ML18078A477
| ML18078A477 | |
| Person / Time | |
|---|---|
| Site: | Salem  |
| Issue date: | 11/27/1978 |
| From: | Calvo J Office of Nuclear Reactor Regulation |
| To: | Rosa F Office of Nuclear Reactor Regulation |
| References | |
| REF-GTECI-A-44, REF-GTECI-EL, TASK-A-44, TASK-OR NUDOCS 7812060382 | |
| Download: ML18078A477 (64) | |
Text
'.-
/
/
- ~._, '.
/
/
/
DISTRIBUTION:
CENTRAL FILE PSB READING JCALVO READING
+ ATTACHED LIST MEMORANDUM FOR:
Faust Rosa, Chief, Power Systems Branch~ DSS FROM:
SUBJECT:
J. A. Calvo, Power Systems Branch, DSS
~SW~M_AR_'{* OF MEETING CONCERNING REVIEltJ OF iHE
- ELECTRICAL SYSTEMS FINAL REQUEST FOR INFORMATION FOR SALEM NUCLEAR GENERATING STATION, UNIT 2 On October 24-25, 1978, \\'Je met with the applicant at the Headquarters of Public Service Electric and Gas Company in Newark, New Jersey to.
discuss the final request for information pertaining tb the electrical systems.
A summary of the discussion is presented in Enclosure 1. Enclosure 2 summarizes the review status of each item after discussion with the applicant. Enclosure 3 presents the final request for information for* the electrical systems. l\\n attendance list is appended as* Enclosure
. 4.
In accordance with our conversation9 by copy of this memorandum, we are requesting* the DPM to forward. tb the app 1 i cant copies of a 11 the
- enclosures.
Enclosures*:
- 1. Meeting'Discussion
- 2.
Review Status Summary Power Systems Branch
-Division of Syttems Safety
- 3.
Final Request for Information
- 4. Attendance List 7 B l 2 _o Jo 3 1 z...
DSS:PSB Ol'l'ICll,.,.
jta.Tvci:*5*;sl\\l **************************.........................
llURNAMIE~
- o o o o o o O oo o o o o 1 o o o o o O o o o oo O '"'" ***' o o o o o o o O o OO O OO o o o o o Oo o OOOO IO o OOI OOOOO 0 oo ool O O O O O O oo O O 0 01 O O O O O O O o o o o I 0 I 0 Io Oo O o o O o 1 o o o o o o o ', o o o o 0
0 00 0 0 O O 0 0
0 O ooo,oo O OOO 0 DATii:~ 11/15/78
- ~*************************........................... *............................................................................
Mi1C PORM 318 (9*76) :NaCM 02413 u.a. GOV*RNM*NT f'IHNTJNC OP'F'ICE: 1978 - z** - 1e1
DISTRIBUTION Docket File NRR Reading PSB Reading H. Denton R. Mattson S. Hanauer R. Fraley, ACRS D. Ross D. Vassallo D. Skovholt V. Benaroya R. Tedesco I&E (3)
NRC PDR Local PDR W. Morrison A. Dromerick F. Rosa H. Li G. Zech F. Orr Meeting Attendees J. Calvo
- e.
UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D. C. 20555 MEMORANDUM FOR:
Faust Rosa, Chief, Power Systems Branch, DSS FROM:
J. A. Calvo, Power Systems Branch~ DSS
SUBJECT:
SUMMARY
OF MEETING CONCERNING REVIEW OF THE ELECTRICAL SYSTEMS FINAL REQUEST FOR INFORMATION FOR SALEM NUCLEAR GENERATING STATION, UNIT 2 On October 24-25, 1978, we met witr the applicant at the Headquarters of Public Service Electric ar:d Gas Company in Newark, New Jersey to discuss the final request for information pertaining to the electrical systems.
A summary of the discussion is presented in Enclosure 1.
summarizes the review status of each item after discussion with the applicant. Enclosure 3 presents the final request for information for the electrical systems. An attendance list is appended as Enclosure
- 4.
In accordance with our conversation, by copy of this memorandum, we are requesting the DPM to forward to t~e applicant copies of all the enclosures.
Enclosures:
- 1.
Meeting Discussion
- 2.
Review Status Summary
'7
/ /'
/'.l~
~
(A.,
l.--G'i Jose A. Calvo Power Systems Branch Division of Systems Safety
- 3.
Final Request for Information
- 4.
Attendance List
\\i ENCLOSURE 1 SALEM NUCLEAR GENERATING STATION, UNIT 2 DOCKET NO. 50-311
SUMMARY
OF MEETING CONCERNING THE ELECTRICAL SYSTEMS FINAL REQUEST FOR INFORMATION OCTOBER 24-25, 1978 On October 24~?-~-,=--l ~~~-,--t_he _ _!!~~ ~ ~-~f_! ~i!J-~-~ -~!~-~--:re_p_r~~e!.f_ta~~ ~e~~- ~c--_Pii?_n c Service Electric and Gas Company in Newark, New Jersey to discuss the final request for information pertaining to the electrical systems. summarizes the review status of each item after discussion with the applicant. Enclosure 3 presents the electrical systems final request for information. A summary of the discussion of each item of request for information is as follows:
40.l Offsite and onsite emergency power systems interactions.
Reference was made to a letter from the applicant to the Division of Operating Reactors, dated August 1, 1977, that documents the applicant 1s response to our positions regarding offsite and onsite emergency power S)stems interactions.
Position 1 - Second level of undervoltage protection.
The appli-cant has documented that extensive studies of the electrical grid system have indicated that with the present and projected system configurations, the voltage at the Salem station switch-yard, under severe contingency conditions, will not go below 95%
. ; of the rated voltage. Also, the applicant has documented that with the use of the automatic load tap changing in the transformers, the safety-related loads will operate satisfactorily with offsite power vcltage as low as 91% under the most adverse conditions. Therefore, the applicant claims that since adequat~ margin exists, the second level of undervoltage protection is not needed.
We noted that the information presented in the aforementioned letter was insufficient and we requested that additional informa-tion be submitted in sufficient detail to permit an independent evaluation of the design.
We indicated that the contingency and operating conditions that were considered in the under¥oltage ca1-culations should be defined. Also, under the most limiting adverse condition, the drop in voltage at the various voltage levels includ-ing the final voltage at the terminal of the driven equipment should be stated. The final terminal voltage available for start-ing the last electrical components should be compared with the mi.nimum voltage required for starting those components.
We also requested that the basic criteria for design and operation of interconnected power systems associated with the Public Service Electric and Gas Company grid should be submitted for our review.
The applicant agreed to provide the information requested and whatever other information is required to substantiate the vol-tage margins and to permit an independent evaluation of the under-voltage calculations.
Position 2 - Load shedding capabilities. The design complies with our position that requires the automatic prevention of load shedding of the emergency buses once the diesel generators are supply-ing power to a11 sequenced loads on the emergency buses.
- However, the design did not include the capability of having the load shedding feature to be automatically reinstated if the diesel generators supply breakers are tripped.
We informed the applicant that the reason for this requirement is to preclude administrative procedural errors in the reinstatement of the load shedding feature from interfering with the availability of emergency power.
The applicant indicated that the safeguards equipment controller that governs the load shedding and sequencing operati.on provides indication in the control room of whether the load shedding feature has been reinstated. This feature in each diesel generator is manually reinstated from the control room via push-button control.
The provisions of the design to have re-instatement status indication and control of the load shedding feature available to the operator in the control will minimize adminis~
trative procedural errors from interfering with the availability of emergency power.
Therefore, we concluced that the existing design is acceptable.
Position 3 - Technical Specification requirements.
The applicant has taken exception to the technical specification that requires simulating interruption and subsequent reconnection of onsite power sources to their respective buses.
The purpose of this specifica-tion is to verify that the load shedding feature has been automatically reinstated.
In view of the fact that manual reinstatement of this feature has been found acceptable, there is no need for this tech-nical specification. Therefore, we accepted the applicant's excep-tior and waived this specification.
Position 4 - Transformer voltage tap settings verification.
Before initial reactor power operation, the applicant has agreed to verify by actual measurements and by correlation of measured values with analysis results the adequacy of the voltage tap settings of the intervining transformers. This commitment is consistent with our position in this regard and is acceptable.
40.2 Diesel generator alarms in the control room.
We noted that a letter from the Division of Operating Reactors to the applicant, dated Septmeber 18, 1978, documents our acceptance of the design of the diesel generator alarms and control circuitry for Sa1em, Unit 1. The applicant indicated that the design of the diesel generator alarms and control circuits for Salem, Unit 2 is identical to that of Salem, Unit 1.
On the basis of both designs being identical, we concluded that the Salem, Unit 2 design in this regard is also acceptable.
40.3 Direct current power system surveillance and specifications.
Recommendation 1.
The applicant indicated that the position of circuit breakers or fuses associated with the battery charger, battery and direct current bus supply are monitored by means of bus undervoltage and blown fuse alarms.
The direct current onsite emergency power system is considered a supporting system as such the bypassed and inoperable status indication of this system at the system level is not needed._ The protection systems being served by the di re ct currE':nt emergency power sys tern will reflect on their own inoperability status indication at the system level the conditions of the supporting power systems.
Our review deter-mined that the design has implemented this recommendations and is acceptable.
Recommendations 2.
The applicant indicated that the design has the built-in capabi 1 ity for verifying peri odi ca lly the current 1 imi ting characteristics of the battery chargers. It was agreed that periodic testing of the current limiting characteristics of the battery chargers will be. included in the technical specifications.
We indicated that we will examine the details of how this test will be performed and monitored during our review of the technical specifications.
L_ Recc.mmendation 3.
The applicant agreed to include in the technical specifications cell-to-cell and terminal connection resistance measurements for each battery.
We stated that during our review of the technical specifications we will examine the details of how these measurements will be accomplished.
Recorrmendation 4a.
The applice.nt stated that.the design did not include a bi-directional and dual range ammeter.
The applicant indicated that the design includes a uni-directional ammeter which wtll be used in conjunction with a battery voltmeter to ascertain whether the battery is on floating and equalizing charge.
The uni-directional.ammeter will also monitor the battery output current when it is supplying power.
The applicant noted that the design of the direct current emergency power system did not permit the connection of large direct current motors. These are being powered from a dedicated 250 volt battery system.
Our review determined that the design satisfies the intent of this recommenda-tion and is acceptable.
Recommendati.on 4b.
The: applicant indicated that the design does not include an alarm when the battery charger goes into a current limiting condition. It was noted that such an alarm will be bene-fidal when large motors are being supply by the battery system and the current drawn by them is in excess of that being supply by the battery charger.
However, it was pointed out that the design of Salem, Unit 2 did not provide for the connection of large loads to the Class lE battery systems.
Also, it was indicated that any fault condition that could cause the charger to go into a current limiting condition would be indicated as high current discharge in the battery ammeter and would cause a low battery voltage alarm.
In view of the fact that the design does not permit the connection of large direct current motors to the Class lE battery system, it appears than an exception to this recommendation is acceptable.
We agreed with the applicant exception in this regard.
Recommendation 4c.
The applicant indicated that the design did not provide for a temperature indicator physically located in each battery room to measure the ambient temperature.
- However, the applicant noted that, as part of the technical specifications, every seven days a different pilot cell in each battery room is selected and the electrolyte temperature of that cell is measured.
We considered this alternative method for ascertaining the temperature of the batteries at each room acceptable.
Recommendation 5.
The applicant stated that the battery chargers are capable of supplying rated load without the batteries operating in parallel. The voltage variation in this mode of operation is within design specifications. It was noted that the design of each redundant Class lE 125 volt direct current distribution system and each redundant Class lE 28 volt direct current distribution
.. system includes two full capacity battery chargers.
Furthermore, the applicant indicated that Section 4.8.2.3.2(c) of the technical specifications for Salem, Unit 2 set forth the requirements for testing the battery chargers which are consistent with satisfying this recommendation.
Our review determined that the design satis-fies this recommendation and is acceptable.
Recommendation 6.
The applicant indicated that the direct current equipment is rated and qualified for operation at the equalizing charge voltage and rated discharge voltage.
The applicant noted that 139 volts were the highest voltage pennitted for operation of equipment and the battery charger will be tripped when this vol-tage is exceeded.
Our review determined that the design satisfies this recol'TJl1endation and is acceptable.
40.4 Cross-connection of redundant electrical equipment.
The applicant noted that the subject of interlocks between redundant safety-related systems and components has been addressed in the responses to request for information items 6.28.4 and 8.6.
With regard to performing an audit of the design to determine that disabling of one component does not render other redundant components inoperable, the applicant noted that such an audit was performed in the past in response to a request for information from the NRC.
The applicant indicated that there were no co~ponents that could be rendered inoperable as a result of disabling other redun-dant components.
The applicant agreed to document and submit the results of this audit to the NRC.
Based on the review of the afore-mentioned information, we have found the design acceptable.
- However, the final acceptability of the design is predicated on the satisfactory documentation of the audit results.
40.5 Grid Stability.
We requested the applicant to provide the results of an up-to-date electrical grid stability analyses showing that the loss of the most critical power source, or load, or inter-tie will not affect the stability of the Public Service Electric and Gas Company grid or the ability to provide offs ite power to Sa 1 em station.
We indicated that the analyses be based on the maximum projected seasonal peak load during the year that Salem, Unit 2 will be connected to the grid.
We also requested the applicant to illustrate the behavior of the grid for each postulated loss of power or load condition on swing curves and to provide a single-line diagram of the interconnected power system considered in the grid stability analyses.
Tb_e effects of recent New York city power blackout on the Public Ser-vice Electrical and Gas Company grid were discussed.
The applicant stated that the design of the Public Service Electric and Gas Company grid provides for the automatic opening of feeders to the New York City when overcurrent and underfrequency conditions are detected.
40.6 Physical independence of the offsite power system.
Reference was made to Figure 8.2-1 of the FSAR with regard to whether the separation of the transmission lines supplying offsite power to the station at tower 1/1 satisfies the physical independent require-ments of the Commission 1s General Design Criterion 17.
We asked the applicant to justify the adequacy of the distance between transmission lines at tower 1/1.
The applicant indicated that the distance between the transmission lines at this tower does not need to be established because tower 1/1 is considered to be part of the switchyard which is accepted as a common area for the offsite power circuits by the Commission 1s General Design Criterion 17.
We accepted the applicant 1s explanation in this regard and concluded that the design was acceptable.
With regard to the physical independence of the offsite power connec-tions between the swttchyard and the emergency buses room, the appli-cant stc;ited tha.t the power cables from the offs i te power trans formers to the emergency buses are routed through concrete encased duct bank.
Our review determined that this design arrangement includes the required separation and is acceptable.
40.7 Electrical independence of the offsite power system.
Offsite power is supplied from the 500 kilovolt switchyard to two 500/13.8 kflovolt station power transformers which are connected to different bus sections of the switchyard.
The secondaries of the two 500/13.8 kilovolt transformers are configured into a 13.8 kilovolt sectionalized ring bus arrangement.
Sectionalizing breakers in the ring bus are normally open, electrically separating the secondaries of the two 500/13.8 kilovolt transformers.
Each 500/13.8 kilovolt transformer feeds two (one for each unit) 13/4 kilovolt station power transformers.
Each 13/4 kilovolt transformer is connected to two of four non-safety related group buses and three emergency buses.
Normally, the four non-safety related group buses in each unit are supplied from the unit generator through the 25/4/4 kilovolt unit auxili.ary transformer. These buses will be automatically transferred to their assi.gned 13/4 kilovolt transformer in the event of a generator trip.
The emergency loads for each unit are distributed among three emergency buses.
All three emergency buses can be fed from either of the two 13.8/4 ki.lovolt transformer serving that unit; normally, one bus is fed from one transformer and two bl1ses from the other. The* emergency buses wi 11 be automatically transferred to the othe:r transformer upon the loss of power in the transformer that they were connected.
In the event of a failure in the transformer which feeds two emergency buses, the transfer of at least one bus to the other transformer is necessary to assure that the mi.nimum redundancy required of the safety systems is maintained when the offsite (preferred) power system ts supply"tng power to the emergency buses.
To preclude the possibility of simultaneous failure of both offsite power circuits of a unit at the 500 kilovolt switchyard from single events such as a breaker not operating during fault conditions, failure of primary and backup protective relaying, loss of control circuit power supply, the design provides for the independent and separate source of direct current for controlling the operation of the switchyard breakers.
We requested the applicant to verify that equi-valent provisions have been incorporated into the design of the off-site power circLlits between the switchyard and the emergency buses.
Our review of this subject with th~ applicant revealed that in the event of loss of power to the 13/4 kilovolt offsite power transformer whi.ch feeds two emergency buses, the failure of a single relay in the control circuits of the in-feeder breakers connecting this trans-former to the emergency buses will frustrate the transfer of the two emergency buses to the other transformer.
Failure to transfer of at least one emergency bus results in the loss of capability of the offsite power system to supply the minimum required power to the safety systems.
We noted that such a design was inconsistent with the Commi:ssi_on's General Design Criterion 17 with regard to minimizing the probabiltty of the simultaneous failure of both offsite power cir-cuits as a result of a sin£le event.
The applicant contented that the des_i:gn of the offs i_ te power sys tern has been found -acceptable by the NRC and satisfy the Commission's General Design Criterion 17 as indicated in the safety evaluation report published October 11, 1974.
The applicant was advised that since this report was issued, a series of failures have occurred in the offsite power systems of operating plants that hc:.ve challenged the availability to provide offsite power to the nuclear power units. These occurrences have prompted the Regulatory staff to examine closely the design of the offsite power systems and to require correction of any deficiencies found in the design.
The applicant indicated thc:.t the failure of the offsite power system to supply the emergency loads is circumvented by the onsite (standby) eme_rgency power system which has sufficient capacity and czpability to supply fndependently all the emergency loads.
Furthermore, the applfccnt indicated that the: importance to safety of the offsite power system is minimized in the safety analysis of the plant when credit is not given for the availability of offsite power during accident con-ditions.
We emphasized that the requirements for having an offsite (preferred} power system and an onsite (standby) power system, each ccpable of independently supplying the emergency loads is consistent wi:th the overall 11defense in depth 11 design philosophy for assuring safety.
,. The applicant was informed that the design of the offsite power system did not satisfy the Commission's General Design Criterion 17 for the reasons stated above and that we require that the design be modified accordingly.
While preparing the meeting minutes on this item wrich required the review of certain information contained in Section 8.0 of the FSAR and the safety evaluation report, it came to our attention that the loads in the non-safety related group buses are automatically trans-ferred to their assigned offsite power transformer upon the loss of the normal supply (unit auxiliary transformer) which occurs when the generator is tripped.
We were under the impression at the meeting with the applicant that the transfer of these loads to the offsite power transformers will be only accomplished by manual means.
We have verified this design feature with the applicant who has confirmed that th.e Joads in the group buses will be automtically transferred to the offstte power transformers. It is our concern that the trans-fer of the non-safety related loads to the offsite power transformers under low grid voltage conditions may cause the voltage level to drop below a point in the emergency buses which may not be sufficient for picking up all required safety loads. Also it is our concern that a single failure in the automatic transferring scheme of the non-safety loads may result in the: simultaneous loss of both offsite
- 1. power circuits.
We will request that the applicant address these con-cerns and either demonstrate the capability of the design in each case against the requirements of the General Design Criteria 17 and 18 or modify it accordingly.
40.8 Reactor coolant pump breaker qualification.
We requested the applicant to verify that the worst case of under frequency and maximum frequency decay rate expected at the Salem station as a result of electric grid disturbances will be within the corresponding values established in the accident analysis for prevent-ing fuel damage, without the need of tripping the reactor coolant pump breaker to assure that the pump coastdown function is maintained. It was noted that the postulated loss-of-flow transient has been analyzed based on a flow coastdown that is equivalent to a linear five to six hertz/secord frequency decay rate for the reactor coolant pump power supply.
The applicant provided the results of an evaluation which indi.c;ates that the maximum expected frequency decay rate at the Salem station is less than or equal to 3 hertz/second.
We requested that a description of the terms of the calculations as well as the calcula-tions themselves be submitted formally for our review.
40.9 125 volt direct current onsite emergency power system, 230/115 volt alternating current vital system and 28 volt direct current vital system interconnections.
We noted that the design of these safety-related systems provides for manual cross-connection of redundant divisions within a system and between a division in one system with a different division in another system. Also, we noted that each redundant distribution bus in each one of the direct current systems is being fed by two battery chargers and one of them is connected to a different division in the 230 volt alternating current vital system as that of the direct current distribution bus.
We requested the applicant to examine each interconnection within and between these systems and demonstrate the capability of the design to withstand single events (including exposure fires) without the loss of protective function.
The interconnections between redundant divisions in the 125 volt di.rect current onsite emergency power system and in the 28 volt direct current vital system, are accomplished via manually operated, mechanically interlocked breakers through which power is supplied to the load distribution buses. A mechanically interlocked breaker can be connected to either of two redundant divisions via separate feeder breakers.
We suggested that administrative controls be instituted that will preclude having both feeder breakers associated with a mechanically interlocked breaker close at the same time.
The appli-cant indicated that it needed to examine the fire hazard analysis for this case before consideration can be given to our suggestion.
With respect to the interconnections between a division in the 230 volt alternating current system with a different division in the 115 volt alternating current system, the applicant indicated that the feeder breakers in the 230 volt standby power sources to the 115 volt vital buses will be normally maintained open under administrative control.
Our review determined that keeping the feeders breakers of the 230 vclt standby power sources open during normal reactor operation will minimize the probability of compromizing the independence between redundant divisions and therefore, we concluded that the design is acceptable.
Each direct current distribution bus is fed by two battery chargers; one is connected to the same division in the 230 volt alternating current vital system as that of the direct current distribution bus, and th~ other is connect to a different division.
We expressed con-cern about compromizing the independence between divisions as a result of a failure in the battery charger which is connected to a different divisfon.
The applicant indicated that the battery charger serves as an isolation device and the propagation of failure from one redundant division to another will not occur. At our request, the applicant agreed to provide information for our review that substantiates the ade-quacy of the battery chargers as isolation devices.
We noted that credit cannot be given in the technical specifications for th.e operability of any portion of the subject systems when it is being powered from a division which is different from its normal assigned division.
The applicant brought to our attention that Section 3.8.2.3 of the technical specifications for the Salem station as written permits continual operation with either one of the two battery chargers operable.
We noted that permitting a direct current distribution bus to be supplied by a battery charger which is connected to a different division as that of the bus, will cause two direct current redundant divisions to be fed by battery chargers which receive input power from the same 230 volt alternating current bus.
We expressed concern that a single failure in the common 230 volt alternating current bus could degrade the capability of two redundant divisions of direct current emergency power below a point where it would result in the loss of pro-tective function.
We indicated that this concern will be resolved if the two battery chargers will be connected to the same division as that of the distribution bus that they feed.
We stated that we will not con-sider a direct current redundant distribution bus operable if it is being supplied by a battery charger that receives input power from a division different as that of the bus.
The applicant was advised that we will not give credit for continual operation under this condi-tion unti.l such a time that the capability of the design to withstand eac~ single event without the loss of protective function is demonstrated.
The appli:cant agreed to substantiate the adequacy of the design in this regard.
40.10 Non-safety loads on emergency direct current sources.
We required the applicant to verify whether the ampere-hour capacity of each 125 volt battery is suitable for supplying all assigned safety and non-safety loads and all cross-connected loads from other redun-dant batteries for a minimum of two hours without the use of the battery chargers.
The applicant indicated that if all the loads which can be cross-connected to a battery are supplied from that battery, the demand on the capacity of the battery would have only increase by approximately two per cent. The applicant presented a tabulation of 1 oads verifying that each 125 volt battery has sufficient margin to carry all the safety and non-safety loads that can be connected to it.
We -also requested the applicant to verify the same information for each 28 volt battery. The applicant stated that if all transferable loads capable of being connected to a single 28 volt battery are supplied by it, the demand on the ampere-hours of the battery would have increase by approximately 17 per cent.
The applicant verified that each 28 volt battery has sufficient margin to carry all the safety and non-safety loads that can be connected to it.
We asked the applicant whether the design provides for the disconnec-tion of non-safety loads from their respective Class lE batteries during accident conditions.
The applicant stated that the batteries are sized to carry all safety and non-safety loads capable of being connected to them. - All non-safety loads are connected to the Class lE batteries through Class lE breakers. Furthermore, the applicant noted that the design includes a 250 volt direct current battery sys-tem which is used to supply power to turbine generator emergency auxiliary motors.
Our review of the design determined that the 125 volt and 28 volt battery systems have sufficient capacity to supply all the loads capable of being connected to the systems, and the connection of non-safety loads on the Class lE batteries will not degrade the capability of the~ battery systems to supply power to a11 safety loads during emergency and accident conditions.
We concluded that the design is acceptable.
40.11 Sharing of the direct current emergency power systems between units.
We noted that Figure 8.3-7 of the FSAR depicts the 125 volt direct.
current emergency system of Salem, Unit 2 being shared with Salem, Unit 1 and vi.ce versa. This is being accomplished via the non-s_afety related buses that supply control power to the 460 volt equipment in the circulating water intake area.
The applicant indicated that
- there is not sharing in the design because only loads are transferred from one power source in one unit to another source in the other unit.
.. Furthermore, the applicant indicated that the circulating water intake area is part of a system which is considered common to both units and as such a single failure in this system will apply to both units. Therefore, the remaining portions of the 125 volt direct current emergency system in each unit, after the single failure, are all that is required to either supply the minimum engineered safety feature loads or the minimum loads to safely shut down the unit.
We indicated that we will consider the applicant 1s justifica-tion of the design in this regard.
There are two non-safety related buses that supply control power to the 460 volt equipment in the circulating water intake area.
Each bus is being fed via a swing breaker whith can be connected to a division of direct current power in unit l or a division in unit 2 through separate feeder breakers that are normally close.
Each non-safety related bus is assigned to a different division in each unit.
Our re-evaluation of the design interconnections has indicated that we have not considered the possibilty of a single event in the ci:rculating water system (common to both units) causing the failure of both non-safety related buses.
It is our concern that the con-sequences of this si.ngle event could result in the loss of two direct current divisions in each unit.
We have considered the appli-cant*s justification of the design and concluded that we cannot pass
40.12
~ judgement on the adequacy of the design until the capability of the*
Class lE design interconnections associated with the non-safety related buses is demonstrated to withstand the effects of single events in the circulating water system.
We will request that the applicant address this concern and either demonstrate the capability of the design interconnections against every single design basis event without the loss of safety function, or modify it to provide the required independence between Class lE divisions.
Compromizing the independence of the vital instrument buses.
We noted that two of the four redundant vital instrument buses were supplied from the same 230 volt alternating current vital bus and backed up from the same 115 volt direct current emergency bus.
We expressed concern abo~t a single failure in either the common 230 volt bus or in the common 115 volt bus could degrade the capability of the two redundant vital instrument buses below a point where it would result in the loss of protective function to mitigate the con-sequences of some accidents.
The applicant indicated that the pro-tective instrumentation has been distributed among the four redundant vital buses in such a manner that if the failure of two redundant vital buses could occur, it would not cause the loss of any pro-tective function.
Our review findings are in agreement with the applicant's justification of the design and we concluded that the design is acceptable.
40.13 28 volt direct current vital system for manual control of protection systems.
The 28 volt direct current vital system include~ a two-division split bus configuration which supplies control power to the three-division split bus alternating-current configuration via the 115 volt direct current emergency power system or the 115 volt alternating current vital system. It appears that the design of the 28 volt direct c_u_rrent _________________ _
vital system for manual control of protection systems satisfies the requirements of IEEE Standard 279-1971 with regard to manual initiation of a protective action at a system level. However, it is not apparent from the information presented in the FSAR whether there arE' some protec-tive actions that are manually initiated at the component level because of 1 imi ted nu_mber of equipment operations i nvo 1 ved.
We expressed con-cern about a single failure in one of the two redundant 28 volt direct current vital distribution systems may preclude the manual initiation of sufficient components in supporting systems and systems initiated at the component level that the protective function cannot be accomplished.
We requested the applicant to perform an audit of the design in this regard.
The results of the audit revealed that the recirculation line for both safety injection pumps to the refueling water storage tank could not be isolated as a result of a single failure in the 28 volt distribution bus that provides power for manual control of the two serially connected isolation valves (SJ67 and SJ68) in the recirculation line. This line need to be isolated during the recirculation mode of the emergency core cooling system to preclude the containment sump effluent from being diverted to trie refueling water storage tank. The applicant pro-posed closing these valves manually at their location in the event of the loss of manual control capability from the control room.
The applicant was advised that the acceptability of *_i~*~*-_p-~~P9~~1-~_H -.. -----~~--:__=_
be evaluated by the NRC staff.
The staff has reviewed the applicant proposed manual actions to isolate the safety injection pumps recirculation line from outside the control room and has found them unacceptable.
The applicant has been informed that we require that all actions during the recirculation mode of the emergency core cooling system, following a loss-of-coolant accident, must be accomplished from the control room.
The applicant has agreed to comply with this requirement.
Each valve control circuit will be provided with an additional push-button which will be located in the control room in the same location as that of the switch used to lock out motive power to the valve during normal reactor operation.
Each push-button will be used to manually close the corres-ponding valve when required and participates in a circuit which do not depend on 28 volt direct current power for operation.
We do not anti-cipate wny problems in the implementation of this design modification and conclude that the design as proposed to be changed is acceptable.
40.14 Power supply diversity for the auxiliary feedwater system.
We requested the applicant to verify that the electrical aspects of the auxiliary-feedwater system satisfy' the diversity -requirements set forth in Branch Technical Position APCSB 10-1 included in Section 10.4.9 of the Standard Review Plan.
The auxiliary feedwater system is comprised of two 50 per cent capacity motor-driven pumps and one: 100 per cent capacity steam-driven pump.
All flow control valves associated with the: three pumps are operated by air. Each valve has an electricc.1/_hy_cl_r-a~Jj~_s~t~~m~_c~baril_sm wht~b is used to position the air-op~rated valve.
The design provides for automatically opening of each valve upon the loss of air pressure.
The electrical/hydraulic servomechanism of the air-operated valves associated with each auxiliary feed pump received power from separate and independent 115 volt alternating current vital buses.
Each vital bus is normally supplied from a static inverter system.
The input to the inverter is from either an alternating current/direct current power supply or the 125 volt direct current system.
In the event of total loss of alternating current to the station, the 125 volt direct current system will provide power to the inverters which in turn wil,l keep the 115 volt alternating current vital buses energized.
Power from one of these vital buses will permit control of the air-operated valves associated with the steam-driven pump.
Our review determined that the design satisfies the motive power diversity requirements set forth in Branch Technical Position APCSB 10-1 and is acceptable.
40.15 Diesel generator cape.city.
We asked the applicant to verify whether all the safety and non-safety loads assigned to each diesel generator were shown in Table QB.8-1 of the FSAR.
We also requested the applicant to verify whether the coin-cident demand load of each diesel generator (when all assigned safety and non-safety loads are connected to it) will exceed the continuous rating of the diesel generator.
The applicant indicated that all safety and non-safety loads assigned to each diesel generator are noted in Table QB.8-1 with the exception of the pressurizer he:aters (750 kilowatts) which are assigned to one of the three diesel generators.
The applicant noted that the pressurizer heaters needed to be connected to the Class lE source in order to meet control room evacuati6n criteria.
It was noted that the continuous rating of each diesel generator will be exceeded if the total load assigned to it will be connected simul-taneously.
We asked the applicant to describe the means provided for disconnecting certain safety and non-safety loads during accident con-ditions to preclude exceeding the continuous rating of the diesel generator.
The applicant indicated that each safeguards equipment con-troller that governs the load shedding and sequencing operation will assure that the continuous rating of a diesel generator will not be exceeded during accident conditions. Our review determined that the provisions of the design to shed those loads which are not required during accident conditions will assure that the capacity and capability of the diesel generator is maintained and therefore, we concluded that the design is acceptable.
40.16 Diesel generator reliability qualifications.
We asked the applicant to verify that each diesel generator satisfies the frequency and voltage variations stated in Position 4 of Regulatory Guide 1.9. The applicant indicated that the diesel generators of Salem, __ Ur:itL2 are identical to those of Salem, Unit 1. With regard to Regulatory Guide 1.9, the applicant noted that the diesel generators of Sal em, lJ_ni t_ l exceeded the frequency decrease limit specified in position 4 of the guide during the loading of the service water pumps.
However, the applicant indicated that periodic testing performed in accordance with technical specification requirements has demonstrated the capability of the diesel gener_ato-rs __ fo qu_i_c~Ji __ ~eco~er- _:from th~
frequency dip and to continue with the sequential connection of the loads. It was noted that this non-conformance of the design with the reconunendation: of Regulatory Guide 1.9 was-brought up to the atten-tion of the NRC when it was detected during preoperational testing.
We asked the applicant to identify and justify any deviations of the reliability qualification testing progrC".m followed for the diesel
. generators of Salem, Unit 2 to the positions presented in Branch Tech-nical Position EICSB 2 of Appendix 7-A of the Standard Review Plan.
It was noted that this position did not apply to Salem, Unit 2 since the diesel generator SE:ts for Salem, Unit 2 have been previously u:.ed as standby emergency power sources in nuclear power plants such as Sal em, Unit 1.
40.17
- 40. 18
- 40. 19 Our review determined that tbe non-conformance of the design with the recommendations of Regulatory Guide 1.9 has been adequately justi-fied by periodic testing.
On the basis that the Salem, Unit 2 di:esel generators are identical to those of Salem 1, Unit 1, we concluded that we do not require additional information pertaining to the reli-ability qualification testing progrc.m of the diesel genera.tors.
Diesel generator protective trips.
We noted that the design of certain diesel generator protective trips (e.g., reverse power, lube oil pressure low) did not satisfy the posi-tions set forth in Branch Technical Position EICSB 17 of Appendix 7-A of the Standard Review Plan.
We asked the applicant to either justify the non-conformance of the design in each case or modify it to satisfy the Branch Technical Position EICSB 17.
The applicant agreed to do this.
Reactor containment electrical penetration design conformance with standards and regulatory guides.
We asked the applicant to state the degree of conformance of its design to IEEE Standard 317-1972 and Regulatory Guide 1.63.
We also asked the applicant to provide the information requested for this item in.
The applicant agreed to do this.
Epoxy insulation failures in reactor containment electrical penetrations.
The applicant indicated that the electrical penetrations were manu-factured by the Conax Corporation and the design did not include epoxy insulation.
40.20 Power connection requirements for the re~idual heat removal letdown line isolation valves and interlocks.
The overpressurization protection requirements for the residual heat removal system have been inplemented in the design of the power connec-tions to the tw(l serially motor-operated isolation valves (RH42 and RH43) in the residual heat removal letdown line and to the corresponding interlocks. Each motor-operated valve is supplied from separate 230 volt alternating current vital motor control centers.
Although, the de$ign of the power connections to these two valves satisfies the overpressurization requirements of the residual heat removal system, it does not satisfy the requirement to achieve cold shutdown, assuming a single failure. This is because there is only a single letdown line with two isolation valve in series to provide suc-tion to the residual heat removal pumps.
The applicant was advised that the staff has accepted for Salem, Unit 2 manual corrective actions to compensate for electrica1 failures in these two valves.
The staffis bases for acceptance of the design in this regard are similar to those documented in supplement number seven to the safety evaluation of Diablo Canyon Nuclear Power Station, Units 1 and 2, issued May 1978.
40.21 Environmental qualifications of electrical equipment located inside containment.
The applicant indicated trat the subject of environmental qualifications of electrical equipment located inside containment has been addressed in response to request for information item 7.30.
The applicant
40.22 40.23 nc.ted that this respons.e has been recently submitted to the NRG for review in letter of October 20, 1978.
Environmental qualification of electrical equipment located outside containment.
The applicant indicated that this sub~ect of environmental qualification has been addressed in response to request for information item 7.32 which ha~ been recently submitted to the NRG for review in letter of October 20, 1978.
Degree of compliance with Regulatory Guide 1.75.
We.noted that the electrical design did not satisfy the recommendations of Regulatory Guide 1.75, particularly with regard to maintaining mini-mum vertical and horizontal distance between redundant cable trays.
The applicant noted that extensive flame tests have been performed to demon-strate the adequacy of the cable arrangement, and the results of these tests were shown to the NRG and its fire consultants.
We advised the*
applicant that the adequacy of the cc.ble installation will be evaluated during the fire review~
40.24 Submerged electrical equipment as a result of a loss-of-coolant accident.
The item pertaining to whether the integrity of the containment electri-cal penetrations could be compromised as a result of a single failure that precludes the protective devices from interrupting the fault currents caused by the floodin£ of safety or non-safety electrical equipment will be considered during our review of the response to item 40.18 above.
We asked the applicant to verify whether additional electrir.a1 equipment will be submerged as a result of further increase of water level in the containment caused by a single failure that precludes the isolation of other sources of water from the containment, following a loss-of-coolant accident.
The applicant indicated that the only other source of water of concern is the main feedwater which is stopped from being injected into the containment by either tripping the steam-driven main feedewater pumps, or closing pump discharge valves, or closing the steam generator inlet isolation valves.
The applicant indicated that a single failure will not preclut the isolation of the main feedwater from the containment.
We considered the applicant 1s response to our request for information in this regard acceptable.
40.25 Bypassed and inoperable status indication for safety systems.
We asked the applicant to state the extent of conformance of the elec-trical power system design to thE* positions set forth in Regulatory Gui.de 1.47 and Branch Technical Position EICSB 21 of Appendix 7-A of the Standard Review Plan.
The applicant indicated that the electrical as well as the in=trumentation and control aspects of safety systems were considered in the indication system to monitor the bypassed and i.noperable status of these safety systems.
Recommendation one of item 40.3 addressed the inoperable status indication of the direct current
.- onsite emergency power system.
We considered the applicant's response to our request for information in this regard acceptable.
40.26 Thermal overload protection.
We requested the applicant to state the extent of conformance of the design with the positions set forth in Regulatory Guide 1.106. The applicant indicated that the recommendations of this guide have been satisfied in the design by permanently jumping the thermal overload protection devices in the valve motor circuits.
We considered the method elected by the applicant to bypass the thermal overload pro-tection devices for electric motors on motor-operated valves to be consistent with the positions set forth in Regulatory Guide 1.106 and is acceptable.
40.27 Underground cable installation.
At our request, the applicant has identified two instances of Class lE underground cable installation. These pertain to the power connec-tions for the service water pumps and to the control connections for two of the steam line isolation valves.
The applicant noted that independence between redundant trains is maintained by routing the cables through separate duct banks encased in concrete.
Furthermore, the applicant state that the installation of these two underground cable systems satifies the requirements set forth for this item in.
Our review determine that the underground cable in-stallation in these two cases as explained by the applicant is acceptable.
ITEM 040. l
.040. l(l) 040.1{2) 040. l (3) 040.1{4) 040.2 040.3 040.4 040.5 040.6 040.7 040.8 040.9 ENCLOSURE 2 Salem Nuclear Generating Station, Unit 2 Summary Review Status of the Electrical Systems Final Request for Information - October 25, 1978 DESCRIPTION Offsite and Onsite Emergency Power Systems Intteractions
- Position 1. Second level of undervoltage protection
- Position 2.
Load shedding capabilities
- Position 3. Technical specification requirements
- Position 4.
Transformer voltage tap settings verification Diesel Generator Alarms in the Control Room Direct Current Power Systems Surveillance and Speci-fications Cross-Connection of Redundant Electrical Equipment Grid Stability Physical Independence of the Offsite Power System Electrical Independence of the Offsite Power System Reactor Coolant Pump Breaker Qualification 125 Volt Direct Current Onsite Emergency Power System, 230/115 Volt Alternating Current Vital System, and 28 Volt Direct Current Vital System Interconnections STATUS NA Pending review of applicant 1s info Resolved Resolved Resolved Resolved Resolved Resolved - {Needs documentation)
Pending review of applicant 1s info Resolved Unresolved Pending review of applicant 1s info 115 volt interconnections - pending applicane, decision.
28 volt.interconnections - pending applicant~
decision.
Battery charger connections - pending review of applicant 1s info
ITEM 040. 10 040. 11 040.12 040. 13 040. 14 040.15 040.16 040. 17 040.18 040. 19 040.20 040.21 040.22 I DESCRIPTIC!lN Non-Safety Loads on Emergency Direct Current Sources Sharing of the Direct Current Emergency Power Sys-tems Between Units Compromizing the Indepence of the Vital Instrument BUSES 28 Volt Direct Current Vital System for Manual Con-trol of Protection Systems Power Supply Diversity for the Auxiliary Feedwater System Diesel Generator Capacity Diesel Generator Reliability Qualifications Diesel Generator Protective Trips Reactor Containment Electrical Penetration Design Conformance with Standards and Regulatory Guides Epoxy Insulation Failures in Reactor Containment Electrical Penetrations Power Connection Requirements for the Residual Heat Removal Letdown Line Isolation Valves and Interlocks Environmental Qualifications of Electrical Equip-ment Located Inside Containment Environmental Qualifications of Electrical Equip-ment Located Outside Containment STATUS Resolved Pending consideration by the NRC (no problem anticipated)
Resolved Pending review by the NRC Resolved Resolved Resolved Pending review of applicant 1s info Pending review of applicant 1s info Resolved Resolved Pending Review by the NRC Pending review by the NRC (no problem anticipated)
ITEM 040.23 040.24 040.25 040.26 040.27 DESCRIPTION Degree of Compliance with Regulatory Guide 1.75 Submerged Electrical Equipment as a result of a Loss-of-Coolant Accident Bypassed and Inoperable Status Indication for Safety Systems Thermal Overload Protection Underground Cable Installation STATUS Pending review by the NRC (fire review)
Resolved Re~olved Resolved Resolved
ENCLOSURE 3 PUBLIC SERVICE ELECTRIC AND GAS COMPANY SALEM NUCLEAR GENERATING STATION, UNIT #2 DOCKET NO. 50-311 POWER SYSTEMS FINAL REQUEST FOR INFORMATION OCTOBER 1978
040.l Offsite and Onsite Emergency Power Systems Interactions: Recent (8.2)
{RSP) operating experience has shown that adverse effects on the safety-related power system and safety related equipment and loads can be caused by sustained low or high grid voltage conditions.
We therefore require that your design of the safety related electrical system meet the following staff positions. Supplement the descrip-tion of your design in the FSAR to show how it meets these positions or provide appropriate analyses to justify non-conformance with these positions.
- 1. In addition to the undervoltage scheme provided to detect loss of offsite power at the safety busses, we require that an addi.tional level of voltage protection for the onsite power system be provided with a time delay and.that this additional level of voltage protection shall satisfy the following criteria:
a)
The selection of voltage and time set points shall be detennined from an analysis of the voltage requirements of the safety-related loads at all onsi~e system distribution levels; b)
The voltage protection shall include coincidence logic on a per bus basis to preclude spurious trips of the offsite power source; c)
The time delay selected shall be based on the following conditions:
(1)
The allowable time delay, including margin, shall not exceed the maximum time delay that is assumed in the FSAR accident analyses; (2) The time delay shall minimize the effect of short duration disturbances from reducing the availability of the offsite power source(s); and (3)
The allowable time duration of a degraded voltage condition at all distributton system levels shall not result in failure cf safety systems or components; d) The. voltage sensors shall automatically initiate the disconnec-tion of offsite power sources whehenver the voltage set point and time delay limits have been exceeded; e)
The voltage sensors shall be designed to satisfy.the applicable requirements of IEEE Std. 279-1971, "Criteria for Protection Systems for Nuclear Power Generating Stations"; and f) The Technical Specifications ~hall include limitin~ condition **--
for operation, surveillance requirements, trip set points with minimum and maximum limits, and a11owab1e values for the second-1eve1 voltage protection sensors and associated time delay devices.
- 2.
We require that the current system designs automatically prevent load S'hedding of the emergency buses once the onsite sources are..
supplying power to all sequenced loads on the emergency buses.
The design shall also include the capability of the load shedding feature to be automatically reinstated if the onsite source supply breakers are tripped. The automatic bypass and reinstatement feature shall be verified during the peri~dic testing identified in Position 3. ',
In the event an adequate basis can be provided for retaining the load shed feature when loads are energized by the onsite power system, we will require that the setpoint value in the.Technical Specifications, which is currently specific as " **. equal to or greater than *** " be amended to specify a value having maximum*and minimum limits. The licensee' bases for the setpoints and limits se.lected must be documented.
- 3.
We require that the Technical Specifications include a test require-ment to demonstrate the full functional operability and independence of the onsite power sources at ieast cnce per 18 months during shutdown.
The Tecr0nical Specifications sha11 include a re~uirement.
for tests: {1) simulating loss of offsite power; (2) simulating loss of offsite power in conjunction with a safety feature actuation signal; and (3) simulating interruption and subsequent reconnection of.onsite power sources to their respective buses. Proper operation shall be detennined by:
a) 1erifying that on loss of offsite power the emergency buses have
- een de-energized and that the loads have been shed from the emergency buses in accordance with design requirenents.
b) Verifying that on.loss of offsite power the diesel generators start on the autostart signal, the emergency buses are energized with pe nnanent ly connected 1 cads, the auto-connected shutdown loads ~re energized through the load sequencer, and the system operates for five minutes while the generators are loaded with the shutdown loads.
c) Verifying that on a safety features actuation signal {without loss of offsite power) the diesel generators start on the autostart s.ignal and operate on standby for five minutes.
d)
Verifying that on loss of cffsite power in conjunction with a safety features actuation signal the diesel generators sta.*t on the autostart signal, the emerg~ncy buses are energized with pennanently connected ioads, the auto-connected emergency (accident) loads are energized through the load sequencer, and the system operates for five minutes whi1e the generators are loaded with the emergency loads.
e) Verifying that on interruption of the onsite sources the loads are shed from the emergency bus~s in accordance with design require-ments and that subsequent loading of the onsite sources l~
through the load sequencer.
040.2 (8.3) 4.
The voltage levels at the safety-related bus~s should be optimized for the full load and minimum load conditions that are expected throughout the anticipated range of voltage variations of the offsite power source by appropriate adjustment of the voltage tap settings of the intervening transfonners.
We require that the adequacy of the design in this regard be verified by actual measurement and by correlation of measured values with analysis results. Provide a description of the method formakirt"gtlfis verification; before initial reactor power operation, provide the --
documentation required to establish that this verification has been accomplished.
Dfesel generator alarms in the control room:
A review of malfunction reports of diesel generators at operating nuclear plants has uncovered that in some cases the information available to the control room operator to indicate the operational status of the diesel generator may be imprecise and could lead to misinterpretation. This can be caused by the sharing of a single annunciator station to alann conditions that*
render a diesel generator unable tO respond to an automatic emergency start signal and to also alarm abnonnal, but not disabling, conditions.
Another cause can be the use of wording of an annunciator window that does not specifi~~lly say that a diesel generator is inoperable (i.e.,
unable at the time to respond to an automatic emergency start signal) when in fact it is inoperable for that purpose.
Review and evaluate the alarm and control circuitry for the diesel generators at your facility to determine how each condition that renders a diesel generator unable to respond to an automatic emergency start signal is alarmed in the control room. These conditions include not only the trfps that lock out the diesel generator start and require manual reset, but also control switch or mode switch positions that block automatic start, loss of control voltage, insufficient starting air pressure or battery voltage, etc. Thi"s review should consider all aspects of possible diesel generator operational conditions, for example test conditions and operation from local control stations. One area of particular concern is the unreset condition following a manual stop at the local station which term1~nates a diesel generator test and pri:or to reseting the di:esel generator controls for enabling subsequent automatic operation.
Provide the de ta 11 s of your eva 1 ua ti"on, the resu1 ts and con cl us ions, and a tabulation of the followfng information:
(a) all conditions that render the diesel generator incapable of responding to an automatic emergency start signal for each operating mode as discussed above; (b) the wording on the annunci:ator wi."ndow in the-control room that is alanned for each of the condHions identified in (a};
040.3 (8.3) (c) a~y other alann signals not included in (a} above tnat also cause the same annunciator to alarm; (d) any condition that renders the diesel generator incapable of responding to an automatic emergency start signal which is not alarmed in the control room; and (e) any proposed modifications resulting from this evaluation.
Direct currnt power system surveillance and specifications:
As a result of a recent review on th~ adequacy of safety-related direct current power systems of operating plants, the fallowing recommenda-tions applicable to those plants undergo.ing operating. license and construction permit reviews have been proposed by the Regulatory Staff. The purpose of these recommendat.i.ons is *to assure the con-tinua 1 operability of the safety-re-1 ated direct current power system.
Determine whether the design of the direct current onsite.
emergency power system for Salem, Unit 2 has implemented these recommendations and submit your findings for our re-view.
------ ----- (l) The: position of circuit breakers or fused disconnect switches associated with the battery charger, battery and direct current bus supply should be monitored to conform to the reconmenda-tions of Regulatory Guide 1.47, "Bypassed and Inoperable Status Indication for Nuclear Power Plant Safety Systems," (May 1973).
(2) The technical specifications should include periodic testing of battery chargers to verify that the current limiting characteristics has not been compromised or lost.
(3)
The technical specifications should_ require that cell-to-cell and terminal connection resistance measurements be made as recc*l11!1ended in IEEE Standard 450-1972, "Recommended Practice for Maintenance, Testing, and Replacement of Large Stationary Type Power Plant and Substation Lead Storage Batteries."
(4)
The direct current power system design should include the following monitors and alarms:
a)
An ammeter (directional and dual range) in the battery output to monitor the battery input current while the battery is on floating and equalizing charge and to monitor the battery output current when it is supply-ing power.
040.4 (8.3) b)
An annunciator to a~~nn whenever the charger goes into a current limiting condition.
c) A temperature indicator to measure the battery room ambient temperature.
(5)
The charger should be capable of supplying its rated load, without the battery operating in parallel, when so required.
The voltage variation in this mode of operation should be within design specifications.
(6)
The direct current equipment should be rated and qualified for operation at the equalizing charge voltage and rated dis*
charge voltage {typically 110 to 145 volts for a nominal 125 volt direct current system.)
Cross-connection of redundant electrical equipment:
Incidents in~
valving the inadvertent disabling of a component by racking out the circuit breaker for a different component have occurred in nuclear power facilities.
In view of these occurrences, we.request that you perform an audit of the design to determine that disabling of one component does not, through incorporation in other interlocking or sequencing controls, render other redundant components inoperable.
Provide the results of your audit far our review.
040.5 (8.2) 040.6 (8.2) Grid Stability: Supplement your response to request for information Item 8.1 by providing a summary of the results of an up-to-date electrical grid stability analyses showing that the loss of the most critical power source, or load, or inter-tie will not affect the stability of the Public Service Electric and Gas Company grid or the ability to provide offsite power to Salem,Unit 2.
The transient stability and load flow.analyses must be based on the maxi-mum projected seasonal peak load during the year that Salem, Unit 2 will be connected to the grid. Illustrate the behavior of the Postulated loss of power or load condition on swing grid for each curve:..
Physical Independence of the: Offsite Power System: It is not clear from the information presented in Figure 8.2-1 of the FSAR whether the separation of the transmission 1 ines supplying offsite power to the station at tower 1/1 satisfies the physical independent require-ments of the Commission's General Design Criterion 17. State the distance between transmission lines at tower 1/1. Justify the adequacy of this distance as it relates to establishing whether the failure of a structure supporting these transmission lines could result in the total loss of offsite power to the station.
Within the same subject of physical independence, verify that the offsite power connections between the switchyard and the plant are independent to the extent required in the Commission General Design Criterion 17.
Identify those common rights-of-way, structures and entries to the emergency buses reams, and verify that a single structural failure could not re:.ult in the total loss of offsite power to the emergency buses.
040.7 Electrical Independence of the Offsite Power System:
To preclude (8.2) 040.8 (8.2) the possibility of simultaneous failure of both offsite power cir-cuits at the switchyard from single events such as a breaker not operating during fault conditions, the design provides for two independence and separate source of direct current for controlling the operation of the switchyard breakers. Verify that equivalent provisions have been incorporated into the design of the section breakers for the 13 kilovolt ring bus and in-feeder breakers connect-ing the 13/4 kilovolt offsite power transformers to the emergency buses.
Reactor Coolant Pump Breaker Qualification: Supplement reque!t for information Item 32.11 as fol*lows:
Verify that the worst case of under frequency and maximum frequency decay rate expected at the Salem,. Unit 2 as a result of electric grid disturbances will be within the corresponding values established in the accident analysis for preventing fuel damage, without the need of tripping the reactor coolant pump breaker to assure that the pump coastdown function is maintained.
Relate the results of your verification to the positions set forth in Branch Technical Posi-tion EICSB 15 of Appendix 7-A of the Standard Review Plan and justify any deviation from our positions.
040.9 (8.3)
(RSP)
-12 125 volt direct current onsite emergency power system, 230/115 volt alternating current vital system and 28 volt direct current vital system interconnections: The design of these*safety-related systems provides for manual cross-connection of redundant divisions within a system and between a division in one system with a different division in another system. Also, each redundant distribution bus in each one of the direct current systems is being fed by two battery chargers and one of them is connected to a different division in the 230 volt alternating current vital system as that of the direct CLirrent distrfbution bus. Availability of power to the distribution buses rather than safety i.s considered as the sole reason for the interconnections in the design of these systems.
Credit car:not be given in the technical specifications for the operability of any portion of these systems when it is being powered from a division which is different from its normal assigned division.
Although, it has been proposed that these interconnections will be accomplished via manually operated, mechanically interlocked breakers under administrative contrcl, it is our concern that a single event s~ch as a fire could compromize the independence between redundant divisions and in some cases result in the loss of protective function.
We require that you examine each interconnection within and between these systems and either demonstrate the capability of the design to withstand single events (including exposure fire:.) without the loss of protective function, or modify the design to provide the required independence of th~ redundant protection systems.
040. 10 (8.3) Non-Safety Loads on Emergency Direct Current Sources:
Indicate whether the ampere-hour capacity of each 125 volt battery and each 28 volt battery is suitable for supplying all assigned safety and non-safety loads and all cross-connected loads from other redundant
.batteries (regardless of whether or not those loads need to be connected to the bus) for a minimum of two hours without the use of the battery chargers. Also, describe the means provided (if any) for disconnecting the non-safety loads from their respective batteries and identify these loads and the corresponding event that required the disconnection of the loads.
- 040. 11 Sharing of the Direct Current Emergency Power Systems Between (8.3)
(RSP)
Units:
FigLire 8.3-7 of the FSAR depicts the 125 volt direct current emergency system of Salem, Unit 2 being shared with Salem, Unit l and viceversa. This is being accomplished via the non-safety re-lated buses that supply control power to the 460 volt equipment in the circulating water intake area. It appears that the design pro-visions that permit sharing of the direct current emergency power system between units through non-safety related buses are not necessary from the standpoint of safety and/or availability of power to the buses.
Furthermore, it is not apparent from the in-formation presented in the FSAR whether this aspect of the design satisfies the requirements set forth in the General De=ign Criteria 5, "Sharing of Structures, Systems and Components, 11 of Appendix A
040.12 (8.3)
(RSP) to 10 CFR Part 50. These requirements as relate to direct current and alternating current power systems are expanded in Regulatory Gui:de 1.81, 11Shared Emergency and Shutdown Electric Systems for Multf-Unit Nuclear Power Plants.
11 We require that you either demonstrate the capability of the design to withstand every single design basis event without the loss of safety function, or modify it to prohibit sharing of the 125 volt direct current emergency power system bebeen the two uni ts.*
~ompromizing the Independence of the Vital Instrument Buses:
Figure 8.3-5 of the FSAR shows two of the four redundant vital instrument inverters being normally supplied from the same 230 volt alternating current vital bus and backed up from the same 115 volt direct current emergency bus.
The two redundant vital instrument buses associated with these two inverters are also capable of being supplied from another 230 volt alternating current vital bu~ which is different from the bus that provides normal input power to the inverters. It is our concern that a single failure in either.of the common 230 volt alternating current vi'ta l buses or in the common 115 vo 1 t di re ct current emergency bus may degrade the capability of two redundant vital instrument buses be1ow a point where it would result in the loss of protective function to mitigate the consequences of some accidents.
We consider this aspect of the design of the vital instrument sys-tem vulnerable to common failure mode (Section 3.12 of IEEE Stan-dard 308-1971).
040 *. 13 (8.3)
(RSP) We requi"re that you either demonstrate the capability of the design to withstand every single design basis event without the loss of protectfve function for all accident conditions, or modify it according1y.
28 volt Direct CLirrent Vi ta l Sys tern for Manual Contra l of Protection Systems:
In order that the protection systems safety function can be accomplished, assuming a single failure, the safety loads for the unit are arranged in a three-division split bus alternating current configuration.
The 28 volt direct current vital system in-cludes a two-division split bus configuration which supplies control power to the three-division split bus alternating current configura-tion vi.a the 115 volt direct current emergency power system or the 115 volt alternating current vital system.
The safety loads in the 115 volt direct current and 115 volt alternating current are arranged in a thr.ee-division and four-division split-bus configura-tion respectively.
Although, it appears that the design1of the 28 volt direct current vital system for manual control of protection systems satisfies the requirements of Section 4.7 of IEEE Standard 279-1971 with re-gard to manual initiation of a protective action at a system level, i.t is not clear how the systems supporting the protection systems such as the alternating current emergency power system are manually
/.
040. 14 (8.3) initiated at the system level. Also, it is not apparent from the information presented in the FSAR whether there are some protective actions that are manually initiated at the component level because of li.mited number of equipment operations involved. It is our con-cern tha.t a single failure in one of the two redundant 28 volt direct current vital distribution systems may preclude the manual initia-tion of sufficient components in supporting systems and systems initiated at the component level that the protective function can not be accomplished.
We require that you perform an audit of the design to determine whether there are protection systems as well as their supporting systems which are not initiated at tre system level, and either demonstrate the capability of the de$ign of these systems to withstand a single failure in the 28 volt vital system without the loss of manual capability to initiate a protective function, or modify the design accordingly.
Power Supply Diversity For the Auxiliary Feedwater System:
Verify that the electrical aspects of the auxiliary feedwater system satisfy the diversity-requirements set forth in Branch Technical Position APCSB 10-1 included in Section 10.4.9 of the Standard Review Plan.
Justify any deviations from this position.
040. i5
. Di.esel Generator Capacity: Supplement response to request for (8.3) 040.16 (8.3) information item 8.8 as follows:
(1)
Update Table Q8.8-l included in aforementioned response to show all the safety and non-safety loads assigned to each diesel generator.
(2) Submit the maximum coincident total demand load in kilowatts for each diesel generator when all assigned safety and non-safety loads are connected to it.
(3)
Discuss the means provided for disconnecting the non-safety loads from their respective diesel generators and iden-tify these loads and the corresponding event that required the disconnection of the loads.
Diesel Generator Reliability Qualifications:
(1)
Provide information to substantiate that each diesel generator satisfies the frequency and voltage variations stated in Position 4 of Regulatory Guide 1.9, "Selection of Diesel Generator Set Capacity for Standby Pow~~r Supplies, 11 (3/10/71).
(2)
Compare the reliability qualification testing program followed for the diesel generators of Salem, Unit 2 to the positions presented in Branch Technical Position EICSB 2 of Appendix 7-A of the Standard Review Plan.
Identify and justify any devia-tions that you may have.
040. 17 (8.3) 040. 18 (8.3) Diesel generator protective trips:
Compare your design of the diesel generator protective trip circuit bypasses to the positions set forth in Branch Technical Position EICSB 17 of Appendix 7-A of the Standard Review Plan.
Identify and justify any deviations that you may have.
Reactor Containment Electrical Penetration Design Conformance with Standards and Regulatory Guides:
State the degree of conformance of your design to IEEE Standard 317-1972, "Electricc;,1 Penetration Assemblies in Containment Structures for Nuclear Power Generating Stations," and Regulatory Guide 1.63.
Identify any exceptions you may have (if any) and justify them on some other defined bases.
Your response should:
(1)
Identify each type of electricz.1 circuit that penetrates containment; (2)
Describe the primary and backup over current protective sys-tems provided for each type of circuit; (3)
Describe the fault current versus time for which the primary and backup protection systems and the penetrations are designed and qualified.
(4)
Provide coordinated curves which demonstrate for each circuit identified, that the maximum fault current versus time condition to which th~ penetration and cable were qualified will not be exceeded.
(5)
Describe the design provisions for periodic testing under simulated.fault conditions.
040.19 (8.3) 040.20 (8.3) Epoxy insulation failures in reactor containment electrical pene-trations: Recent operating experience at Millstone, Unit 2 has shown that the deterioration of the epoxy insulation between splices has caused electrical shorts between conductors within a containment electrical penetration assembly.
Indicate what tests and/or analyses that have been performed to demonstrate the acceptability of the design in this regard.
Provide whatever information is required to perform an independent evaluation of this aspect of the electrical penetr~tfon design.
Power connection requirements for the residual heat removal letdown li.ne i.solation valves and interlocks: Verify that the overpressuriza-tion protection requirements for the residual heat removal system set forth in request for information item 7.9 have been implemented in the design of the power connections_to the motor-operated iso~ation valves in the residual heat removal letdown line and to the corres-ponding interloc~s. The verification must show that the power con-nections to the:se valves and their interlocks satisfy the single failure criterion. This requirement must oe satisfied both while provi.ding the capabillty of achieving cold shutdown and while pre-venting overpressurization of the residual heat removal system.
040.21 (8.3) 040.22 (8.3) Environmental Qu~lifications of Electrical Equipment Located Inside Containment: Supplement request for information item 32.l as follows:
Identify safety-related electrical equipment (e.g., switchgear, motors, cables, electrical penetrations, splices, terminal blocks) inside the containment which a:re required to function during and/or following a design basis accident (loss-of-coolant accident as well as main steam line break).
Provide the same type of information for the safety-related electrical equipment as that requested in Item 32.1 for the: safety-related in-strumentation and control equipment.
Environmental Qualification of Electrical Equipment Located Outside Containment: Supplement request for information item 32.3 as follows:
Wi.th regard to the assurance that the environment is maintained within the temperature range for which the equipment is qualified, we require that the applicant, in each applicable case, demonstrate that a single failure in an environmental support system will not degrade the capability of the redundant Class lE equipment being served beyond a point where the safety function cannot be accomplished for the time required.
In the event that this capability cannot be demonstrated, we require (1) the equipment be qualified to the limiting environmental conditions that are expected to occur at the equipment location, assuming the loss of the environmental support system, or
~
040.23 (8.0) (2) the environmental support system be modified to meet the single failure criterion. The modification of the environmental support system must be accomplished in accordance with the same criteria as that of the Class lE system being served.
Degree of Compliance with Regulatory Guide l.75, "Physical Indepen-dence of El ectri cal Sys terns, 11 (Revis ion l) : Appendix A to Branch Technical Position APCSB 9.5-1 included in Section 9.5.1 of the Standard Review Plan sets forth fire protection requirements for those electrical designs which do not satisfy the positions of Regula-tory Guide 1.75, "Physical Independence of Electrical Systems,"
(Revision l). It is apparent from the information presented in Sec-tion 7.2.l and 8.3.7 of the FSAR and in the response to request for information Item 7. ll that the proposed physical arrangement of the electrical equipment does not satisfy some of the positions.set forth in Regulatory Guide 1.75.
The degree of conformance of the electrical design with the positions set forth in Regulatory Guide l.75 must be established in order to determine the applicaability of the fire protection requirements to the electrical design. Thus, compare your separation design require-ments to those in the IEEE Standard 384-1974, "Criteria for Separa-tion of Class lE Equipment and Circuits, 11 as augmented by Regulatory Guide l.75, (Revision 1), and identify those requirements and aspects of your design which are not in accordance with either the standard or the: Regulatory Guide.
Where less stringent criteria are proposed~
discuss the reasons for concluding that the less stringent criteria are adequate.
040.24 (8.3) Submerged Electrical Equipment As a Result of a Loss-of-Coolant Accident:
Your response to request for infannation item 6.28 did not address whether the integrity of the cc*nta i nment el ectri cal penetrations could be compromised as a result of a single failure that precludes th~ protective devices from interrupting the fault currents caused by the flooding of safety or non-safety electrical equipment, particularly valve motor~. Evaluate this aspect of the design and submit the results of your evaluation for our review.
In determining whether the water level reached in the containment, following a design basis accident, has caused electrical equipment to become submerged, consideration should be given to any further increase in water level due to the continual injection of other sources of water such as the feedwater into the containment. This could occur as a result of a single electrical or mechanical failure preventing the isolation of these other sources of water from the containment. Verify whether additional electrical equipment to that identified in request for information item 6.28 will be sub-merged because of further increase of water level in the containment as a result of a single failure that precludes the isolation of other sources of water from the containment. following a loss-of-coolant accident.
')*
)
l, 040.25 (8.3) 040.26 (8.3) 040.27 (8.3) Bypassed ar.d inoperable status indication for safety systems:
Supplement the response to request for information item 7.6 by a~dressing the extent of conformance of the electrical power sys-tem design to the positions set forth in Regulatory Guide 1.47, 11Bypassed and Inoperable Status Indication for Nuclear Power Plant Safety Systems, 11 and Branch Technical Position EICSB 21 of Appendix 7-A of the Standard Review Plan.
Thermal Overload Protection:
State the extent of conformance with the-: positions set forth in Regulatory Guide 1.106, "Thermal Overload Protection for Electric Motors on Motor-Operated Valves. 11 Underground cable installation: Identify any Class lE underground cable insta1lation to be used in your design and state hc;w these Class lE underground cable systems will conform to the following requirements:
(l) Quality standards, as required by the Commission's General Design Criterion (GDC 1).
(2)
C I Classification, as required by GDC 2.
Seismic ategory
- i.I
) *
.._ (3) Minimization of the probability and effects of fires, as required by GDC 3.
(4) Compatibility with the environmental conditions associated with all modes of operation and appropriate protection against events and conditions outside the nuclear unit, as required by GDC 4.
(5) Sufficient independence and redundancy to satisfy the onsite power system requirements dictated by GDC 17.
(6)
Prevention of a conman failure mode of the redundant cable systems for any design basis event including rain and floods, as required by IEEE Standard 308, Section 5.2.1.
(7)
Consistency with IEEE-Guide for the Design and Installation of Ca.ble Systems in Power Generating Stations (P422).
Identify and justify any exceptions.
ENCLOSURE 4 Salem Nuclear Generating Station, Unit 2 Docket No. 50-311 Discussion of Electrical Systems Final Request for Information Meeting of October 24-25, 1978 ATTENDANCE LIST Public Service Electric & Gas Company R. Burricelli J. Wroblewski W. Gailey R. Skwarek F. Christiana W. Pavincich R. Basha 11 A. Gilrain Y. Yaworsky USN RC A. Dromerick J. Calvo