ML19250A826
| ML19250A826 | |
| Person / Time | |
|---|---|
| Site: | LaSalle  |
| Issue date: | 10/16/1979 |
| From: | Parr O Office of Nuclear Reactor Regulation |
| To: | Peoples D COMMONWEALTH EDISON CO. |
| References | |
| NUDOCS 7910240661 | |
| Download: ML19250A826 (17) | |
Text
.
y,c
/[on nea,*)
v UNITED STATES y
)
g NUCLEAR REGULATORY COMMISSION
%1
- *... #gV(j
,j WASHINGTON, D. C. 20555 s%
OCT i6 B N Docket Nos.: 0 373 and 50-374 Mr. D. Louis Peoples Director of Nuclear Licensing Commonwealth Edison Company P. O. Box 767 Chicago, Illinois 60690
Dear Mr. Peoples:
SUBJECT:
REQUEST FOR ADDITIONAL INFORfMTION CONCERNING LA SALLE COUNTY STATION, UNITS 1 & 2 As a result of our continuing review of the La Salle Final Safety Analysis
~
Report, we find we need additional information in the area of instrumentation and control systems, power systems and structural engineering to continue our evaluation. The specific information required is listed in the Er:losure.
Please inform us after receipt of this letter of the date you can supply the requested information.
Please contact us if you desire any discussions or clarification of the infor-mation requested.
Sincerely,
/ [3Qc' c p (
c' t
,/
Olan D. Parr, Chief Light Water Reactors Branch No. 3 Division of Project Management
Enclosure:
As stated cc: w/ enclosure:
See next page
}207 bbk 7910240$$[ h
Nr. D. Louis Peoples Director of. Nuclear Licensirag Connonwealth Edison Company P. O. Box 767 Chicago, Illinois 60690 cc: Richard E. Powell, Esq.
Isham, Lincoln & Beale One First National Pl.za 2400 Chicago, Illinois 60670 Dean Hansell, Esq.
Assistant Attorney General State of Illinoie 188 West Randolph Street Suite 2315 Chicago, Illinois 60601 Mr. Roger Walker, Resident Inspector U. S. Nuclear Regulatory Comnission P. O. Box 737 Streator, Illinois 61364
}?O[
00b
ENCLCSURE REQUEST FOR ADDITIONAL INFORMATION 030.0 INSTRUMENTATION AND CONTROL 031.272 The response to Question 031.244 is not acceptable as discussed below.
(1)
We requested a listing of each type of relay that must be energized or remain energized during a seismic event. The response lists only ECCS relays. The list should be re-vised to include all Class IE relays, whose unintended change of state during a seismic event, could cause an un-desired condition.
(2)
We requested that the coil voltages at which the above relays were qualified be provided. The response states that the ECCS relays were qualified at the normal voltages.
Seismic testing using only the normal voltages is not acceptable since the test does not demonstrate that the re-lay will perform its safety function during extreme voltage conditions. The relay may fail to pick up or it may drop out during a seismic event if the coil voitage is at the minimum level. The seismic qualification program should be modified to include testing at the voltage extremes or a justification on some other basis should be provided. Tne FSAR including responses to questions, specifically 031.244, should be revised to be consistent with this position.
031.273 The response to Question 031.236 is not acceptable. We requested a description of the Seismic Qualification Program for the conden-ser vacuum switches (component #821-N056).
The response states that these switches are qualified by their similarity to a pre-viously qualified switch. We request (1) a complete comparison between the two switches and (2) a complete description of the Seismic Qualification Program used for the switch that is similar to the condenser vacuum switch. This information should clearly demonstrate that the condenser vacuum switches will survive a seismic event and continue to function. Tne response to 031.236 should be revised to be consistent with this response.
031.274 The response to Question 031.148 - (3) and (4) does not satisfy our concerns. We requested a schedule for completion of the test-ing for units which have not been qualified. Table 3.10-1 page 3-10-27 states that qualification information will be available after July 1978 for penetration assemblies. Also Table 3.10-1 page 3-10-30 states that qualification information will be avail-able after September 1978 for main control boards. Table 3-10-1 should be revised to show the qualification results for this equipment. We also requested identification of the documents which describe the verification test method, procedures, and results of seismic qualification for each piece of Class IE equipment. This information has not been included in Table 3-10-1 nor elsewhere in the FSAR; therefore, the FSAR should be revised to provide this information.
1297 086
. 031.275 The response to Question 031.52 is not acceptable. This response indicates some indicators and recorders are seismically qualified.
We reg ?re that all equipment used for post-accident.T.cnitoring and safe shutdown be qualified to function within acceptable limits following a seismic event, this includes all indicators and recorders. The response to Question 031.52 and other parts of the FSAR should be revised to show conformance with this position.
031.276 Question 031.148(1) requested a revision of Tables 3.10-1 and 3.10-2 to include all Class IE equipment.
Qualification for the ADS solenoid valves were not included in the responses.
The ADS valves perform a safety function and are considered Class IE.
These valves should be environmentally and seismically qualified.
The qualification information for these valves, as specified in Questions 031.83.148 and 031.156(2) through (7), should be provided and Tables 3.10-1 and 3.10-2 should be revised to include these items.
031.271 The response to Question 031.250 which refers to Question 031.5 is incomplete. The test plan, test set up and test procedures have not been provided for (1) the damper operator for CBC05YA, (2) the fan motor IVG0ZC, or (3) the SGTS logic equipment and the main steamline isolation valve, solenoid valve. We request that you provide this information.
031.278 We request that you describe the qualification requirements for the equipment which protects RPS components from abnormal voltages and frequencies due to a failure of the RPS Motor Generator set, regulat~ ion system. The response should include a description of how these requirements have been satisfied.
031.279 We. requested a description of the qualification program to demonstrate that various Class IE isolation devices are acceptable (see Questions 031.128, 031.137 and 031.146).
The response to 031.137-2 and 3 states that the RMC system and the RBM system are not Class IE tkrefore the isolators between these systems do not have to be quali/ied. We conclude that the RBM systcm is a safety related system requiring all associated equipment to be qualified, see Question 031.282.
We request that the environmental qualification information specified in Questions 031.5 and 031.148-(2), (3) and (4) be pro-vided for the equipment associated with the RBM system, including the isolation devices. The response to Question 031.137-2 :nd 3 should be revised to be consistent with this position.
l'nl 087
. 031.280 Qualification of Isolation Amplifiers We require safety circuits to be separated from nonsafety circuits in accordance with IEEE Std-279-1971, and General Design Criterion Number 5 and Number 24.
There fore:
(1)
An acceptable way for separating safety circuits from non-safety circuits is by the use of qualified isolators.
Information describing the qualification program for isolators which are used to separate Class IE circuits from non-Class IE circuits has been requested, but not provided. Specifi-cally, in Questions 031.069, 031.128 and 031.146, qual i fica-tion information for isolators used in the startup transient recorder system was requested, and this information has not been provided. A list identifying each Class IE input to the startup transient recorder system should be provided.
Also a description of how these safety related inputs are protected from failures in non-safety related-startup trans-1ent system should be provided.
(2)
Questions 031.93, 031.128, 031.137, 031.158 and 031.228 requested qualification information on isolators, used to separate Class IE circuits from non-Class IE circuits.
Each interface between Class IE and non-Class IE circuits should be listed with location specified. The isolation device between the circuits listed above should be identified and the qualification program for each should be provided.
The qualification program should include all information specified in Question 031.148-(2), (3) and (4).
(3)
The responses to Questions 031.89(3) and 031.143(5) do not satisfy our concerns. The response to 031.143(5) states "the LSCS system design does not include separation between divisional-associated and non-divisional-associated circuits for the plant process computer".
This does not answer the question that we asked which was:
Clarify the response to Question 031.89 Part 3.
Include the following topics in the clarification:
(a)
Justification for the use of the plant computer for essential functions, (b)
Schematic diagrams for the plant process computer Divisions 1 and 2, essential back up circuits, (c)
Identification of the computer bared essential circuits, and (d)
Justification for interconnecting Divisions 1 and 2 wiring with a flamable pathway in violation of the response to PSAR Question 7.3 Part f.
1?n7 088
. We request that this information be provided. Also we request a definition of the terms divisional-associated circuits and non-divisional-associated circuits.
The defini-tions should clearly explai-the differences between the two terms.
031.281 Branch Technical Position EICSB#23, listed in Appendix 7A of the Standard Review Plan (NUREG-75/087), states our requirements for instrumentation for post accident monitoring and safe shutdown.
There are inconsistancies in the FSAR and your design does not satisfy all of our requirements. Therefore:
(1)
FSAR Section 7.5.2.2(b) indicates that several recorders and indicators may not perform their required function following a seismic event. This is not acceptable since the requirements of IEEE-Std-279-1971 are not satisfied.
The response to Question 031.84 states that " indicators and recorders utilized for post accident monitoring were seis-mically tested and shown to be operable after test". This is in conflict with FSAR section 7.5.2.2(b).
We require all indicators and recorders, used for post accident monitoring and safe shutdown should be qualified to operate within acceptable limits following a seismic event without operator action or maintenance. The FSAR, including all questions and responses, should be revised to remove all inconsistancies with this position.
(2)
Branch Technical Position EICSB#23 requires that instrumentation for post accident monitoring and safe shut-down should be redundant, with indicators in the control room for both channels with at least one channel recorded.
FSAR Section 7.5.1.2 does not satisfy this requireme
.ince there are no provisions to record the suppression pool temperature. FSAR Section 7.5.1.2 and LSCS design should be revised to show that all post accident monitoring and safe shutdown instrumentation has redundant channels with an indicator for each channel and a recorder for at least one of the redundant channels.
(3)
Branch Technical Position EICSB#23 also requires that instrumentation for post accident monitoring and safe shut-down should be energized from the onsite emergency power supplies.
FSAR Section 7.5.1.2(a) lists five systems which provide reactor shutdown information to the reactor operator.
With exception of the control rod status lamps, these systems are all energized from non-Class IE sources. Thus, failure of the single Class IE source to the control rod status lamps in conjunction with loss of off-site power would result in loss of all shutdown status information to the operator. We require that the design be modified to pro-vide Class IE power to one of the other systems providing shutdown status information.
12n7 089
. 031.28i Questions 031.14, 031.67, 031.117 and 031.150 requested information on the RBM system to demonstrate that this system satisfies the requirements for a safety related system.
Chapter 15 of the FSAR takes credit for the function of tais system to prevent unsafe operation of the nuclear plant, and FSAR 5ection 15.4.2 specifically states that the RBM is designed to be single failure proof. We require that the design of RSM be modified to satisfy the requirements of a safety related system, or when excep-tions to these requirements are taken that these exceptions be identified and justified. We also require a complete description of how this system will perform its intended safety function when required.
031.283 The main steamline isolation valve leakage control system does not meet the single failure criterion. The failure of a single relay would permit the uncontrolled blowdowr of a main steamline.
This design deficiency is common to both the inboard and the out-board leakage control systems.
During the review of Hatch 2, changes were made by General Electric to ensure that the design would meet the single failure criterion.
The LaSalle drawings do not incorporate these changes. We require that the design be modified to meet the single failure criterion.
Revised drawings should be provided showing these changes.
031.284 Questions 031.044(2), 040.70, 031.149, 031.237 and 031.260 all request information for our review, so that we may determine that methods used for testing safety related systems are acceptable.
The requested information has not been provided. We discourage the use~ of fuse pulling, jumpers, removal of wires and disconnec-tion of connectors, in order to test safety related circuits.
However, we will accept these procedures when we have determined, that from our reviews, that all safety related systems have been returned to their normal operational made following the tests.
Therefore, we require that the following information be provided for our review.
(1)
Identify each circuit where fuse pulling, jumpers, wire lifting or disconnecting connectors are used when perform-ing a test.
(2)
Justify the reason for each case.
(3)
Describe how restoration or each circuit is verified after testing is complete.
Table 031.260-(l) provides examples of this information, however, we require a list describing each case where a safety circuit is disabled. Revise the table to provide this information.
iM7 090
040.0 POWER SYSTEMS BRA!!CH 040.113 Experience at some operating plants has shown that diesel engines have (9.5.8) failed to start due to accumulation of dust and other delf terious material on electrical equipment associated with starting of the diesel generators (e.g., auxiliary relay contacts, control switc5es - etc.).
Describe the provisions that have been made in your diesel generato
- building design, electrical starting system, and combustion air and ventilation air intake design (s) to preclude this condition to assure availability of the diesel generator on demand.
Also describe under normal plant operation what procedure (s) will be used to minimize accumulation of dust in the diesel generator room.
In your response also consider the condition when Unit 1 is in operation and Unit 2 is under construction (abnormal generation of dust).
040.114 Operating experience has shown that accumulation of water in the starting (9.5.6)
RSP air system has been one of the most frequent causes of diesel engine failure to start on demand. Condensation of entrained moisture in com-pressed air lines leading to control and starting air valyes, air start motors, and condensation of moisture on the working surfaces of these components has caused rust, scale and water itself to build up and score and jam the internal working parts of these vital components therecy preventing starting of the diesel generators.
1207 091
2-In the event of loss of offsita power the diesel generators must function since they are vital to the safe shutdown of the reactor (s).
Failure of the diesel engines to start from the effects of moisture conce'::stien in a.c starting systams and from other causes have lowered their operational reliability to substantially less than the desired reliability of 0.99 as specified in Branch Technical Position ICSB (PSB) 2 " Diesel Generator Reliability Testing" and Regulatory Guide 1.108 " Periodic Testing of Diesel Generator Units Used as Onsite Electric Power Systems at Nuclear Power P1 ants."
In an effort toward improving diesel engine starting reliability, we require that compressed air starting system designs include air dryers for the removal of entrained moisture. The two # air dryers most commonly used are tnc dessicant and refrigerant types. Of these two types, the refrigerant type is the one most suited for this application and therefore is pre-ferred.
Figure 9.5-8 of the FSAR, " Diesel Generator Starting Air System P&ID,"
shows that the diesel engine for the high pressure core spray (HPCS) has no air dryer while the standby diesel generator has a refrigerated air dryer. Starting air should be dried to a dew point of not more than 50*F when installed in a normally centrolled 70 F environment, otherwise the starting air dew point should be. ountrolled to at least 10*F less than the lowest expected ambient temperature.
Revise your design of the HPCS diesel engine air starting system accordingly, describe this feature of your design.
1?n7 092
. 040.115 Provide a detail discussion (or plan) of the level of training ;roposed (8.3) for your operators, maintenance crew, quality assurance, and supervisory personnel responsible for the operation and maintenance of the emergency diesel generators.
Identify the number and type 'of personnel that will be dedicated to the operations and maintenance of the emergency diesel generators and the number and type that will be assigned from your general plant operations and maintenance groups to assist when reeded.
In your discussion identify the amount and kind of training that will be raceived by each of the above categories and the type of ongoing training program planned to assure optimum availability of the emergency generators.
Also discuss the level of education and minimum experience requirements for the various categories of operations and maintenance personnel associated with the emergency diesel generators.
040.116 Several fires have occurred at some operating plants in the area of (9.5.7)
RSP the diesel engine exhaust manifold and inside the turbocharger housing which have resulted in equipment unavailability. The fires were started from lube oil leaking and accumulating on the engine exhaust manifold and accumulating and igniting inside the turbocharger housing.
Accumulation of lube oil in these areas, on some engines, is apparently caused from an excessively long prelube period, generally longer than five minutes, prior to manual starting of a diesel generator.
This condition does not occur on an emergency start since the preluce period is minimal.
!?n7 093
4_
When manually starting the diesel generators for any reason, to minimi:e the potential fire hazard and to improve equipment availability, the prelube period should be limited to a maximum of three to five minutes unless otherwise recomended by the diesel engine manufacturer. Confirm your compliance with this requirement or provide your justification for requiring a longer prelube time interval perior to manual starting of the diesel generators. Provide the prelube time interval your diesel engine will be exposed to prior to manual start.
040.117 An emergency diesel generator unit in a nuclear power plant is normally (9.5.7)
RSP in the ready standby mode unless there is a loss of offsite power, an accident, or the diesel generator is under test. Long periods on standby have a tendency to drain or nearly empty the engine lube oil piping system. On an emergency start of the engine as much as 5 to 14 or more seconds may elapse from the start of cranking until full luce oil pressure is attained even though full engine speed is generally reached in about five seconds. With an essentially dry engine, the momentary lack of lubrication at the various moving parts may damage bearing surfaces pro-ducing incipient or actual component failure with resultant equipment unavailability.
The emergency condition of readiness requires this equipment to attain full rated speed and enable automatic sequencing of electric load within ten seconds.
For this reason, and to improve upon the availabiltty of this equipment on demand,
- is necessary to establish as quickly as possicle 12n7 094
, an oil film in the wearing parts of the diesel engine, i.ubricating oil is normally delivered to the engine wearing parts by one or more engine driven pump (s).
During the starting cycle the pump (s) accelerates sicwly witn the engine and may not supply the required quantity of Irbricating oil where needed fast enough. To remedy this condition, as a minimum, an electrically driven lubricating oil pump, powered from a reliable DC power supply, should be installed in the lube oil system to operate in parallel with the engine driven main lube pump. The electric driven prelube pump should operate onlyduring the engine cranking cycle or until satisfactory lube oil pressure is established in the engine main lube distribution header.
The installation of this prelube pump should be coordinatad with the respective engine manufacturer. Some diesel engines include a lube oil
~
circulating pump as an intregal part of the lube oil preheating system which is in use while the diesel engine is in the standby mode.
In this case an additional prelube oil pump may not be needed.
Confirm your compliance with the above requirement or provide your justification for not installing an electric prelube oil pump.
040.118 Periodic testing and test loading of an emergency diesel generator (8.3)
RSP in a nuclear power plant is a necessary function to demonstrate the operability, capability and availability of the unit on demand periodic testing coupled with good preventive maintenance practices will assure optimum equipment readiness and availability on demand. This is the desired goal.
32n7 095
. To achieve this optimum equipment readiness status the the following requirements should be met:
1.
The equipment should be tested with a mir.imum loading of 25 percent of rated load. No load or light load operation will cause incomplete combustion of fuel resulting in the formation of gum and varnish deposits on the cylinder walls, intake and exhaust valves, pistons and piston rings, etc., and accumulation of unburned fuel in the turbocharger and exhaust system. The consequ?nces of no load or light load operation are potential equipment failure due to the gum and varnish deposit: and fire in the engine exhaust system.
2.
Periodic surveillance testing should be performed in accordance with the applicable NRC guidelines (R.G.1.108), and with the recomendations of the engine manufacturer. Conflicts between any such rec:=endations and the NRC guidelines, particularly with respect to test frecuency, loading and duration, should be identified and juttified.
3.
Preventive maintenance should go beyond the normal routine adjust-ments, servicing and repair of components when a malfunction occurs.
Neventive maintenance should encompass investigative testing of t omponents which have a history of repeated malfunctioning and require constant attention and repair, In such cases consideration should be given to replacement of those components with other products which have a record of demonstrated reliability, rather than repetitive repair and maintenance of the existing c:mponents. Testing 12n7 096
. of the unit after adjustments or repairs have been made only confirms that the equipment is operable and does not necessarily mean that the root cause of the problem has been eliminated or alleviated.
4 Upon completion of repairs or maintenance and prior to an actual start, run, and load test a final equipment check should be made to assure that all electrical circuits are functional, i.e., fuses are in place, switches and circuit breakers are in their proper position, no loose wires, all test leads have been removed, and all valves are in the proper position to permit a manual start of the equipment. After the unit has been satisfactorily started and load tested, return the unit to ready automatic standby service and under the control of the control room operator.
Provide a discussion of how the above requirements have been implemented in the emergency diesel generator system design and how they will be considered when the plant is in commercial operation i.e., by wnat means will the above requirements be enforced.
Il9 The availability on demand of an emergency diesel generator is
)
RSP dependent upon, among other things, the proper functioning of its controls and monitoring instrumentation. This equipment is generally panel mounted and in some instances the panels are mounted directly on the diesel generator skfd. Major dfesel engine damage has occurred at some operating plants from vf bratton induced wear on skid mounted control and monitoring instrumentation. This sensitive instrumentation 17n7 097
. is not made to withstand and function accurately for prolonged periods under continuous vibrational stresses normally encountered with internal combustion engines. Operation of senstive instrumentation under this environment rapidly deteriorates calibration,. accurzcy and control signal output.
Therefore, except for sensors and other equipment that must be directly mounted on the engine or associated piping, the controls and monitoring instrumentation should be installed on a free standing floor mounted panel separate from the engine skids, and located on a vibration free floor area or equipped with vibration mounts.
Confirm your compliaaca tith the above requirement or provide justification for noncompliance.
040.120 Operating experience at certair nuclear power plants which have two (8.3)
RSP cycle turbocharged diesel engines manufactured by the Electromotive Division (EMD) of General Motors driving emergency generators have experienced a significant number of turbocharger mechanical gear drive fail ures. The failures have occurred as the result of running the emergency diesel generators at no load or light load conditions for extended periods. No load or light load operation could occur during periodic equipr.ent testing or during accident conditions with availability of offsite power. When this equipment is operated under no load conditions insufficient exhaust gas volume is generated to operate the turbocharger.
As a result the turbocharger is driven =echanically from a gear drive in i907 098
_g-order to supply enough combusion air to the engine to maintain rated speed. The turbocharger and mechanical drive gear normally suoplied with these engines are not designed for standby service encountered in nuclear power plant application where the equipment may be called upon to operate at no load or light load condition and full rated speed for a prolonged period. The EMD equipment was originally designed for locomotive service where load speeds for the engine and generator are much lower than full load speeds. The locomotive turbocharged diesel hardly ever ruas at full speed except at full load. The EMD has strongly recommended to users of this diesel engine design against operation at no load or light load conditions at full rated speed for extended periods because of the short life expectancy of the turbocharger mechanical gear drive unit normally furnished. No load or light load operation also causes general deterioration in any diesel engine.
To cope with the. severe service the equipment is normally subjected to and in the
'terest of reducing failures and increasing the availability of their equipment, EMD has developed a heavy duty turbocharger drive gear unit that can replace existing equipment. This is available as a replacement kit, or engines can be ordered with the heavy duty turco-charger drive gear assembly.
To assure optimum availability of emergency diesel generators on demand, the emergency generators for the La Salle County Station, Units No. I and No. 2 driven by two cycle diesel engines manufactured by EMD should be provided with heavy duty turbocharger mechanical drive gear assembly as recommended by EMD for the class of service encountered in nuclear pcwer plants. Confirm your compliance with this requirement, or provide justifi-cation for not making this change.
1?n7 099
130.0 STRUCTURAL ENGINEERING BRANCH 130.23 The response to Question 130.22 as stated in Amendment 46 to the FSAR does not provide adequate information to judge that the proper soil properties have been used in the elastic half space analysis.
Modeling of the soil structure interaction system should be consistent for calca-lating dynamic responses as well as for calculating soil properties.
Therefore we require the following additional information be provided in Table 130.22-1:
(1) Based on the soil property curves (shear modulus vs strain, damping values vs strain) used in the half-space analysis, provide the corresponding soil strain for each layer of soil.
(2) Based on the assumption and theory of elastic half-space modeling of soil, calculate the maximum soil strain during an SSE event for each layer of soil.
Compare the results of (1) and (2) above.
If significant differences are indicated, modify the soil properties and reanalyze until the results of (1) and (2) agree reasonably well. However, to avoid reiteration soil properties corresponding to low strain level may be used.
Revise your comparison of floor response spectra computed by means of the two modeling methods (finite element shear beam vs half-space) if necessary.
1'"7 100
.