ML17037B625

Letter Regarding a Review of Licensee Responses to Previous Generic Request for Information Relative to the Electrical Power Distribution Systems and an Enclosed Safety Evaluation and Statement of Staff Positions

ML17037B625
Person / Time
Site:	Nine Mile Point
Issue date:	06/02/1977
From:	Lear G Office of Nuclear Reactor Regulation
To:	Rhode G Niagara Mohawk Power Corp
References
Download: ML17037B625 (28)

Text

JUN 2 1977 Distribution 4 Bocket ORB 83 Local PDR NRC PDR Docket Ho. 50-220 GLear CParrsih DJaffe SNowicki Niagara Mohawk Power Corporation Attorney, OELD ATTN: t/r. Gerald K. Rhode OISE (3)

Vice President - Engineering DEisenhut 300 Erie Boulevard tlest TBAbernathy Syracuse, New York 13202 JRBuchanan ACRS (16)

Gentlemen:

RE: HIHE NILE POINT NUCLEAR STATION UNIT NO. 1 We are currently reviewing the onsite emergency power systems of all operating nuclear power facilities to assess the susceptibility of their safety related electrical equipment with regard to ( 1) sustained degraded voltage conditions at the offsite power sources and (2) inter-action between the offsite and onsite emergency power systems.

We have completed our review of licensee responses to our previous generic request for information relative to the electrical power distribution systems. Based on this initial review, we have prepared the Safety Evaluation and Statement of Staff Positions contained in Enclosure l.

We request that you compare the current design of the emergency power systems at your facility(ies) with the Staff Positions stated in the enclosure and:

(1) propose plant modifications as necessary to meet the Staff Positions, or (2) provide a detailed analysis which shows your facility design has equivalent capabilities and protective features.

Additionally, we 'require that certain technical specifications be incorporated into all facility operating licenses. Model technical specifications, consistent with the Staff Positions contained in Enclosure 1, are provided in Enclosure 2.

Accordingly, we request that you apply, within.,fovtty-,¹gve days of the receipt of thi s letter, for an amendment to your facility operating license(s) to incorporate comparable technical specifications to thos presented in the enclosure. Additionally, you should provide a description and a schedule for the completion of any plant associated modifications.

e k'~

I K

", ~ 33' P

A. <<314 3~I 3>>, ~ '

A

'L'>> " '<< ',<< ~ I 3

3 3 < 3<< ~

I I

~ A n ~

3

~ R

<< ~

P

<<3 <<

4' 3 3

JUN 2 ]977 nagara Mohawk Power Corporation - 2-4 If you have'any questions on this matter, please contact us.

Sincerely, Original signed by George Lear, Chief Operating Reactors Branch 83 Division of Operating Reactors

Enclosures:

1. Staff Positions

2. Model Technical Specifications cc: Arvin E. Upton, Esquire LeBoeuf, Lamb, Lefby 8. MacRae 1757 N Street, N. H.

Mashington, D. C. 20036 Anthony Z. Roisman, Esquire Roisman, Kessler and Cashdan 1025 15th Street, H. li.

5th Floor Hashington, D. C. 20005 Hr. Eugene G. Saloga, Applicant Coordinator Wine t<ile Point Energy Information Center P. 0. Box 81 Lycoming, Hew York 13093'crrIcc~

.. ORB III3, ORB 83 0 ORB 83 SV RHAM C W CParrish SN owi DJa GLear DATC ~ 5/$~/77 5/ & l /77 @I (P7 Po~ hrc-3ia (Re . 9-fb) AZCM 0240 0 V $ ,4OVCRNMCNT PRINTIN4 OPPICCI IOTA 425 ISS

i '

I

~, ~ 4 Jt, a i gil ~ei ~

e gc p ~

p k

I II ,qJ t I

ENCLOSURE 1 SAFETY EVALUATION AND STATEMENT OF STAFF POSITIONS RELATIVE TO THE EMERGENCY POWER SYSTEMS FOR OPERATING REACTORS A. INTRODUCTION The onsite emergency power systems of operating nuclear power facilities are being reviewed to assess the susceptibility of their associated redundant safety-related electrical equipment 'to:

(a) Sustained degraded voltage conditions at the offsite power source; and (b) Interaction of the offsite and onsite'emergency power systems.

We have completed our review of the responses to our generic request for additional information~~ relative to the electrical power distribution I

svstems of currentlv ooeratino nuclear oower facilities.. In response to our request, all licensees have analyzed their system designs to determine that the voltage levels at the safety-related buses have been optimized for the full load and minimum load conditions that are expected throughout the anticipated range of voltage variations for the offsite power sources. The transformer voltage tap adjustments that were necessary to optimize the voltage levels have been accomplished.

In addition to the above corrective action, we have developed the following staff positions for use in evaluation of each of the operating nuclear power plants with regard to the two items identified above. These positions were developed on the basis of our review of- the licensee response to our Letters to all licensees, dated August 12 and 13, 1976.

requests for additional information and of other related information as cited in the text.

POSITIONS

1) Position 1: Second Level of Under-or-Over Volta e Protection with a Time Dela Me require that a second level of voltage protection for the onsite power system be provided and that this second level of voltage protection shall satisfy the followina cri teria:

a) The selection of vol.age and time set points shall be determined from an analysis of the voltage requirements of the safety-related loads at all o~site system distribution 1'evels; b) The voltage protection shall include coincidence logic to preclude spurious trips of the offsite power source; c) -The time delay selected shall be based on the following conditions:

(1) The allowable time delay, includi.ng margin, shall not exceed the maximum time delay that is assumed in the FSAR accident analyses; (2) The time delay shall minimize the effect of short duration disturbances from reducing the availability of the offsite power source(s); and (3) The allowable tim duration of a degraded voltage

. condition at all distribution system levels shall not result in failure of safety systems or components;

\

d) The voltage monitors shall automatically initiate the disconnection of offsite power sources whenever the voltage set point and time delay limits have been exceeded; e) The voltage monitors shall be designed to satisfy the requirements of IEEE Std.- 279-1971, "Criteria for Protection Systems for Nuclear Power Generating Stations"; and f) The Technical Specifications shall include limiting conditions for operation, surveillance requirements, trip set points with minimum and maximum limits, and allowable values for the second-level voltage protection monitors.

General Design Criterion 17 (GDC 1.7) "Electric Power Systems", of Appendix A, "General Design Criteria for Nuclear Power Plants," of 10.CFR Part 50 requires: (a) two physically independent circuits from the offsite trans-mission network (although one of these circuits may be a delayed access circuit, one circuit must be automatically available within a few seconds following a loss-of-coolant accident); (b) redundant onsite A.C. power supplies; and (c) redundant D.C. power supplies.

GDC-17 further requires that the safety function of each a-.c. system (assuming the other system is not functioning) shall be to provide sufficient capacity and capability to assure that: (a) specified acceptable fuel design limits and the design conditions for the reactor coolant pressure boundary are not exceeded as a result of anticipated operational occurrences; and (b) the core is cooled and containment integri ty and other vital functions are maintained during any of the postulated accidents.

-4<<

Existing undervol tage monitors automatically perform the required func-tion of switching from offsite power, the preferred oower source, to the redundant onsite power sources when the monitored voltage degrades to a level of between 50 to 70 percent of the nominal rated safety bus voltage.

This is usually accomplished after a one-half to one second time delay.

These undervoltage monitors are designed to function on a complete loss of the offsite power source.

The offsite power system is the common source which normallv suoolies power to the redundant safety-related buses. Any transient or sustained I

degradation of this conmon source will be reflected onto the onsite system's safety-related buses.

A sustained degradation of the offsite oower system's voltage could result in the loss of capability of the redundant safety loads, their control circuitry, and the associated electrical components required for performing safety functions.

The operating procedures and guidelines utilized bv electric utilities and their interconnected coooerative oraanizations minimize the pro-bability for the above conditions to occur. However. since dearadation

- of an 'offsite oower svstem that could lead to or cause the failure of redundant safety-related electrical equipment is unacceptable, we require the additional sa ety margins associated with implementation of the 0

protective measures. detailed above.

2) Position 2: Interaction of Onsite Power Sources with Load Shed Feature We require that the current system designs automatically prevent load shedding of the emergency buses once the onsite sources are supplying power to all sequenced loads on the emergency buses. The design shall also include the capability of the load shedding feature to be automatically reinstated if the onsi,te source supply breakers are tripped. The automatic bypass and reinstatement feature shall be verified during the periodic. testing identified in Position I

3.

In the event an adequate basis can be provided for retaining the load shed feature when loads are energized by the onsite power system, we will require that. the setpoint value in the Technical Specifications, which is currently specified as "...equal to or greater than..." be amended to specify a value having maximum and minimum limits. The licensees'ases for the setpoints'and limits selected must be documented.

GDC 17 requires that provisions be included to minimize the probability of losing electric power from any of the remaining supplies as a result of or coincident with the loss of power generated by the nuclear power unit, the loss of power from the transmission network, or the loss of power from the onsite electric power supplies.

The functional safety requirement of the "loss-of-offsite power monitors" is to detect the loss of voltage on the offsite (preferred) power system and to initiate the necessary actions required to trans-fer the safety-related buses to the onsite system. The load shedding feature, which is required to function prior to connecting the onsite power sources to their respective buses can adversely interact with the onsite po'wer sources if the load sheddi'ng feature is not bypassed after it has performed its required function. The load shed feature should also be reinstated to allow itlto perform its function if the onsite sources are interrupted and are subsequently required to be reconnected to their respective buses.

3} Position 3: Onsite Power Source Testin We require that the Technical Specifications include a test requirement

'o demonstrate the full functional operability and ~independence of the onsite power sources at least once per 18 months during shutdown. The Technical Specifications shall include a requirement for tests: (1) simulating loss of offsite power in conjunction with a safety injection actuation signal; and (2) simulating'nterruption and subsequent reconnection of onsite power sources to their respective buses. Proper operation shall be determined by:

a} Verifying that on loss of offsite power the emergency buses have been de-energized and that the loads have been shed from the emergency buses in accordance with design requirements.

7 b) Verifying that on loss of offsite power the diesel generators start from ambient condition on the autostart signal, the emergency buses are energized wi th permanently connected loads, the auto-connected emergency loads are energized through the load sequencer, and the system operates for five minutes while the generators are loaded with the emergency loads.

c) Verifying that on interruption of the 'onsite sources the loads are shed from the emergency buses in accordance with design requirements and that subsequent loading of the onsite sources is through the load sequencer.

GDC 17 requires that provisions be included to minimize the probability of losing electric power from any one of the remaining supplies as a I

result of or coincident with the loss'f power generated by the reactor power unit, the loss of power generated by the nuclear power unit, the loss of power from the .ransmission network, or the loss of power from the onsite electric power supplies.

The testing requirements identified in Position 3 will demonstrate the capability of the onsite power system to perform its required function. The tests will also identify undesirable interaction between the offsite and onsite emergency power systems.

TABLE 3.3-3 Continued ENGINEERED SAfETY FEATURE ACTUATION SYSTEH INSTRUHENTATION HINIHUH TOTAL NO. CHANNELS CHANNELS APPLICABLE FUNCTIONAL UNIT OF CHANNELS TO T 0 EIIA E ~OPEIÃt N NO ES .1 ID LOSS OF POWER

a. 4.16 kv Emergency Bus Undervoltage (Loss of Voltage) 4(3)/Bus 2/Bus 3(2)/Bus 1, 2, 3 Aor8 CD CD I

b. 4.16 kv Emergency Bus Undervoltage (Degraded n Pl Voltage) 4(3)/Bus 2/Bus 3(2)/Bus 1,2,3 Aor8 n n I CD I CA CA

'u Dl m

n.

Tl

"(Entries in parenthesis are applicable for 2 out of 3 coincidence logic)

"*Required when ESF equipment is required to be operable

• ""Action A for 2 out of 4 logic Action B for 2 out of 3 logic

TABLE 3.3-3 Continued ACTION STATEMENTS ACTION A - Mith the number of OPERABLE channels one less than the Total Number of Channels operation may proceed, provided both of the following conditions are satisfied:

a. The inoperable channel is placed in the tripped condition within one hour.

b. The Minimum.Channels OPERABLE requirement is met; however, one additional channel may be bypassed for up to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> for surveillance testing per Specification (4.3.2.1.1).

ACTION B - Mith the number of OPERABLE Channels one less than the Total Number of Channels operation may proceed until performance of the next required CHANNEL FUNCTIONAL TEST provided the inoperable channel is placed in the tripped condition within hour.

1

TABLE 3.3-4 Continued ENGINEEREO SAFETY FEATURE ACTUATION SYSTEM INSTRUMENTATION TRIP VALUES ALLOWABLE FUNCTIONAL UNIT TRIP VALUE VALUES LOSS OF POWER

a. 4.16 kv Emergency Bus Undervottage + ) volts with a + ) volts with a (Loss of Voltage) + ) second time delay + ) second time delay

b. 4.16 kv Emergency Bus Undervoltage + ) volts with a + ) volts with a (Degraded Voltage) + ) second time delay + ) second time delay

TABLE 4.3-2 Cont)nued ENGINEERED SAFETY FEATURE ACTUATION SYSTEM INSTRUMENTATION SURVEILLANCE RE UIREMENTS OPERATING CHANNEL MODES IN WHICH CHANNEL CHANNEL FUNCTIONAL SURVEILLANCE FUNCTIONAL UNIT CHECK CALIBRATION TEST RE UIRED LOSS OF POWER

a. 4.16 t<v Emergency Bus Undervoltage (Loss of Voltage) S M 1,2,3

b. 4.16 kv Emergency Bus Undervoltage (Degraded Voltage) 1,2,3 S = at least once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> R = at least once per 18 months M = at least once per 31 days

ELECTRICAL PRIER SYSTEMS SORVEILLANCE RE UIREMEHTS 4.8.1.1.X Each diesel generator shall be demonstrated OPERABLE:

a. At least once per 18 months during shutdown by:

1. Simulating a loss of offsite power in conjunction with a safety injection actuation test signal, and:

a) Verifying de-energization of the emergency busses and load shedding from the emergency busses.

b) Verifying the diesel starts from ambient condition on the auto-start signal, energizes the emerg ncy busses with permanently connected loads, energizes the auto-connected emergency loads through the load sequencer and operates for > 5 minutes while its generator is loaded with the emergency loads.

c) Verifying that on diesel generator trip, the loads are shed from the emergency busses and the diesel re-starts on the auto-start signal, the emergency busses are energized with permanently ~connected loads, the auto-connected emergency loads are energized through the load sequencer and the diesel operates for > 5 minutes while its generator is loaded with the emergency loads.

~