ML19260C017

Ack Receipt of NRC Re Violation of General Design Criteria 17.Proposed Alternative Second Level of Undervoltage Protection Based on Detection,Alarm & Operator Action

ML19260C017
Person / Time
Site:	Vermont Yankee File:NorthStar Vermont Yankee icon.png
Issue date:	12/06/1979
From:	Moody D VERMONT YANKEE NUCLEAR POWER CORP.
To:	Ippolito T Office of Nuclear Reactor Regulation
References
WVY-79-139, NUDOCS 7912180238
Download: ML19260C017 (7)

Text

,

VERMONT YAN KEE NUCLEAR POWER CORPORATION SEVENTY SEV5N GROVE STREET B.3.2.1 RUTLAND, VERMONT 05701 asp'v von WW 79-139 ENGINEERING OFFICE TURNPIKE RO AD WESTBORO. M ASS ACHUSETTS 01581 TELEPHONE 637 366-9001 December 6, 1979 United States Nuclear Regulatory Commission Washington, D.C.

20555 Attention:

Office of Nuclear Reactor Regulation Mr. Thomas A. Ippolito, Chief Operating Reactors Branch #3 Division of Operating Reactors

References:

1.

License No. DPR-28 (Docket 50-271) 2.

USNRC Letter, dated August 12, 1976 3.

WNPC Letter No. WW-76-ll4, dated September 16, 1976 4.

USNRC Letter, dated June 3, 1977 5.

WNPC Letter, No. WW-77-65, dated July 18, 1977 6.

USNRC Letter, dated October 16, 1979 We have reviewed the 'information transmitted in your letter of October 16, 1979 (Reference 6) and are of the opinion that our past transmittals on this subject (References 3 and 5) have been inadequate in conveying our thoughts to you, particularly those relating to violations of GDC-17.

These violations would occur if we were to follow the NRC position on degraded grid voltage.

Attachment A is being provided to restate our concerns. Greater emphasis has been placed on explaining these violations to GDC-17, and on the resulting decrease in overall nuclear plant safety. An example of a severe grid disturbance has also been provided as an illustration of our concerns.

Since it is neither our desire to knowingly violate GDC-17, nor to decrease nuclear safety, we have proposed in our previous correspondence (References 3 and 5), an alternative second level of undervoltage protection based on detection, alarm, and appropriate operator action.

This alternative 1614'022 7912180 d 3

U. S. Nuclear Regulatory Commission December 6, 1979 Attn:

Mr. Thomas A. Ippolito Page 2 design addresses all aspects of the NRC's concerns relating to grid undervoltage, and furthermore, results in total compliance with GDC-17 and an enhancement of nuclear plant safety. The alternative design has been in operation since 1977.

We trust that this information will finally close out any outstanding issues you may have.

Very truly yours,

.b.

D. E. Moody M ager of Operations DEM/jgh Attachment 1614 023 e

dM e

ATTACRMENT A The interconnected electric system of the United States includes generating units, bulk power transmission lines, substations, distribution lines, and trans fo rmers. The electric energy proce sed by this system is produced, not to schedule, but in response to the instantaneous demands of millions of customers.

This incredibly complex system cannot be controlled monolithically because it would be neither efficient nor effective to do so.

The interconnected systems in the USA are controlled by a number of independent control centers which function in a coordinated manner. Under normal circumstances, several parameters must be continually adjusted both manually and automatically to match the continuous random fluctuation in customer demand for power. Reliability, security, and stability are paramount, and means to improve system robust rass and raise the performance level of system security are constantly being made.

If this incredibly complex system undergoes a major disturbance, there are both automatic and manual actions that take place to try to maintain its equilibrium.

Since the power system is dynamic in nature, recovery from a disturbance is never instantaneous, it takes time; anywhere from a few milliseconds to a number of seconds or even minutes may be needed to ensure recovery, depending on the magnitude and nature of the disturbance.

Recovery itself mty be complete, that is, to the pre-disturbance state; or may be partial to some threshold of adequacy below the pre-disturbance state.

If the initiating disturbance is severe enough, the system may be on the verge of disintegr ting; say sdditicn:1 di:turbance could cause ental collapse of the system.

The NRC position requires that the offsite power source be disconnected automatically from the onsite distribution system emergency buses by means of undervoltage relaying (with optimum time delay), if it is determined that the offsite power source is degraded.

This automatic disconnection would take place whether there is a short-term or a long-term (sustained) degradation. The lack of discrimination for short-term degradation can result in a decrease in overall nuclear plant safety as outlined below:

1.

The foregoing discussion on interconnected electric power systems shows that a simple undervoltage relay is neither an adequate nor an appropriate device to sense the complicated chain of events taking place in a grid.

The determination of whether the grid is undergoing a short-term degradation or a long-term degradation cannot be made by this simplistic unsophisticated relay. Furthermore, there can be no " optimum" time delay prior to initiating automatic disconnection of the grid from the nuclear power plant emergency buses.

The desired time delay would depend on the nature of the initial disturbance and the recovery time of the system; and, as pointed out earlier this could be anywhere from a few milliseconds to a number of seconds or even minutes.

It would be in the interests of nuclear safety to give the grid a chance to recover prior to initiating its disconnection.

By permitting manual action, the operator has the flexibility to determine the time for disconnection af ter he has 1614 024 ;

communicated with the system dispatcher and taken all fac2 ors into co ns ideration. Af ter weighing these factors. against the risks involved, he can take appropriate action to safeguard the nuclear facility.

2.

General Design Criteria 17 (GDC-17) requires in part that "An onsite electric power system and an offsite electric power system shall be provided to permit functioning of structures, systems, and components important to safety."

n yy 4 By initiating disconnection of offsite power for short-term degradation

's-we believe that GDC-17 is violated because an offsite electric power system is no longer provided to permit functioning of structures, systems and components. By premature automatic disconnection-of the offsite power source, power with historically known availability and reliability is no longer available to perform the necessary safety function required by GDC-17.

The violation of GDC-17 is even more significant because a device (undervoltage relay) incapable of following the perturbations of the grid, and of determining its degree of degradation, has been used to accomplish this arbitrary disconnection.

Under the given circumstances, only manual disconnection of the offsite source by the station operator would be appropriate in order to satisfy GDC-17; this manual disconnection permits an evaluation of the situation by the station operator and an assessment of the safety risks involved.

3.

GDC-17 also requires in p+

that " Provisions shall be included to minimize the probability.. losing electric power --

." GDC-17 is violated because the probability of losing electric power has not been minimized. Contrary to the requirements of GDC-17, offsite electric peuer is arbitrarily disconnected from not only the unit under consideration, but possibly from all other nuclear power plants connected to the grid. Events that could lead to this situation are as follows:

If the nuclear generating unit is at power and low voltage is sensed on the, grid by the undervoltage relaying, disconnection of this source from the energency buses would result. The emergency buses, together with certain plant auxiliaries connected to these buses, would be without power until the onsite emergency power system restored power to the buses. The loss of these auxiliaries for a few seconds (typically ten seconds) would initiate a unit trip and loss of the generating unit.

If the undervoltage sensed by the undervoltage relays was due to a grid disturbance, then subsequent loss of the nuclear generating unit could trigger total collapse of the grid. The consequences would be a total and prolonged loss of offsite power to the subject euclear unit as well as to all other nuclear units on the grid.

We would like to describe a recent system disturbance involving short-term degradation that could have had far reaching consequences had it not been for timely action by the system dispatcher.

On July 30, 1979, operating conditions necessitated that REMVEC (Rhode Island - Eastern Massachusetts - Vermont Energy Control) direct that 15%

load be manually shed due to low voltage conditions in order to preserve the integrity of the balance of the system. An initial load shedding of 1614 025

5% was initiated followed up by an additional 10%.

Factors contributing to this disturbance were as fo? lows. Temperatures were forecast to be in the mid to upper 80's for July 30,.1979; but actually reached the mid 90's.

Additionally, the actual load at the time of the disturbance was 130 MW (10%) higher than forecast.

Generating equipment out of service totaled 3140 MW; included in this total were three units with 1290 MW that were originally expected to be on-line that morning. It was expected that voltage levels would be lower than desirable; but, above level at which drastic action would be needed.

A half hour before load shedding was necessary, a line carrying 650 MW into REMVEC tripped. One minute before load shedding was initiated a 550 MW generating unit was lost. As this stage the REMVEC dispatcher shed 5%

load.

Subsequent to thie-load shedding a generator carrying 380 MW faltered and its load dropped to 80 MW; reports received by the dispatcher indicated that this unit would probably trip.

At this stage load shedding amounting to 15% was instituted.

Voltage profiles at two generating stations and one substation, showing the degradation and recovery prior to and subsequent to each load shedding operation are illustrated in Figure 1.

It is worth noting that both the first and the second low voltage occurrences lasted a mere 3 to 5 minutes. Had either Generating Station #1 or Generating Station #2 been a nuclear unit, designed in accordance with the NRC position on degraded grid voltage, it is very likely that they would have tripped due to this disturbance.

REMVEC has informed us that at 10:28 a.m.

the grid was in an extremely precarious situation, and that any additional loss of generation would have resulted in total collapaa.

The purpose of providing the above example is fourfold.

Firstly, so that one can appreciate the role of the systeca dispatcher in 2onitoring and controlling events that threaten to disrupt the system; secondly, to show the rapid restoration of the grid following dispatcher action, thirdly, to visualize the misapplication, ineffectiveness, and safety implications of trying to monitor and interpret long-term degradation with an undervoltage relay and fourthly, to contemplate the consequences of needlessly tripping a nuclear plant due to a short-term disturbance.

In the interests of overall nuclear plant safety, we believe that a protection system based on detection, alarm, and appropriate operator action is the only solution to this problem. Operator action is justified because on receiving an alarm the operator can determine if the interconnected power system is.:

(a) Undergoing a transient as a result of a disturbance, (b) in the recovery stage with recovery imminent, (c) not recovering adequately.

Based on this information, the operator can either prepare to disconnect the offsite power supply or he may - tually disconnect the degraded offsite power supply.

With the margin of generating reserves becoming less and less in the approaching years, the probability of total disintegration and collapse of portions of the U.S. interconnected power system becomes more and more a 1614 026 e.

i

reality, especially if assisted by arbitrary actions. We sincerely request that NRC reassess and reevaluate its position requiring automs tic disconnection of offsite power. This position unfortunately has a tendency to be overly concerned for the apparent safety of individual components while overlooking major system-wide safety concerns.

E 1614 027 I

' ~~

J ['l l'l I'I l

3.i t j [ i i

l l I

~

u t l l

II I

i i i i l.I I

i i

I l

I

_ tit LO V O L_TS_

I l

l l l 3

I l I f

1 l

iI

[

g} l !

w t so a

ip l' W l to j

. i :

A U1.

I 1

e DJ g

g i t

E i*i 1

I l

i l l f6 O

• C

^ !

O i

l l

l i

-d lj 3

i l

l l

t i

6 l '

l l l

l i

I l e l

1 '"- "LI N E T R I P (9:E b A M ) ---

i i

i ;. /~ fi i

I f l (I l'

l 1

i l_

t T,e

>I i i I c o

il o

i.

l t-1 i

o-4 i3!

I i. l l

D.__-

t D l 1

j o,

i.

I k!us l

I i I

l l cn i

en

-rt vt -

et o

s.

im i

I i i

i o.

_.n_

.a

'fe I

I, l

l l l I

==

q l

l l

l I I l

~

l bl 17" '

I 4

1, I

I

+ j i

6 x

m I

i i

t

. i l

4 i

l s-l@-

I l

l i

I

_i i !

i i I i

i V f j ;

l i

I i

g GENE R ATDR"TRI A (1U:'17 AMI '

u-I [,

I ST ART E% i OAn ^9E nOtMG (10:29 AM)..

l l

i y,

l 4

i i

t i i : i i

I i l l

1 i

! l l w

i e

w.

L l[

l

.t,

! l l l i I

I I

l GEMERATOR ' f n.LT ERS (io:uo n M)

I l

%TRRT ISM LD AB %H F D D f NG ( 10: tJ') 4M3_

-_j i

l i l

'i i

i i

t w-l l ! !

l 7,

,I l l ;

i i i

l l

,. i o,

i !, !

l ! I

'l I

l I

~~

~

l' i i

i

i 8

i

i i i i i

_ y,

! ! l31 l !

I l

i i i l l ! l l

l i

i

!m I

t i

I ! l !

~~i\\

l'i

! I i i il i

l l j i *!

i i i l i t i j

i i i !

i

.W

, i i

3._ _

i l l

! I l l i I

! i i i

I l

I i i

i !

i ! :

! I l I I

1 l t

I i

j i :

l t i

i j

l l -

i 4

/

I I l I

l l

l l

t I

1 l I

l l I

I i

L I

I i I

I !

I i,

i i

i t

j l

l i

i i

i j

.- m r----.-

i !

__ _ h I i

.i_-i i

i

! _i

- i I

i

.p I! l l !l

, _... _j _ i I

i i[ I i I i '

_i.

f~

1614 028..

.