ML17311B311

Safety Evaluation Supporting Amends 102,90 & 73 to Licenses NPF-41,NPF-51 & NPF-74,respectively

ML17311B311
Person / Time
Site:	Palo Verde
Issue date:	11/28/1995
From:	NRC (Affiliation Not Assigned)
To:
Shared Package
ML17311B310	List: ML17311B309 ML17311B311
References
NUDOCS 9512140031
Download: ML17311B311 (14)

Text

gP,S RE00 (4

~o Cy C1O I

g Vl0

+~

~O

++*++

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 GU 0

NO 102 TO 90 0

0 ZONA PU

IC S

C 0

G C

S G

C S

ALO VERDE NUCLEAR GENERATING STATION UN T NOS.

1 2

AN 3

OCK NOS.

STN 50-528 S

N 5 -5 ND STN 50- 30 l.

TTR IITI By application dated July 3, 1995, the Arizona Public Service Company (APS or the licensee) requested changes to the Technical Specifications (Appendix A'o Facility Operating License Nos.

NPF-41, NPF-51, and NPF-74) for the Palo Verde Nuclear Generating Station, Units 1, 2, and', respectively.

The Arizona Public Service Company submitted this request on behalf of itself, the Salt River Project Agricultural Improvement and Power District, Southern California Edison

Company, El Paso Electric Company, Public Service Company of New

Mexico, Los Angeles Department of Water and Power.,

and Southern California Public Power Authority.

The proposed Technical Specification (TS).amendment temporarily adds new Action Statements 3.8.1. l.f and 3.8. l.l.g to TS 3.8.1. 1, "A.C. Sources Operating," to provide a method of responding to switchyard voltages within the expected range but below the level necessary to provide adequate voltage for full potent>al plant loading.

These TSs are supplemented by administrative procedures which are intended to prevent extended operation with inadequate voltages.

The staff made changes to the proposed technical specifications which were discussed with the licensee.

The new ACTION statements would require the manual blocking of fast bus transfer (FBT) on one train within the first hour of detecting a switchyard voltage falling below the level necessary for the electrical distribution system (EDS) to maintain compl'iance with General Design Criterion (GDC) 17 of Appendix A to 10 CFR Part 50. If the switchyard voltage condition continues beyond the first hour, the emergency diesel generator (EDG) for the second train would be started, connected in parallel with the grid through the emergency bus and loaded; the emergency bus would then be separated from the grid before the end of the second hour.

Acceptable switchyard voltage is required to be restored within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or plant shutdown would be required.

Alternatively, fast bus transfer for the second train would be blocked before the end of the second hour.

Bases 3/4.8.1, 3/4.8.2, and 3/4.8.3

("A.C. Sources,"

"D.C. Sources,"

and "Onsite Distribution Systems," respectively) are also being revised to provide guidance on how and why offsite power voltage in the lower portion.of the expected range and the number of startup transformers in service affect compliance with GDC 17 and to provide the basis for the additional action statements.

95$ QQQQQ3 1 5QQQ5+8 OR AOOCI P

0 Qi

2.0 BACKGROUND

The Palo Verde EDS is comprised of two redundant, independent, preferred offsite AC power circuits and two redundant, independent, onsite EDGs.

The offsite power is normally supplied via the startup transformers to the Class lE 4.16-kV buses through the essential safety feature (ESF) transformers.

The site has three startup transformers, each of which supplies two power circuits

~

~

~

~

~

~

i.e., six circuits for three units).

Each startup transformer supplies two ifferent units; in other words, each unit's Class lE onsite circuit is fed from different startup transformers.

Should a loss of offsite power occur, the Class lE 4.16-kV buses separate from the ESF transformers and receive power from the EDGs.

The non-Class 1E portions of the EDS are fed from the main generator through the auxiliary transformer.

Should a plant/main generator trip, an FBT occurs, transferring the non-Class lE loads from the auxiliary transformer to the startup transformers.

As a result of this transfer, all Class lE and non-Class 1E 1oads are fed from the two startup transformers which feed that unit.

In Section 8 of the Palo Verde Safety Evaluation Report (NUREG-0857) and its supplements, the staff documents the adequacy of the offsite and onsite electrical distribution system.

Palo Verde was initially licensed with FBT blocking circuits (letter from E.

E.

Van Brunt, Jr.

(APS), to F. J. Hiraglia (NRC), dated March 31, 1982).

If the switchyard voltage could not provide adequate voltages at the Class 1E 4. 16-kV buses after an FBT of non-Class lE loads from the auxiliary transformer to the startup transformers, the FBT blocking relays would anticipate this and would prevent the transfer of the non-Class IE loads, to the startup transformers.

This maintained adequate voltage to the ESF equipment needed for the mitigation of a design basis accident from the Class lE EDS throughout the entire range of expected switchyard voltages, but resulted in a loss of power to all non-Class 1E loads (e.g.,

the reactor coolant pumps,, circulating water pumps, and normal plant lighting).

Until self-identified by the licensee as a deficiency in 1990, settings for protective relays for the high-voltage electri'cal distribution systems for Palo Verde were performed by a division of APS not within the scope of the Palo Verde 10 CFR Part 50, Appendix B, guality Assurance Program; Configuration Control Program; or Design Control Program.

The relays that blocked FBT under certain low-voltage conditions were reset lower in 1986 in an effort to enhance a second function (generator coastdown) of the relays.

The new relay setting created an unreviewed safety question because it created a system response that had not previously been analyzed.

On an accident signal, that response was the loading of ESF equipment onto the offsite source of power, stripping of that equipment off the source due to the action of the degraded voltage relays, and then reconnecting the equipment onto the EDGs (i.e., double sequencing).

However, resetting the relay to its pre-1986 setting is not recommended by the licensee because (1) the original setting was determined to be too high for its generator coastdown function and could cause a unit trip under load rejection conditions; (2) assumptions made by the original architect/engineer for the Class IE electrical distribution system may be inadequate and may have resulted in an inadequate original design

II 4~

1

(i.e., the light and heavy loads are more extreme than originally assumed);

and (3) the original design did not employ fault-tolerant logic and could, therefore, permit unnecessary challenges to safety systems.

Since the setting for the FBT blockinq relays has been identified as inadequate through the licensee's engsneering "Design Basis and Calculation Reverification" efforts, switchyard voltage has been administratively controlled above 525-kV to preclude "double sequencing".

Probabilistic risk analysis (PRA) performed by the licensee has compared the probability of a core-melt event for (1) blocking fast bus transfer in one train after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> for the next 71 hours8.217593e-4 days <br />0.0197 hours <br />1.173942e-4 weeks <br />2.70155e-5 months <br />, and in the second train after 2

hours for the next 70 hours8.101852e-4 days <br />0.0194 hours <br />1.157407e-4 weeks <br />2.6635e-5 months <br />; (2) blocking fast bus transfer in one train after the first hour for the next 71 hours8.217593e-4 days <br />0.0197 hours <br />1.173942e-4 weeks <br />2.70155e-5 months <br /> and supplying power to the other train from the EDG after the second hour for 70 hours8.101852e-4 days <br />0.0194 hours <br />1.157407e-4 weeks <br />2.6635e-5 months <br />; and (3) a normal shutdown assuming the plant is in a normal configuration and no other transients or accidents, except an uncomplicated reactor trip, occur during the shutdown process.

Because the proposed actions would allow operation for up to 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> s with one offsite circuit inoperable, 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> was chosen for comparison purposes.

The PRA has shown that the probability of a core-melt event during power operation with FBT blocked in one train after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> for the next 71 hours8.217593e-4 days <br />0.0197 hours <br />1.173942e-4 weeks <br />2.70155e-5 months <br />, and in the second train after 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> for the next 70 hours8.101852e-4 days <br />0.0194 hours <br />1.157407e-4 weeks <br />2.6635e-5 months <br /> is approximately 1.91E-6.

The probability of a core-melt event during power operation with FBT blocked in one train after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> for the next 71 hours8.217593e-4 days <br />0.0197 hours <br />1.173942e-4 weeks <br />2.70155e-5 months <br /> and the EDG powering the opposite train after the second hour for the next 70 hours8.101852e-4 days <br />0.0194 hours <br />1.157407e-4 weeks <br />2.6635e-5 months <br /> (the proposed configuration) is between approximately 1.91E-6 and 1.93E-6.

The probability of a core-melt event due to a normal

shutdown, assuming the plant is in a normal configuration and no other transients or accidents (except an uncomplicated reactor trip) occur during the shutdown process,

.is 2.4E-6.

The licensee's temporary change is designed to balance the probability of double sequencing due to low switchyard voltage coincident with an accident, which is unlikely (4.9E-5/r-y), against the probability of loss of forced circulation due to a unit trip coincident with low voltage and the FBTs

blocked, which is also unlikely but more probable (4.0E-3/r-y).

3.0 LICENSEE COMPENSATORY ACTIONS As an interim measure, the licensee has abnormal operating procedures, which instruct that when all three startup transformers are in service, switchyard voltages are to be maintained at voltages between 525-kV and 535.5-kV.

Unit 1

is not vulnerable to double sequencing at or above, including instrument uncertainties, approximately 524-kV; and Units 2 and 3 are not vulnerable at or above, including instrument uncertainties, approximately 518-kV.

The difference is due to additional loads on Unit 1 from the water reclamation facility.

In addition, with this amendment FBT is to be manually blocked in one train within the first hour when voltages below these values are encountered.

The train which is blocked is then capable of supporting ESF loads throughout the entire range of expected switchyard voltages.

If the low voltage continues into the second hour, the EDG for the other train is to be

started, connected in parallel with the grid, loaded, and separated from the

gl

~

C IV

grid by the end of the second hour.

In this configuration, the plant then has only one offsite power circuit inoperable which must be restored within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or plant shutdown is required.

This amendment request includes an option to block FBT in the second train within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

This option is provided primarily in the event of complications.with the EDG.

When only two startup transformers are in service, the voltage provided to all three units must be at or above, including instrument uncertainties, approximately 525-kV.

However, the response is the same as with three startup transformers in service.

The blocking of one train of FBT returns one train of offsite and onsite power to conformance with GDC 17 throughout the entire range of expected switchyard voltages.

The train not blocked will have the ESF loads supplied by its EDG should the disturbance last beyond the second hour.

This action minimizes the potential to double sequence in either train in the event of an accident.

The other option of blocking FBT in the second train would return both trains of offsite and onsite power to conformance with GDC 17 throughout the entire credible range of sustained switchyard voltages and is in conformance with the current licensing basis.

Pending modifications to restore automatic voltage protection, administrative controls between the licensee's Energy Control Center (ECC) and the Palo Verde Unit 1 control room have been implemented.

The ECC has been instructed to maintain switchyard voltage between 525-kV and 535.5-kV.

An alarm has been established at the ECC at 526-kV.

When the alarm sounds, the ECC has been instructed to call the Unit 1 control room.

Unit 1 will coordinate the response for the site.

If the switchyard voltage is below the unit-specific required voltages, the affected units will enter the abnormal operating procedures.

Currently, the licensee administratively maintains the switchyard between 100 percent (525-kV) and 102 percent (535.5-kV) of nominal voltage to

~

~

~

~

~

~

~

~

reclude, among other things, the voltage at the EDS buses from dropping too ow and causing an adverse condition among the Class lE loads.

The licensee has performed additional analyses (including uncertainties) to show that at switchyard voltages above 99.6 percent (523.09-kV), the "double sequencing" scenario cannot occur.

An indicator within the Palo Verde plant monitoring system (PHS) computer has been recently activated.

The switchyard voltage is now displayed on a

computer terminal in the control room and changes color if the voltage falls below required levels.

The event also registers on the computer typer.

This indication allows Unit 1 to rely on the PHS in addition to the ECC, to determine if action i5 required due to sustained switchyard voltage in the lower portion of the expected range and to coordinate the response with Units 2 and 3.

A Region IV inspector reviewed Procedure 41AO-lZZ57, "Degraded Grid Voltage,"

Revision 4.

This procedure provided operator guidance at all three units to respond to switchyard voltage in the lower portion of the expected range in various plant modes.

The basic action was to restore one emergency bus in

4l l

each unit by blocking the fast bus transfer of non-safety-related loads to the startup transformers which supplied the safety-related loads.

The inspector reviewed the effect of blocking the fast bus transfer and determined that licensee calculations indicated this block would allow safety-related voltage to remain above the degraded voltage relay setpoint.

The inspector reviewed the requirements the licensee provided to the ECC.

In addition, the inspector toured the ECC, reviewed the grid information available there, and discussed the Palo Verde site voltage requirements with ECC personnel.

The inspector determined that grid voltage and current information were readily available in the ECC.

The inspector reviewed licensee letter file 95-005-419.8, "PVNGS Expectations Regarding Evaluations Potentially Affecting Grid Voltage Range Limits," dated February 23,

1995, and ECC internal instructions and noted that operational expectations were clearly stated.

In addition, the inspector noted that the ECC had in place an audible alarm for warning when grid voltage at the site approached 100 percent (525-kV).

The inspector concluded that the licensee had taken reasonable corrective actions to identify when a low-voltage condition existed on the grid and what actions to take to ensure that Palo Verde units remain operable or in compliance with the TS.

4.0 NEW TS SECTIONS 3.8.l.l.f and 3.8.1.I.

and BASES The proposed TS amendment temporarily adds new Action Statements 3.8. l.l.f and 3.8.l.l.g to TS 3.8.1.1,, "A.C. Sources-Operating,'"

to provide a method of responding to sustained switchyard voltage in the lower portion of the expected range.

These action statements would require the manual blocking of FBT en one train within the first hour of a degraded switchyard voltage should the switchyard voltage fall below the level necessary for the EDS to maintain compliance with GDC 17 of Appendix A to 10 CFR Part 50.

If the switchyard voltage condition continues beyond the first hour, (I:) the EOG for the second train would be started, connected in parallel with the grid through the emergency

bus, loaded, and separated from the grid before the end of the second

hour, and the offsite circuit would.be restored within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />; or (2) fast,bus transfer for the second train would be blocked before the end of the second hour; or (3) the unit would, be put in hot standby within the next 6

hours and in cold shutdown within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

Bases 3/4.8.1, 3/4.8.2, and 3/4.8.3, "A.C. Sources,"

"O.C. Sources,"

and "Onsite Distribution Systems," respectively, are being revised to provide guidance on how and why switchyard voltage in the lower portion of its expected range and the number of startup transformers in service affect compliance w>th GDC l7 and to provide the basis for the additional action statements.

5. 0 EVALUATION The plant has implemented measures in conjunction with the Energy Control Center to avoid operating the plant with the offsite voltage in the lower portion ((525 kV) of its expected range.

In the past year, there have been a

few times when the voltage dropped below this level; however, none lasted longer than a few minutes.

This has provided reasonble assurance that

0 C

I

/

operation of the plant with the offsite voltage in the area of concern will be avoided to the extent possible.

However, if such a situation should persist, the plant has prepared new technical specification provisions.

The plant is currently licensed to have both trains of FBT automatically blocked when low switchyard voltage exists.

As stated

above, the interim administr~tive procedures and temporary TS Actions.are being added to prevent double sequencing events from occurring.

The train that is manually blocked is consistent with previous UFSAR Chapter 6 and Chapter 15 safety analyses.

Under this condition, it will be able to contribute to.the mitigation of an accident as initially analyzed and licensed.

The EDG, which is loaded and isolated from offsite power is also acceptable for the limited period of time since the entire system can withstand a loss of offsite power (LOP).

With both trains blocked, the EDS is also in an analyzed condition.

The risk associated with low switchyard voltage, without fast bus transfer blocked, lies in the potential for "double sequencing".

The proposed temporary response is to prevent the double sequencing potential in one train of the EDS within the first hour by blocking FBT.

This then places the plant in a configuration which has the other train of offsite and onsite power inoperable, since none of the ESF equipment in the second train could be guaranteed to operate after being double sequenced.

In this configuration the plant does not meet single failure and therefore response within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> is appropriate.

With one train of FBT blocked, the other train of offsite and onsite power is inoperable.

The next most limitinq action for the unblocked train is TS 3.8.2.1.a, "D.C. Sources Operating," which has an allowed outage time of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

In a low voltage event, the ability of the Class lE 125-VDC battery chargers to perform their function is indeterminate since the Class lE 125-VDC batteries must be assumed to provide the 125-VDC control power to the Class lE ESF circuit breakers for both of the sequences during the double sequencing and the Class lE 125-VDC battery capacity calculations assume only one sequence.

Exceeding this Limiting Condition of Operation is avoided by starting the EDG, connecting it through the emergency bus in parallel with the grid, loading it, and disconnecting the emergency bus from the grid within the second hour of a low switchyard voltage.

This restores the associated Class lE battery charger to,operable status and eliminates the vulnerabil.ity to double sequencing on the second train because if an accident occurs, the loads will be automatically loaded onto the

.EDG only and the second breaker cycling sequence will not occur.

Once power is provided to the second train from the EDG, only one offsite power circuit remains inoperable.

Under such a condition, the plant would normally enter Action Statement 3.8. l.l.a, which requires the restoration of the inoperable power source to operable within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

The proposed actions are consistent with such actions by allowing operation for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> from the onset of the low switchyard voltage before requiring the plant be placed in hot standby within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and cold shutdown within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

Alternately, FBT can be blocked in the second train to return it to operable within the second hour.

Since the plant was originally licensed with both

l

trains blocked in low voltage situations, no further action would then be necessary.

However, the licensee's actions provide for a maximum duration in this condition of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

The licensee is operating under temporary measures in order to maintain design/operation compliance with UFSAR Section 8.3.1. 1.3 and prevent double sequencing during a degraded voltage condition.

These amendments will expire upon the implementation of the final modification.

Based on the above, the staff finds this temporary change to be acceptable.

6.0 ST E CONSULTATIO In accordance with the Commission's regulations, the Arizona State official was notified of the proposed issuance of the amendments.

The State official had no comments.

7. 0 ENVIRONMENTAL CONSIDERATION The amendments change a requirement with respect to the installation or use of a facility component located within the restricted area as defined in 10 CFR Part 20.

The NRC staff has determined that the amendments involve no significant increase in the amounts, and no significant change in the types, of any effluents that may be released offsite, and that there is no significant increase in individual or cumulative occupational radiation exposure.

The Commission has previously issued a proposed finding that the amendments involve no significant hazards consideration, and there has been no public comment on such finding- (60 FR 39431).

Accordingly, the amendments meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9).

Pursuant to 10 CFR 51.22(b) no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendments.

8.0 CONCLUSION

The Commission has concluded, based on the considerations discussed

above, that (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed

manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendments will not be inimical to the common defense and security or to the health and safety of the public.

Principal Contributors:

C.

Thomas D. Acker Date:

el I