ML17201M205
| ML17201M205 | |
| Person / Time | |
|---|---|
| Site: | Dresden, Quad Cities, 05000000 |
| Issue date: | 10/13/1988 |
| From: | NRC |
| To: | |
| Shared Package | |
| ML17201M204 | List: |
| References | |
| NUDOCS 8810260494 | |
| Download: ML17201M205 (6) | |
Text
UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D. C. 20555 SAFETY EVALUATION REPORT ENCLOSURE 1 DESIGN MODIFICATION ON LPCI SWING BUS TRANSFER SCHEME QUAD CITIES UNITS 1&2/DRESDEN UNITS 2&3 DOCKET NO. 50-254/265 & 50-237/249
1.0 BACKGROUND
By letter dated February 19, 1988 from J. A. Siladay to T. E. Murley, Corranon-wealth Edison Company (CECo, the licensee) provided plans to implement a design modification to the Low Pressure Coolant Injection (LPCI) swing bus transfer
.scheme on Dresden and Quad Cities units.
CECo has determined that both plants are susceptible to a DC control power failure scena'rjo which was first identi-fied at the Fermi 2 plant. The postulated scenario involves a single failure of one division of 125V DC control power under the design basis loss of coolant accident (LOCA) coincident with a loss of offsite power {LOOP).
Under the above sequence of events, the licensee found that it can lead to a loss of AC power to the LPCI swing bus which provides power to all LPCI injection motor operated valves, thus losing the LPCI function i.e., all four LPCI pumps to inject water into the reactor vessel.
To eliminate the above design deficiency with a DC control power failure, the licensee has submitted a design modifica-tion to the LPCI swing bus transfer* scheme for our review.
This modification was submitted as a result of the Electrical Systems Branch's
{SELB) informal inquiry to CECo on December 16, 1987 to determine whether the Fermi design deficiency was applicable to Quad Cities Units 1.and 2 and Dresden Units 2 and 3. These BWR units were selected for review of their LPCI swing bus configuration because we believe their design is similar to the Fermi design i.e., the transfer scheme requires two DC control power sources to accomplish the 480V swing bus AC power transfer from one redundant division to the other.
By letters dated December 21 and 22, 1987 from J. A. Siladay to T. E. Murley, CECo notified the NRC of the Fermi scenario's applicability to Dresden and Quad Cities units and confirmed that the existing 125V DC control power for the LPCI swing bus transfer scheme represents a potential single failure which should be corrected. However, our scope of evaluation is confined to modifications pertinent only to a single failure of DC control power, not the station battery.
ss10260494 8::nof3 '"
PDR ADOCK 050002~7 p
~
-~
2.0 EVALUATION The existing 480V LPCI swing bus design for Quad Cities and Dresden (See Figure-1) is nonnally fed from Division II via two in series interrupting devices; Quad Cities uses a circuit breaker and contactor while Dresden uses two circuit breakers in series.
Upon loss of the nonnal feed, the bus automat-ically transfers to its Division I Standby Alternate 480V power source. This is accomplished upon sensing under-voltage from the nonnal 480V source (Divi-sion II) for longer than 15 seconds.
The auto bus transfer for each plant is accomplished as follows:
For Quad Cities Units 1 (2), nonnally closed contactor 1952 (2952) opens on sensing under-voltage and nonnally closed breaker 1951
{2951) is tripped open from the normal 480V power source by using DC control power from the Division II battery.
Upon expiration of the 15 sec time delay, the transfer to the Alternate 480V Division I {Bus 18) takes place by closure of both the normally open circuit break~r 1851 {2851) and contactor 1852 (2852) by using DC control power from the Division I battery.
The Dresden Unit 2 (3) existing design {See Figure-!), has a nonnally closed.
circuit breaker 2971 (3971} which is tripped open along with circuit breaker 2972 (3972) by utilizing DC control power from the Division II battery. Then, the transfer to the Alternate 480V Division I (Bus 28) power source is complet-ed by closing both normally open circuit breaker 2871 (3871) and circuit breaker 2872 (3872) by utilizing DC control power from the Division I battery.
Interlocks are provided for each interrupting device {i.e., breaker or contactor) within a division and between redundant divisions. Thus, to com-plete the transfer, the design requires 125V DC control power from the Division II battery to open and Division I battery to close all the necessary circuit breakers or contactors to complete an automatic transfer. In the event of a DC failure in either division (i.e., battery or control power), the auto transfer will be blocked.
To remedy the Quad Cities and Dresden design deficiency in the swing bus transfer scheme, the.licensee submitted a study titled "Evaluation of Alternate LPCI Swing Bus Transfer Schemes," prepared for CECo by Sargent & Lundy (S&L) dated February 19, 1988.
The evaluation considered the following three alter-native designs:
I) eliminate reliance on Division II battery to accomplish auto transfer.
II) provide an automatic switchover capability from a primary to a backup source of 125V DC control power at Division II by making available two sources of control power.
III) provide two different control powers (Division I & Division II) for the two circuit breakers in Division II (applicable to only Dresden)
- In addition to correcting the subject swing bus des1gn deficiency, CECo contracted S&L consultants to further review our concerns raised during a telecon with CECo on February 5, 1988 regarding the following items:
- 1)
Additional options to the three already evaluated alternatives.
- 2)
Proper coordination between the feed breakers and the LPCI swing bus for various fault conditions.
- 3)
Battery system review to detennine whether loss of one division of either DC system would result in unacceptable degradation of ECCS.
- 4)
Failure Modes and Effects Analysis (FMEA) that reviews all aspects of the swing bus transfer devices' control logic, both.
before and after this proposed modification
- All these studies have been completed and submitted to the NRC for review by CECo in letters dated May 13, 1988, June 21, 1988 and July 9, 1988. The.
staff is in the process of evaluating these studie~.
The licensee has selected the Alternative I transfer design for both Quad Cities and Dresden, rather than one of the other two alternatives, because Alternative I doesn't compromise required cable separation and independence of redundant DC power sources. Alternative I, for Quad Cftfes requires removing the auxiliary interlocking contact (1951/a) for breaker 1951, which is located in the trip circuit of breaker 1851.
The primary purpose of contact 1951/a was to prevent simultaneous closure of both breakers 1951 and 1851 between the Dfvfsion I and II power supplies (thus protecting against a cross-tie of redundant power sources). For the Dresden modfffcation, CECo decided to replace circuit breakers 2972 and 2872 with ac contactors thus modifying the configuration and transfer scheme of Dresden to be identical with the one at Quad Cities.
With the existing design deficiency, certain abnonnal plant conditions (within the required design basis) could result in a failure of the automatic transfer function from energizing the swing bus which supplies power to all of the LPCI flow control valves (i.e., total loss of LPCI capability). For example, if a LOOP de-energized 480V AC Bus 19 (Divfsfon II) coincident with a loss of Division II 125V DC control power (due to a single failure) the swing bus would become de-energized without the ability to transfer automatically. A detailed sequence of events would be as follows (refer to figure-1):
- 1) LOOP creates an under voltage condition on the LPCI swing bus, 2) 480V AC Bus 18 (Division 1) output*breaker (1851) attempts to close and re-energize swing bus as part of automatic transfer scheme, 3) Interlocking contact 1951/a immediately trips breaker 1851 open because the Bus 19 output breaker (1951) is still closed (failed closed due to loss of Division II control power), and 4) Bus 19 (conse-quently the LPCI swing bus) remains de-energized since Division II control power is also necessary to start the diesel generator to load onto Bus 19 during a LOOP.
However, this deficiency in the swing bus automatic transfer
L_
- scheme design can be corrected by removing auxiliary contact 1951/a from the trip circuit of breaker 1851 {Alternative I des1gn). This design modification alters the aforementioned scenario by allowing breaker 1851 to remain closed (because interlock with breaker 1951 fs removed) whfch energizes contactor 1852 to close and thus establish proper transfer. Once the transfer f s completed (i.e., breaker 1851 and contactor 1852 closed), interlocks are provided to prevent breaker 1951 and contractor 1952 from closing. Therefore, with th1s modification in place there is no longer any reliance upon the Division II battery to accomplish the auto transfer, in effect correcting the design deficiency. The original AC power supply configuration may be returned to the preferred lineup by a manual control, when appropriate control and motive power sources are restored.
Although this design mod1f1catfon removes one of the two interlocks which protects against a cross-tie of redundant power sources, CECo has utfl1zed breaker coordination f n combination with the remaining interlock to protect dgainst this occurrence.
As previously ment1oned the staff is review;ng the S&L study submitted by CECo 1n a letter dated May 13, 1988 (Study 2) to determine the adequacy of the breaker coordination between the feed breakers and the LPCI swing bus. The staff has determined that proper breaker coordination in comb1natfon with a single interlock 1s an acceptable alternative to the utilization of two interlocks.
3.0 FINDINGS The scope of thfs safety evaluation was 11m1ted to mod1f1catfons of DC control power for the LPCI swing bus transfer scheme (and not the entire D.C. system and station battery).
We reviewed th£ lfcensee' s proposed three a lternatfve swing bus transfer schemes and determined that Alternative I is an acceptable design because ft maintains:
- 1)
Orfgfnal transfer philosophy and licensing basts for the plant.
- 2)
Or1g1nal electrical separation criteria (i.e., no redundant DC division crosst1e within a 480V AC division).
- 3)
No reliance on D1v1s1on II battery power to trip the circuit breaker 1951 prior to accomplishing transfer to the alternate source.
- 4)
Interlock protection between two AC power divisions to prevent paralleling of redundant power sources.
Independent of the swfng bus design issue, CECo has asserted that the histori-cal licensing basts of their ECCS single failure assumptions for Dresden and Quad Cities have only considered single "active" component failures. Conse-quently their previous LOCA analyses have not addressed failures of "passive" components such as the 125V DC battery. The licensee was advised by the staff that single failure criterion, as applied to electrical systems, is all inclu-sive (1.e. must include battery failures). Acceptance criteria of DC power
- systems, according to the Standard Review Plan (as well as historically),
requires that the DC system must have redundancy and meet the single failure criterion.
NRC has never distinguished between active and passive electrical failures. Results of our evaluation regarding acceptability of CECo's ECCS analysis which does not postulate failure of a station battery is provided in.
As agreed in a December 21, 1987 telecon, the licensee provided an evaluation of the probability of a postulated battery failure coincident with LOOP and LO~A. They estimated the probab!l~ty of simultaneous LOCA~ LOQ~,and battery fa1 lure to be on the order of 10 per year. They further stated that this probability is wel1_~elow the corranonly accepted threshold for safety signifi-ca~4 sequence of 10 per year and the typical plant core damage frequency of 10
- Based on this probability estimate and other mitigation factors, such as monitoring of key battery related parameters in the control room and surveil-lance of the station battery, we agree with the licensee's assessment that the potential safety significance, resultant from the effects of a sing.le failure in DC control power for the transfer scheme, is low for the interim period prior to implementation of corrective circuit modifications. Therefore, the proposed schedule for implementation of circuit modifications is acceptable.
- 4. 0 CONCLUSION Based on our review of the licensee's proposed LPCI swing bus transfer modifi-cation, which was designed to keep a failure of 125V DC control power (assumed to occur simultaneous with LOCA and LOOP) from precluding LPCI swing bus transfer, we concur with the Alternative I design proposal. for both Dresden and Quad Cities units. We've concluded that it will correct the existing design deficiency and is acceptable.
Furthennore, the licensee's proposed implementation schedules provided for each of the four units are as follows:
- 1.
Quad Cities Unit 2
- 2.
Quad Cities Unit I
- 3.
Dresden Unit 2
- 4.
Dresden Unit 3 April, 1988 outage June, 1989 outage October, 1988 outage December, 1989 outage We find the licensee's proposed implementation schedules acceptable.
Principal Reviewer:
P. Kang Dated: October 13, 1988
1/
... l DIV. II 125 vdc DIV. II DIV. II 125 Vdc DIV. II 125 Vdc DIV. II BUS 19 (29) *.
480 Vac DIV. I BUS 18 28 I N.C.
) 1951 (2951)
N.O.
1851 (2851) 125 Vdc 1
)
DIV. I N.C.
N.O.
_;.....__19_s_2 -(-29_s_2 l ____
__,..._T_~l852 (2852)
LPCI SWING BUS 18/19-5 (28/29-5)
PROPOSED A EXISTING QUAD CITIES - 1 (2)
BUS 29 (39) 480 vac DIV. I BUS 28 38 I N.C.
125 Vdc )
N.O.
)
2971 (3971)
DIV. I 2871 (3871) e N.C.
125 Vdc I)
N.O.
2972 (3972)
DIV. I 2872 (3872)
I I
- LPCI SWING BUS 28/29-7 (38/39-7}
DIV. II 125 Vdc DIV. II EXISTING DRESDEN - 2 (3)
BUS 29 (39) 480 Vac I) N.C.
2971 {3971)
N.C.
125 Vdc DIV. I DIV. I I )
BUS 28 (38)
N.O.
2871 (3971) 2972 (3972)
N.O.
__ _i ___ :1 -----_:_ __
..... T __
2812 (3872)
LPCI SWING BUS 28/39-7 (38/39-7)
PROPOSED DRESDEN 2 (3)
FIGURE -1