ML043440083
| ML043440083 | |
| Person / Time | |
|---|---|
| Site: | Indian Point  |
| Issue date: | 07/08/2005 |
| From: | Holden C NRC/NRR/DLPM |
| To: | Brian Holian NRC/NRR/DIPM |
| Milano P, NRR/DLPM , 415-1457 | |
| References | |
| TAC MC3372, TIA 2004-03 | |
| Download: ML043440083 (8) | |
Text
July 8, 2005 MEMORANDUM TO: Brian E. Holian, Director Division of Reactor Projects Region I FROM:
Cornelius F. Holden, Acting Deputy Director
/RA/
Division of Licensing Project Management Office of Nuclear Reactor Regulation
SUBJECT:
RESPONSE TO TASK INTERFACE AGREEMENT REGARDING USE OF PROTECTIVE DEVICES IN LIEU OF CABLE SEPARATION (TIA NO. 2004-03 AND TAC NO. MC3372)
In a memorandum to E. Leeds dated June 17, 2004, Region I requested assistance from the Office of Nuclear Reactor Regulation (NRR) in addressing an unresolved item (URI) identified during an inspection at Indian Point Nuclear Generating Unit No. 2 (IP2). The URI, in part, addressed a concern about the acceptability of using dual fuses to provide electrical independence in lieu of physical separation for cables. On the basis of this concern, Region I requested that NRR provide its determination on the following issues: (1) does reliance on two protective devices in a non-safety circuit (installed to ensure that an overload or fault will not cause the circuit cables to exceed their thermal limits) provide independence between redundant safety systems? and (2) pursuant to Title 10 of the Code of Federal Regulations (10 CFR) Section 50.59, should the licensee have obtained a license amendment prior to implementing the change (i.e., relying on protective devices as a substitution for physical separation)?
The staff has reviewed the information provided in your request. As stated in the attached safety evaluation, the staff concluded that reliance on two safety-related protective devices in a non-safety circuit will not provide independence between redundant safety systems for IP2 unless an appropriate basis for that claim is established. The staff has concluded that the revision to the plant's design basis to allow the use of dual protective devices as a substitution for physical separation can be accomplished using the 10 CFR 50.59 process, without a license amendment, as long as the engineering analysis addresses all the appropriate issues. This is needed in order to judge the applicability of criteria in 10 CFR 50.59 which evaluate, among others, the likelihood of occurrence of a malfunction of equipment important to safety. For example, if the non-safety cables with dual protective devices are ever energized from ungrounded supplies such as the emergency diesel generators, the analysis should address issues such as adequate cable insulation level, quick detection and isolation of ground faults, etc., in order to address the concern for excessive transient voltages if an arcing fault should occur on the loads supplied by those cables. For other types of electrical faults, the analysis should show that the protective devices will actuate to deenergize the cables before the cable limitations, such as thermal limits, are exceeded.
This completes the action for TAC No. MC3372.
Attachment:
As stated Technical
Contact:
A. Pal, NRR/EEIB (301) 415-2760 occur on the loads supplied by those cables. For other types of electrical faults, the analysis should show that the protective devices will actuate to deenergize the cables before the cable limitations, such as thermal limits, are exceeded.
This completes the action for TAC No. MC3372.
Attachment:
As stated Technical
Contact:
A. Pal, NRR/EEIB (301) 415-2760 DISTRIBUTION: See attached list Adams Accession No: ML043440083 OFFICE PM:PDI-1 LA:PDI-1 SC:EEIB SC:PDI-1 D:PDI-1(A)
DD:DLPM(A)
NAME JBoska SLittle RJenkins RLaufer JUhle CHolden DATE 7/6/05 6/17/05 6/22/05 6/20/05 6/23/05 7/8/05 OFFICIAL RECORD COPY
DISTRIBUTION FOR MEMORANDUM REGARDING THE RESPONSE TO TASK INTERFACE AGREEMENT (TIA NO. 2004-03 AND TAC NO MC3372)
Hard Copy:
NON-PUBLIC PD1-1 R/F E-Mail:
T. Marsh R. Barrett J. Calvo C. Holden J. Uhle R. Laufer R. Jenkins J. Boska A. Pal R. Clark S. Monarque B. McDermott, R-I V. McCree, R-II S. Reynolds, R-III A. Howell, R-IV
Attachment SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION REGARDING TASK INTERFACE AGREEMENT (TIA 2004-03)
CONCERNING UNRESOLVED ITEM ON CABLE SEPARATION ENTERGY NUCLEAR OPERATIONS, INC.
INDIAN POINT NUCLEAR GENERATING UNIT NO. 2 DOCKET NO. 50-247
1.0 INTRODUCTION
In a memorandum dated June 17, 2004, the Division of Reactor Projects, Region I, requested assistance from the Office of Nuclear Reactor Regulation (NRR) by Task Interface Agreement (TIA) No. 2004-03 in addressing an unresolved item (URI) identified during an inspection in March 2004 at the Indian Point Nuclear Generating Unit No. 2 (IP2). The URI, in part, addressed a concern about the acceptability of using dual fuses to provide electrical independence in lieu of physical separation for cables. On the basis of this concern, NRR was requested to evaluate: (1) whether the licensees reliance on two protective devices in a non-safety circuit provides independence between redundant safety systems, and (2) should the licensee have obtained a license amendment prior to implementing the change.
2.0 BACKGROUND
In 1995, Consolidated Edison Company of New York (Con Edison, the former licensee for IP2) completed a program to establish existing cable routing and separation for most cable locations at IP2. From this program, IP2 identified cable separation anomalies. These anomalies were corrected by analysis, cable rerouting, installing thermal blankets, and installing a second protective device. In its Safety Evaluation (SE) No. 92-131-GM, Revision 2, the licensee in part states that the additional circuit protection will improve the separation between non-safety related circuits and safety-related circuits. The function of the additional protective device is to provide protection for cables from a fault in a circuit. In the event of a failure of an existing circuit protective device, which is considered a single failure, the additional fuse will clear the fault and preclude damage to the affected cable and any other cables that cross or are routed with this cable. Based on this SE, IP2 revised the updated final safety analysis report (UFSAR)
Section 7.2.4.1.4 to state:... A few non-safety related power cables run with or crossover redundant safety circuits. Fuses and/or current limiters (which are similar to fuses) have been installed in these circuits to ensure that an overload or fault will not cause them to exceed thermal limits and affect redundant channels.
The IP2 design requires independence between redundant safety systems. Non-safety cables are allowed to be routed in the same raceways with safety system cables. To maintain 1 See Note 5 to UFSAR Figure 8.2-18 independence, non-safety cables (when routed in the same raceway with safety system cables of a selected channel or train) are required to remain with, and be treated like, the safety system cables. Non-safety cables are not allowed to be routed with redundant safety system cables. Independence at IP2 is obtained by spacial separation between redundant safety system cables, by treating non-safety cables like safety system cables when routed together, and by spacial separation between non-safety cables and redundant safety cables. To resolve identified anomalies and to accommodate modifications where required spacial separation between non-safety and redundant safety cables cannot be obtained, IP2 incorporated an additional method for achieving independence into their design bases. The design now allows two protective devices to be installed in the non-safety circuit to ensure that an overload or fault, coincident with a failure of one of the protective devices to operate, will not cause the non-safety cable to exceed thermal limits and affect redundant safety system cables.
3.0 EVALUATION In TIA No. 2004-03, the Region I staff requested NRR to provide a determination of the following issues:
1.
Does reliance on two protective devices in a non-safety circuit (installed to ensure that an overload or fault will not cause the circuit cables to exceed their thermal limits) provide independence between redundant safety systems?
IP2 was originally built to meet draft Atomic Energy Commission (AEC) criteria published on July 11, 1967, and to the proposed Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Standard 279 dated August 28, 1968. The requirement was to provide separation and independence for those multiple channels providing redundancy for plant protection functions in order to meet single failure criteria. The original plant design criteria1 required non Class 1E circuits (power, control and instrumentation) to be routed in trays and conduits convenient to the termination points. This was accomplished by routing cables in any safety-related channel and, as such, by treating each cable as an associated circuit. Because of the design allowance, no tray hopping was permitted. Once a non Class 1E circuit was assigned to a specific routing channel, it should have remained in that channel throughout the whole cable run. From 1989 to 1995, Con Edison generated several types of reports as part of its Cable Separation Program.
In these reports, various justifications were given to meet safety functions and single failure criteria. One of the justifications was to provide two safety-related protective devices in a non-safety circuit to meet single failure criteria. During the licensing of IP2, the separation requirements for non-safety circuits from safety circuits were not well-defined. The main criterion for cable separation was to meet single failure criteria of a component or device without impacting safety.
A non-safety circuit that is routed with redundant safety cables could degrade both safety systems if a fault or an overload in the non-safety circuit persisted. Although not included in the IP2 design basis, Regulatory Guide (RG) 1.75, Physical Independence of Electric Systems, does not allow routing of non-safety circuits with redundant safety cables. However, the NRR staff believes that it is acceptable to use two safety-related protective devices, properly coordinated with upstream devices, in the non-safety circuit when used in a grounded (solidly or 2See Industrial Power Systems Handbook by Beeman Page 286, and Applied Protective Relaying by Westinghouse Electric Corporation, Page 11-2.
3See IEEE Standard 242 - 1986, Page 272.
low impedance) electrical system. The protective devices ensure that an overload or fault will not cause the circuit cables to exceed their thermal limit and provide independence between redundant safety systems when a non-safety cable is routed with redundant safety cables. The basis for the acceptance of the routing of non-safety circuits with redundant safety cables is that an overload or fault, coincident with a failure of one of the protective devices to operate, will not cause the non-safety cable to exceed thermal limits and affect redundant safety system cables.
Therefore, the NRR staff finds that reliance on two protective devices in a non-safety circuit provides independence between redundant safety systems for IP2 during grounded operation.
During the March 2004 inspection, the NRR staff also noted that the 480 volt electrical system at IP2 is grounded when the normal power supply source is the station service transformers.
When the emergency diesel generators (EDGs) are providing power during an emergency situation, the 480 volt system is ungrounded by design because IP2 EDGs do not have a neutral ground connection. In an ungrounded electrical system, intermittent (arcing) ground faults could lead to substantial overvoltages. The voltage to ground can reach several times the normal line-to-ground voltage2 and may cause multiple insulation failures in a short period of time. Arcing ground faults that are not promptly detected and cleared can be extremely destructive3. Further, the ground fault current in the ungrounded system will not be detected by the overcurrent protective devices. Therefore, cable insulation may be subjected to overvoltages during intermittent ground faults.
Based on the above, the NRR staff concludes that sole reliance on two safety-related protective devices in a non-safety circuit (installed to ensure that an overload or fault will not cause the circuit cables to exceed their thermal limits) is not acceptable to provide independence between redundant safety systems for IP2 during ungrounded operation. However, additional protective measures (such as adequate cable insulation level, quick detection and isolation of ground faults, etc.) can be included in the licensees evaluation and utilized to address this concern in order to maintain independence between redundant safety systems.
1.
Pursuant to 10 CFR 50.59, should the licensee have obtained a license amendment prior to implementing the change (i.e., relying on protective devices as a substitution for physical separation)?
Pursuant to 10 CFR 50.59, a license amendment is not required if: (i) a change to the technical specifications incorporated in the license is not required, and (ii) the change, test, or experiment does not meet any of the criteria in paragraph (c)(2) of 10 CFR 50.59. In Paragraph (c)(2),
eight scenarios are provided for which a license amendment is required prior to implementing a proposed change. The NRR staff has reviewed these scenarios and determined that (c)(2)(ii) and (c)(2)(viii) are potentially applicable. 10 CFR 50.59(c)(2)(ii) specifies that an amendment is required if the change results in more than a minimal increase in the likelihood of occurrence of a malfunction of a structure, system, or component (SSC) important to safety previously evaluated in the FSAR (as updated). Based on the available information, the NRR staff concluded that the modifications made by Con Edison have not increased the likelihood of occurrence of a malfunction of an SSC important to safety. Additionally, 10 CFR 50.59(c)(2)(viii) specifies that an amendment is required if the change results in a departure from a method of evaluation described in the UFSAR used in establishing the design bases or in the safety analyses. Based on the available information, the staff concluded that the change made by Con Edison did not result in a departure from a method of evaluation described in the UFSAR used in establishing the design bases or in the safety analyses. Therefore, the licensee was not required to obtain a license amendment prior to implementing the change.
4.0 CONCLUSION
The NRR staff concludes that, based on the conditions as discussed above, reliance on two safety-related protective devices in a non-safety circuit (installed to ensure that an overload or fault will not cause the circuit cables to exceed their thermal limits) cannot alone provide independence between redundant safety systems for IP2. However, additional protective measures (adequate cable insulation level, quick detection and isolation of ground faults, etc.)
can be utilized to maintain independence between redundant safety systems. Additionally, the IP2 licensee was not required to obtain a license amendment prior to implementing the change (i.e., relying on protective devices as a substitution for physical separation).
Principal Contributor: A. Pal Date: July 8, 2005