ML19257B484
| ML19257B484 | |
| Person / Time | |
|---|---|
| Site: | Trojan File:Portland General Electric icon.png |
| Issue date: | 01/11/1980 |
| From: | Goodwin C PORTLAND GENERAL ELECTRIC CO. |
| To: | Schwencer A Office of Nuclear Reactor Regulation |
| References | |
| NUDOCS 8001160406 | |
| Download: ML19257B484 (10) | |
Text
i.
_-C r..,J'C '_ d r ECl.6CC~C LCCCEf'/
January 11, 1980 Trojan Nuclear Plant Docket 50-344 License NPF-1 Director of Nuclear Reactor Regulation ATTN:
Mr. A. Schwencer, Chief Operating Reactors Branch #1 Division of Operating Reactors U. S. Nuclear Regulatory Commission Washington, D. C.
20555
Dear Sir:
Attached is our response to your letter of October 1, 1979 relating to the generic issue of degraded grid voltage as it applies to the Trojan Nuclear Plant. Please note that we have responded item by item to each one of the NRC positions provided in Enclosure 1 to your June 3, 1977 letter.
As you can see from the attachment, a number of modifications are planned.
The estimated completion date for these modifications is the startup of Cycle 4, which at this time is expected to occur sometime in late spring or early summer of 1981. Should you have any questions, please do not hesitate to contact me.
Sincerely,
%u C. Goodwin, Jr.
Assistant Vice President Thermal Plant Operation and Maintenance CG/GAZ/4sa3A16 Attachment c:
Mr. Lynn Frank, Director State of Oregon Department of Energy 8001160 4 0 6 018 i
Slj
'd 1753~082
PROPOSED NRC RESPONSE NRC POSITION 1 - Second Level of Under-Or-Over Voltage Protection with a Time Delay We require that a second level of voltage protection for the onsite power system be provided and that this second level of voltage protection shall satisfy the following criteria:
a) The selection of voltage and time set points shall be determined from an analysis of the voltage requirements of the safety-related loads at all onsite system distribution levels; b) The voltage protection shall include coincidence logic to preclude spurious trips of the offsite power source; c) The time delay selected shall be based on the following conditions:
(1) The allowable time delay, including margin, shall not exceed the maximum time delay that is assumed in the FSAR accident analyses; (2) The time delay shall minimize the effect of short duration disturbances from reducing the availabil-icy of the offsite power source (s); and (3) The allowable time duration of a degraded voltage condition at all distribution system levels shall not result in failure of safety systems or ccm-ponents; d) The voltage monitors shall automatically initiate the dis-connection of of fsite power sources whenever the voltage set point and time delay limits have been exceeded; e) The voltage monitors shall be designed to satisfy the requirements of IEEE Std. 279-1971, " Criteria for Protec-tion Systems for Nuclear Power Generating Stations"; and f) The Technical Specifications shall include limiting condi-tions for operation, surveillance requirements, trip set points with minimum and maximum limits, and allowable values for the second-level voltage protection monitors.
General Design Criterion 17 (GDC 17) " Electric Power Systems" of Appen-dix A, " General Design Criteria for Nuclear Power Plants," of 10 CFR Part 50 requires:
(a) two physically independent circuits from the offsite transmission network (although one of these circuits may be a delayed access circuit, one circuit must be automatically available within a few seconds following a loss-of-coolant accident); (b) redundant onsite AC power supplies; and (c) redundant DC power supplies.
1753 083
a GDC 17 further requires that the safety function of each AC system (assus-ing the other system is not functioning) shall be to provide sufficient capacity and capability to assure that:
(a) specifA=d acceptable fuel design limits and the design conditions for the reactor coolant pressure boundary are not exceeded as a result of anticipated operational occur-rences; and (b) the core is cooled and containment integrity and other vital functions are maintained during any of the postulated accidents.
Existing undervoltage monitors automatically perform the required function of switching from offsite power, the preferred power source, to the redundant onsite power sources when the monitored voltage degrades to a level of between 50% to 70% of the normal rated safety bus voltage. This is usually accomplished af ter a 1/2 to 1 second time delay. These under-voltage monitors are designed to function on a complete loss of the outside power source.
The offsite power system is the common source which normally supplies power to the redundant safety-related buses. Any transient or sustained degradation of this comuon source will be reflected onto the onsite system's safety-related buses.
A sustained degradation of the offsite power system's voltage could result in the loss of capability of the redundant safety loads, their control circuitry, and the associated electrical components required for performing safety functions.
The operating procedures and guidelines utilized by electric utilities and their inrarconnected cooperative organizations minimize the probabil-icy for the above conditions to occur. However, since degradation of an offsite power system that eculd lead to or cause the failure of redundant safe-y-related electrical equipment is unacceptable, we require the additional safety margins associated with Esplementation of the prstection measures detailed above.
PGE RESPONSE A second level of voltage protection for the onsite power system will be provided. This level will consist of a set of four solid-state defi-nite time (4-see time delay) undervoltage relays and two timers (set for 56-see time delay) connected to each of the two 4.16-kV ESF buses.
Coincidence logic will be used as shown in Figure 1.
The relays and timers operate to achieve an output as follows:
1.
If a safety injection signal (SIS) is present and two of the 4 see level undervoltage relays operate, the normal 4.16-kV ESF bus feeder breaker (see FSAR Figure 8.3-1; breakers 152-101 and 152-201) will be tripped unless the undervoltage condition corrects itself within 4 sec.
Tripping the feeder breaker causes a loss of voltage on the bus.
The existing undervoltage protection relays will operate to start and connect the diesel generator to the bus and begin sequencing on the DBA loads.
1753 084 2.
If an SIS is not present and two of the 4-sec level under-voltage relays and one of the two timers operate, the normal 4.16-kV ESF bus feeder breaker will be tripped unless the undervoltage condition corrects itself within 60 sec.
The proposed second level of voltage protection meets the NRC June 3, 1977 letter (outlining the staff positions on the degraded grid voltage generic issue) design criteria as follows:
RESPONSE TO POSITION a)
The onsite distribution system model has been revised to incorporate more realistic loadings from that used in our October 1976 and October 1979 submittals on the effects of degraded voltage conditions at Trojan. To be conservative, the second-level voltage and time delay setpoints are based on results obtained by assuming that all Plant normal operating (at 100 percent power) and emergency shutdown loads are being fed through the startup transformers. This achieves the lowest realistic Plant distribu-tion bus voltages for a given switchyard voltage.
Based on the above referenced revised load-flow calculations, at a switch-yard voltage of 230-kV (normally 236 kV-240 kV) the ESF motor terzinal voltage of 480 V decreases to 415.68 Y (which is just above 414 V [90 percent of 460 V, rated voltage], the lowest rated voltage a 460-V motor can operate at continuously); the 4.16-kV bus voltage decreases to 3.85 kV.
The switchyard voltages corresponding to the distribution bus voltage where the Size 1, 2, 3, and 4 motor contactors cannot pick up and 90 percent of 4.0-kV motor terminal voltage (3.6 kV) are both below 230 kV.
The second-level undervoltage relays will therefore be set to pick up at 3.85 kV.
By design all safety-related motors must accelerate their loads to rated speed within 4 see with 70 percent motor terminal voltage. The 4-see time delay allows the undervoltage relay to ride through all safety-related motor starting voltage dips when the switchyard voltage is just above the 230-kV setpoint.
The 56-see time delay associated with the second level of undervoltage protection allows all 12.47-kV bus loads to be started when the switch-yard bus voltage is greater than 230 kV (the reactor coolant pump motor (6000 hp at 11.5 kV rated motor terminal voltage) requires 28 see to accelerate its load to rated speed with 80 percent motor terminal vol-tage]. 12.47-kV motor starting voltage dips will thus not cause the second level voltage protection scheme to operate unless an SIS is already present.
Safety-related motors are connected to either the 4.16-kV switchgear, 480-V load centers, or 480-V motor control centers. The 4.16-kV switch-gear and 480-V load centers use d-c control circuits; the 480-V motor control centers (MCC) use 120-V a-c control circuits. The 480-V MCC control circuit basically consists of a machine tool control transformer which steps the control voltage from 480 V to 120 V and 120-V motor starter contactor. 1753 085
s-The motors, machine tool control transformers, and motor starter contac-tors all have Class B insulation. Their operation below rated voltage (supplying rated loads) results in higher operating currents. These higher currents cause some coil heating.
Several machine tool control transformers and Size 1, 2, 3, and 4 motor starter contactors were tested to determine the coil temperature rise (using the resistance method) when operated just below the minimum contactor pickup voltage for 60 sec. The Class B insulation rating was not exceeded for any of these components in the 60 sec.
PGE system studies indicate that it is virtually impossible to sustain grid voltages below approximately 192 kV (which corresponds to approxi-mately 3.02 kV on the 4.16-kV bus and 322 V on the 480-V bus). Examina-tion of typical 4.16-kV and 480-7 induction motors shows that operation between 230-kV and 192-kV switchyard voltages for 60 see will not exceed the Class B insulation rating; however,,we have some concern about the ability of some of the 480-V motors to deliver the necessary t,rque to the load and are continuing to examine all loads in detail.
Since the contactors, =achine tool control transformers, and motors can survive for at least 60 see in a degraded voltage condition, the 480-V MCC control circuit fuse sizes will be upgraded to allow the maximum expected secondary current to flow with the contactor voltage just below its pickup point. This will ensure contactor availability following an undervoltage protection sche =e operation.
RESPONSE TO POSITION b)
Spurious trips on both first-level and second-level undervoltage protec-tion schemes are sinimized by using, in each case, four undervoltage relays whose outputs are connected in coincidence logic. The coincidence logic requires two out of the four relays to trip before any protective action is taken. The two undervoltage protection schemes are described below:
a.
The existing two out of two undervoltage protection scheme on each 4.16-kV ESF bus, presently set to load shed its bus and start its diesel generator at 2.56 kV, will be replaced with four undervoltage relays, all set at 2.;
kV.
Opera-tion of two of the four undervoltage relays will cause a bus load shed and diesel start as shown on Figure 1.
b.
The new second-level undervoltage protection scheme,will consist of four definite time undervoltage relays, all set at approxi=ately 3.85 kV (4-see ci=e delay to operate af ter pickup) and two 60 see time delay relays, set for a 56 see time delay. Operation of two of the four undervoltage relays will energize the two time delay relays. The normal ESF 4.16-kV bus feeder breaker will then be tripped if the undervoltage condition per:ists:
- 1) immediately if an SIS exists or 2) after at least one 56-see timer has operated. 00h
RESPONSE TO POSITION c)
The time delay was selected based on the following conditions:
1.
The FSAR accident analyses allow 10 see for the diesel generators to start, come up to speed and voltage, and begin to load. If an SI occurs when the 4.16-kV ESF bus voltage is above 3.85 kv, the diesel generators will be automatically started by the SI but not loaded. The ESF loads will immediately be sequencially loaded via the DBA sequencer. However, if the bus voltage remains above 3.85 kV, the second level of voltage protection will ride thrcugh all motor starting dips.
If the bus voltage decays beJow 3.85 kV within the first 4 see following the SI, the secend level of voltage protection will operate, all bus loads will be shed, and the diesel will begin loading via the DBA sequencer within 10 see as assumed in the accident analyses. If the bus voltage decays below 3.85 kV after the first 4 see following the SI, the second level of voltage protection will opsrate, the running ESF loads will be shed, and the diesel will begin loading via rhe DBA sequencer.
[ Note: This operation is similar to that resulting from a loss of offsite power occurring during an SI; running safety loads would also be shed and resequenced, except that it occurs at a higher 4.16-kV bus voltage level.]
2.
The effect of short duration disturbances such as switching transients and line faults will not cause the diesels to start and load. Thus, the availability of the offsite power source is not reduced.
3.
Safety systems or components will not fail since, as des-cribed above, they can operate at the reduced voltage levels for a minimum of 60 see without exceeding the Class B insulation temperature rise. Upgrading the 480-V MCC fuse sizes ensures that the circuit protective devices will not operate due to the undervoltage condition for a minimum of 60 sec. This ensures the availability of the ESF loads for sequential logding.
RESPONSE TO POSITION d)
As described above, the undervoltage relay and timer outputs will use coincidence logic (two out of four and one out of two) to automatically initiate disconnection of the offsite power source via a trip of the normal 4.16-kV ESF bus feeder breakers when the undervoltage setpoint and time delay limits have been exceeded.
RESPON5E TO POSITION e)
The voltage monitor design will satisfy the applicable requirements of IEEE Standard 279-1971.
1753 087
+
RESPONSE TO POSITION f)
Technical Specifications proposing limiting conditions for operation, surveillance requirements, trip setpoints with minimum and maximum limits, and allowable values for the second-level voltage protection relays will be proposed as described in Position 3 below.
NRC POSITION 2 - Interaction of Onsite Power Sources with Load Shed Feature We require that the current system designs automatically prevent load shedding of the emergency buses once the onsite sources are supplying power to all sequenced loads on the emergency buses. The design shall also include the capability of the load shedding feature to be automat-ically reinstated if the onsite source supply breakers are tripped. The automatic bypass and reinstatement feature shall be verfied during the periodic testing identified in Position 3.
In the event an adequate basis can be provided for retaining the load shed feature when loads are energized by the onsite power sytem, 'ce will require that the setpoint value in the Technical Specifications, Caich is currently specified as " equal to or greater" be amended to specify a value having maximum and minimum limits. The licensees' bases for the setpoints and limits selected must be documented.
GDC 17 requires that provisions be included to minimize the probability of losing electric power from any of the remaining supplies as a result of or coincident with the loss of power generated by the nuclear power unit, the los: of power from the transmission network, or the loss of power from the onsite electrical power supplies.
The functional safety requirement of the " loss-of-offsite power monitors" is to detect the loss of voltage on the offsite (preferred) power system and to initiate the necessary actions required to transfer the safety-related buses to the onsite system. The load shedding feature, which is required to function prior to connecting the onsite power sources to their respective buses can adversely interact with the onsite power supplies if tr.a load shedding feature is not bypassed after it has performed its required function. The load shed feature should also be reinstated to allow it to perform its function if the onsite sources are interrupted and are subsequently required to be reconnected to their respective buses.
RESPONSE
Both levels of undervoltage protection will be operable when the onsite source, the diesel generator, is supplying power to all sequenced loads.
As described above, all safety loads can be started without operating the second level of undervoltage protection. The existing undervoltage set-point is below the maximum motor starting voltage dip for all the ESF 1753 088 motors and therefore, these relays will not operate. Since the under-voltage protection is still connected to the 4.16-kV ESF buses, degrada-tion of the offsite power source with the onsite source supplying the emergency loads will have no effect on the undervoltage protection scheme. Once fully loaded, only diesel generator mechanical or elec-trical component failures will cause the 4.16-kV ESF bus voltage to degrade to the setpoint of either level of undervoltage protection for the required time period. Assuming a single failure, only one of the two redundant safety trains will be affected; safe plant shutdown will still proceed using the redundant train. Tripping the safety loads at the second level of undervoltage protection setpoint protects them from damage and ensures their future availability once the diesel generator problem has been found and corrected.
NRC POSITION 3 - Onsite Power Source Testing Ve require that the Technical Specifications include a test requirement to demonstrate the full functional operability and independence of the onsite power sources at least once per 18 months during shutdown. The Technical Specifications shall include a requirement for tests:
(1) simulating loss of offsite power in conjunction with a safety injection actuation signal; and (2) simulating interruption and subsequent recon-nection of onsite power sources to their respective buses. Proper operation shall be determined by:
a.
Verifying that on loss of offsite power the e=ergency buses have been deenergized and that the loads have been shed from the emergency buses in accordance with design requirements.
b.
Verifying that on loss of offsite power the diesel genera-tors start from ambient condition on the autostart signal, the emergency buses are energized with pe:manently connected loads, the auto-connected emergency loads are energized through the load sequencer, and the system operates for 5 min while the generators are loaded with the emergency loads.
c.
Verifying that on interruption of the onsite sources the loads are shed from the emergency buses in accordance with design requirements and that subsequent loading of the onsite sources is through the load sequencer.
GDC 17 requires that provisions be included to minimize the probability of losing electric power from any one of the remaining supplies as a result of or coincident with the loss of power generated by the reactor power unit, the loss of power generated by the nuclear power unit, the loss of power from the transmission network, or the loss of power from the onsite electric power supplies.
1753 087
The testing requirements identified in Position 3 vill demonstrate the capability of the onsite power system to perform its required function.
The tests will also identify undesirable interaction between the offsite and onsite emergency power systems.
RESPONSE
Technical Specifications on diesel generator testing similar to those provided in Enclosure 2 of the NRC June 3, 1977 letter were proposed by License Change Application 37, dated November 30, 1977. Additional Technical Specifications to include test requirements to demonstrate the capability of the onsite power system to perform its required func-tion will be submitted within 8 months of the date of this letter.
IMPLEMENTATION SCHEDULE All modifications proposed in this submittal vill be completed by the startup of Cycle 4.
RAY /CAz/4sa3A8 L
A LF T TI S IAWE E
C N.H V
I K
AT T S SR 6
ASN1 I
UTRA 4 NSO V
R K
A T GL E
P ANL 6
K
- 1. S SWRI A 4U ACE R S
F B
PU L
P R
ND O
OD E
I N
I RS EAET EE R N M
T I
OP HRFI CC TAS D R
T N E L
DS A L
N R H G
P T
I I
WNMW T I E C O
D N
RU T
s ADDR AS s'
s MR L
LS I
I SR CR
,T A E
L.
L A
ONA C
M C
N RUL E
E E
W/
S W/
S G TNA S
H L
L C
s NN I
I S S O A G
6 S
C S
5 N
O I
T V
C L
KD E
E 6E T
S 1 H O
4 S EI E D PR D &T A T
A O E
L G
R I
A T S A
I T
NU T
S B
L I
O 4
V 7
R 2
E 3
3 4
D
/
N 2
U s'
C C
C SCLSCLS>)b>)
Ef/EY/E D
E 4
4 4
S Y
Y Y
Y O
Y Y
Y Y
P A
A A
A A
A A
A O
L L
L L
L L
L L
E 2
E 3
E 4
E S
E 6
E 7
E 8
R 3
P E
R R
R R
I R
R R O O
O O
O O
O O
V N V N V N V
N V
N V
N V
N V
N I
U U
U U
U U
U U
ER s
e s
U 4
4 G
I F
N $o 1 $5$$
g$i a F2 2Cm 1
n t
j 3f
-