ML18152A153
| ML18152A153 | |
| Person / Time | |
|---|---|
| Site: | Surry  |
| Issue date: | 05/01/1989 |
| From: | VIRGINIA POWER (VIRGINIA ELECTRIC & POWER CO.) |
| To: | |
| Shared Package | |
| ML18152A155 | List: |
| References | |
| NUDOCS 8905150093 | |
| Download: ML18152A153 (21) | |
Text
e FINAL
SUMMARY
REPORT EMERGENCY DIESEL GENERATOR SEQUENCING VIRGINIA POWER COMPANY SURRY POWER STATION - UNITS 1 AND 2 MAY I, 1989 h134-JWD-11224-1 0_!
/
1::,1:;,()!=i 1 =i(>()'";/:°=: :3*;1(>5(>4
~\\
~b~~ -~Dotf 05000280 p
TABLE OF CONTENTS
1.0 INTRODUCTION
2.0 DISCUSSION 3.0 APPROACH 4.0 RESOLUTION 5.0 SAFETY ANALYSIS 6.0 POST MODIFICATION TESTING 7.0 TECHNICAL SPECIFICATION CHANGES 8.0 EOG TESTING RESULTS 9.0 EXHIBITS h134-:-JWD-11224-2
-~
e
1.0 INTRODUCTION
The Nuclear Regulatory Commission (NRC) IE Information Notice (IEIN) 85-91, 11 Load Sequencers for Emergency Diesel Generators 11
( EOG I s) dated November 27, 1985, identified a scenario at the Duane Arnold Nuclear Plant which would bypass the EOG load sequencing logic during a condition requiring sequencing of loads onto the EOG.
The severity of the design deficiency was increased due to the fact that a single event causing loss of offsite power to both emergency buses could result in the loss of both EDG's.
The original design of the emergency power system at Surry Power Station considered the design basis nuclear accident to be the worst case loading condition for the diesel generators. Therefore, a Consequence Limiting Safeguards (CLS) Hi-Hi signal with a simultaneous loss of offsite power (LOOP) was used as the design basis for the emergency diesel generators.
Engineering analysis has shown that Surry Power Station would be subject to the loss of both EDGs due to a single event if the loss of offsite power occurs some time after a LOCA.
Under this circumstance, the potential is created to overload both EDGs at the same time by exceeding the maximum EOG load limits.
Based on this analysis, load sequencing modifications will be performed.
The following paragraphs discuss the original configuration of the system, describe the approach taken to resolve the load sequencing concerns, and provide the Safety Analysis conducted to determine that the modifications do not constitute an unreviewed safety question.
2.0 DISCUSSION The 4160V emergency buses for a specific unit are supplied from different, independent offsite sources.
Buses lH and 2H have dedicated EDGs, EOG 1 and 2 respectively.
Buses lJ and 2J share EOG 3.
Load sequencing modifications do not affect the initial start sequence of the EDGs.
Closing the EOG breakers onto the 4160V emergency buses is accomplished by the degraded/undervoltage circuits which monitor the voltage from their respective emergency buses.
These circuits initiate closure of the respective EOG emergency supply breaker after EOG speed and voltage permissives are met.
The EDGs start on an accident signal, but run unloaded at rated speed and voltage until an undervoltage signal is received.
If the EOG is the sole supplier to an emergency bus, the degraded/undervoltage protection is defeated.
Additionally, the undervoltage protection initiates an EOG automatic start.
Prior to the load sequencing modification, the undervoltage protection circuit did not initiate the load sequencing of safety related loads onto the EDGs (see Exhibit 1). Certain loads were tripped (and not sequenced back on), but the majority of the safety-related loads were neither tripped nor sequenced.
The loads that were sequenced onto the emergency buses (i.e., auxiliary feedwater pumps and recirculation spray pumps) were initiated by an engineered safeguards signal through timers.
This action occurred regardless of the state of the offsite power source.
The loads h134-JWD-11224-3
I e
e picked up by the EOG for undervoltage conditions were:. 1) the loads running on the emergency bus prior to the accident signal (minus the loads tripped off by the undervoltage protection circuit); 2) the accident-initiated loads sequenced onto the emergency buses immediately or after their preset time delays; and 3) the loads manually applied.
If the LOOP occurred some time after the LOCA (e.g., 5 minutes), then the safety-related loads running prior to the LOOP (minus the loads tripped off by the undervoltage protection circuits) would be restarted at the instant the EDGs picked up the emergency buses. This would have created a potential to overload both EDGs at the same time by exceeding the maximum EOG load limits, based on the General Motors' Electro-Motive Division (EMO) dead load capability curve ACD 67-41.
3.0 APPROACH To eliminate the potential overloading of the EDGs, modifications to the logic schemes for the emergency buses are being made to shed and restart loads when a LOOP occurs.
The sequence used to restart the safety-related loads will depend on the particular accident event in progress.
The time delays utilized will consider the capabilities of the engine-generator combination, and the safety requirements of the nuclear steam supply system.
In order to select the most appropriate delay times for the loads, a series of special tests have been performed to determine the actual response of the EDGs under conditions similar to those encountered during accident conditions. These special tests are explained in Section 8 of this report.
The specific sequence of the modified loads and the associated times were selected to limit the impact on nuclear safety analysis calculations in order not to exceed existing safety analysis bounds and to ensure the capabilities of the EDGs are not exceeded.
- 4. 0 RESOLUTION The emergency buses have been modified to add an emergency diesel generator load sequencing scheme initiated by a loss of offsite power (LOOP) condition. This scheme ensures that the maximum EOG load capabilities are not exceeded under the worst case load applications, and therefore, resolve NRC concerns described in IE Information Notice 85-91.
The worst case load application bounds the loads experienced upon a simultaneous CLS and LOOP condition, and for various LOOP after CLS scenarios.
One basis for the evaluation is the analysis of the EOG test results provided by Morrison-Knudsen Company, Inc., the diesel manufacturer's representative.
Under accident conditions, the following additional loads are shed upon a LOOP initiation and resequenced as required onto the 4160V and 480V emergency buses following the reset of the degraded/undervoltage protection circuit.
(see Exhibit 2):
h134-JWD-11224-4
e e
Auxiliary Feedwater Pumps (AFW)
Inside Recirculation Spray Pumps (IRS)
Outside Recirculation Spray Pumps (ORS)
Pressurizer Heaters - Backup (PHTR)
Filter Exhaust Fans (FEF)
Except for the auxiliary feedwater pumps, a LOOP signal initiates the load sequencing logic regardless of the presence of an accident signal for the sequenced loads.
The loads would have to be energized (breakers closed) in order to be tripped, and the breaker close permissives would have to be met in order to restart the loads.
For example, the load sequencing scheme would not automatically start the inside recirculation spray pumps unless a CLS signal had been present for 120 seconds prior to the LOOP start signal being applied.
The LOOP initiated load sequencing for the auxiliary feedwater pumps only occurs in the presence of a CLS or an SI signal; otherwise, the pumps start automatically when the LOOP occurs (by loss of reserve power relaying).
During the presence of an SI condition, a LOOP would restart the auxiliary feedwater pumps in 10 seconds, while during the presence of a CLS condition a LOOP would restart the auxiliary feedwater pumps in 140 seconds.
The longer delay during a CLS condition is to ensure that the EDG's cold load limit on the turbocharger is not exceeded to the detriment of its frequency response.
The EOG load sequencing of the new design will be as follows for CLS actuation followed by a LOOP after 5 minutes or longer.
The table illustrates the scenario for a LOOP occurrence 5 minutes after the CLS actuation.
TIME DESCRIPTION.
T = 0 sec.
CLS actuation; EOG starts Note:
SI and CLS loads are started between 0 sec. and 300 sec.
T = 300 sec.
LOOP occurs T = 302 sec.
Undervoltage protection initiates load shed of non-essential loads and trip of safety-related loads for sequencing T = 304 sec.
EOG breaker closes, energizing initial load block (HHSI, LHSI, CS)
T = 314 sec.
ORS restart (10 sec. sequencing delay)
T = 324 sec.
IRS restart (20 sec. sequencing delay)
T = 334 sec.
FEF restart (30 sec. sequencing delay)
T = 444 sec.
AFW restart due to CLS signal (140 sec. sequencing delay)
T = 484 sec.
PHTR energized (180 sec. sequencing delay) h134-JWD-11224-5
e e
the EOG load sequencing of the new design will be as follows for a SI actuation followed by a LOOP after 50 seconds or longer.
The table illustrates the scenario for a LOOP occurrence 50 seconds after the SI actuation.
TIME DESCRIPTION T = 0 sec.
SI actuation; EOG starts Note:
SI loads are started between O sec. and 50 sec.
T = 50 sec.
LOOP occurs T = 52 sec.
Undervoltage protection initiates load shed of non-essential loads and trip of safety-related loads for sequencing T = 54 sec.
EOG breaker closes, energizing initial load block (HHSI, LHSI)
T = 64 sec.
AFW restart due to SI signal (10 sec.
sequencing delay)
T = 84 sec.
FEF restart (30 sec. sequencing delay)
T = 234 sec.
PHTR energized (180 sec. sequencing delay)
NOTE:
The inside and outside recirculation spray pumps, which require a CLS Hi-Hi signal prior to start, are not running with only a SI condition present and therefore are not sequenced.
A LOOP condition continues to be determined by the degraded/undervoltage protection circuit (undervoltage condition) for 4160V emergency buses, which trips certain bus loads, starts the EDGs and provides a close signal to their circuit breakers.
Each protection circuit utilizes a 2 out of 3 logic to determine a LOOP condition. A timer logic is initiated, and selected loads shed once a LOOP condition exists in conjunction with a closed normal offsite source breaker or an open EOG breaker.
Because of this modification, additional loads are now shed for later restarting, after an appropriate time delay, provided their existing close permissives are met.
The control circuit for each sequenced load and its associated degraded/
undervoltage protection circuit required modification.
The load sequencing scheme utilizes the undervoltage protection circuit. A new General Electric (GE) HFA auxiliary relay was added to the corresponding existing undervoltage circuit to provide the necessary contacts to the control circuits of the modified loads.
Each contact of the HFA relay operates an Agastat timing relay (TDDO) for each load (except for the auxiliary feedwater pumps).
Each auxiliary feedwater pump required two Agastat timing relays (TDDO), one for each accident condition being postulated (CLS Hi-Hi or SI).
Fan 1-VS-F-58A required one Agastat timing relay (TDDO) from each connected power source (lH-1 or 2J-l).
Fan 1-VS-F-58B also required one Agastat timing relay (TDDO) from each connected power source (IJ-1 and 2H-1).
On pickup of the HFA relay (undervoltage h134-JWD-11224-6
y e
e oondition), the Agastat timing relays will initially trip the selected load breakers to shed the required loads, and block the close (manual and automatic) circuits.
On drop out of the HFA relay (undervoltage condition reset), the Agastat timing relay will return to its de-energized state, provide a time delay to remove the trip signals and allow the closure of the load breakers provided all close permissives are met.
A CLS Hi-Hi contact and an additional SI contact were added as interlocks for each auxiliary feedwater pump control circuit, to provide load sequencing logic while under an accident condition. These contacts prevent the auxiliary feedwater pumps from being included in the initial load block of the EOG during a CLS Hi-Hi or SI condition.
Latching relays were utilized in the control logic to ensure that once an accident signal was initiated, the resetting of that signal would not defeat the required logic until the auxiliary feedwater pump was manually stopped.
A LOOP occurring after a CLS reset would trip the running inside and outside recirculation spray pumps.
A seal-in contact (of the accident initiated start signal) was added to each of these pump control circuits to allow the running pumps to restart automatically after the LOOP initiated trip.
(Note:
A RS pump which has been manually stopped and manually restarted would require manual action once tripped by the LOOP initiated signal).
5.0 SAFETY ANALYSIS 5.1 Introduction An evaluation of the impact of the post Loss of Offsite Power (LOOP) delays on the transients analyzed in Chapters 6 and 14 of the Surry UFSAR has been performed.
For those analyses that are affected by a LOOP, the licensing design basis assumption is that the LOOP occurs at the initiation of the transient.
For the EOG sequencing analysis, it was assumed that the LOOP may occur at any time during the transient. This analysis supports the setpoint parameters that have been defined for load sequencing.
A 10 CFR 50.59 evaluation is provided to assure that a LOOP during any point of the transient will not create any new or worse accident than has already been analyzed in the safety analysis report.
5.2 Effect of a Delay or Interruption of Spray Flow on Containment Analysis The impact of a delay or interruption of the spray systems on containment peak pressure, peak temperature, depressurization time, subatmospheric peak pressure, and net positive suction head (NPSH) analysis has been evaluated.
An evaluation of containment over-cooling is also discussed in this report. Analyses have shown that a loss of the recirculation spray (RS) pumps just before the subatmospheric pressure peak is more severe than for a loss of RS pumps after the subatmospheric peak pressure.
An interruption of the containment spray (CS) and RS flows at the start of the transient, just after the RS pump starts, will impact the containment peak pressure slightly, since containment peak pressure h134-JWD-11224-7
--~~-------
e e
occurs after CS and the inside RS pumps are actuated for the current licensing design basis analysis.
The interruption has a minimum impact on the pump NPSH analysis and on the peak containment temperature profile.
5.2.1 Impact On Containment Peak Pressure And Temperature h134-JW0-11224-8 For the existing peak pressure analysis, it has been shown that an interruption in CS and RS flow for a short duration will have a slight impact on containm.ent peak pressure. This is because such a LOOP would only interrupt the CS and RS flows when switching from offsite power to emergency power.
The CLS timer would not be interrupted during the transition from station power to emergency power.
Therefore, if a LOOP occurred prior to the time when these pumps start, there would be no additional delay time applied to the RS pumps.
On initiation of the CLS signal, the EOG automatically starts; however, the safety systems might not be powered by the EOG at this time.
The safety systems are powered by offsite µower first, if available. Only when offsite power is lost, are the safety systems loaded on the EOG in sequence.
It takes a finite amount of time to transfer the loads of the individual safety systems to the emergency power generators. Assuming the CS pumps and the EOG are already running at the time when a LOOP occurs, then it is calculated that the containment spray would experience an 18 second interruption in flow.
If the LOOP occurred when the inside and outside RS pumps were running, a 68 and a 28 second interruption in flow would result for these systems, respectively.
Note:
The 68 and 28 seconds are the total flow interruptions associated with the 20 and 10 second load sequencing delays for the EOG sequencing modification for the inside RS pumps and outside RS pumps, respectively.
The design basis accident peak pressure for the existing licensing containment analysis is 44.71 psig which is less than the containment design pressure, 45 psig.
The licensing analysis has been done using the LOCTIC generated mass and energy data. This methodology produces a second pressure peak which is usually more 1 imiting than the primary peak generated by the blowdown.
The current licensing design basis accident analysis has been duplicated for the EOG sequencing analysis using a degraded inside RS pump flowrate of 3000 gpm and a 95% CS efficiency.
The results of the EOG sequencing analysis have shown that an interruption in CS and RS flows at the most critical time produces a peak pressure slightly greater than the current licensing design base accident peak pressure of 44.71 psig, but remains less than the 45 psig containment design pressure.
e e
More recent analyses, performed as part of a core uprating effort, use Westinghouse generated mass and energy data which incorporates a steam water mixing model.
When this mass and energy data is input into the LOCTIC code, the second pressure peak does not occur.
The peak containment pressure is controlled by the heat sinks and the mass and energy data only. If this methodology were applied for peak pressure analysis, the containment peak pressure would occur prior to actuation of the CS and RS pumps.
Therefore, a RS and CS pump delay would have no impact on containment peak pressure.
It has been shown that peak containment temperature does not exceed the existing environmental qualification (EQ) envelope.
The new temperature profile has been shown to be within the existing EQ envelope.
Since the EQ envelope has not been exceeded even with the LOOP delays, the existing peak temperature profile is still valid.
5.2.2 Impact On Containment Depressurization And Subatmospheric Peak Pressure.
The subatmospheric containment at Surry was designed to depressurize within one hour following a design basis accident.
Using minimum safeguard assumptions, LOCTIC calculations were performed to determine the containment depressurization time based upon an interruption of the inside/outside RS system flows.
These calculations assumed an additional one minute delay on the inside RS pump and a corresponding two minute delay on the outside RS pump.
The results of this analysis have shown that the depressurization time is extended by 60 seconds.
Because of the sufficient amount of margin that exists in the licensing analysis, the increase in depressurization time is insignificant. The present licensing analysis LOCTIC deck was used for this analysis.
Interruptions occurring past the first hour have a more significant impact on the subatmospheric peak pressure. A LOCTIC ca lcul ati on was performed using a 68 second fl ow interruption for inside RS, and a 28 second flow interruption for outside RS.
The results from this calculation have shown
- that, using the above delays, the subatmospheric peak pressure narrowly missed the atmospheric pressure limit.
Because of this, the above delays are the assumed maximum delays that could be tolerated before the containment exceeds the atmospheric limit.
5.2.3 Impact Of EOG Delay On Long-term Containment Cooling h134-JWD-11224-9 After the containment is depressurized with both the inside and outside RS pumps running, the operator will be concerned with the minimum containment pressure limit. The concern then becomes over-cooling the containment below the minimum design pressure of the containment liner and base mat.
With the CLS signal either present or cleared, the operator can readily trip the outside RS pump to prevent over-cooling the
e e
containment.
However, the inside RS pumps cannot be manually stopped while the CLS signal is present.
Procedural guidance will be provided for the operator for such events.
Due to the reduced decay heat power, a LOOP at this time would have little effect on the containment response since the operator would have time to limit the containment pressure rise by restarting the necessary RS pumps.
5.2.4 Impact on NPSH Analysis 5.2.5 5.2.6 h134-JWD-11224-10 The starting of the inside and outside RS pumps is initially delayed 2 and 5 minutes respectively. This ensures sufficient water is in the containment sump to provide adequate net positive suction head for the pumps.
Any later interruption in RS flow due to LOOP sequencing will not adversely affect the net positive suction head for the pumps.
At the beginning of the transient, the NPSH for the low head safety injection (LHSI) pump is not affected since it takes a suction from the refueling water storage tank (RWST).
Only after switchover does NPSH become a concern for the LHSI pump.
An interruption in RS at any time would allow the containment pressure to increase which would aid the available NPSH for the RS pumps and for the LHSI pump after switchover.
Since the CS pumps take suction from the RWST, an interruption in power to the CS pumps has no impact on their NPSH.
It has been concluded that a power interruption to the CS, RS and the LHSI pump would not reduce the available NPSH to these pumps.
Impact on Dose Calculations For accidents which actuate the RS and SI pumps, e.g., the large break LOCA, the filter exhaust fans would be necessary to ventilate the safeguard building through the filters.
The impact of a 30 second interruption of the power to these fans has been evaluated. It was determined that the offsite dose calculations previously performed would still be bounding.
Further, the limiting control room dose is based on a 30-day exposure interval. A 30 second filter exhaust fan delay for the large break LOCA would not significantly change that calculated dose.
Impact on Emergency Procedures The containment analyses for sequencing assumes that the EOG will be running during the entire transient. This is consistent with the philosophy used for the licensing design basis accident.
For the design basis licensing analysis, a 10 second EOG start time is applied to the loading of the engineering safeguards equipment at the start of the transient.
Once the EOG starts, it is assumed to be running for the entire transient. Therefore, for the EOG sequencing analysis, an additional 10 second EOG start time was not applied after a LOO~ had occurred.
I e
e Normally the EOG would be running during the time of peak containment pressure.
It is not expected that the operator would stop the EOG this early in the transient. Therefore, the peak pressure analysis is ~ot affected by the current procedures.
The existing emergency procedures allow the operator to stop the EDGs (provided offsite power is available) without consideration of the impact on the subatmospheric peak pressure.
Once the EOG is stopped manually, it would take too long for the operator to restart the EOG in time to reload the CS and RS pumps.
This condition could allow the operator to manually stop the EOG prematurely and risk exceeding the containment subatmospheric condttion.
There is currently enough margin in the depressurization time such that the additional EOG start time at any time during the accident would not impact depressurization. This analysis has been discussed in Section 5.2.2.
Existing procedures are being revised to require operation of the EDGs until plant conditions allow the EDGs to be shutdown.
Specifically, the operating procedure (OP) controlling EOG shutdown is being annotated to require a 90 minute wait period prior to shutdown if the OP is entered from the loss
- of primary or secondary coolant emergency procedures (EPs).
The capability of the EOG to run unloaded exceeds 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />.
Once these conditions are met, the EDGs should be stopped and placed in the 11AUTO" start mode to avoid extended operation in the unloaded condition.
5.3.
Transient Analysis Impact Due To EOG Load Sequencing Following A Loss Of Offsite Power An interruption in the emergency bus power during a LOOP has been evaluated for the UFSAR Chapter 14 transients.
The main impact is on those transients which actuate a CLS signal. These transients actuate more equipment and require a more detailed load sequencing.
Those transients that do not actuate a CLS, would delay auxiliary feedwater by approximately 10 seconds following a LOOP.
The SI loads are placed on the emergency bus as soon as it can handle a load.
Small break transients may not actuate the CLS signal; even if a CLS is actuated, there will be sufficient water inventory in the steam generator to provide cooling such that the 140 second delay to the AFW for CLS conditions will not adversely affect the peak cladding temperature (PCT).
5.3.1 Impact On LOCA Analysis h134-JWD-11224-11 For a LOCA which actuates a CLS signal, a 2 minute 20 second delay of the AFW to the steam generators would have insignificant effects on the PCT.
The PCT is primarily dependent on safety injection flow and containment pressure. A delay of the AFW flow to the steam generators would not impact the containment pressure during a LOCA.
Further, the PCT occurs relatively early in the transient before the RS system can have enough influence on the containment pressure to affect PCT.
e 5.3.2 Impact On MSLB Analysis During a MSLB which actuates a CLS signal, a 2 minute 20 second delay in AFW actuation would have very little impact.
For the.RCS transient, this delay would result in a slight reduction in over-cooling since all AFW is conservatively assumed to go to the faulted steam generator in the analysis. This delay in AFW would lessen the severity, by a small amount, of a MSLB on containment temperature and pressure by reducing the mass inventory deposited into the containment.
5.3.3 Intermediate And Small Break Analysis A CLS signal would be received during both the LOCA and MSLB provided the break size is large enough.
For smaller break sizes, a CLS signal might not be received during a LOCA or MSLB.
An AFW delay for these smaller breaks would be less significant since these transients tend to be longer and provide more time for response and recovery.
For such LOCAs, a 2 minute 20 second AFW delay would not cause the steam generators to approach dry out.
For the intermediate MSLB, the delay would again lessen the consequences slightly to both containment and RCS.
For the intermediate LOCA and MSLB break sizes which would actuate the CLS signal, the containment pressures and temperatures would not be limiting.
The PCT would also be less limiting for the intermediate size break LOCA.
If a CLS signal is not received for a small break then the CS and RS pumps would not be loaded on the EOG.
This results in a reduction of the loads on the EOG.
In this case, the AFW delay is only 10 seconds.
These small break transients are usually not severe enough to be a concern and the results are bounded by the analysis for larger breaks.
5.3.4 Other UFSAR Chapter 14 Accidents h134-JW0-11224-12
- In addition to the LOCA and the MSLB transients there are many other accidents which are potentially affected by the new EOG loading sequence.
These accidents are documented in Chapter 14 of the Surry UFSAR.
Although these accidents are different from each other, the impact of EOG load sequencing is basically the same.
None of these accidents would require safety injection, CS or the RS pumps to be loaded on the EOG during a LOOP condition.
This is because none of these accidents would actuate the Phase I CLS signal. The AFW pumps would be required for these accidents since a reactor and turbine trip would be expected. A ten second delay for the AFW pump loading (without a CLS signal) would have an insignificant impact on these accidents. A comprehensive list of these accidents is given below:
- 1)
- 2)
- 3)
- 4)
- 5)
- 6)
- 7)
- 8)
- 9)
- 10)
- 11)
- 12)
- 13)
- 14) e Uncontrolled Control-Rod Assembly Withdrawal From a Subcritical Condition Uncontrolled Control-Rod Assembly Withdrawal at Power Malpositioning of the Part-Length Control-Rod Assemblies Control-Rod Assembly Drop/Misalignment Chemical and Volume Control System Malfunction Startup of an Inactive Reactor Coolant Loop Excessive Heat Removal Due to Feedwater System Malfunctions Excessive Load Increase Incident Loss of Reactor Coolant Flow Locked Rotor Incident Loss of External Electrical Load Loss of Normal Feedwater Loss of Alternating Current Power to the Station Auxiliaries Turbine-Generator Unit Overspeed The control rod ejection accident was not included as part of the above list since this accident consists of two parts. These are a rapid, but short lived, power excursion and a small break LOCA.
Because of the potential to pressurize the conta~nment and depressurize the RCS, the rod ejection accident would require the SI pumps, and perhaps the CS pumps and the RS pumps if this accident actuates the CLS signal~
As for the previously discussed accidents, the AFW pumps would also be required for the rod ejection accident for recovery efforts. The proposed delays associated with all these pumps would not impact the recovery from this accident.
A fuel handling accident inside containment or in the fuel building would not require any of the major loads to be placed on the EOG e.g. the SI, CS or RS pumps.
During a LOOP, this accident may require some small loads to be placed on the EOG e.g., the containment isolation valves. It is therefore concluded that the analysis of this accident would not be impacted by the EOG sequencer loading during a LOOP.
The pressurizer heaters are powered from the emergency bus to provide the operator with RCS pressure control for long term recovery following a LOOP.
During the transients discussed h134-JWD-11224-13
e above, the pressurizer heaters are assumed to be off unless use of the heaters might produce less conservative results.
The initial steam space in the pressurizer can provide more than ample cushion to cover a delay of 180 seconds in the power to the pressurizer heaters.
5.4 Unreviewed Safety Question Evaluation A 10 CFR 50.59 evaluation was made to examine the impact of the addition of an EOG load sequencing scheme during a transient which has a subsequent LOOP.
This modification will improve the ability of the emergency diesel generator to provide the necessary power following a LOOP by sequencing the loads onto the emergency buses in acceptable loading blocks.
Previously there was no EOG load sequencing for a LOOP condition occurring after the transient began.
The results of the evaluation are:
a)
The implementation of this modification does not increase the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety and previously evaluated in the Final Safety Analysis Report.
The addition of an emergency diesel generator load sequencing scheme to each unit, which interfaces with safety-related equipment and safety-related systems, is being installed while each Unit (1 and 2) is in cold shutdown or refueling mode.
The design change will modify the operation of the auxiliary feedwater pumps, recirculating spray pumps (inside and outside), emergency bus pressurizer heaters, and the filter exhaust fans.
It will provide sequencing of these loads onto the EOGs to ensure that the maximum EOG load capabilities will not be exceeded under the worst case load applications, and ensure the availability of the systems necessary to mitigate the consequences of a design basis event.
With the most limiting restart equipment delays, the results of the applicable accident analyses will still meet their acceptance criteria.
The probability of an accident occurrence is not increased by this modification.
Providing EOG load sequencing to address a subsequent LOOP during a OBA event does not increase the probability of either event.
Likewise, the consequences of this accident are not increased by the proposed modification.
In fact, the proposed change addresses an accident scenario not previously identified and thereby limits accident consequences to within existing assumptions used in the accident analyses.
As identified previously, offsite dose consequences remain unchanged.
b)
The implementation of this modification does not create a possibility for an accident or a malfunction of a different type than any evaluated previously in the Final Safety Analysis Report.
h134-JW0-11224-14
e e
This design change does not produce any new accident precursors nor the possibility for a malfunction of a different type than those previously evaluated in the Updated Final Safety Analysis Report (UFSAR).
In fact, the
_proposed modification addresses worst case EDG loading scenarios which were not previously addressed in the original design base.
The operation of safety-related equipment or systems, or the availability of safety-related power sources, are not adversely affected. This modification will ensure the ability of the emergency diesel generators to provide the necessary power following a LOOP subsequent to a design basis accident, by sequencing the loads onto the emergency buses in acceptable loading blocks.
The modification will be performed while both Units 1 and 2 are in cold shutdown or refueling mode.
c)
The implementation of this modification does not reduce the margin of safety as defined in the basis for any Technical-Specification.
The addition of an emergency diesel generator load sequencing scheme will ensure the availability of the EDGs
- to mitigate the consequences of a LOOP subsequent to a design basis event.
As such, the proposed modification ensures that the containment design assumptions are maintained (i.e., 45 psig peak pressure and containment depressurization to subatmospheric within 3600 seconds).
Therefore, no margin of safety or Technical Specification basis is reduced by this modification.
The modification is being implemented while each unit (1 and 2) is in cold shutdown or refueling mode.
The results of the design basis accident analyses are not impacted.
Therefore, there are no reductions in safety margins.
5.5 Conclusion A review has been made of the containment analysis, MSLB analysis, large break LOCA analysis and other UFSAR Chapter 14 accidents.
Containment calculations have shown that a conservative delay time for the inside RS pump and the outside RS pump can be implemented without violating the design peak pressure, or the subatmospheric peak pressure limit following a LOCA.
Since this analysis assumes the EDG will be running during the entire transient, the current emergency procedures are being revised to support this assumption.
Specifically, the operating procedure (OP) controlling EDG shutdown is being annotated to require a 90 minute wait period prior to shutdown if the OP is entered from the loss of primary or secondary coolant emergency procedures.
The load sequencing delays following a non-coincident LOOP were evaluated and determined not to result in a consequence increase for the MSLB, the large breat LOCA or any of the other UFSAR Chapter 14 accidents.
The unreviewed safety question evaluation concluded that the implementation of this modification does not create a possibility of an accident or a malfunction of a different type than any evaluated previously in the Final Safety Analysis Report.
There h134-JWD-11224-15
e e
will be no increase in the calculated dose consequences since the assumptions used for the dose calculations will not be impacted.
As required by GDC 35 (Emergency core cooling) and GDC 38 (Containment heat removal),
11Suitable redundancy... shall be provided to assure that for onsite electric power system operation (assuming offsite power is not available) and for offsite electric power system operation (assuming onsite power is not available) the system safety function can be accomplished, assuming a single failure.
11 The current containment design basis analysis, with the 44.71 psig peak containment pressure, meets the requirements of these criteria. The results of the EOG sequencing design modification analysis are considered separate from the licensed containment analysis.
The EOG load timer settings were chosen to maintain the containment response within the containment design basis envelope.
Therefore, in accordance with the General Design Criteria cited above, the design basis analysis for containment heat removal will continue to assume that the LOOP occurs coincident with the LOCA.
The EOG sequencing modification was necessary to prevent overloading the EOG if a LOOP occurred at any time during a design basis accident.
Previously, load sequencing capability was only possible at the start of the transient, but not at any time during the transient.
The lack of a load sequencing capability any time during the transient could have caused the EOG to stall and result in a loss of the safeguards electrical equipment.
Thus, the EOG sequencing modification was required to ensure operation of the plant safety systems during a design basis accident.
6.0 POST MODIFICATION TESTING Following the completion of the modification, each control circuit will receive a wire continuity check, a device operational check, and a circuit functional check to operate the load breakers.
These checks will be performed in accordance with the test matrix of the design change package and existing and/or new periodic test procedures.
Testing of the complete system from initiation of LOOP, SI, and CLS conditions through the correct operation of the pump or load will be performed by a series of tests. Tests will be performed on the individual pumps and load breakers to ensure correct operation of these components.
Periodic tests check the logic of the controls to ensure that the controls operate as designed from emergency bus undervoltage initiation to load breaker operation. These periodic tests are performed as a normal part of the refueling outage.
7.0 TECHNICAL SPECIFICATION CHANGES There are no changes required to the Technical Specifications as a result of this modification.
However, surveillance considerations for this -
additional logic will be added as an enhancement to Section 4.6 by the end of 1989.
h134-JWD-11224-16
e e
a.a EOG TESTING RESULTS 8.1 General The Engineering report, 11Addition of Diesel Generator Sequencing 11 made several assumptions, based on Morrison-Knudsen Co., Inc. input, requiring verification since these assumptions contradicted the results of the computer model which Morrison-Knudsen helped develop and introduced the concept of a cold load limitation on the EOG.
Therefore, special tests were developed to determine the actual capability of the EDGs.
The tests were designed to analyze the voltage and frequency response of the EOG under worst case loading.
Additionally, a test was performed to determine if a cold load limitation would impact the frequency response due to a cold turbocharger as experienced by Morrison-Knudsen with similar units.
Regulatory Guide 1.9, 11Selection, Design, and Qualification of Diesel-Generator Units used as Standby (Onsite) Electric Power Systems at Nuclear Power Plants 11
, was used to develop guidelines for the EOG load sequencing modifications based upon the voltage and frequency responses obtained from the test.
8.2 EOG Response Characteristics The tests performed on EOG #3 demonstrated the diesel generator's ability to start worst case motor loads and return to rated voltage and frequency quickly.
Most of the motors utilized during the tests were in their recirculation mode of operation and therefore a resistive l-0ad bank wai used to augment the lower running load.
Sufficient motors were available for the necessary KVAR and KVA demand.
This loading bounds the worst case loading expected on the EOG.
The results indicated that on the initial load block, the voltage and frequency dipped below that suggested in Reg. Guide 1.9.
However, since this situation only occurred on the initial load block the results are acceptable.
The voltage did recover to 75%
and 90% of nominal within approximately 2.3 seconds and 2.7 seconds, respectively. The frequency recovered to 95% and 98% of nominal in -
2.4 seconds and 3.7 seconds, respectively.
The worst case subsequent load block, an auxiliary feedwater pump starting with an existing EOG load of approximately 2600 KW, resulted in a 20% voltage dip with a 90% voltage recovery in 0.33 seconds.
The frequency which did not dip below 98% of nominal.
The volts/Hz characteristics of the voltage regulator provides a significant impact on the large initial load block.
In essence, it provides for a "soft start". The frequency decay holds down the voltage which, in turn, reduces the KW seen by the diesel engine since real power (KW) is proportional to the square of the voltage.
This 11 soft start 11 provides a slower voltage recovery than that of a typical static exciter/voltage regulator system.
The 11 soft start 11 does provide for a less severe frequency impact due to the apparent reduction of load on the EOG.
hl34-JWD-11224-17
J e
e 8.3 Cold Load Limitation During development of the Engineering report, 11Addition of Diesel Generator Sequencing 11, Morrison-Knudsen revealed that a cold load limitation on the EOG could exist. This limitation exists because the turbocharger is being driven off the engine gearing until the exhaust gas warms the turbocharger sufficiently to allow it to 11freewheel 11
- This limitation could impact the frequency response of the diesel should loading levels exceed this limitation. Ates-twas developed to determine the maximum power output and the duration associated with the cold load limit.
- A review of the test data concluded that an initial cold load limitation of 2720KW does exist. The tests did not conclusively..
determine the cold load limitation duration; however, the experience
. -of Morrison-Knudsen indicates that 2-3 minutes is.,r,equ~Ped to.reach the 11 HOT 11 EOG capability. Engineering utilized this limitation in its design of the EOG load sequencing modification to delay the start of loads that may be impacted by this limitation. The auxiliary feedwater pump was delayed 140 seconds during the presence of a CLS signal due to this limitation. The final load, pressurizer heaters, was delayed 180 seconds to allow for timer accuracies.
8.4 EOG Load Sequencing The tests on EOG #3 indicated that the EOG requires a 7 second interval between the initial and second load blocks and a 5 second interval between subsequent load blocks to meet the Reg. Guide 1.9 criterion for voltage and frequency recovery within 60% of the sequence interval. The setpoints were selected to allow for timer accuracy and still maintain these intervals between load blocks.
Taking timer setting tolerances into account, none of the EOG sequencing timer settings allow two or more motors to start at the same time.
The cold load limitation of the turbocharger indicated that any load block which presented more than 2720KW starting load to the EOG should be delayed for at least 2 minutes. This reasoning does not consider the positive benefit of reduced voltage on starting motor load, yet provides a conservatism of design.
Multiple motor starts (motors starting at the same time) can occur for a LOOP during the first five (5) minutes after an accident signal because the motors may start due to an accident signal or an EOG sequencing timer reset. Different accident/LOOP sequences were reviewed for the possibility of multiple motor starts during any subsequent load block.
The worst multiple motor start is that of the outside recirculation spray pump and the auxiliary feedwater pump (140 seconds after the EOG energizes the bus).
In order to encounter this situation, the LOOP must occur between 144 and 172 seconds after the CLS actuation.
The starting KVAR of this combination would provide for a larger than normal voltage drop for a subsequent load block; however, the drop should quickly recover to within 75% of nominal voltage.
Additionally, since this condition occurs after the turbocharger is no longer a diesel limitation, the frequency decay should not drop below 95% nominal nor require a long recovery time.
No manual action would be required for circuits which may have their contactors h134-JWD-11224-18
)
-C e
e
.i l
dropout during the momentary decay in voltage because required loads with AC control circuits have maintained SI or CLS contacts for starting. Additionally, agastat timers used in AC control circuits should not dropout due to their 50% voltage dropout rating.
8.5 EOG Eguivalency Maintenance was performed on all three EOGs to ensure that the EOGs were equivalent. Morrison-Knudsen supported this effort and provided statements to the equivalency of all three EOGs.
This equivalency allowed testing of EOG #2 for the cold load limitation, and EOG #3 for the loading response, and the application of these results to each EOG.
Morrison-Knudsen will provide future maintenance and/or testing recommendations to ensure the EOGs maintain their ability to respond as demonstrated by these tests.
hl34-JW0-11224-19
,'. ~.
ttUNDERVOLTAGE PROitCTION BEFORE SEQUENCING MODIFICATION I 2/3 VOLTAGE < 751. 4160V t I 2/3 VOLTAGE< qex 4160V t
~,
t t 12 SEC. 1
...._ I EOG START1 ~
,,. I I
~
- !50 SEC.I 17 SEC. j jse SEC.
~,
UNDERVOL TAGE PROTECTION OPERATION CLOSE EOG BREAKER
,1 M
TRIP OFFS I TE BREAKER TRIP NONESSENTIAL LOADS
'.'( ~
EOG SPEED 871 RPM :!: 20 RPM EOG VOLTAGE 2 SEC.
EOG BREAKER CLOSE q~ :!: 2X OF 4161V RESIDUAL VCl. TAOE TltER UNDERVOL.TAOE PROTECTION RESETS CENERGIZE ALL LOADS ON BUS>
SIMULTANEOUS LOOP l CLS CLS FQ..LOWED BY LOCP AT !5 MIN
i
UNDERVOLTAGE PRO~CTION
}
f;.!!,~U A~ER SEQUENCING MO JFICATION A
1213 ~VOLTAGE < 75X 4160V I I 2/3 VOLTAGE< q01. 4160V I
t I SI I CLS I I SI I t -t I 2 SEC.:
I EOG START1 ~
I 11 SEC. I 60 SEC.,
~ I I.,
150 SEC.
~,
UNDERVOLTAGE PROTECTION OPERATION CLOSE EOG BREAKER TRIP OFFSITE BREAKER TRIP NONESSENTIAL LOADS EOG SPEED t
TRIP AND BLOCK START 870 RPM ! 20 RPM OF SAFETY-RELATED SEDUENCED LOADS
'l, I
EOG VOLTAGE 2 SEC.
..... EOG BREAKER CLOSE
)
q5x ! 2X OF 4160V RESIDUAL VOLTAGE TIMER
\\
,,r -
I UNDERVOLTAGE PROTECTION RESETS
(
~
~
/
<INITIATE LOAD SEDUENCING>-
)
~
CLS I SI I t
I
~,
H
)
I lt40 SEC. I 10 sEc. j I 10 sEc. I 120 SEC. 130 SEC.
Item sEc.j i
', ~
~,
~,
~,
~,
~,
INITIAL LOAD BLOCK PERMIT AFW PERMIT ORS PERMIT IRS PERMIT FEF PERMIT PRESS CHHSI, LHSI, CS RESTART RESTART RESTART RESTART HTR RESTART MISC. 480V LOAD>
./
---