Ignalina Source Book
10.3 Emergency Core Cooling Sysytem
The ECCS functions to cool the fuel during LOCAs and some
operational transients. The Emergency Core Cooling System works in conjunction
with the Main and Auxiliary Feed Water System. The ECCS is supported by several
other systems, such as Service Water System, Intermediate Cooling Circuit,
Emergency Power System, Accident Confinement System, Parameter Display System,
Deaerating and Feedwater Facility, Auxiliary Deaerator Makeup and Demineralized
Water System. The adequacy of the ECCS design has been subject of analysis of
different SAR teams dealing with system and accident analysis as well as with
equipment qualification. The major finding of the SAR was that no single failure
of ECCS equipment or equipment in support function would result in failure to
meet its safety requirements. In general, the three short-term trains and three
long-term trains provide a high degree of redundancy and ensure that there is
adequate flow to cool the fuel, although the main and auxiliary feed water pumps
may be unavailable as a consequence of the break location or environmental
effects. Impairment of the auxiliary feed water pumps can also be caused by a
number of different single failures. However, the accident analysis shows that
in these cases the accumulators and ECCS pumps provide adequate cooling.
Nevertheless, the loss of one short-term train and one long-term train represents
a reduction in defense-in-depth.
The SAR considered the overall ECCS design as adequate, provided
the agreed upon modifications are implemented. The modifications identified involve
mainly initiation logic. The quoted consequential failures have been justified on
the basis of the following arguments:
- during all the accident scenarios for which the main and
auxiliary feed water weaknesses are expected to emerge, the remaining trains of
ECCS pumps or accumulators are considered sufficient,
- more realistic calculations and engineering judgment led
to the identification of success criteria for ECCS well below those assumed using
calculations performed at the design stage.
The actual ECCS design was found to have more redundancies
built in than originally recognized from 3 x 50% to 3 x 100%. This permits
reduction or complete elimination of need for supplementary contribution by
main or auxiliary feed water, capability to withstand all consequential failures,
assumed outages and single failures.
The main recommendations resulting from the assessment of the
ECCS and its connected and support systems are as follows:
- Environmental effects may incapacitate the main and
feedwater pumps for certain break locations but in these cases the accident
analysis shows that adequate cooling after the first 10 minutes can be provided
by 4 ECCS pumps. The current Technological Specification  permits 1 ECCS
and 1 auxiliary feed water pump to be out of service for maintenance, and another
pump to be taken out of service for up to 72 hours. If the letter pump is an ECCS
pump, and if an additional ECCS pump is assumed to fail due to single failure,
there may only be 3 ECCS pumps available. A recommendation has been made to change
the Technological Regulation to permit at most 1 ECCS pump being out of service
- There is no automatic ECCS initiation following certain
steam line breaks. Fuel failures can occur and activity is released directly to
environment. A recommendation has been made to initiate ECCS based on the rate
change of drum separator pressure and accident analysis shows that fuel failures
are precluded with early ECCS initiation.
- When calculational uncertainties are taken into account in
the analysis of partial breaks, fuel failures and possibly fuel channel failures,
are predicted because ECCS initiation is not sufficiently prompt to prevent fuel
heatup. A recommendation has been made to initiate ECCS based on low flow in multiple
fuel channels. Accident analysis shows that ECCS is initiated promptly on this signal,
and predicted cladding and pressure tube wall temperatures are well below the failure
criteria. A reactor trip based on this parameter is already being installed, so the
recommendation is to extend the signal to initiate ECCS.
- Accident analysis shows that downcomer breaks result in large
amount of water accumulating in rooms above the ACS. The drainage capacity is such
that large pools of water, which may devolve organic iodides, exist for long periods
of time. In addition, the operator may have difficulty ensuring that the needs of
ECCS recirculation are met because of low drainage rate. A recommendation is made
to improve drainage capacity.
- Accident analysis shows that for breaks which affects both
loops (e.g., steam line break) oscillation in emergency core cooling flow delivery
to the loops can occur. Pressure in a loop increases due to emergency core cooling
inflow, so flow is then diverted preferentially to the other loop. Its pressure
then builds up, causing flow to go to the other loop. Although adequate flow is
maintained, the operator may have difficulty diagnosting phenomena and controlling
ECCS flow. A recommendation has been made to provide improved operator training or
consider modification that would ensure that emergency core cooling water is delivered
to the location where is needed.
- The auxiliary feed water pumps have neither an over-current
protection trip in case excessive throughput, nor flow regulation devices to prevent
excess flow. Therefore, the response of pumps is indeterminate for certain accidents
(feedwater or steam line breaks). In order to ensure adequate defense-in-depth, a
recommendation has been made that Ignalina NPP take steps to ensure that the pumps
do not burn out due to excessive throughput, by either installing over-current
protection or preferably by introducing flow limiters to prevent excessive flow.
- There is a lack of analysis of the dynamic effects on
pipework following LOCAs, e.g., waterhammer following check valve closure. A
recommendation has been made for Ignalina NPP to request the designer to either
provide the calculations or perform new ones to demonstrate the adequacy of the
- The seismic walkdown of the ECCS identified several areas
where improvements are required. Recommendations were made to inspect pump anchors,
to replace existing piping anchors with ones connected to structural beams, and
to install bumpers to prevent damage due to piping interaction.
All of these recommendations are accepted by Ignalina NPP.
The ECCS and AFWS have undergone important modifications during 1996, e.g.,
the safety injection of water is now directed to the GDHs. The system description
and system analysis have not considered these modifications homogeneously. The
Single Failure Analysis performed by the SAR have to be characterized as conservative
but must be repeated using recent system configuration and actuation.