ML13333A141
| ML13333A141 | |
| Person / Time | |
|---|---|
| Site: | San Onofre  |
| Issue date: | 01/14/1991 |
| From: | Ray H Southern California Edison Co |
| To: | |
| Shared Package | |
| ML13331A528 | List: |
| References | |
| NUDOCS 9101150353 | |
| Download: ML13333A141 (13) | |
Text
BEFORE THE UNITED STATES NUCLEAR REGULATORY COMMISSION Application of SOUTHERN CALIFORNIA EDISON
)
COMPANY and SAN DIEGO GAS & ELECTRIC COMPANY
)
DOCKET NO. 50-206 for a Class 104(b) License to Acquire,
)
Possess, and Use a Utilization Facility as
)
Amendment Application Part of Unit No. 1 of the San Onofre Nuclear
)
No. 189, Supplement 1 Generating Station
)
SOUTHERN CALIFORNIA EDISON COMPANY and SAN DIEGO GAS & ELECTRIC COMPANY, pursuant to 10 CFR 50.90, hereby submit Amendment Application No. 189, Supplement 1.
This amendment application consists of Proposed Change No. 233, Revision 1, to Provisional Operating License No. DPR-13. Proposed Change No. 233, Revision 1, modifies the Technical Specifications incorporated in Provisional Operating License No. DPR-13 as Appendix A to reflect modifications of the Safeguards Load Sequencing System (SLSS) that will be completed prior to restart from the current Cycle 11 refueling outage. In addition, a license condition is proposed to require installation of a plant modification to resolve a design deficiency related to automatic transfer capability between the vital bus electrical power sources. Proposed Change No. 233, Revision 1, also addresses NRC comments on Proposed Change No. 233, Revision 0, that was submitted for NRC approval as part of Amendment Application No. 189 on September 28, 1990.
The SLSS modification and the license condition for installation of a plant modification to resolve a vital bus automatic transfer deficiency are necessary to satisfy single failure requirements. The SLSS modification consists of changes to the SLSS logic so that each sequencer will start and 9101150353 910114 FDR ADLOCK 05000206 P
-2 load its associated diesel generator and sequence safety-related electrical loads upon a safety injection signal (SIS) and concurrent loss of its respective 4160 volt electrical bus rather than upon a SIS and loss of both 4160 volt buses.
The proposed license condition requires installation of a plant modification during the Cycle 12 refueling outage to eliminate a vital electrical bus single failure susceptibility.
Based on the significant hazards analysis provided in the Description and Significant Hazards Consideration Analysis of Proposed Change No. 233, it is concluded that (1) the proposed change does not involve a significant hazards consideration as defined in 10 CFR 50.92, and (2) there is reasonable assurance that the health and safety of the public will not be endangered by the proposed change.
SUP1AA.SN2
0r
-3 Subscribed on this day of
, 1991.
Respectfully submitted, SOUTHERN CALIFORNIA EDISON COMPANY By:
ZM&
Harold B. Ray Senior Vice Presiden Sub ribed and r to before me this J sv) day ofUUr OFFICIAL SEA Notopb.Nat jot'ary Public in a d for the tate of California James A. Beoletto Attorney for Southern California Edison Company By:
IllA)Bo t
DESCRIPTION AND SIGNIFICANT HAZARDS CONSIDERATION ANALYSIS OF PROPOSED CHANGE NO. 233, REVISION 1 TO PROVISIONAL OPERATING LICENSE NO. DPR-13 INTRODUCTION This is a request for NRC approval to change Technical Specification Nos. 3.5.1, 3.7.1, 4.1.1, and 4.4 and to add License Condition 3.N for San Onofre Nuclear Generating Station, Unit 1 (SONGS 1).
The Technical Specification changes are necessary to reflect modifications of the Safeguards Load Sequencing System (SLSS) that are being implemented during the current refueling outage in accordance with 10 CFR 50.59.
The modifications are being performed to satisfy single failure requirements and consist of changes to the SLSS actuation logic. The modified SLSS will enable each sequencer to start and load its associated diesel generator upon a safety injection signal (SIS) and concurrent loss of its respective 4160 volt electrical bus rather than upon a SIS and loss of both 4160 volt buses.
The proposed license condition is necessary to require implementation of a plant modification to eliminate a single failure susceptibility concerning automatic transfer between the primary and backup power sources for the vital electrical buses. The plant change will be installed during the Cycle 12 refueling outage.
The need for these changes was discovered as a result of the Emergency Core Cooling System (ECCS) Single Failure Analysis. An interim report on the results of that analysis was submitted to the NRC on July 31, 1990. These proposed changes to the Technical Specifications will resolve the topic identified as Issue No. 8, Sequencer Logic'Deficiency, in Enclosure 2 of that report. The plant change proposed by the license condition will resolve a single failure susceptibility concerning the power sources for the vital electrical buses. The susceptibility was identified by SCE as an "issue under review" in the ECCS single failure analysis.
The resolution to the sequencer logic deficiency issue that is embodied by this proposed change differs from the preliminary corrective actions discussed in the ECCS Single Failure Analysis Interim Report. Continued evaluation of the subject has identified changing the SLSS actuation logic for automatic loading of the diesel generators and sequencing ECCS loads as the preferred resolution.
This revision of Proposed Change No. 233 is necessary to address comments received during NRC review of Proposed Change No. 233, Revision 0, which was submitted for NRC approval on September 28, 1990. Specifically, this revision i) adds the response time and setpoint for the 4160 volt bus reactor trip instrumentation (Figure 3.5.1-1 gives a setpoint/response time curve that is typical for the type of relays used in the bus undervoltage reactor trip channels. The specific curve for these reactor trip channels is now being developed based upon testing of the actual relays used in the trip circuitry.
The specific curve will be submitted as a second supplement to this amendment application by January 25., 1991.), ii) specifies that the 4160 volt bus undervoltage reactor trip instrumentation be operable in Modes 1, 2, 3*, and 4*, and iii) revises the vital bus transfer probabilistic risk assessment that confirms the acceptability of scheduling the associated plant modification for Cycle 12. The first two items listed above are being proposed to be consistent with the Standard Technical Specifications, as requested by the NRC. Change bars are provided in the left margin throughout this proposed change to indicate the Revision 1 changes.
EXISTING TECHNICAL SPECIFICATIONS See Attachment 1.
PROPOSED TECHNICAL SPECIFICATIONS See Attachment 2.
EXISTING LICENSE CONDITION None.
PROPOSED LICENSE CONDITION See Attachment 3.
I. DESCRIPTION OF TECHNICAL SPECIFICATION CHANGES This proposed change requests NRC approval to revise Technical Specification Nos. 3.5.1, 3.7.1, 4.1.1, and 4.4 to reflect modifications that are being completed on the SLSS prior to restart from the Cycle 11 refueling outage. The modifications are being performed in accordance with 10 CFR 50.59 and are delineated in the Discussion section below.
The proposed change to Technical Specification 3.7.1, Auxiliary Electrical Supply, amplifies on the diesel generators as backup sources of power for the 4160 volt buses by describing in the Basis section of the Technical Specification the design requirements for automatic starting and loading of the diesels. The modifications to the SLSS that accompany this proposed change enable each sequencer to automatically start and load its associated diesel generator and sequence ECCS loads upon receipt of a SIS and a concurrent loss of its respective 4160 volt bus. Previously, the SLSS required a SIS and loss of both 4160 volt buses to automatically load the diesel generators and sequence ECCS loads. It is also proposed that the above design condition for automatic starting and loading of the diesel generators and ECCS load sequencing be specified in Technical Specification 4.4, Emergency Power System Periodic Testing.
Changes to Technical Specification Table 3.5.1-1, Reactor Trip Instrumentation, and Table 4.1.1, Reactor Trip System Instrumentation Surveillance Requirements, are also proposed to reflect revised actuation logic for reactor trip upon loss of power. A once a refueling outage surveillance interval is proposed in Table 4.1.1 for the 4160
- With the reactor trip system breakers in the closed position, the control rod drive system capable of rod withdrawal.
volt bus undervoltage reactor trip instrumentation channels. This interval is proposed since these instrumentation channels use 1 out of 2 logic for each 4160 volt bus to trip the reactor. Testing this instrumentation during power operation would risk spurious reactor trips. However, as discussed in the NRC safety evaluation report on degraded grid voltage dated June 23, 1982,,and in the Order dated January 2, 1990, we are committed to change this trip logic during Cycle 12 to 2 out of 3. We plan to increase the surveillance frequency for the 4160 volt bus undervoltage reactor trip channels to monthly after the plant modification is completed.
II. DISCUSSION OF TECHNICAL SPECIFICATION CHANGES INTRODUCTION An interim report on the methodology and results of the ECCS Single Failure Analysis was submitted to the NRC on July 31, 1990. The report identified eight issues related to satisfying single failure requirements that need resolution. SCE committed to implement corrective actions for all eight of these open issues prior to restart from the current outage.
The proposed Technical Specification changes address the issue that concerns a deficiency in sequencer logic. The issue involves three potential plant conditions which could delay ECCS operation. Each of these three plant conditions are discussed below. The 4160 volt electrical distribution system and the SLSS are next described to aid an understanding.of the potential for delayed ECCS operation.
4160 VOLT ELECTRICAL DISTRIBUTION WITH EXISTING SLSS LOGIC There are two independent safety-related 4160 volt electrical distribution trains consisting of Buses IC and 2C. These buses supply electrical power to systems and components that are required for normal operation, safe plant shutdown, and mitigation of design basis events.
These two electrical distribution systems are energized by off-site electrical sources through Auxiliary Transformer C. Attachment 4 illustrates the normal electrical bus alignments (after completion of 480 volt modifications being implemented during the current outage).
In the event electrical power is not available from off-site sources, each of the two 4160 volt distribution systems is powered by an emergency diesel generator. Upon receipt of a SIS with concurrent loss of Buses IC and 2C, the SLSS trips all loads on the buses, closes the diesel generator output breakers, and sequences the ECCS loads.
For a SIS without a loss of power, the loads on the bus are not tripped, and all ECCS loads except the Main Feedwater Pumps are loaded in a single block. (The Main Feedwater Pumps have their own time delay relay controlling their restart.)
The diesel generators automatically start but ao not load upon a SIS, a loss of a single 4160 volt bus, or a SIS concurrent with a loss of a single 4160 volt bus.
3
POTENTIAL FOR DELAYED ECCS OPERATION There are three potential plant conditions which could delay actuation of the ECCS longer than assumed in the safety analysis:
During emergency diesel generator surveillance testing, the diesel generator is paralleled to its respective 4160 volt bus.
Failure of the diesel generator breaker to trip concurrent with a SIS and loss of off-site power could result in neither sequencer being able to detect the loss of both 4160 volt buses. The sequencer on the surveilled train would sense only a SIS because the diesel generator would maintain the bus energized. That sequencer would attempt to block start ECCS loads while maintaining power to the non-essential loads on its bus. This would result in diesel generator overload and a degraded bus voltage condition leading to failure of this train. The other train would initially sense a SIS and loss of its respective electrical bus but would not connect its diesel generator or sequence its ECCS loads until the first train failed. This would delay ECCS initiation beyond the timing assumed in the safety analysis.
During ground detection activities on Bus 1C or 2C, the bus is isolated from Auxiliary Transformer C and is connected to the main generator via Bus 1A or lB. If a SIS event were to occur coincident with a loss of off-site power, the sequencer for the bus not being tested would not detect a loss of bus since there would be voltage on the bus connected to the main generator. The bus being tested would detect a SIS only and block start ECCS loads while maintaining non-essential loads on the bus. The SIS would result in a unit trip. The unit trip would cause the main generator voltage to eventually decrease enough to result in a loss of bus signal on the bus under test. Hence, the loss of both buses would then be sensed and the ECCS loads connected and sequenced. This would delay ECCS initiation beyond the timing assumed in the safety analysis. In addition, if the bus not under test were to fail, ECCS initiation would not be achieved.
Failure of the main feeder breaker to open on Bus 1C or 2C in response to a degraded grid condition concurrent with a SIS could lead to a failure of ECCS loads to properly sequence. The bus with the failed breaker would remain connected to the grid and would have a degraded voltage condition. Since it would still have voltage, loss of the bus would not be sensed by the SLSS and thus a SIS and concurrent loss of both buses would not be detected. As a result, the ECCS loads would be block loaded on the train with the degraded voltage and would not be sequenced on the redundant train. The loads on the train with the degraded voltage would not start in the time required by the safety analysis.
SLSSMODIFICATIONS ECCS load sequencing potentially could be delayed by the above three plant conditions because of the present actuation requirement to sense a SIS in combination with a loss of voltage on both 4160 volt buses.
SCE 4
is now in the process of eliminating these potential ECCS actuation delays. A design change is being installed to modify the logic for each sequencer so that the loads on the respective ECCS train are sequenced upon a SIS in conjunction with the loss of the respective 4160 volt bus.
The following modifications are being implemented in accordance with 10 CFR 50.59 and will be completed prior to restart from the current refueling outage:
- Modification of the circuitry for each SLSS sequencer to actuate a loss of power signal upon loss of voltage on their respective 4160 volt buses rather than on the loss of both buses.
- Addition of separate actuation logic for initiation of reactor trip upon loss of both 4160 volt buses (to avoid reactor trip upon loss of single bus that would result from modification of the sequencer circuits).
In addition to implementation of the above plant changes, SCE will limit the duration of ground detection activities in accordance with Technical Specification 3.7.1, Action G. Operation with only one 4 Kv electrical bus (i.e., the bus under test is considered inoperable) during such ground searches is acceptable since the assumption of a single failure (e.g., the loss of the bus not under test) while operating in an action statement is not required.
III. DESCRIPTION OF LICENSE CONDITION License Condition 3.N is being proposed to schedule installation of a plant modification to resolve a single failure susceptibility affecting the power sources for the vital electrical buses. The plant modification will be completed prior to restart from the Cycle 12 refueling outage. The plant change is necessary to assure that the vital buses are capable of accommodating all safety-related electrical loads so that the plant can reach safe shutdown under all accident conditions.
IV. DISCUSSION OF LICENSE CONDITION INTRODUCTION SCE identified in the ECCS Single Failure Analysis Interim Report the potential for the loss of vital bus power due to the lack of retransfer capability as an "issue under review." It is proposed that this single failure susceptibility be eliminated by implementing a plant modification during the Cycle 12 refueling outage. The need for this plant change is described below.
SINGLE FAILURE Vitat buses 1, 2, and 3/3A are normally powered through inverters connected to DC Bus. No. 1. The vital buses power a portion of the safety-related instrumentation and equipment necessary to assure the 5
plant can reach safe shutdown. These buses also accommodate loads for components that are located inside containment but that are not qualified for operation in a harsh environment.
The harsh environment that would result from a LOCA or MSLB potentially could cause short circuits on some of these non-qualified loads. The occurrence of multiple faults on the Train A vital buses would cause the automatic transfer switches to transfer the vital buses to the backup power source (Train B 480 volt motor control center number 2).
This circumstance would not jeopardize the safety-related loads because the backup power source has sufficient capacity for the protection devices to isolate the faulted loads. However, if the Train B 480 volt power should fail after an auto-transfer, all power would be lost to the affected Train A vital buses since the auto-transfer switches are not designed to retransfer back to the primary power source. This may result in a temporary inability for the SLSS to automatically actuate ECCS operation and to reach safe shutdown. Electrical power could eventually be restored to the vital buses by the operator manually initiating transfer back to the inverters.
DESIGN CHANGE/RISK ASSESSMENT SCE intends to eliminate this single failure susceptibility by implementing a plant modification. However, the modification cannot be performed during the present outage because the static auto-transfer switches and inverters currently deemed necessary for the design change have a procurement lead time of approximately 12 months. Therefore, SCE proposes a license condition to require installation of the plant change during the Cycle 12 refueling outage. As discussed below, completion of the modification at that time is justified because the risk of adverse consequences occurring during Cycle 11 operation is negligible. The proposed schedule also provides adequate time to finalize the engineering design, procure the necessary equipment and materials, install the hardware, and performance test the system.
SCE has revised the probabilistic.risk assessment (PRA) for continuing plant operation with the present vital bus automatic transfer capability to assure that scheduling the plant modification for the Cycle 12 refueling outage is acceptable. A revised analysis was necessary to provide additional explanation of the assumptions made in the original evaluation and to more accurately reflect the design of the SONGS 1 electrical distribution system as it will be configured upon return to service. The assumptions, methodology, and results of that assessment are presented in Attachment 5. The-results of that analysis show that the risk of core damage due to this single failure susceptibility is less than 2 x 10' per year. This contribution to the overall core damage frequency (estimated to be 2 x 104 per year) is quite low, accounting for less than 0.1% of the total.
Therefore, SCE has concluded that the probability of this single failure scenario occurring during the upcomiing fuel cycle is sufficiently low to allow implementation of the plant change during the Cycle 12 refueling outage.
The proposed schedule for implementing the plant change concerning vital bus auto-transfer also allows the final design to benefit from the 6
integrated resolution of SEP Topic VI-7.C.2, Failure Mode Analysis (ECCS), and Regulatory Guide 1.97, Post-Accident Instrumentation. As committed in our letter dated May 2, 1990 (and confirmed in the NRC Order dated January 2, 1990), that integrated evaluation will be submitted to the NRC by June 30, 1991, and will address physical and electrical separation issues among other considerations. One of the open items to be resolved by the integrated evaluation concerns physical and electrical separation of vital buses 1, 2, 3, and 4 and their associated transfer switches and regulated buses. Completion of the vital bus automatic transfer modification prior to resolving this separation issue as part of the integrated SEP VI-7.C.2/Reg. Guide 1.97 evaluation is likely to result in subsequent changes in the design.
V. SIGNIFICANT HAZARDS CONSIDERATION ANALYSIS As required by 10 CFR 50.91(a)(1) this analysis is provided to demonstrate that the proposed license amendment to revise the SLSS actuation logic in the Technical Specifications and add a license condition concerning vital bus automatic transfer capability does not represent a significant hazards consideration. As demonstrated below, in accordance with the three factor test of 10 CFR 50.92(c),
implementation of the proposed amendment was analyzed using the following standards and found not to:
- 1) involve a significant increase in the probability or consequences of an accident previously evaluated; or 2) create the possibility of a new or different kind of accident from any accident previously evaluated; or 3) involve a significant reduction in a margin of safety.
- 1. Will operation of the facility in accordance with these proposed changes involve a significant.increase in the probability or consequences of an accident previously evaluated?
Response: No Sequencer Logic Deficiency The only accidents evaluated in the Updated Final Safety Analysis Report (UFSAR) that are related to the proposed Technical Specification changes are a LOCA or MSLB. Safe shutdown from both of these events is assured, in part, by automatic injection of borated water into the Reactor Coolant System (RCS) by the Safety Injection System. A SIS is automatically initiated by either low pressure in the pressurizer or high containment pressure. Reliable operation of the Safety Injection System is assured by i) two separate and independent pumping trains* for delivering borated water to the RCS and ii) two emergency diesel generators for powering Safety Injection System equipment during loss of off-site power conditions.
During ground detection activities, one pumping train may be inoperable for a limited period in accordance with Technical Specification 3.7.1, Action G.
7
The SLSS starts and loads the diesel generators and provides proper sequencing of the ECCS loads onto the ECCS buses. This proposed change reflects plant modifications that are being performed during the current refueling outage. The modification will change the SLSS actuation logic so that each sequencer starts and loads its respective diesel and sequences the ECCS loads upon receipt of a SIS concurrent with the loss of its respective electrical bus rather than upon a SIS and loss of both buses. In addition, separate trip signals indicative of loss of both 4160 volt buses are being created outside of the SLSS to retain the logic for reactor trip upon loss of off-site power (i.e., loss of both 4160 volt buses).
These plant modifications do not affect the Safety Injection System logic initiating circuits or the probability of spurious reactor trips.
Operation of SONGS 1 in accordance with this proposed change will not increase the probability or consequences of an accident previously evaluated. Rather, the plant modifications reflected by this change assure that ECCS operation will be initiated within the time frame assumed by the MSLB and LOCA safety analyses presented in Sections 15.2 and 15.16 of the UFSAR.
Vital Bus Automatic Transfer Due to the vital bus transfer single failure susceptibility in the SONGS 1 electrical distribution system, the consequences of a LOCA or MSLB could be more serious than previously concluded by the UFSAR accident analyses. The probability of a LOCA or MSLB occurring is unaffected by the single failure susceptibility.
If the vital buses were being powered from their backup power source, failure of that power source would lead to a temporary loss of all vital bus electrical power. Such an occurrence may prevent automatic actuation of the safeguards required to avoid core damage following a LOCA/MSLB. This possibility stems from the lack of automatic retransfer capability from the vital bus backup power source (480 volt motor control center number 2) to the primary source (DC Bus. No. 1).
Electrical power could eventually be restored to the buses by the operator manually transferring to the primary source.
SCE plans to implement a design modification during the Cycle 12 refueling outage to eliminate the possibility of the above single failure scenario. In addition, SCE has concluded that operation throughout Cycle 11 with the current plant configuration does not represent a significant increase in the consequences of a LOCA/MSLB because such a series of events is highly unlikely to occur. All of the following circumstances would have to exist to temporarily lose power to one or more of the vital buses:
- Sufficient short circuiting of unqualified electrical loads on the vital buses to cause automatic transfer to the backup power source.
8
- Failure of the vital bus backup power source (Train B 480 volt motor control center number 2) after an automatic transfer.
SCE has performed a PRA for this scenario to confirm that operation with the current plant configuration for a limited period does not represent a significant risk of core damage and/or adverse consequences to the public. The results of that analysis show that the risk of core damage due to this single failure susceptibility is less than 2 x 107 per year. Therefore, continued plant operation throughout Cycle 11 with the existing vital bus configuration does not represent a significant increase in the consequences of an accident previously evaluated.
- 2. Will operation of the facility in accordance with these proposed changes create the possibility of a new or different kind of accident from any accident previously evaluated?
Response: No Sequencer Logic Deficiency The proposed Technical Specification changes do not introduce the possibility for any new accidents. The plant changes that accompany this proposed change do not affect the requirements for generation of a SIS or initiation of a reactor trip. All new circuits, cabling, and terminations are being installed to satisfy seismic category A requirements and physical and electrical separation criteria for safety-related systems.
In addition, SCE has confirmed that operation of one of the two trains of the Safety Injection System in a sequenced mode (SISLOP) concurrent with the other train in a block-loaded mode (SIS only) will not result in any adverse consequences. Once the plant changes are complete, at least one safety injection train would.operate upon receipt of a SIS and a concurrent loss of one of the two 4160 volt buses.
Vital Bus Automatic Transfer The design for the plant modification that will eliminate the vital bus automatic transfer single failure susceptibility is not yet final.
SCE will complete the necessary design modification in accordance with all applicable regulatory requirements to assure that the revised electrical distribution system does not introduce the possibility of any new accidents.
- 3. Will operation of the facility in accordance with this proposed change involve a significant reduction in a margin of safety?
9
Response: No Sequencer Logic Deficiency The proposed Technical Specification changes reflect plant changes that are being performed to eliminate three single failure scenarios that potentially could have delayed initiation of safety injection after a LOCA or MSLB and concurrent loss of off-site power. In each case, the resulting delay could have been beyond the timing assumed in the analyses described in UFSAR Sections 15.2 and 15.16 for a MSLB and a LOCA. The plant changes dictate that safety injection operation will be initiated upon receipt of a SIS and concurrent loss of one rather than both 4160 volt electrical buses to assure there is no reduction in a margin of safety.
Vital Bus Automatic Transfer Interim operation during Cycle 11 with the present vital bus automatic transfer capability involves a slight chance that the plant may not be able to automatically initiate required safeguards following a LOCA/MSLB. However, SCE has concluded that the potential for this event is not significant since the probability of its occurrence is estimated to be less than 2 x 101 per year. The design for the plant modification that will eliminate this single failure concern will be installed during the Cycle 12 refueling outage to maintain all existing margins of safety.
SAFETY AND SIGNIFICANT HAZARDS DETERMINATION Based on the preceding analysis, it is concluded that: (1) Proposed Change No. 233 does not constitute a significant hazards consideration as defined by 10 CFR 50.92; (2) there is reasonable assurance that the health and safety of the public will not be endangered by the proposed change; and (3) this action will not result in a condition which significantly alters the impact of the Station on the environment as described in the NRC Final Environmental Statement. -
Existing Technical Specifications -
Proposed Technical Specifications - Proposed License Condition - Schematic Diagram of SONGS 1 Electrical Distribution System - Probabilistic Risk Assessment of Continuing Plant Operation with Present Vital Bus Automatic Transfer Capability, Revision 1 PCNSP233.SN2 III 10