ML17313A924
| ML17313A924 | |
| Person / Time | |
|---|---|
| Site: | Palo Verde  |
| Issue date: | 05/04/1999 |
| From: | Thatcher D NRC (Affiliation Not Assigned) |
| To: | Richards S NRC (Affiliation Not Assigned) |
| Shared Package | |
| ML17313A923 | List: |
| References | |
| TAC-MA4406, TAC-MA4407, TAC-MA4408, NUDOCS 9905170150 | |
| Download: ML17313A924 (10) | |
Text
I
~
~
~
~g R500
~4
~o Cy 0O 1
0
/p qO
+w*w+
UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 May 4, 1999 FROM MEMORANDUMTO:
Stuart A. Richards, Director Project Directorate IV8 Decommissioning Division of Licensing and Project Management Dale Thatcher, Section Chief Electrical Engineering Section Electrical 8 Instrumentation 8 Controls Branch Division of Engineering
SUBJECT:
REQUEST FOR ADDITIONALINFORMATION,PALO VERDE TECHNICALSPECIFICATION AMENDMENTRELATEDTO DOUBLE SEQUENCING (TAC Nos. MA4406, MA4407, and MA4408) p Palo Verde Nuclear Generating Station Arizona Public Service Company 50-528, 50-529 and 50-530 MA4406, MA4407and MA4408 PD IV Mel Fields DE/EEIB Awaiting Information Plant Name:
Utility:
Docket Nos.:
TAC Nos.:
Resp. PD:
Project Manager.
Review Branch:
Review Status:
Attached is a request for additional information on Arizona Public Service Company's proposed change to the Palo Verde Technical Specifications dated December 16, 1998. The technical specification change request is related to double sequencing at Palo Verde.
Please forward the attached questions to the licensee.
1
Attachment:
As stated CONTACT:
J. Lazevnick, DE/EEIB 415-2782 9905i70i50 9905ii PDR ADQCK 05000528 p
1
~
gAR REGNI (4
~
~4 "o
Cy I
nO I
0 Yr
~O
+a**+
UNITED STATES NUCLEAR REGULATORY COMIVIISSION WASHINGTON, D.C. 20555-0001 REQUEST FOR ADDITIONALINFORMATION PALO VERDE TECH SPEC AMENDMENTREQUEST DATED DECEMBER 16, 1998 REGARDING DOUBLE SEQUENCING Your December 16, 1998, submittal states that Palo Verde Technical Specification (TS) 3.8.1 Condition G is being revised to ensure that the appropriate actions will be taken to prevent double-sequencing of the safety-related loads.
Condition G of the revised TS is:
"One or more required offsite circuits (s) do not meet required capability." The submittal states that maintaining the "required capability" ensures that post-trip voltage willstay above the degraded voltage relay (DVR) trip setpoint and the event will not cause loss of offsite circuits. The submittal indicates that the operators willuse the proposed Bases for TS 3.8.1 Condition G to assess whether the offsite circuits meet the "required capability."
The "required capability" of the offsite power circuits is based upon the pre-trip switchyard voltage, the number of Palo Verde units online and capable of regulating switchyard voltage, post-trip startup transformer loading, and number of 525 kV transmission lines in service.
With regard to the switchyard voltage portion of the operator's assessment, the submittal states that the maximum drop in switchyard voltage that would occur as a result of a Palo Verde unit trip has been determined analytically by a bounding grid calculation.
Has the accuracy of the grid calculation been determined?
How? What is the accuracy, and has it been verified using actual grid experience?
How willthe bounding grid calculation be kept current with changing grid conditions over the years?
Is a program in place to keep it current?
The submittal states that with one or the other Palo Verde units online and available to regulate switchyard voltage, the switchyard voltage will not change significantly following a unit trip. In this condition, the post-trip switchyard voltage is assumed to be equal to the measured steady-state pre-trip switchyard voltage.
Have you considered how the switchyard voltage would be affected ifthe remaining Palo Verde unit (s) were operating at their maximum MVARcapability prior to the unit trip? For example, iftwo Palo Verde units were online generating their maximum MVARs supporting the switchyard voltage, how would the switchyard voltage be affected ifone of the units tripped?
Has this been considered in developing the operators'ssessment for the "required capability" of the offsite circuits?
3.
The submittal states that maintaining the "required capability" ensures that post-trip voltage willstay above the DVR trip setpoint and the event will not cause loss of offsite circuits. Have you established that the safety equipment willstart and operate properly if ATTACHMENT
r, I
I
the offsite source voltage is at a value just'above the point at which the DVRs would actuate?
That is, have you performed both a dynamic and steady state analysis to verify that safety equipment would safely start and continue to operate ifthe switchyard voltage is at a point just above a value that would result in actuation of the relays?
What technique was used to perform the analysis, hand calculation or software program?
Has the technique been validated, by a test or otherwise?
4..
a.
In the submittal you state that APS has not been able to identify a practical automatic device that would prevent double sequencing.
Reference 19 contained in a 1997 IEEE paper, "A Discussion of Degraded Voltage Relaying for Nuclear Generating Stations," identifies a potential method for accomplishing this. This reference (S. Z. Haddad, J. B. Wisniewski, and S. G. H. Ashrafi, "Degraded Voltage Protection for Nuclear Plant Safety-Related Loads," Transactions ofthe American Nuclear Society, vol. 66, 1992, pp. 442-443) recommends a
supervisory instantaneous undervoltage relay whose function would be to decide at the instant of a LOCA signaI whether LOCA mitigation should be from the off-site power supply or from the diesel generator.
Have you considered such protection at Palo Verde?
Ifso, why was it ruled out?
b.
An additional option that is available is to reduce the time delay of the DVR and utilize a loss of power relay with a definite time delay characteristic and higher setpoint (around 80%). This would provide a smaller window of vulnerability that equipment is exposed to before they are separated from the degraded offsite system.
The tripping of the main generator could also be delayed until after all automatic load sequencing has taken place in order to maintain the higher pre-trip switchyard voltage during the electrically demanding load sequencing period, and utilize the DVR protection during steady-state operation for which it is better suited. While these options would not preclude double sequencing, they would provide better assurance that the electrical equipment could tolerate it.
Have these options been considered?
Ifso, why were they ruled out? Have other options been considered?
What are they and why were they ruled out?
Your submittal implies that double sequencing must be avoided for an accident scenario to be safely mitigated. What brings you to this conclusion?
Are your conclusions the same for a double sequencing scenario that is initiated by a non-degraded voltage delayed loss of,offsite power as for the double sequencing that is initiated by a degraded voltage?
We understand that the double sequencing of safety equipment has been previously'demonstrated by a test at Palo Verde.
Ifthere is concern for double sequencing that is the result of a non-degraded voltage delayed loss of offsite power, what did the test fail to capture that is the cause for the concern?
In your April 7, 1999, meeting with the NRC staff in Rockville, Maryland you provided an estimate of the frequency of a low switchyard voltage occurring with an accident at Palo Verde. This frequency was 7.5E-8/year.
The probability that the switchyard voltage would be low was obtained by taking the total amount of time (12.5 minutes) that the Palo Verde switchyard voltage was less than 525 kV, over the period of time (4.25 years) that the procedural controls were in effect at Palo Verde.
Ideally, the estimate of the
t l,
probability that the switchyard voltage would be low following an accident would be obtained by collecting data on the number of times a plant trip resulted in a low switchyard voltage.
This would capture any failures of grid voltage correction equipment (generator voltage regulators, capacitors, SVCs, etc.) following a trip, and also any analytical inaccuracies.
Is this data available over the period of time the procedural controls were in effect? Ifso, what has it shown?
In addition, please submit the frequency estimates provided in the April 7, 1999, meeting and identify how the results were obtained.
In the April 7, 1999, meeting with the NRC staff you showed a slide entitled "Actions Taken" which identified a list of things that had been done at Palo Verde relative to the undervoltage problem.
Please provide that list, including any other measures
- taken, along with a discussion of each item and what it has accomplished.
Identify those measures that are used to control the switchyard voltage level and that provide the operator with information that the voltage level is approaching or may be in an unsatisfactory range.
Identify the setpoints of any low voltage alarms or trips.
Your submittal states that the "required capability" of each offsite circuit must be reviewed ifeither of the following conditions exist:
~,
The steady-state switchyard voltage is below 525 kV or
~
Only one Palo Verde unit is online and capable of regulating switchyard voltage (generator synchronized to the grid and automatic VAR control equipment in service).
What is the "automatic VAR control equipment" referred to in the second bullet? Does this equipment automatically compensate for the lost VARs provided by a Palo Verde generator that has tripped? What mechanism will provide the lost VARs that were being provided by a Palo Verde generator that has tripped?
,9.
Following an accident, what is the sequence of events and approximate times of accident signal initiation, reactor trip, safety load initiation (start of load sequencing),
turbine trip, generator trip, non-safety load fast bus transfer, and WRF trip? What signals initiate each of these?
10.
We note that there are a number of options available to the operator to exit revised Condition G. One of those would be to block fast bus transfer which, depending on the number of offsite circuits affected and transfers blocked, could leave the plant reliant on natural circulation when the plant trips. There is however no time limitwith the plant in this condition that we are aware of. Because of this, this might be the operator's'referred choice since Required Action G.2 (Transfer the ESF bus(es) from the offsite circuit(s) to the EDG(s)) would still leave the plant in a 72-hour or 24-hour Action statement.
We recognize that there are often competing safety and regulatory demands between the choices the operator must make and believe that these considerations and some guidance should be provided to the operators in the TS Bases to help him make the correct choice.
Please provide a discussion of the options available to the operator
0
to exit Condition G and identify the safety and regulatory consequences of each of those.
Add some guidance of this nature to the TS Bases or explain why it is not needed.
11.
TS 3.3.7 Surveillance Requirement (SR) 3.3.7.3 is being changed by deleting the specific voltage at which the DVR time delay occurs.
The time delay however is specified as "~ 35 seconds" with no lower limit. With no lower limiton the time delay the delay could degrade to a very short delay, such that the DVR would separate the offsite system from the safety buses on a short negative voltage transient when it is not necessary to separate.
A lower limitshould therefore be specified for this time delay.
12.
TS 3.3.7 SR 3.3.7.3 is being changed for the loss of voltage relay to verify the time response at 0 volts (~ 2.4 seconds) rather than 2929.5 volts (z 11.4 seconds).
The explanation provided is that there is no specific requirement in any analysis that the loss
, of voltage relays trip in 2.4 seconds or less for a complete loss of voltage function; their explicit function is to trip in 2.4 seconds or less for a complete loss of voltage condition.
The loss of voltage setpoint (~ 3250 volts) is also being deleted.
The explanation provided is that although the nominal setpoint of these relays is 3250 volts, they will not necessarily trip at that level; the manufacturer only shows the time/voltage curve for these relays in the range of 0 to 2925 volts because the trip time above 2925 is less predictable.
The relay in question is apparently a time undervoltage relay with inverse time characteristics.
While we agree that the primary function of the relay is to detect a loss of voltage, there is also a secondary function provided by this relay. That function is to provide a lower limitfor the DVR such that a voltage that falls substantially below the setpoint of the DVR will be detected by the loss of voltage relay and trip the circuit more quickly than the DVR, avoiding the potentially more limiting effects of the lower voltage.
The change to only test the relay at 0 volts would not verify this secondary function of the relay. We agree that the nominal setpoint (3250 volts) is not a predictable value. at which to check the timing of the relay. Therefore," we believe that the relay timing should be checked at the maximum (2929.5 volts) and minimum (0 volts) points shown on the manufacturer's time/voltage curve for the relay.,ln addition, the surveillance should specify a lower as well as an upper limitfor the time delay to avoid unwanted separations from the offsite power system as explained in question 11 above.
13.
One of the changes being made to the Palo Verde UFSAR is the deletion of a statement that the time delays of the undervoltage relays are such that: "The allowable time delay, including margin, does not exceed the maximum time delay that is assumed in accident analyses."
No explanation for this deletion has been provided. Please explain why this statement is being deleted and the impact on the safety analysis.