the valves do not close automatically that they be closed manually.
Periodic sampling confirms that proper sodium hydroxide concentration exists in the tank. In addition, system performance is monitored by pump discharge pressure gauges and heat exchanger inlet and outlet temperature gauges in the Control Room.
Containment recirculation sump water level instrumentation is installed inside the recirculation sump. This instrumentation is described in Section 6.2.2.
6.3.3 Design Evaluation The Containment Spray System provides two full-capacity heat removal systems for the Containment, sized, as described in Sections 6.3.1 and 6.3.2, to remove reactor residual heat at a rate consistent with the heat generated after ice melt, thereby precluding an increase of containment pressure above design limits. Each of the two Containment Spray Pumps provides 100% of the iodine removal capability required in the containment. The fact that at least one Containment Spray Pump comes on automatically for iodine removal in the event of an accident, is factored into the calculation of when the full heat removal capability flow from one spray pump plus additional flow from the Emergency Core Cooling System of the spray systems is required. The Containment Spray System design is based on the spray water being raised to the thermodynamic wet bulb temperature of the Containment in falling through the steam-air mixture within the building. The minimum fall path of the droplets is approximately 85 ft. from UFSAR Revision 30.0
INDIANA MICHIGAN POWER D. C. COOK NUCLEAR PLANT UPDATED FINAL SAFETY ANALYSIS REPORT Revised:
29.0 Chapter:
6 Page: 47 of 47 the upper containment spray ring headers to the operating deck and approximately 50 ft. from the lower containment spray headers to the Containment floor. The actual fall path is longer due to the trajectory of the droplets sprayed out from the nozzles. In the evaluation of the spray effectiveness in removing iodine, discussed in Chapter 14, the physical arrangement of structures was considered in calculating the actual fall distance.
Heat transfer calculations, based on a range of droplet sizes from 700 to 1000 microns show that thermal equilibrium is reached in a distance of a few feet and the spray water essentially reaches the saturation temperature. The heat transfer calculations in lower containment take into account the fact that the accident may take place in one corner of this compartment thereby rendering the effectiveness of the spray nozzles located in the other regions of the volume less than 100%
effective. The 900 GPM flow per spray train to lower containment is based on a situation requiring maximum heat removal to achieve suppression of the containment pressure below 10 psig. This spraying is more than adequate for the iodine removal function. Smaller energy releases develop only local steam pockets in lower containment. In such case the local spray nozzles are considerably more than adequate for the required heat removal. In addition to heat removal, the Containment Spray System is effective in scrubbing fission products from the containment atmosphere. Also, condensation and spray striking the surface of the steel liner will generate a liquid film, which acts as a barrier to leakage from the containment. No credit, however, has been taken for this leakage barrier phenomenon.
A system malfunction analysis is detailed in Table 6.3-4.
6.3.3.1 Materials Compatibility Parts of the system which are, or are liable to be in contact with borated water, the sodium hydroxide spray additive, or a mixture of the two are stainless steel or an equivalent corrosion resistant material.
UFSAR Revision 30.0