ML073440280

Final Response to Palisades Nuclear Plant- Task Interface Agreement (TIA) 2007-002 Design and Licensing Basis Status of Fast Transfer Scheme

ML073440280
Person / Time
Site:	Palisades
Issue date:	12/12/2007
From:	Michael Case NRC/NRR/ADRA/DPR
To:	Khadijah West Division of Reactor Safety III
Cruz, H. D.
References
TAC MD5855, TIA 2007-002
Download: ML073440280 (11)

Text

December 12, 2007 MEMORANDUM TO: K. Steven West, Director Division of Reactor Safety Region III FROM:

Michael J. Case, Director /RA/

Division of Policy and Rulemaking Office of Nuclear Reactor Regulation

SUBJECT:

FINAL RESPONSE TO PALISADES NUCLEAR PLANT-TASK INTERFACE AGREEMENT (TIA) 2007-002 RE: DESIGN AND LICENSING BASIS STATUS OF FAST TRANSFER SCHEME (TAC NO. MD5855)

On June 18, 2007, the Region III Division of Reactor Safety requested assistance from the Office of Nuclear Reactor Regulation (NRR) in answering the following questions regarding the fast transfer scheme at the Palisades Nuclear Plant:

1.

Is the scenario of a design basis accident with a subsequent single failure of the safeguards transformer within either the licensing or design basis for the Palisades plant?

2.

How should the NRC evaluate the consequences on the plant, specifically the impact of high motor shaft torques on the ECCS equipment, should an out-of-phase transfer occur?

3.

Is the risk significance high enough to justify requiring the design or licensing basis to include the fast transfer?

The NRR staffs assessment is documented in the enclosed staff evaluation.

Docket No: 50-255

Enclosure:

As stated CONTACT:

Holly D. Cruz, NRR/DPR (301) 415-1053

December 12, 2007 MEMORANDUM TO: K. Steven West, Director Division of Reactor Safety Region III FROM:

Michael J. Case, Director /RA/

Division of Policy and Rulemaking Office of Nuclear Reactor Regulation

SUBJECT:

FINAL RESPONSE TO PALISADES NUCLEAR PLANT-TASK INTERFACE AGREEMENT (TIA) 2007-002 RE: DESIGN AND LICENSING BASIS STATUS OF FAST TRANSFER SCHEME (TAC NO. MD5855)

On June 18, 2007, the Region III Division of Reactor Safety requested assistance from the Office of Nuclear Reactor Regulation (NRR) in answering the following questions regarding the fast transfer scheme at the Palisades Nuclear Plant:

1.

Is the scenario of a design basis accident with a subsequent single failure of the safeguards transformer within either the licensing or design basis for the Palisades plant?

2.

How should the NRC evaluate the consequences on the plant, specifically the impact of high motor shaft torques on the ECCS equipment, should an out-of-phase transfer occur?

3.

Is the risk significance high enough to justify requiring the design or licensing basis to include the fast transfer?

The NRR staffs assessment is documented in the enclosed staff evaluation.

Docket No: 50-255

Enclosure:

As stated CONTACT:

Holly D. Cruz, NRR/DPR (301) 415-1053 DISTRIBUTION:

PUBLIC PSPB Reading File GeorgeWilson RidsNrrDpr RidsNrrDprPspb StaceyRosenberg RidsNrrLADBaxley RidsRgn1MailCenter CliffordDoutt RidsAcrsAcnwMailCenter RidsRgn2MailCenter VijayGoel RidsNrrPMSPeters RidsRgn3MailCenter MaheshChawla RidsOgcMailCenter RidsRgn4MailCenter RidsNrrDraApla RidsNrrAdro HollyCruz RidsNrrDeEeeb PHiland MCunningham DRoth ADAMS ACCESSION NO.: ML073440280

• No significant changes to the SE.

NRR-043 OFFICE PSPB/PM PSPB/PM*

PSPB/LA*

APLA/BC*

DE/D*

PSPB/BC OGC*

DPR/D NAME HCruz SPeters DBaxley MRubin PHiland SRosenberg DRoth (NLO)

MCase DATE 12/10/07 12/11/07 10/18/07 11/5/07 11/9/07 12/11/07 11/9/07 12/12/07 OFFICIAL RECORD COPY

STAFF EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION DESIGN AND LICENSING BASIS STATUS OF FAST TRANSFER SCHEME AT PALISADES NUCLEAR PLANT TASK INTERFACE AGREEMENT (TIA) 2007-002

1.0 INTRODUCTION

On June 18, 2007 (Agencywide Documents Access Management System (ADAMS) Accession No. ML070950159), the U.S. Nuclear Regulatory Commission (NRC), Region III, Division of Reactor Safety requested assistance from the Office of Nuclear Reactor Regulation (NRR) in providing answers to the following questions regarding the fast transfer scheme at Palisades Nuclear Plant (Palisades):

1.

Is the scenario of a design basis accident with a subsequent single failure of the safeguards transformer within either the licensing or design basis for the Palisades plant?

2.

How should the NRC evaluate the consequences on the plant, specifically the impact of high motor shaft torques on the ECCS [emergency core cooling system]

equipment, should an out-of-phase transfer occur?

3.

Is the risk significance high enough to justify requiring the design or licensing basis to include the fast transfer?

In response, the NRR staff does not consider the scenario of design-basis accident with a subsequent single failure of the safeguards transformer to be within the current licensing basis of the Palisades plant. However, the independent failure of the safeguards transformer is within the current licensing basis. The present fast transfer scheme at Palisades can result in a situation in which the operating essential motors can be subjected to excessive current transients and shaft torques which can damage the operating essential equipment in both trains due to common cause failure. Therefore, the potential safety impact of an inadequate fast transfer scheme from a deterministic standpoint would be based on the potential damage to the operating essential equipment. The NRR staffs evaluation is documented in Section 3.0 of this NRR staff evaluation.

2.0 BACKGROUND

The Region III inspection team completed the component design basis inspection (CDBI) at Palisades on December 15, 2006. The CDBI team determined that if the safety-related 2400 V buses were carrying full accident loads and if a fast transfer occurs from the normal offsite power source (the safeguards transformer) to the second qualified source (the startup transformer), the safety-related buses could experience greater than 1.33 per unit volts/hertz (p.u. V/Hz) ratio which can cause damage to motors, motor couplings, and/or shafts. However, the licensee stated that this issue had been previously evaluated and determined to be outside

the plant=s design and licensing basis. The CDBI team questioned this conclusion and left the issue as an unresolved item (URI 05000255/2006009-11).

ENCLOSURE The inspection team determined that Palisades was originally designed to supply power to the safety-related buses via the station power transformer. The design included a fast transfer to the startup transformer upon a plant trip. This fast transfer, described in the final safety analysis report (FSAR), Section 8.6.2, is designed to occur within 10 cycles with a bus dead time of approximately one-and-one half cycles when the safety buses are fed via the station power transformer. In 1987, the plant suffered a loss-of-offsite power, due to loss of the startup transformer. This, along with issuance of the Station Blackout Rule (10 CFR 50.63), prompted the licensee to add a new transformer (the safeguards transformer). The design for this transformer included a fast transfer scheme; however, the number of cycles and maximum dead bus time specified in the FSAR for the station power transformer were not applied. No calculations were done as part of the modification to evaluate the fast transfer scheme from the new safeguards transformer. No post-modification testing was done following installation of the safeguards transformer to verify that the fast transfer would operate as expected. Following implementation of the modification, the licensee normally operated the plant with the safety-related buses being powered from the safeguards bus.

In 1993, the licensee experienced a loss of the safeguards transformer with a subsequent fast transfer to the startup transformer. During the evaluation of that fast transfer, the licensee identified that, if the safety-related 2400 V buses had been carrying their accident loads, then damage to the safety-related components might occur, based on a 1.33 p.u. V/Hz ratio being exceeded. Additionally, the licensee determined that one of the safety-related 2400 V buses could have tripped on overcurrent, while the other could have tripped on sustained undervoltage.

The licensee concluded the scenario was acceptable, as the diesels would start, and reclose the breakers to the safety-related buses. Modifications to the plant were planned but later determined unnecessary (see Regulatory Interactions section discussed below). In 1994 and 1996, the plant again experienced fast transfers from the safeguards to the startup transformer.

Regulatory Interactions As part of the modification to install the safeguards transformer, the licensee performed an evaluation under 10 CFR 50.59. The focus of the evaluation was on the benefits of installing a new transformer to improve the offsite power capability and the plants design basis which incorporated GDC-17. The effects on the fast transfer scheme were not evaluated by the licensee.

Following the 1993 event (loss of safeguards transformer) and subsequent discovery that the fast transfer scheme might result in loss of both safety-related 2400 V buses, the licensee submitted a letter dated January 7, 1994, to the NRC which documented the actual dead bus time as being 7.5 cycles and described the expected consequences, including unacceptable motor shaft torques of 1.71 p.u. V/Hz on safety-related Bus 1C and 1.64 p.u. V/Hz on safety-related Bus 1D, tripping of individual motors on overcurrent or undervoltage and subsequent tripping of Bus 1C on overcurrent and Bus 1D on undervoltage. However, the licensee concluded that operability would not be affected, because the second level undervoltage protection schemes would initiate load shedding and sequencing of loads onto the emergency diesel generators, including those loads which tripped off previously. The licensee's analysis did not address the consequences of the unacceptable motor shaft torque values. In

correspondence dated January 7, 1994, Consumers Power Company made the following statement:

AA modification is being considered to reduce the dead bus time during a fast transfer.

The modification, if implemented, is targeted for completion in the 1996 refueling outage.@

In its letter dated February 28, 1996, however, the licensee provided five reasons for determining that the modification was not warranted: 1. no critical safety concern was identified and that all safety-related systems would operate as designed; 2. that fast transfers only rarely occurred at Palisades; 3. that Palisades had only experienced minimal equipment problems during the two fast transfers which had occurred (As referenced by the licensees letter, a total of three fast transfers have occurred to date.); 4. that the impact on safety was insignificant; and 5.

that the decrease in dead bus time would be minimal.

Eleven years later during the CDBI, the inspection team reviewed the acceptability of the fast transfer scheme, given the site's operating experience and the possible consequences. The team also noted that the assumption of a dead bus time of 7.5 cycles was non-conservative, and based on the relay manufacturer's information, the dead bus time might be as long as 11 cycles.

Finally, the inspectors noted that the loads used in the 1993 study might not reflect 2006 operation.

3.0 EVALUATION Question 1 Is the scenario of a design basis accident with a subsequent single failure of the safeguards transformer within either the licensing or design basis for the Palisades plant?

No, the NRR staff does not consider the scenario of design-basis accident with a subsequent single failure of the safeguards transformer within the licensing basis of the Palisades plant.

However, the independent failure of the safeguards transformer is within the design and licensing basis as discussed below.

The following is stated in the Palisades, FSAR, Section 1.4.16 (Revision 26):

Licensing Basis:

The original Palisades FSAR contained Appendix I, which presented a comparison of plant design features with the 1967 draft General Design Criteria (GDC). From the wording of Criterion 39, Emergency Power, and Criterion 41, Engineered Safety Features Performance, of the original FSAR, it is clear that design considerations for single failure concerns were limited to failure of a single active component. Palisades was not designed with system redundancy (electrical or fluid systems) comparable to newer plant designs. As such, and in general, only the failure of a single active component (and not a passive failure) was considered.

Active and Passive Failures An active failure is a malfunction, excluding passive failures, of a component that relies on mechanical movement to complete its intended function upon demand.

Since the safeguards transformer is not an active component (does not need mechanical movement to complete its intended function upon demand), the NRR staff concludes that the scenario of design-basis accident with a subsequent single failure of the safeguards transformer is not within the licensing basis of the Palisades plant.

The following is stated in the Palisades, FSAR, Section 8.6.1 (Revision 26):

Design Basis:

The automatic transfer control system is designed to monitor and select available offsite power sources and permit transfer of the 4160 volt and 2400 volt loads to the available offsite source upon loss of the normal power source.

For Palisades, the safeguards transformer is the normal source of power to Class 1E, 2400 V buses. The purpose of the fast transfer scheme is to permit transfer from the normal source of power (safeguards transformer) to the other available offsite power source (Startup Transformer 1-2). The loss of the normal source of power can be caused by failure of the safeguards transformer or because of a fault within the protection zone of the safeguards transformer. Under this condition, the fast transfer will take place to the alternate available offsite source (Startup Transformer 1-2). However, this purpose cannot be ensured by the present fast transfer scheme, which is prone to failure, as explained in the answer to Question 2.

The failure of the fast transfer scheme can also result in damage to the normally running Class 1E loads, such as 2400 V service water and component cooling pumps. Thus, the fast transfer scheme is within the design basis stated in Section 8.6.1 of the FSAR, but its intent is not met due to the excessive transfer time needed to complete the transfer. Since the fast transfer scheme intent is not met, there is a potential safety impact on the normally operating essential loads such as service water system (SWS) and component cooling water (CCW).

Question 2 How should the NRC evaluate the consequences on the plant, specifically the impact of high motor shaft torques on the ECCS equipment, should an out-of-phase transfer occur?

As discussed above, failure of the safeguards transformer and an inadequate fast transfer following an ECCS demand is not within the plants design basis. However, the independent failure of the safeguards transformer is within the design basis. The present fast transfer scheme at Palisades can result in excessive current transients and shaft torques which can damage operating essential equipment immediately or due to cumulative effects in both trains.

Both safety buses, which supply the essential equipment, are served by this transformer, such that this is a common cause failure across both safety trains. Therefore, the NRC staff should

consider that essential equipment can fail, causing a loss of safety function, most notably, SWS and CCW.

The safety buses (2400 V 1C and 1D) are normally fed from safeguards transformer No. 1-1 via the 2400 V safeguard bus. In the case of loss of supply from the safeguards transformer due to transformer failure or a fault within its protective relaying zone, the normally closed breakers between the 2400 V safeguard bus and safety buses 1C and 1D will open, and the alternate breakers from start-up transformer No. 1-2 will close due to the fast transfer scheme at 2400 V safety-related buses.

According to the American National Standards Institute (ANSI) C50.41-2000, Section 14.3, a fast transfer or reclosing is defined as one which:

a) occurs within a time period of 10 cycles or less, b) the maximum phase angle between the motors residual volts per hertz vector and the system equivalent volts per hertz vector does not exceed 90 degrees, and c) the result volts per hertz between the motor residual volts per hertz phasor and the incoming source volts per hertz phasor at the instant of transfer or reclosing is completed does not exceed 1.33 p.u. V/Hz on the motor rated voltage and frequency basis.

If the fast transfer scheme is not successful (does not meet the industry criteria of a successful fast transfer as described above), the voltage from startup transformer can be out-of-synchronism with the residual voltage of essential motors. Therefore, these safety-related motors can be subjected to excessive motor shaft torques, inrush currents, degraded voltage, or potential loss of alternate startup transformer. In addition, the failure of fast transfer scheme (alternate breakers fail to close within required time) can result in subjecting the essential motors to excessive current transients and shaft torques, possibly damaging the equipment immediately or due to cumulative effects.

ANSI C50.41-2000, Section 14.1 states the following:

Induction motors are inherently capable of developing transient current and torque considerably in excess of rated current and torque when exposed to out-of-phase bus transfer or momentary voltage interruptions and reclosing on the same bus. The magnitude of this transient current and torque may range from 2 to 20 times rated and is a function of the motor's electrical characteristics, operating conditions, switching time, rotating system inertia and torsional spring constants, number of motors on the bus, etc.

Any non-parallel bus transfer or reclosing subjects the motor (including the motor windings) and driven equipment to transient forces in excess of normal running values.

Accordingly each bus transfer or reclosing reduces the life expectancy of the motor by some finite value, and it is recommended that, whenever possible, systems be designed to avoid (or minimize) bus transfer and reclosing.

In its letter dated January 7, 1994, the licensee acknowledged the shortcoming in its fast transfer scheme. In this letter, it is stated that the combination of the 345 kV switchyard logic, opening time of 345 kV circuit breakers, speed of the fast transfer relays, and opening and closing times of the 2400 V load bus supply breakers results in a relatively long overall bus transfer time of approximately 14 cycles and a Adead bus@ time of approximately 7.5 cycles. A Adead bus@ time of approximately 7.5 cycles allows the internal voltage and phase angles of connected induction motors to fall significantly out-of-phase with the incoming startup transformer (SUT 1-2) supply prior to re-energization. Depending on plant operating conditions at the time of transfer, the long Adead bus@ time of approximately 7.5 cycles can result in excessive current transients and voltages which do not meet the resultant 1.33 p.u. V/Hz acceptance criteria.

In its letter dated February 28, 1996, the licensee revised its position stating that while the present fast transfer operations have not met all of the design performance expectations, no safety significant components have failed to operate during experienced fast transfers. The licensees evaluation shows that, although various non-safety related loads could be lost during this transfer, all safety-related systems will operate as designed and operability requirements will be met.

The NRR staff does not agree with the licensee=s 1996 position. Depending on plant operating conditions at the time of transfer, the long Adead bus@ time of approximately 7.5 cycles can result in unacceptable voltages which do not meet the industry standard ANSI C50.41-2000, which recommends a resultant 1.33 p.u. V/Hz acceptance criteria. It is stated in the summary of the licensee=s calculation No. EA-A-PAL-90-129 (Section III.D.2.h), that the fast transfer of station power loads from safeguards transformer (SGT 1-1) to startup transformer (SUT 1-2) during loss-of-coolant accident (LOCA) conditions fails to meet three-out-of-five acceptance criteria considered in this calculation. The criteria and results from the calculation are as follows:

Criterion 1:

Resultant vectorial V/Hz between the combined bus motor residual V/Hz and the incoming power source V/Hz does not exceed 1.33 per unit just prior to completing the transfer.

Result:

The resultant vectorial per unit V/Hz values between the combined bus motor residual V/Hz and the incoming power source V/Hz are 1.7111 (Bus 1C) and 1.6425 (Bus 1D) which are above the 1.33 V/Hz criteria.

Criterion 1 is not met.

Criterion 2:

A fast transfer will not result in a loss-of-offsite power. All loads will re-accelerate and continue to operate normally.

Result:

High motor inrush currents and long motor acceleration times following transfer will result in tripping of 2400 V Bus 1C via overcurrent protection.

Due to inadequate 2400 V recovery voltages following transfer, the second level undervoltage relaying protection will trip 2400 V Bus 1D at approximately 6.5 seconds. Thus, a fast transfer during LOCA conditions will essentially result in a loss of offsite power. Criterion 2 is not met.

Criterion 3:

Safety related loads fed by ac contactors will not dropout and require manual restart. Thus, if a transfer fails (loss-of-offsite power), all safety related loads must be capable of being automatically loaded onto the EDGs and not require operator intervention.

Result:

All safety related loads are capable of being automatically loaded onto the EDGs and do not require operator intervention. Criterion 3 is met.

Criterion 4:

Transformer inrush currents do not exceed 4 times normal during bus transfer.

Result:

SUT 1-2 inrush current following bus transfer is 10601 amps, which is above the 10240 amp (4 times normal current) limit. Criterion 4 is not met.

Criterion 5:

For a fast transfer from station power transformer (SP 1-2) to startup transformer (SUT 1-2), the maximum Adead bus@ time assumed will be 1.5 cycles and the total transfer time will not exceed 10 cycles.

Result:

This criterion does not apply to fast transfer from SGT 1-1 to SUT 1-2.

[This criterion of dead bus and total transfer time, if applied to fast transfer from SGT 1-1 to SUT 1-2, will not be met since the Adead bus@ time is approximate 7.5 cycles, and the total transfer time is approximately 14 cycles.]

As can be seen from above, the present fast transfer scheme at Palisades can result in a situation in which the operating essential motors can be subjected to excessive transient currents and shaft torques which can damage the operating essential equipment in both trains due to the common cause failure. The SWS and CCW motors are normally operating essential loads.

Question 3 Is the risk significance high enough to justify requiring the design or licensing basis to include the fast transfer?

The NRR staff performed only a high level probabilistic risk perspective evaluation. A more detailed evaluation would require additional information and analysis by the licensee. The occurrence of a safeguards transformer fast transfer is estimated at 1.7E-2/year based on Palisades plant experience to date. To damage ECCS bus loads due to a design basis event, a safeguards transformer fast transfer needs to occur with ECCS loads on the 1C and 1D buses.

Assuming that the fast transfer occurs within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following an event, the fast transfer event frequency is estimated at 4.7E-5, while the probability of a design basis LOCA would be less than 1E-3/year. Therefore, for initiating events, the combination of initiating event and an inadequate fast transfer is considered small. In addition, for a loss of offsite power event or a safeguards transformer fast transfer, ECCS loads should not be loaded on the bus and recovery

of offsite power or emergency power (diesel generators) should be available as before.

Therefore, the fast transfer impact on ECCS motor loads would be limited.

In addition, SWS and CCW motor damage from an inadequate safeguards transformer (1C and 1D) fast transfer was also considered by the NRR staff, since certain SWS and CCW pumps are running during normal operation and are susceptible to possible damage. The potential for failure is difficult to assess since damage to motor loads, based on an inadequate safeguards transformer fast transfer, is not well documented and no apparent bus (1C and 1D) motor damage has been noted for the events at Palisades. As a very conservative, upper bound estimate, one could assume an inadequate safeguards transformer fast transfer (1.7E-2/year) coupled with failure of the standby SWS or CCW pumps on the order of 1.0E-2/year giving a bounding frequency of 1.7E-4/year (dominated by SWS failure modes). Crediting the start and alignment of the backup fire protection pumps for the SWS would give an estimated bounding frequency on the order of 3.4E-6/year. This conservatively assumes that all operating SWS and CCW pumps fail on the fast transfer, even though no such failures have occurred in three previous events. While this frequency would contribute slightly to the plants risk profile, it is very conservative. Therefore, the risk contribution from an inadequate safeguards transformer fast transfer is considered low.

Irrespective of the risk contribution from a failed safeguards transformer, the independent failure of the safeguards transformer is within the current licensing basis of the plant. The potential safety impact of an inadequate fast transfer scheme from a deterministic standpoint would be based on the potential damage to the operating essential equipment in both safety trains.

The NRR staff reviewed the fast transfer scheme at other nuclear plants, and has made the following observations:

1.

At Browns Ferry Nuclear Plant, the automatic transfer (between normal and alternate supply) is blocked after a short time delay in case of an accident signal.

2.

At Columbia Nuclear Plant, the transfer to alternate supply is delayed by approximately 5.5 seconds. This time delay is considered sufficient to allow motor voltages to decay resulting in a slow/delayed bus transfer.

3.

At Millstone Nuclear Plant, a fast transfer failure is followed by slow transfer. (Typically in such a scheme, fast transfer is blocked by a fast acting synch check relay if the voltage and angle difference between the incoming and the running bus voltage is high due to incoming and running voltage being out-of-synchronization.)

The above examples show protection features that are built into automatic fast transfer schemes so that the safety motors are not subjected to out-of-synchronization excessive voltages, currents, and torque transients.

The present fast transfer scheme at Palisades does not serve its purpose and in fact can result in excessive transient currents and shaft torques which can damage essential equipment immediately or due to cumulative effects.

The NRR staff disagrees with the licensee=s position stated in its letter dated February 28, 1996, that the modification to the fast transfer scheme would be of little value and would not be cost

effective. It is better to have no fast transfer scheme than to have an inadequate transfer scheme which can be susceptible to failure.

4.0 CONCLUSION

1)

The NRR staff does not consider the scenario of design-basis accident with a subsequent single failure of the safeguards transformer within the licensing basis of the Palisades plant. However, the independent failure of the safeguards transformer is within the design basis.

2)

The present fast transfer scheme at Palisades can result in a situation in which operating essential motors can be subjected to excessive current transients and shaft torques which can damage the operating essential equipment in both trains due to the common cause failure. The operating essential equipment damage could occur immediately or due to cumulative effects.

3)

Irrespective of the risk contribution from a failed safeguards transformer, the independent failure of the safeguards transformer is within the current licensing basis of the plant.

The potential safety impact of an inadequate fast transfer scheme from a deterministic standpoint would be based on the potential damage to the operating essential equipment in both safety trains. The NRR staff disagrees with the licensee=s position stated in its letter dated February 28, 1996, that the modification to the fast transfer scheme would be of little value and would not be cost effective. It is better to have no fast transfer scheme than to have an inadequate transfer scheme which can be susceptible to failure.

Principal Contributors: Vijay Goel Cliff Doutt Date: December 12, 2007