ML19220B718
| ML19220B718 | |
| Person / Time | |
|---|---|
| Site: | Crane  |
| Issue date: | 02/03/1977 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML19220B713 | List: |
| References | |
| NUDOCS 7904270246 | |
| Download: ML19220B718 (18) | |
Text
-
THR"E MILE ISLAND NtJC10.AR PChER STATION UNIT NDSER 2 DOCKET.%NSER 50-320 PROTEGICN AN'D EMERGENCY PChER SYSTEMS SUFFLEMENTAL SArnd EVALUATION FIPCRT
- 7. 0 Instn:mentatien and Centrol 7.1 General The Cc:nissien's General Design Criteria, Institute of Electrical and Electronics Engineers (I m ) Standards including Criteria for Protection Systems for Nuclear Pcwer Generating Stations (II r Std 279-1971 and I::: Std 279-1968), and applicable Regulatory Guides for'Fcwer Reactors have been utilized as the bases for evaluating the adequacy of the protection and control systers.
IC : Std 279-1968 is the editicn applicable to the Three Mile Island Unit 2 reactor protecticn system; however, the 1971 edition is applicable to the remainder of the design.
The review of the protecticn and centrol systems was accceplished in part by cc= paring the designs with these of the Rancho Seco and Three Mile Island Unit 1 plants.
Our review concentrated en these areas which are unique to Three Mile Island thit 2, for which new informaticn has been received, or which have remained as ccntinuing areas of cencern during this and prior reviews of si-llarly designed plants.
The electrical drawing audit has been cc=pleted and this sunplemental Safety Evaluatica Report reflects the results of this audit, and cur review of the information presented in the Final Safety Analysis Report thrcugh and including Amndment 50.
79042702'$
A site visit for de pu:pese of viewing the physice.1 arrangement and insta11aticn of electrical equipment and verifying the implementation of the design will be scheduled when dese installations are sufficiently ccmplete (esti ated to be during the first quarter of 1977).
We will report the results of this site visit in a subsecuent report.
7.3.3 Main Feedeater and Steam Line Isolatien Requirements for feedeater and main steam line isolation are related to the analysis covering.ain steam line break (see Section 10.3 and 15.2.2 cf this report).
Our Saferv Evahaticn Repcr: dated September 1976 required that the electrical, instre.entation and control pcrtiens necessary to isolate the feedeater system satisfy the single failure criterien and that the redundant 1cgic circuitries be rcuted in accordance with de physical separa:icn criteria for safety systems. The present design uses a Feedeater La:ching System signal to provide this isolatien function.
Utis feedeater latching signal is generated frcm four pressure switches per steam generater, with two pressure switches located in each of the two main steam lines for a steam generator. The output of these pressure switdes are configured into relay logic circuitri such dat de contacts frc= these logic relays form a ene-cut-of-two taken twice logic matrix for feedeater isolatien. Be output 1cgic matrix signals are then applied to the folicwing six valves:
(1) the main feedeater centrol valve, (2) a bicck valve dcwnstream of this valve; (3) the star up feedwater centrol valve, (4) a block valve dcwnstream of this valve and (5) de two associated main stea-line valves. He design also includes interlock and bypass devices, as well as, indicators 81 2S7 i
3_
for the purpose of system status informaticn. The above description applies to the design associated with each one of the two steam generators.
We have reviewed this design and ccncluded that the electrical, instraentaticn and centrol aspects frca (and including) the sensors to the final actuators for the design confom to the single failure criterien and are in accordance with the physical separation criteria i
for safety systems. Mcwever, we note that the final solenoids (actuators) for the two centrol valves are not safety grade equipment and are pcwered frcm a ncn-Class IE pcwer source (loss of pcwer to these solenoids should result in centrol valves cicsing). Additionally the two dcwnstream block valves associated with these centrol valves are not pcwered frcm the Class IE power system thcugh they require pcwer to perfo m de isolaticn function. The Staff's ccncem abcut these items is that they are not totally in ccnfor :ance with de safety criteria.
Accordingly, we will continue to review the electrical aspects of this area in accordance with de overall system requirements. We will repcrt additicnal info mation ccncerning these items in a supplemnt to this report.
With regard to main steam line isolaticn, we noted in our Safety Evaluatica Report dated September 1976 that shculd it be determined that this isolaticn functicn is essential for acceptable ccnsequences folicwing a steam line break accident, we would require that the electrical, instamentaticn and centrol portiens necessary to isolate the steam system satisff the single failure criterien.
In this regard, the applicant has provided an analysis, which should demcnstrate that the consequences of b1cwing down both the steam generators is acceptable.
We will report the results of this staff review as it cance ns the electrical, instrumentation and centrol aspects for this item in a St^298
_ supplement to this report.
7.4.1 Emergencv Feedeater System The emergency feedsater system censists of one turbine driven pump, two motor-driven pt==s and associated piping and valves.
Diversity of centrol power is provided, such that, in the absence of all alter-nating current pcwer the turbine-driven sitsystem could operate.
Actuaticn of the system occurs en Icss of the two main feedwater pumps, loss of all four reactor coolant pumps, loss of power, differential pressure, or manual cperatien.
The original des'.gn as proposed was ncdified because in the event of a steam line break accident, total reliance for auxiliary feedwater flew to the unaffected steam generator was dependent en the cperaticn of the integrated control system and the air supply system which are non-safety grade systems. Tnis design was subsecuently modified to include bypass valves arcund the diaphragm operated valves which are controlled by the integrated control system and the air supply system. This provides an alternate path for feedwater f1cw which is not dependent en these systems. Additicnally, in the criginal design the motor-driven emerge.'cy feewater ptrps were inter 1ccked with pressure switches so as to prevent the ptmps frca starting if 1cw suction pressure existed. These interlocks have been removed and a Icw sucticn pressure alarm provided.
We have reviewed the instrimentation, centrols and electrical system design for the emergency feedsater system and conclude that they conform to the applicable criteria and are acceptable, stiject to final review of the steam line break analysis.
- 81. 299
- 7. 5 Safety Related Disclav Instrumentation The safety related display instrumentaticn provides information to the reactor cperator to enable him to perfom required safety functicns during nc=al cperations, abnomal cperational cccurrences, and accident and post-accident conditions.
Our review of this instrumentatien included the features for monitoring of the engineered safety features system, support systems, safe shutdcwn systems, and accident and post-accident conditions. We had noted during the course of this review that the display instn=entaticn required for safe shutdcwn and post-accident mcnitoring had not been procured as seismic Category I.
An additicnal concem noted was the physical separation between cable routing circuits asscciated with redundant monitored parameters. Accordingly, the applicant has provid.ed the folicwing additional infocation ccncerning these items.
All elements of the menitoring systems were investigated for their I
seismic capability frcm sensor and sensor mountings thrcugh centrol reca indicators and panels.
In cases where there were differences in the physical characteristics between Three Mile Island Unit Number 2 equipment and the qualified equipment, these differences are detemined to be incensequential with respect to the seismic capability of the ccmpcnent. The cnly two types of ccmpcnents are indicaters and recorders used -for reactor coolant te=erature, pressuri er temperature, pressuri:er level and steam generator level. These compcnents are mechanically identical to these which wili be seismically tested by the Babcock and Wilccx Ccmpany in the seccnd quarte; cf 1977.
However, should the additional testing by the Babcock and Wilcox Ccmpany indicate deficiencies, 81 300 we will require that these deficiencies be corrected for the Three Mile Island Unit Number 2 Plant. Also, if any of this equiprant should fail to meet its design functions, pcr:able meters could be utilized to menitor the required parameter frca the redundant and indepe.ident sensor cu: puts at the shutdown panel curside of the control roca.
With regard to the second concern all cabic trays centaining cirtuits asscciated with inst =mentaticn for safe shutdckn are qualified as Seismic Categorf I.
Most of these circuits are physically separated and the cable trays which carry these circuits centain cnly 1cw voltage, Icw current instrumentation cables. Also, additional means such as diverse parameters are provided to permit the operator to cbtain the necessary info maticn We have reviewec the above infomaticn provided by the applicant cenceming the display instrumentaticn required for safe shutdown, which included descriptive informaticn, cable tray laycut drawings, and correlaticns tables between instruments and their associated cable trays.
Based en this review we conclude that the present design is adequate subject to our viewing selected installations concerning this areas during our site visit.
7.6 Cther Svstems Recuired For Safetv 7.6.1 Chanteever Frem Iaiecticn Mode To Recirculation Mede Fo11cwing A Less-Of-Coolant Accident The original design as proposed accomolished the changeover frca the injecticn mode to the recirculation mode of cperaticn follcwing a postulated less-of-coclant accident ccmoletely manually. We expressed conce= abcut the nu-ber of cperations which the cperator would have 81 201 to cceplete, and the time available during which these cperations must be correctly ccepleted. As a result of these concerns the applicant dccumented that this feature of the design wculd be autc=ated. Also, this autecatic feature is to be initiated en Icw borated water storage tank level.
In addition, the applicant has provided the revise' electrical schematics and diagrams which shew how this automatic fea*ure is ig lemented.
We have reviewed the infor::ation provided concerning this revised design and conclude that the electrical, instrumentation and centrol aspects of this modified design conform to the apprcpriate recuirements, and is acceptable subject to cur verifying its insta11aticn during the site visit.
7.8 Oualificatien Of Sdety Related Electrical Ecuirment 7.8.1 Seismic Qualificaticn The applicant has stated that the seismic Categcry I electrical equipment has been seismically qualified by prototype tests or analyses in accordance with Ir-- Std 344-1971, " Seismic Qualificaticn for Class I Electric Equipment for Nuclear Pcwer Generating Staticns." In addition, the applicant has identified this equipment, cescribed the seismic qualifica:icn progrsms, st==arized the tes: and/or analysis results, and identified the test documenta:icn.
We have reviewed this info::atien and conclude that the seismic qualification of the seismic Category I electrical equipment is acceptable.
81 302
g,
7.3.2 Environmental C h ification The applicant has identified in the Final Safety Analysis Report all instrumentaticn, centrol, and electrical equipment i.:por ant to safety.
Futher, he has identified the location of this equipment and stated the expected li titing envircnmntal conditions at that 1ccaticn. Additicnally, the applicant stated that qualificaticn tests and analyses have demen-strated the ability of the safety related equipment to functica in the no =al and post-accident environment in accordance with these expected limiting envircnmental conditions. However, recent re-analyses performed for this plant have indicated that the containment vapor temperature exceeds briefly that of the centainment design basis te=erature for a short period of time follcwing selected postulated steam line breaks within containment. The applicant has documented that an analysis has been performed which shows that this vapor temperature does not result in any safety related equipment temperature in excess of the temperature for which the equipment has been qualified. We agree with this analysis, and conclude that envircnmental qualificaticn of this safety related equipment is acceptalbe.
We have also noted during the course of cur review that selected Class ZE electrical equipment within the balance-of-plant scope of supply has no special envircnmntal conditions specified in their equipment design specificatien requirements.
Equipment within this category includes such items as switchgear, motor centrol centers, and motors '.ccated curside the reactor building. The applicant has dcctmented that these items of equipment have been designed in accordance with industry standards, and has provided additional infomation (including test results and certificaticns) for specific items of equipment to 81 303
.).
suppcrt the emircnmental qualificaticn of this equipment for use in Class IE systems.
We are presently reviewing the above info mation in accordance with the staff's generic review conceming the qualifica:icn of balance-of-plant electrical equipment. This generic review is being conducted for all cperating license applica:icns which are currently under review.
We will report additional results concerning this item (for Bree Mile Island Unit.Vrber 2) in a supplement to this report.
7.9 Containment Electrical Penetratiens ne applicant has stated that all containment electrical penetraticns meet seismic Class I requirements and are in accordance with the applicable requirements of Section III of the American Society of Mechanical Engineers Code. Additionally, the containment electrical penetrations are designed to meet all the electrical requirements for the service environment without dielectric breakdcwn or overheating and are qualified for the service envircnment.
The applicant has further stated that the centainment electrical penetraticns assemblies meet the ruquirements of IEEE Std 317-1971, " Electrical Penetraticn Assecblies in Centainment Structures for Nuclear Fueled Pcwer Generating Stations." Also, a descripticn of the prctotype test as perfor ed by General Electric and the results of this test are contained in the test report General Electric Number 74-502-3. The applictnt has documented that both the electrical and envircnmental test cetditicas as noted in this test report exceed the design electrical and envir:nmental conditicns for Three Mile Island Uni: Number 2.
Also, with regard to this report the applicant has documented that he 01.~204
. intends to ccrply with any resolutiens between General Electric and the Nuclear Regulatory Cc= mission Staff that have a safety significance for the Three Mile Island Unit Number 2 plant.
We have reviewed the informaticn provided concerning the containment electrical penetrations and ccnclude that these penetrations confom to the applicable requirements and are acceptable subject to the final detailed review of the above General Electric test report.
8.1 General General Design Criteria 17 and 18 and the follcwing Regulatory Guide and standards were utili.ed as the primary bases for evaluating the adequacy cf the electric power systems of B ree Mile Island Unit 2:
(1) Regulatory Guide 1.6, " Independence Eerseen Redundant Standby (Onsite) Pcwer Scurc.es and Between Beir Distributicn Systems" (2) Regulatory Guide 1.9 " Selection of Diasel Generator Set Capacity for Standby Pcwer Supplies" (3)
IC= Standard 308-1971, " Criteria for Class IE Electric Systems for Nuclear Pcwer Generating Stations".
I site visit for the purpose of viewing the physical a:. a 3emnt and insta1M icn of electrical equipment and verifving the implementation of the design will be scheduled when these insta11aticns are sufficiently complete (estimated to be during the first quarter of 1977). We will report the results of this site visit in a subsequent report.
S.2 Offsite Pcwer System Tne substaticn at the site incorperates a 230 kilovolt breaker-and-a-half switching arrangement which provides ten:dnal faci e_s thee
11 transmissien circuits and tl ; unit auxiliarf transformers. Two of three transmissicn circuits go north to Middletown Juncticn en different double circuit tcwers to ccnnect the substation to the existing Metrcpolitan Edison Ccmpany 230 kilovolt transmission network.
Tne third circuit connects the substaticn (en a different righ* of way) to the existing N tropolitan Edison Company 230 kilovolt transmissicn network at Jacksen.
The two rights of way are divergent. This arrangement ensures that at least cne circuit is avai:- le if stracturel, collapse cccurs within a right of way.
Pri.arv and backup protective relaying systems have been provided for each 230 kilevolt circuit in addition to circuit breaker failure protection.
Two redundant and separate scurces of direct current centrol pcwer are supplied to the 230 kilovolt substation frca Tnree Mile Island Unit 1 250/125 volt direct cur ent system.
Loss of eitner direct current source would not inhibit the ability to supply offsite power to the statien.
Offsite pcwer is normally supplied from the 230 kilovolt substaticn to the two unit auxiliarf transformers by two physically independent circuits.
This arrangemen* provides for two i:nnediate access scurces. Each of the two unit auxiliarv transfo=ers (230/4.16 kilovolts) normally cennects to cne of the two 4.16 kilovolt engineered safety feature buses.
The two 4.16 kilovolt engineered safety feature buses are arranged in a two divisicn split-bus ccnfiguration.
In the event of a failure to either circuit, transfer of the loads to the remaining source is acccmplished autcmatically by relay and breaker acticn. Each unit auxiliary transforner is sized to carrf the unit full lead auxiliaries and the engineered safety feature auxiliaries.
~
81 206
h
- 17.-
Steady state and transient stability analyses have been nade to determine the perfor=ance of Diree Mile Island thit 2 as well as the transmissicn network during contingency situaticns. The results of these studies have shcwn that no unit instability, system instability, transmissicn line overload or cascading cutages will occur as a result of 3-phase fault and cutage of any transmissicn line emanating frcm either the Three Mile Island 230 kilovolt or 500 kila'olt bus. Additicnal studies have shown that the sudden loss of the cutput of Three Mile Island thit 2 by itself or alcng with the next largest unit (Three ble Island Unit 1) will not result in any system or unit instability, transmissicn overloads, cascading cutages or intolerable voltage ccnditicns in the network. Also, the planned transmissicn system meets the Mid-Atlarc.c Area Council's
" Reliability Principles and Standards" and has been approved by the Council.
In additien, we have requested that the applicant provide additional infomaticn en offsite pcwer systems (for the Three Mile Island thit Nunber 2 staticn) which relates directly to the Mi11stene thit St=ber 2 occurrence. The anplicant has orally stated that this irlo=aticn will be prepared and submitted for staff review.
We coaclude that the design of the offsite power system satisfies General Design Criteria 17 and 18, and is therefore acceptable subject to our final review of the above requestid additicnal infomaticn.
8.3 Onsite Pcwer Systems 8.3.1 Altemating Current Pcwer System Cnsite standby alte=ating current pcwer is supplied by tw 3000 81 307
- Each diesel supplies cne 4.16 kilovolt kilowatt diesel generators.
emergency bus which is associated with cne divisien of the two-divisien split-bus ccnfiguraticn.
Inter 1ccks are provided to prevent paralleling Each diesel is autcmatically started by an the diesel generators.
undervoltage signal frc= its respective bus or by a safety feature actuation signal. Only one of the two diesels is recuired to provide emergency pcwer for accident conditicns.
Be redundant engineered safety features and vital instr.: mentation and centrol leads are supplied, directly or indirectly, frcm the two 4.16 kilovolt emergency buses through the two-division split bus configuration.
Tnis configuraticn is maintained throughout the alternating current and direct current subsystems.
Interlocks are provided to prevent redundant buses frem being paralled by tie breakers.
Ecwever, we have identified features of the design enabling a single ccmconent to be pcwered frca either of two redundant engineered safety features sources. The applicant has stated that intericcks are provided to prevent these ccmpenents from being powered from more than ene redundant scurce simitanecusly. We have verified that these inter 1cck features have been included in the design during cur electrical drawing audit.
The diesel generators are rated at 3000 kilcwatts centinuous and 3300 kilcwatts for two hours. The maximum emergency lead they will be required to carrf is 2416 kilevatts for a period of 40 minutes. This is well wit h Se reccamendatic~s of Regulatory Guide 1.9.
Tne applicant ha; also stated dat the diesel generator units at Tnree Mile Island Unit 2 are identical to thoso supplied to the licensed Peach 30ttcm Units 2 and 3.
81'P08
O.
Since the emrgency loads fo. Ihree Mile Island Unit 2 are cenparable to the Peach Bottcm units and in view of the in-sertice usage of the units in nuclear applicaticns, additicnal reliability cualification testing for these units is not deemed necessary.
Each diesel generator and its auxiliarf system is separately enclosed 8
in a seismic Categorf I installation.
The starting and cperation of any diesel is not ccnditiened by cperaticn of the other.
Each diesel will receive a starting signal when any of the folicwing occurs:
1.
Less of essential bus voltage 2.
A safety feature acctuaticn signal 3.
Manual start (local or remote) 4.
Test signals to sir:ulate any of de above.
Each emergency generater is equipped with mecannical and electrical trip interlocks to ensure personnel protecti i and to prevent or limit equipment damage. Our positicn with regard to diesel generator trip devices is that these devices (with the ereptien of engine overspeed and generatcr differential) shculd be bypassed if a safety feature's actt.ation signal is present, and the bypass circuitry should cc= ply with the safety criteria, or that the trip function be formed with coincidence logic and be cc=pletely testable.
During the drawing audit it was noted that additicnal equipment protective trips were included in the design which did not ccafom to this pcsiticn.
Subsec.uently, the applicant provided dcctmentaticn which clearly indicated that the design wctdd confom to this staff posiri.cn.
In additicn, the applicant has provided the electrical schematics for the modified design. We have reviewed these electrical schematics and other informatica provided 81 " 9 bl.o by the applicant and conclude that this aspect of the desip is acceptable.
We also noted during cur review that the design did not include provisiens for periodically testing the undencitage relays at the 4.16 kilovolt The engineered safety features buses during normal pcwer cperations.
applicant agreed to include provisions in the design, to test these undervoltage relays periodically and to submit revised electrical schematics for the r:odified desip. We have reviewed these electrical schematics and other infomation provided by the applicant conceming this rod'iied design and conclude that this design is acceptable.
Each diesel engine is supplied with a 25,000 gallen diesel fuel tank and a 550 gallen day tank with two 10-gallen per minute fuel oil transfcr pt=ps which autcmatically maintain the level in the day tank.
Sufficient fuel is stored to allcw cne unit to supply post-accident power requirements for seven days.
The statien 120 volt altemating current system consists of five charmels of 120 vcit altemating current vital pcwer each supplied normally via a si' tic switch frem a 250 volt direct current /120 volt altemating current inverter or,as a backup to each channel,a 480/120 volt altemating current regulated voltage transfer er.
We noted during our review that for the system level safety features actuaticn signal there exists a cmnection between redundant electrical trains by the way of the instrument pcwer ccnnecticns for the cutput relays in the safet/ features actuatien system cabinets. To allay this concem, the applicant Fas stated that these output relays are qualified as isolaticn devices. We have reviewed this informatica and ccnclude that the information provided is inadequate. We will require ST - 33 0
. that the applicant provide actual tests results to demcnstrate that these cutput relays are qualified as isolaticn devices.
Accordingly, we ccnclude that the design of the emergency altemating current pcwer system meets General Design Criteria 17 and 1S, I - Std 308-1971, and Regulatory Guides 1.6 and 1.9 and is therefore acceptable subject to satisfactory resoluticn of the item noted above.
ACRS Ccncerns Long-Tem Post-Accident.tnitoring Instrantation
\\
18.7.1 The Comittee has noted that, "Leng-tem post-accident cperaticn of the plant to maintain safe shutdcwn ccnditions may be dependent en instrumentation and electrical equipment within containmnt which is susceptable to ingress of stean er water if the hermetic seals are either initially defective or should beccme defective as a result of ans,ge or aging.
Also, the Cc=lttee believes that apprcpriate test procedures to confim continucus 1cng-tem seal capability should be developed."
The applicant is aware of these concerns and is presently ccmpiling a list cf instrants fo1 which these ccncerns are applicable. Once this list of instrants have been explicitly identified additional infcmation must be provided by the applicant Wich addresses these concems.
We will report additicnal results of cu review conceming these matters in a supplement to this report.
18.7.1 Instrant Line Failures Tne Cc=lttee recomended that; " studies be made to assure te.at failure of an instrant line cannot cause plant centrc11 ability problems of significance to public safety."
g.
Studies of this nature have been made for other Babccck and Wilcox plants. Hcwever, explicit documentaticn which addresses this concern for the Three.A!ile Island Unit."u:ter : Station is presently not cent ned in its Final Safety Analysis Report. The applicant is aware of this cencem and when additienal explici info matien is 4
available, we will provide additional results of our review of this matter in a supplement to this report.
18.8.1 Batter. Surelied Direct Cur ent Pcwer Svstem The Ccrittee has also recc= ended that, 'Turther review be made of the battery supplied Dizect Current pcwer system to assure that ncn-essential leads do not interfere wi:L its safety function."
In respense to : Sis cencern the applicant has stated that all essential and ncn-essential 1] ads are ccnnected to the Direct Current buses through individual Class IE circuit breakers located in seismic Class I areas.
Also, the fault protection coordinaticn scheme is such that a fault within any load / feeder circuit will cause its circuit breaker to trip prior to initiatien of a trip of any upstream circuit breaker. ~his ensures that faults in ncn-essential 1 cads / feeders ccnnected to the Direct Current bus do not interfere with any safety functicns.
In additien, the circuits in the Direct Current distribution panels are all individually fused en both the positive and negative sides. The fuse rating for each Icad in the distribution panel is such that its time overcurrent trip characteristics fcr all faults will cause the fuse to open prior to the initi-+icn of a trip of tF branch circuit breaker at the de bus.
~
We have reviewed the infor:.s.ica provided ccncerning this matter and ccncluded that the present design is censistent wi*.h other plant 81.~312
-1S-designs of this vintage fcund acceptable by the staff.
However we will rec,uire apprcpriate Technical Specificatien cnncerning periodic testing of these circuit breakers trip characteristics so as to assure that the present design is adequate. We will report additicnal results, if any, cencerning this item in a supplement to this report.
81~313