GNRO-2012/00126, Day Response to Bulletin 2012-01, Design Vulnerability in Electric Power System

Day Response to Bulletin 2012-01, Design Vulnerability in Electric Power System

ML12299A394
Person / Time
Site:	Grand Gulf
Issue date:	10/24/2012
From:	Pertto M Entergy Operations
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
GNRO-2012/00126, BL-12-001
Download: ML12299A394 (15)

Text

.-

~Entergy Entergy Operations, Inc.

7003 Bald Hill Road Port Gibson, MS39150 Tel 601-437--6409 Michael Perito Vice President, Operations Grand Gulf Nudear Station GNRO-2012/00126 October 24, 2012 U.S. Nuclear Regulatory Commission ATIN: Document Control Desk Washington, DC 20555-0001

SUBJECT:

90-Day Response to Bulletin 2012-01, Design Vulnerability in Electric Power System Grand Gulf Nuclear Station - Unit No. 1 Docket Nos. 50-416 License No. NPF-29

REFERENCE:

1. NRC letter to Entergy, Bulletin 2012-01 Design Vulnerability in Electric Power System, dated July 27,2012 (GNRI2012/00163)

Dear Sir or Madam:

On July 27,2012, the NRC issued Bulletin 2012-01 (Reference 1), requesting that each licensee submit a written response in accordance with 10 CFR 50.54(f) within 90 days of the bulletin to provide requested information. This letter provides Entergy Operations',

Inc. 90-day response to Reference 1 for Grand Gulf Nuclear Staion (GGNS) Unit 1 in Attachment 1.

No new commitments are contained in this document. Should you have any questions concerning the content of this letter or require additional information, please contact Curtis Williams at 601-437-7333.

I declare under penalty of perjury that the foregoing is true and correct. Executed on October 24, 2012.

~MP/ras

GNR0201200126 Page 2 of 2

Attachment:

1. GGNS 90-Day Response to NRC Bulletin 2012-01 cc: Mr. Elmo Collins Regional Administrator U. S. Nuclear Regulatory Commission, Region IV 1600 East Lamar Boulevard Arlington, TX 76011-4511 U. S. Nuclear Regulatory Commission Attn: Director, Office of Nuclear Reactor Regulation One White Flint North 11555 Rockville Pike Rockville, MD 20852 NRC Senior Resident InsPector Grand Gulf Nuclear Station Port Gibson, MS 39150 U. S. Nuclear Regulatory Commission Attn: Mr. Kaly Kalyanam MS 0-8 B1 One White Flint North 11555 Rockville Pike Rockville, MD 20852

Attachment 1 GNRO-2012J00126 GGNS gO-Day Response to NRC Bulletin 2012-01 GNRO-2012/00126 Page 1 of 12 GGNS 90-Day Response to NRC Bulletin 2012-01 Bulletin Response Overview:

• System Description - Items 2., 1.d, 2.a, 2.c

• System Protection - 1., 1.a, 2.b, 2.d

• Consequences - 1.b, 1.c, 2.e

• Attachment 1, page 9 - Simplified One-Line Diagram (ESF System Only)

• Attachment 1, pages 10 Tables o Table 1 - ESF Buses Continuously Powered From Offsite Power Source(s) o Table 2 - ESF Buses Not Continuously Powered From Offsite Power Source(s) o Table 3 - ESF Buses Major Loads o Table 4 - Offsite Power Transformers o Table 5 - Protective Devices GNRO-2012/00126 Page 2 of 12

System Description

Items 2., 1.d, 2.a, and 2.c request system information and will be addressed in this section:

2. Briefly describe the operating configuration of the ESF buses (Class 1E for current operating plants or non-Class 1E for passive plants) at power (normal operating condition).

Grand Gulf has two independent, qualified 500 kV grid connections via sWitchyard Service Transformers (ST11 and ST21) of Delta to Grounded Wye configuration that normally supply redundant 4.16 kV power to ESF buses 15AA, 16AB, and 17AC. Additionally, a qualified 115 kV sub-station connection through a Wye to Grounded Wye ESF Transformer (ESF Transformer 12) is connected to ESF buses 15AA, 16AB, and 17AC for the provision of back-up power when power from the primary paths is unavailable.

See Attachment 1, page 9 for an unofficial simplified one-line diagram with Balance of Plant (BOP) connections removed.

1.d. Describe the offsite power transformer (e.g., start-up, reserve, station auxiliary) winding and grounding configurations.

See Attachment 1, Table 4 for offsite power transformer winding and grounding configurations.

2.a. Are the ESF buses powered by offsite power sources? H so, explain what major loads are connected to the buses including their ratings.

For at power (normal operating condition) configurations, ESF buses 15AA, 16AB, and 17AC are powered by transformers ESF11 and ESF21. These transformers receive their power from 34.5 kV buses 11 Rand 21 R, respectively, which also provide power to plant BOP loads. Bus 11 R receives its power from ST11 while bus 21 R receives its power from ST21.

See Attachment 1, Tables 1 and 2 for ESF bus power sources See Attachment 1, Table 3 for ESF bus major loads energized during normal power operations, including their ratings.

GNRO-2012/00126 Page 3 of 12 2.c. Confirm that the operating configuration of the ESF buses is consistent with the current licensing basis. Describe any changes in offslte power source alignment to the ESF buses from the original plant licensing.

Section 8.1.4.1, "Safety Design Bases - Offsite Power" of the GGNS UFSAR describes the current licensed design of offsite sources powering the plant:

a) Three offsite circuits from the Entergy Electric System provide the Alternating Current (AC) power requirements of the station.

b) Alternating current power from the 500-kV switchyard to the onsite electrical distribution is supplied by two physically independent circuits.

c) Each 500-34.5 kV service transformer has a rating capable of feeding the necessary power required for both BOP and safety loads of the unit.

d) The 500 kV switchyard is provided with two independent 125-volt Direct Current (DC) systems and three auxiliary AC power supplies, one from Division 2 ESF 4.16 kV bus of Unit 1, one from 13.8 kV-480 V station service transformer, and one from ESF transformer 12.

e) Each 34.5-4.16 kV engineered safety feature transformer has a rating capable of supplying ac power to start and run ESF loads required due to a Loss of Cooling Accident (LOCA). The power comes from the 500-34.5 kV service transformers.

f) The 115-4.16 kV engineered safety features transformer has a single, independent offsite circuit. This transformer is capable of supplying AC power to start and run the ESF loads required as the result of a LOCA. Offsite grid analysis performed in 2000-2001 determined that the 115 kV offsite circuit was not capable of.supplying sufficient power to start and run the ESF loads required as the result of a LOCA. Transmission system upgrades, additional capacitor banks at the Port Gibson, South Vicksburg, and Fayette 115 kV substations, were performed and the capability of the 115 kV circuit has been restored.

g) Loss of Grand Gulf Nuclear Plant generating capability or its most critical offsite circuit will not cause system instability.

Section 8.2.1.2 of the UFSAR, "Switchyard" describes the design redundancies of the GGNS switchyard:

"The two 500 kV and one 115 kV lines described in subsection 8.2.1.1 provide three physically independent sources of preferred power to the three independent and redundant ESF load groups within the station."

"The breaker switching configuration provides for the isolation of any faulted line without affecting the operation of any other line. This scheme also provides for the isolation of anyone breaker in the 500 kV bus for inspection or maintenance without affecting the operation of any of the connecting lines or any other connection to the buses. The buses have adequate capacity to carry its load under any postulated switching sequences. The design provides for the isolation of any breaker, connecting the unit to the substation buses, without limiting the operation of the unit or any line connecting to the 500 kV power grid. Also either 500/34.5 kV service transformer breaker can be isolated and inspected GNRO-2012/00126 Page 4 of 12 or maintained as needed without affecting any line or unit input. Either of the 500/34.5 kV service transformers can be taken out of service for inspection or maintenance without jeopardizing the operation for the other service transformer."

"A fault of any section of 500kV bus will be cleared by the adjacent breakers and will not interrupt operation of any of the remaining part of the 500 kV switchyard bus. "

"The preferred power sources are not Class 1E and are not manufactured and purchased under a quality assurance program as described in Chapter 17. However, aU material is the highest grade of commercial equipment manufactured to the industrial standard listed in Grand Gulf Nuclear Station (GGNS) Ultimate Final Safety Analysis Report (UFSAR) subsection 8.2.1.4. The design has been made in the same fashion as Class 1 systems and subjected to essentially the same reviews, checks, and calculation methods. This design is considered to meet the requirements of General Design Criterion 1 as evoked for the offsite (preferred) power system."

"In satisfaction of General Design Criterion 3, the three offsite power systems have special separation and/or totally enclosed raceways over their entire length."

"Thus all features of the offsite (preferred) power supply are designed to provide maximum practical reliability and total redundancy in servicing the station safety load groups. Compliance with General Design Criterion 17, 'Electric Power System,' is demonstrated by supplying the sWitchyard with offsite ac power by means of two 500 kV and one 115 kV physically independent circuits. Furthermore, the offsite power sources to the engineered safety features (ESF) buses are then brought in by three physically independent circuits from this switchyard and the 115 kV transformer through ESF transformers. Physical separation, the breaker switching configuration, redundant switchyard protection systems, and transmission system are designed on load flow and stability studies so as to minimize simultaneous failure of aU offsite power sources."

Although Grand Gulf has multiple ways of powering its ESF buses through its redundant line-ups, the following at power (normal operating condition) offsite power sources have been confirmed to be consistent with the current licensing basis:

Unit 1 Circuit #1 - Power to ESF buses via 500 kV Switchyard (transformers ST11 and ESF11 from Baxter)

Unit 1 Circuit #2 - Power to ESF buses via 500 kV Switchyard (transformers ST21 and ESF21 from Franklin)

Unit 1 Circuit #3 - Power to ESF buses via 115 kV connection (transformer ESF12 from Port Gibson)

GNRO-2012/00126 Page 5 of 12 System Protection Items 1., 1.a, 2.b, and 2.d request information regarding electrical system protection and will be addressed in this section:

1. Given the requirements above, describe how the protection scheme for ESF buses (Class 1E for current operating plants or non-Class 1E for passive plants) is designed to detect and automatically respond to a single-phase open circuit condition or high impedance ground fault condition on a credited off-site power circuit or another power sources. Also, include the following information:

Consistent with the current licensing basis and GDC 17, existing protective circuitry will separate the ESF buses from a connected failed offsite source due to a loss of voltage or a sustained, balanced degraded grid voltage concurrent with certain design basis accidents. The relay systems were not specifically designed to detect an open single phase of a three phase system.

Detection of a single-open phase condition is beyond the approved design and licensing basis of the plant. No specific analysis for single phase impedance grounds along the ESF bus connections has been completed. However, taking a topical look into the design of the ESF system will give a basic idea of how the protective devices would react in the situation of a single phase high impedance ground.

Grand Gulfs Division I and Division II ESF uses a Load Shedding and Sequencing (LSS) system that employs one-out-of-two taken twice logic so that either a loss of voltage or degradation of voltage on any of the three phases on the secondary side of Service Transformers (ST) ST11, ST21 , and Engineered Safety Feature (ESF) Transformer ESF21 will actuate the LSS system (reference criterion 6.2.4 of SDC-9). Additionally, the Division I and Division II protection system has a backup under-voltage protection scheme using one-out-of-two logic resulting in an Incoming Feeder Trip during an under-voltage. Division III is protected by solid state under-voltage relays using one-out-of-two taken twice logic to detect under-voltage conditions that protect the system by initiating an Incoming Feeder Trip.

Based on a review of the logic employed by Grand Gulfs under-voltage detection and protection scheme, applicable drawings, and System Design Criteria, the Division I, Division II, and Division III under-voltage protection schemes would initiate the appropriate de-energization of the respective bus and realignment to the appropriate Emergency Diesel Generator. The GGNS under-voltage protection schemes would prevent the Division I, Division II and Division III ESF buses from enduring a prolonged under-voltage event.

The GGNS design basis and licensing basis (consistent with RIS 2011-12 and Branch Technical Position BTP PSB-1) is to monitor offsite power as supplied to the ESF buses. BTP PSB-1 states that the under-voltage scheme should be provided to detect the loss of offsite power at the ESF buses, and related to the voltage sensors states that Class 1E equipment shall be utilized and shall be physically located at and electrically connected to the Class 1E switchgear. It is clear the original design basis and licensing basis was to monitor voltage at the ESF buses, not at some other location such as a switchyard.

GGNS employs two Wye to Delta transformers (ST11 and ST21) to step down the incoming 500 kV offsite power sources for system bus power and one Wye to Wye with a Delta tertiary transformer (ESF12) to step down the 115 kV offsite power. Inherent to the design of the Wye-Delta transformer is that a loss of phase on the primary side of a Wye to Delta transformer may not result in a loss of phase on the secondary side. This feature protects downstream three phase equipment from damage and, if properly sized, a Wye to Delta transformer can continue to properly supply power to its loads when a phase is lost (open phase) on the primary side with no significant adverse affects.

GNRO-2012/00126 Page 6 of 12 The GGNS service transformers are rated as high as 168 MVA (maximum rating including forced air and forced cooling), whereas DC-199 (Offsite Power Supply Design Requirements) indicates that GGNS requires approximately 78 MVA be supplied from the 500 kV grid.

Because of the subject design feature of the Wye to Delta transformer, Grand Gulf is susceptible to the likely possibility that an open phase fault on the primary side of ST11 and/or ST21 would not be detected by the under-voltage protection schemes at the Division I, Division II, or Division III ESF buses if aligned to the transformer(s) of interest.

In the case of ESF12, it is not currently known if the delta tertiary would influence regeneration of a phase on the secondary side when a primary phase is open. It is expected that because of the Wye-Wye configuration, the open phase on the primary would result in loss of the phase on the secondary which would be detected by the under-voltage protection scheme.

1.a. The sensitivity ofprotective devices to detect abnormal operating conditions and the basis for the protective device setpoint(s).

Consistent with the current licensing basis and GDC 17, existing electrical protective devices are sufficiently sensitive to detect design basis conditions like a loss of voltage or a degraded voltage, but were not designed to detect a single phase open circuit condition. See Attachment 1, Table 5 for undervoltage protective devices and the basis for the device setpoints.

Existing electrical protective devices are also sufficiently sensitive to detect a ground fault.

Attachment 1, Table 5 lists ground protection on the ESF buses and the basis for the device setpoints.

2.b. "the ESF buses are not powered by offsite power sources, explain how the surveillance tests are performed to verify that a single-phase open circuit condition or high impedance ground fault condition on an off-site power circuit is detected.

Grand Gulfs ESF buses are normally powered by offsite power sources.

2.d. Do the plant operating procedures, including off-normal operating procedures, specifically call for verification of the voltages on all three phases of the ESF buses?

The current plant operating procedures verify ESF bus voltage when the bus is being energized in normal conditions and MCC 15842 voltage in Abnormal Operations by the R21 System Operating Instructions (04-1-01-R21-15, 04-1-01-R21-16, 04-1-01-R21-17.)

GNRO-2012/00126 Page 7 of 12 Consequences Items 1.b, 1.c, and 2.e request information regarding the electrical consequences of an event and will be addressed in this section:

1.b. The differences (if any) of the consequences of a loaded (i.e., ESF bus normally aligned to offsite power transformer) or unloaded (e.g., ESF buses normally aligned to unit auxiliary transformer) power source.

Installed relays were not designed to detect single phase open circuit conditions. Existing loss of voltage and degraded voltage relays may respond depending on load and possible grounds. In general, there will be no plant response for an unloaded power source in the event of a single-phase open circuit on a credited off-site power circuit because there is insufficient current to detect a single-phase open circuit for this configuration.

The plant response for a loaded power source cannot be calculated without specifying the amount of loading and the specific loads invotved.

1.c. If the design does not detect and automatically respond to a single-phase open circuit condition or high impedance ground fault condition on a credited offsite power circuit or another power sources, describe the consequences of such an event and the plant response.

1. GGNS did not credit in the Current Licensing Basis that the Class 1E protection scheme for the ESF buses was designed to detect and automatically respond to a single-phase open circuit condition'on the credited off-site power source as described in the UFSAR and Technical Specifications.

2. Since GGNS did not credit the ESF bus protection scheme as being capable of detecting and automatically responding to a single phase open circuit condition, an open phase fault was not included in the design criteria for either the loss of voltage, the degraded voltage relay scheme or secondary level undervoltage protection system design criteria. Since open phase detection was not credited in the GGNS design or licensing basis, no design basis calculations or design documents exist that previously considered this condition.

3. Without formalized engineering calculations or engineering evaluations, the electrical consequences of such an open phase event (including plant response), can only be evaluated to the extent of what has already been published by Electric Power Research Institute (EPRI) and Basler; which is a generic overview. The difficulty in applying these documents to the GGNS specific response is that these are generic assessments and cannot be formally credited as a basis for an accurate response. The primary reason is that detailed plant specific models would need to be developed (e.g., transformer magnetic circuit models, electric distribution models, motor models; including positive, negative, and zero sequence impedances (voltage and currents), and the models would need to be compiled and analyzed for the GGNS specific Class 1E electric distribution system).

Section 8.2.1.2 of GG UFSAR discusses alarm information related to the control room Operators when trouble is detected in the switchyard:

GNRO-2012/00126 Page 8 of 12 "The switchyard general alarm, signaled by the Balance-of-Plant (BOP) Process Computer, alerts the control room operator of abnormal or alarm conditions in switchyard components. The conditions which result in a switchyard general alarm are listed in Table 8.2-2. The switchyard annunciator panel provides the alarm signal to the process computer. The computer signals the alarm only. It does not identify the switchyard source. Upon receipt of the general alarm, the control room operator dispatches personnel to the switchyard control house to identify the source alarm point at the switchyard annunciator panel. Further operator action is dictated by the appropriate alarm response instruction or the Entergy Mississippi, Inc. dispatcher. Further detailed information regarding the alarm condition is obtained locally at the alarming switchyard component."

Continuing, a review of GGNS UFSAR Section 8.2.1.3 gives insight on a loss of phase input to 500 kV Station Service Transformers 11 and 21 :

The Entergy Mississippi, Inc. system dispatcher has control of all 500 kV switchyard components except for the synchronizing breakers, which are under control of the plant operator. Information transmitted back to the system dispatcher includes watt and var loadings of all lines, transformers, and generators, as well as status of all controlled devices. Various switchyard alarms are also transmitted to the system dispatcher to enable him to take necessary steps to have problems corrected before they become serious. In addition to the SCADA system that reports to the Entergy Mississippi, Inc. system dispatcher, a separate remote supervisory is in operation. This unit will report to the Entergy System Operating Center in Pine Bluff, Arkansas for input to the Entergy generation control, Fossil Energy Management Organization in Houston, Texas, and South Mississippi Electric Power Association control center."

In the event of an open phase occurring on the 500 kV primary of ST11 and/or ST21 , the service transformers would very likely continue to supply power with no significant adverse effects. If the voltage were to degrade at the ESF buses below the respective under-voltage protection set points (even for one phase), the protection scheme would intercede and separate the bus from the offsite power source.

In the event of an open phase occurring on the 115 kV primary side of ESF12, it is expected that the loss of a phase would be sensed by under-voltage protection scheme (even for one phase);

the protection scheme would intercede and separate the bus from the offsite power source.

More evaluation is necessary to determine the potential impact of an open of phase on the primary side of the Wye Delta transformers (ST11 and ST12) and the potential impact of an open phase on the primary side of the Wye-Wye-Delta Tertiary transformer (ESF12). This will allow recommendations for further hardening methods to the specific case of loss of an offsite incoming phase.

2.e. If a common or single offsite circuit is used to supply redundant ESF buses, explain why a failure, such as a single-phase open circuit or high impedance ground fault condition, would not adversely affect redundant ESF buses.

Not applicable - GGNS does not use a common or single offsite circuit to supply redundant ESF buses. The design of the onsite and offsite electrical power systems provides compatible independence and redundancy to ensure an available source of power to the ESF loads.

Electrical power from the transmission network to the 500 kV switchyard and 115/4.16 kV ESF transformer is provided by physically independent transmission lines. This provides three offsite sources of power to the ESF buses, one more than required by Criterion 17. Three physically independent circuits, one more than required, are provided from the switchyard to the onsite ESF distribution system.

GNRO-2012/00126 Page 9 of 12 Simplified One-Line Diagram (ESF Connections Only)

GNRO-2012/00126 Page 10 of 12 Table 1 - ESF Buses Continuously Powered From Oftsite Power Source(s)

Description of ESF Bus Power ESF Bus Name (normal operating Original licensing Source condition). basis configuration (YIN)

Transformer ESF11 or ESF21 15M Y Transformer ESF11 or ESF21 16AB y Transformer ESF11 or ESF21 17AC Y Table 2 - ESF Buses Not Continuously Powered From Offsite Power Source(s)

Description of ESF Bus Power ESF Bus Name (normal operating Original licensing Source condition). basis configuration (YIN) .

Note: Table 2 is not applicable to N/A N/A Grand Gulf GNRO-2012/00126 Page 11 of 12 Table 3 - ESF Buses Normally Energized Major Loads ESF Bus Load Voltage Level Rating fHP/kW) 15M BOP Battery Charger 4160V 220 15M CRD Pump 4160V 325 15M Control Room AlC 4160V 153 15M Safeguard Switchgear 4160V 250 and Battery 15M Power panel transformer 4160V 210 16AB BOP Battery Charger 4160V 220 16AB CRD Pump 4160V 325 16AB Plant Air compressor A 4160V 230 16AB Safeguard Switchgear 4160V 250 and Battery 16AB Power panel 4160V 210 transformers 16AB Drywell chillers 4160V 660 transformers 17AC Diesel Cooling Water 4160V 100 Pump 17AC Diesel Auxiliaries 4160V 30 Table 4 - Offsite Power Transformers Transformer Winding MVASize Voltage Rating Grounding Configuration (OA/FA/FOA) fPrimary/Secondary) Configuration Service Wye to Delta 101/135/168MVA @ 500kV/34.4kV Grounded Transformer ST11 65°C Secondary Service Wye to Delta 10111351168MVA @ 500kV/34.4kV Grounded Transformer ST21 65°C Secondary ESF Transformer Wye Wye Delta 28 MVAlOAl65°C 115kV/4.16kV Center 12 Grounded Primary GNRO-2012/00126 Page 12 of 12 Table 5 .. Protective Devices Protection Protective UV Setpoint Basis for Setpoint Zone Device Logic (Nominal) 4.16 kV Undervoltage 1 out 2900V Primary level bus undervoltage shall be monitored via ESF Relay of2 (70 0k of a one-out-of two-taken-twice coincidence logic set at (Primary) taken 4160V) 70% nominal 4.16 kV bus voltage, with a time delay twice of 0.5 seconds to preclude spurious actuations due to transients.

4.16 kV Degraded Bus 1 out 3700V Consistent with the guidance of Branch Technical ESF Relay of2 (90 0k of Position PSB-1, the secondary level of degraded bus (Secondary) taken 4160V) undervottage sensor inputs shalf be provided to the twice LSS System. This level of undervoltage protection shall:

a) Protect equipment/motors from any adverse effects of sustained degraded voltages, b) Prevent spurious separation of offsite power sources, from Class 1E loads due to normal power transients, as a result of starting large motors, or from short duration power system disturbances.