ML19297C831

Summarizes Review of 801015 Rept Re 800407 Loss of Offsite Power at Facilities.General Design Criteria 17 Misinterpreted.Rept Should Be Retracted & Reissued After Review of Offsite Power Aspects Has Been Performed

ML19297C831
Person / Time
Site:	Arkansas Nuclear
Issue date:	12/15/1980
From:	Rosa F Office of Nuclear Reactor Regulation
To:	Michelson C NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
References
NUDOCS 8101080183
Download: ML19297C831 (9)

Text

.$ )sp i i

1 f[y..yj:,

UNITED STATES

• g} M (j NUCLEAR REGULATORY COMMISSION y

.c.

o. b A

-* * [

/

t W ASHINGTON, D. C 20555

%.,v f l

..' \\

,.f L.

n..

DEC 151980 MEMORANDUM FOR:

Carlyle Michelson, Director Office for Analysis & Evaluation of Operational Data FROM:

Faust Rosa, Chief

~

3 Power Systems Branch

?

2 Division of Systems Integration, NRR

SUBJECT:

AE00 REPCRT ON THE LOSS OF 0FFSITE POWER EVENT AT ARKANSAS NUCLEAR ONE, APRIL 7,1980 (REPORT DATED OCTOBER 15, 1980)

REFERENCE:

Memorandum from C. Michelson to H. R. Denton dated December 5,1980, Loss of Offsite Power Event at Arkansas Nuclear One, Units 1 and 2 on April 17 (sic),1980 I have reviewed the subject report which was transmitted to H. R. Denton by your memorandum dated Nov. 5,1980. My teview was limited to those portions of the report which address the offsite power aspects of the event.

I found the report to be in error in its analysis of the event, its interpretation of GDC 17, and consequently in its conclusions.

As the responsible Branch Chief in the electrical power area, and (coincidently) as the staff member that evaluated the ANO design for conformance to GDC 17 following the loss of offsite power event at ANO on September 16, 1978, I feel that it is necessary to correct the unwarranted negative impression conveyed by this report with regard to the adequacy of GDC 17 and the competence of the staff in its application.

I have also reviewed your memorandum (reference) which provides some clarification in regard to the offsite power aspects of the subject report.

I find that these clarifications do not correct any of what I consider to be the major deficiencies in the report.

I recommend that this report be retracted, and reissued after a proper evaluation of the offsite power aspects of the subject event has been performed. provides the interpretation of the requirements of General Design Criterion 17 (GDC 17), Electric Power Systems, and GDC 5, Sharing of Structures Systems and Components, which are used by the Power Systems Branch (PSB) in licensing reviews. is the station single line diagram from the ANO Unit 2 FSAR. These enclosures are intended to provide the background for the following specific coments.

1.

In general, any evaluation of a loss-of-electric-power event at a nuclear plant must be based on a clear understanding of the requirements of GDC 17.

,,,n a

830]o80/83

Carlyle Michelson DEC 151M The evaluation should then determine (1) whether these requirements had been met, (2) whether the requirements are adequate (cr would have been if implemented) for assuring plant safety, (3) what other factors (if any) not directly related to GDC 17 requirements played a significant part in the course of the event, and (4) whether the GDC 17 (or other) requirements need to be revised and how in order to assure safety. However, any eval u-ation findings of design or other deficiency should be supported by reference to specific non-conformance with existing regulations, or by inclusion in the evaluation of fully developed support.ng bases; anything less than this can only have a negative impact on both nuclear safety and the nuclear regulatory process.

In my opinion, the subject report reflects a lack of clear under-standing of the requirements of GDC 17, and it does not address explicitly and unambiguously any of the points cited above.

2.

I was unable to determine from the following statements in the report, and from the related discussion in the report and in the reference memorandum, whether the finding of deficiency was attributed to non-conformance of the design to the requirements of GDC 17 and GDC 5, to the misinterpretation and consequent misapplication of these requirements by the staff, or te the inadequacy of the requirements themselves:

Pg. ii "The most important findi$gs include: the lack of regulatory requirements for the station switchyard to function following a single failure;..."

Pg. 7 - " Finding The finding concerning the offsite power system is that a single failure (loss of autotrusformer) results in a loss of offsite power event for both units at Arkansas Nuclear One. Since the implementation of GDC 17 has not required the offsite power system to meet the requirements of the single failure criterion, this deficiency may be generic to all operating plants.

It is undesirable that a single failure should result in a loss of offsite power transient for both units and the actuation of safety-related equipment."

The staff interpret'ation of the requirements of these GDCs, and a description of how they are applied, are provided in Enclosure 1.

I would be pleased to discuss any differing interpretation of these requirements that may be held by AEOD staff.

If the finding was attributed to non-conformance to these GDCs (as interpreted in Enclosure 1), then the finding is in error for the reasons discussed in comment (3) below.

If the finding was attributed to the inadequacy of the

DEC 15fcM Carlyle Michelson

-3 requirements of GDCs 5 and 17, then there is an obvious failure to recognize that such a finding cannot possibly be supported by the simple qualitative evaluation of the subject event that was performed; such a finding can only be supported by a comprehensive quantitative probabilistic assessment of overall AC power availability such as that presently underway in generic Task A-44, Station Blackout.

Completion of this task is scheduled for 1982 (G. Edison or P. Baranowsky, PAS, can provide further details).

In my opinion, the only findings that can be supported by the AEOD evaluation is a recommendation for performance of a task A-44 type assessment; and possibly another recommendation that licensees review the design and coordination of their switchyard protective relaying in view of the ANO exper;me (see coment (4) below).

3.

Conformance of the ANO design to GDC 17 was reviewed by the undersigned immediately following the incident at ANO on September 16, 1978.

This incident invcived a number of electrical failures including a failure in the offsite power system. The review concluded that the design had not been in conformance with GDC 17 with regard to the independence between the two required offsite power circuits 4ecause, under certain conditions, in event of failure of the autotransformer (the common element in the immediate access circuit for both units) the auxiliary loads of both units were auto-matically transferred to Startup Transformer No. 2 (the common element in the second circuit which had been designed as a second immediate access circuit for both units), thus overloading and failing this circuit.

This is a violation of requirement (e) cited in Enclosure 1.

This review was fully documented in Enclosure 3 [It is noted that the reference memorandum corrects the statement on Pg. 3 of the report that "a staff position regarding conformance to GDC 17 was not formalized."] also presented three acceptable methods for attaining conformance to GDC 17.

One of these methods, the defeat of all capability for automatic transfer of loads to ST2, i.e., simply making it a delayed access circuit, was implemented prior to restart of both units.

During the subject event there was no automatic transfer of loads to ST2; therefore, the design was in conformance with GDC 17.

4.

The report (primarily on Pg. 2) describes the isolation of the autotransformer as a failure due to malfunction of " protective relay switches." Characteriz-ing this as a failure is at best questionable. As noted in the report, the licensee was unabie to~ 6stablish that this was a failure.

It is of course

'vtsible that the coordination of the switchyard protective relaying was not timized, and this should be checked.

However, it is much more likely that s

txe p.-otective relaying and associated breakers functioned in accordance with

DEC 151S80 Carlyle Michelson design in response to the power transient associated with the failure from offsite causes of the third of three 500 kv transmission lines and one of the two 161 kv lines, and the trip of the two units.

In the absence of data explicitly defining the prior and post event switchyard breaker configuration and the timing and sequence of the breaker operations that occurred, it is virtually impossible to characterize the autotransformer isolation as a fail ure.

5.

The AE0D evaluation lacks perspective in that it does not place any emphasis on the remaining capability of the offsite/onsite electric power system immediately following the event. The event was not a total loss sof offsite power, only the 500 kv immediate access offsite power capability was lost.

The delayed access circuit from the 161 kv switchyard through transformer ST2 to both units was available throughout and could have been used (as noted in the report) by means of manual operator action from the control room. However, operator action to effect this immediately was neither necessary from a safety standpoint or desirable from a human factors stand-point, since the two diesel generators in both units had automatically started and energized all the emergepcy buses. Additionally, since the 500 kv immediate access circuit suffered no equipment damage, it could have been used as a second delayed access circuit.

Thus, on a per unit basis immediately following the event, the onsite system was capable of supplying power for the minimum required accident loads assuming a singla failure; and the offsite/onsite system was capcble of supplying minimu required safe shutdown loads assuming a triple failure.

6.

The subject event involved the failure from offsite causes of four ;f tne five transmission lines emanating from the switchyard.

This would be a severe challenge to the offsite system of any multi-unit nuclear plant site, regardless of the specific switchyard / unit circuit configuration.

In my opinion, the perfmnance of the ANO offsite/onsite electric power system during the subject event represents an affirmation of the adequacy of GDC 17, not a basis for questioning its adequacy.

I would be pleased to meet with AEOD staff for a further discussion of the above comments.

,. AW Faust Rosa, Chief Power Systems Branch Division of Systems Integration, NRR

Enclosure:

As stated cc: See page 5

DEC 151980 Carlyle Michelson cc:

ACRS H. Denton E. Adensam R. Bernero H. Faul kner J. Lafleur W. Mills V. Stello G. Vissing R. Martin N. Haller K. Seyfrit J. Sniezek D. Ross D. Eisenhut R. Vollmer F. Schroeder S. Hanauer W. Johnson P. Check DSI Branch Chiefs PSB Members G. Edi' son P. Baranowksy

LNCt05URE I Requirements of GDC 17 c..u,

. s o aua,u

,...u

a. -

this criterion presents the minimum requirements for the of fsite and onsite electric power systems deterministically, 1.e.. in terms of spectf f c system and circuit configus ations and functional requirements. The only requirement in

'".'",w'.*"J.", $".*.a[.'l'.U.*i7

• ."',[" *s"f**

GDC 17 for explicitly meeting the single failure criterion is with regard to the onsite power system. In applying u a t..u a

.s a mi..

.,.i.

LDC 17. It has been useful for the staf f to also interpret the deterministic requirements for the of fsite power

"."[,*7*""*.'$*sll"I""'"',.I*.".l$. u Z.

system in to:rms of required conformance to the. single failure criterion. The text of GDC 17 at the lef t is keyed to

u. u..,a.

i. i s..nu u.

..u 6 7[**[m"SU7" *[7."'.f",'*Ys'"[i N the staf f interpretation of its deterministic requirements. and the corresponding staf f interpretations regarding 4.a a a aui. e u N.nformance to single failure:

N co

.. u.,a

....a.4

... m

a., u.

a An of fsite power system and an onstte power system shall be provided each independent of the other and capable of

. ai

. ua i.e.,a-e

• ""f*/."/[,"i/l.f"ua'fl,u""a*".iu) providing Iower for all safety functions. [The offsite and onsite power systems considered together must meet the

.na s u...

ua.a s in in... a.

single failure criterion on a system basis without loss of capability to provide power for all safety functions;

• 1. 5 2"[.YliU.

aw a,-

additionally, in view of requirement (b) below, the two systems considered together must be capable of sustaining a double failure one of which is complete loss of of fstte power. without loss capability to provide power for the wu i u..w su.

wi..

a, a

uu u

.,a.

.he: 6...

uw w.a mus.

minimum required safety functions.]

s a.

.. hua

.v. and i han, s.

. to.

iIwi, s.i, e h

a..

.o. s.u..

b.

The complete onstte electric power system (Class IE) must be capable of sustatning a single failure without loss

.I.""*. 'i?.*".'.'L" "" 'i/f'4U."E'. '

of capability to provide puwer for the minimum required safety functions.

.ya,

6.u u.

saw.si.,e.. um.

.us y y gfe m The offsite shall be comprised of two physically independent circuits connecting the transmission network (grid)

'"$'"/"".a'" 'A".7["'.",*'/.*./* l.' ".".77 c.

a aa.i.. in..u.s p..iu a u to the onsite distribution system (safety buses). [ Separate transmission line towers are required but comon

$N'.".'..Un '."*U.4"a. u

.au. no a..'

switchyard structures are acceptable. No requirement for meeting single failure, and in the absolute sense single failure cannot be met because there is only one power source, the grid.]

i. 6 u o ~u n. wup.b.u s..ua

.. m a z

...a.6u u.

uw. u i. *w.

a i.

. u u...a. a. u s u u.

.m d.

One of these circuits shall be designed to be available within a few seconds following a loss-of-coolant

• [J" "s U.*.*d77.".Ew'J7Ei[."*"..,".".

accident. [1he staf f has designated this circuit as the "Immediate access circuit." $1nce only one such

. u..

. u..

on s -a+6. s d circuit is required, the of fstte power system need not meet the single failure criterton with respect to its O..*.w,"a."". 7."."e I".$." i.".[.u.5"".,.*a.".' '.".* IImmedlate access function.]

\\

<=. u

.on

.a

e.

• D'"N*.**ilI$iYU"[iE[i.".I"*

e.

Each of the twu required of fsite power circuits shall be designed to be available in suf ficient time to ef fect

'"L'JU*, U"'al7s'1"I"."' NI.;

safe shutdown in event of loss of all onsite power and the loss of the other of fsite circuit. [fhe second circuit has been designated by the staff as the " delayed access circuit." The of fsite power system i.e.. the

/,

,)

i.u,.a M ' ",7..727.'"(([.Y1*.U." '~*[l.".!a*I,t".

eccc5s c1rcuit funct1on.] gether, must meet the single failure criterlon, but only with respect to the delayed s

ri 6,i a 6. i.o...a i.

two circuits considered to

/

....uana..u.. u h a

.o.. -

R u.".'us."".'E.N.'.'~"7 ff $ d7 N f.

Analyses (performed by the utility) must verify that the grid remains stable in event of loss of the nuclear m i

.s,..a en sh.

u..inu s unit generator. the largest other unit on the grid or the most critical transmission line. [fhere is no specific seguirement for meeting single failura, llowever, overlapping requirement (a) above requires the of f-N site /onsite power systems to meet single failure on a system basis.]

..a

-..a mu sn s,..

nucu m.,.

, r.

Requirements of GDC 5 b

.u.a... a.

u a i..aa,.u.n a n..h i- _ u n.u

.a u.

7M s.n r i.[.Us[*.7, s ","7'u"", a*'iu","5 N" "sh,u fd

- Sharing of of fstte electric power components and systems among nuclear units is permitted in accordance with the aik i.hau.a. i.

clearly stated requirements of goc 5. and providing ali the requirements of goc 17 are met on a per nuciear

"* E*E.'Id **.*7.U*U 7.s."..". ".7am*a g unit basis. Sharing of onsite electric power components and systems is no longer permitteJ. see Regulatory i

C#

Guide 1.bl. Share.d Emergency and Shutdown Ele tric Systems for Multi-Unit Nuclear Plants, u.

b

Q 'e ! av f vy f M SZE D

.g, s re nouxfor afr

?f?rtst 12919.12/7/d?A93 N0 'l!

• Q Alegr ff4RVArd

• yyy vl, gyp

• e l..M l1/fffM?/Ff?2ff2P fdJM/M ftfff No./

flet d'&

41 90 9 / Alt 9ff:

\\ ges

\\ ggrr e A. ff/JNUff? J N'ord.*tt toed dM?!ff BUf 3m.

m + e..e 4/Nff s fgM (fMffsypf Agf fp pppfysep e

26d 4**

tys 4/Af AUfM/Mff.

L, /EOD RgPat-0

(*}iss ~

-I

- p,, y in-m:nu a i7,:uss u aian

,\\ are g

2. 4YmCUA8tf 4kfCenktCF Laat 70 BY.Antt

'E!*

m Geerr ek s. Pat kne istmap goo 4lrt%%4 l9 ft/r [

t9 tlR I

I

<m e

,, L,,,,,,,.,,.,,.,,,,,,

,,....,.-,. z

[$

g. f?lffidt rive,40 6dil

$12.61*EfB-!dS/fM9ddh$1FABY)

g. tfligt?B M94 OffffY00$! ASA

% y* 114lM.4lff M91 L/MWf

_ 4 ppg a 46 *f Af/fo &*/?.S S ff/f Mfd &Jf.*)

?IR go 'R19,fJfM/S eb /

I

, Y persg/ppo sfef tfff (fM M &

y gjpggyyp pyg;,

rasuriewto -irim:ssa;

.s/tr. C m'

n

" yf m~,,,,,,,,,r so rsar ?r. r e

m;mnwcrgman fag sung g)

W

's '. I* ". '# "gy=p.',.*s* s#

T is;;; g ap 7

• 14 t/.'*.*lft mwd l

s dA;/11FJJ.4f*/ e/JJ

?!./ 4.9* 4. 4 iT i'

f Y) h) 4.9n half otN) erf of

?

4

>f AIAt!!f tiettet ponpfftp p

rests HMfrafer 31a r. 29,6 eII e

e,,,..

~~. >. ~ w n

}

.00049*9 "n'~

r

=',

Lr; v

c

)

1. f###

)#d l) s.J.####

,)

)

}

e arr 491

• Jr j4.Atrar.4 21 44 rr+ ett ad O 414175.991 At b

O A #

b i

h A#. i

,i

,p ip j

i t

JJJJ t/171R mu Totaffrowff!

li LL Y~n YLs.

PLL PL.

1 gy,G.,.",,G,,4

~

,)

)

)

er*N)o r e) ode K Q

ar;*se j y grarre?

1 4

4 1

i

. ) s.A 4)*A

1. A

• A

/R$. lJ//ft/A481 A

m.,7

/

o 4

'r*4? ideo ffM7//f l En clu u r e 2 1 /M B) h ff /Aff

• ? //a791//

• /dt? /411/

f AMENDMENT 49

• cfsus/>r usSt ARKANSAS PCWER & LIGHT COMPANY ARKANSAS NUCLEAR ONE - UNIT 2

• <*H 'ornsantassist Station Single Line Diagram FIGURE 8.3-1

yg4g h Joe er 17fffM i $ * $ (Ar "

fo nqrtooeg. d "'

I' ,ll"'

b L w' e, L o ss

/azs "

c l'12 W v#

h,

.fs / net /M/FR ~. p&er str[r% -e

(

• ss t fics Jits y

y,,

m s f 6 & 't siun7t t sa IE sire?srer e.,

aser * * *. -, !W

\\

/f*4A

/ /M i f

'?1/1ss(LsdL1 M

I

-- p

\\

pp 1969 Jypyisa gje*

_f

, MF 21 sure 'assf esonst-b t'l l 9 I

• S '

'f l p 5 Y ^

ua, '.2'si,,

vi, '*' sir,=

MA 6s*t stff

,m' s'$$'$$'Ein nra>

l

==/A

/*

N/?nb

.p.1 iy**^,

r 21ll %

[

~... r]

s!

• in -sin snu-suo sus rT's

• m-/s

/s-* r L--

t 4

1 M,ia roun renano L--.

"i'*

.~.

st.1 seeEr Pos,coatts ***MrA h

co fish ava, UJMatJHal /AAU 64*/1itt,le/2 5i333 4 ore)

,I

/

f fw* w EL*L g

U " "*!!!al

,a>

nn aur A

nivruu arf was (Jn Reft 16) p g

//*ldNJ Mill.

rear y svert:ser 'rogforvert l'19?!9 '2!M!!!JWff M* 9 d "'

e

.foo?co

• ma o, sa s m wsfirst arrif a sur.Inun "

w planne.-

mtr~;m V"s M"A.%.

L'u TT utR R q

ed/4/!M.40*r D?ffn ?/1'd-9-4 ?d !!

9 i

T i,}

II iP I

a

{s.9er 4t?9stf E 9 'A'f ?'Y ei 4 9 **' Y

• )

)

9 f

f 9

J l

1 k

MI'm (frffet**

th=4fon UrtMP fiffr/trin est:1

.g peespf(4) s; Mnt/ft)

INr.pnrLa 9H sisr 0,4814 Ad* W.ohnLiW J:JrtSW^

jysastr/W!N

('

'W [v s,,,,,,

y

",#'.".f'

.s. a o

n a

w

,)

,)

,)

11A l 0) h) asur fr/

• rar

)

)

$ aserser 4 te r e s.saraork ras a ster serran l i o avr arf 6

h5 4

l ('

i I

f g

> 6 t) g ll d #.

MA a4y

<f 9

P l

,p

) 1

1 b.

h),.,. ,,. L $u.. ? ,4 f uN y;intre**7j'{ . ~ er. 2a.!L. - J Up 17/ TIM jmr 2 4 e i _c! N / 7

4. f 4 f l!

JMB 443 et 3 t ?" 3// / $JJf ( p

f. it If lMfMNffAf Afet*(Uff. /Affff fulffff (JAD ff9N:7 i JNdA. lMUF fffffBJi i/Af.

p et M41.lAMff NJfrf// M.1 j,f,f l f,g[, 18i.232.;33 B'dB7doed!' 40 WO l H4 4 736_ W '/SNJfN/Aff frMP != deed 4 f*4244 ' MF!dMr#?.*NUI4MiffRPrW9 f lMfSMJf/2 N/MMJJo/f I =Ife e 5 !=If00 9 f' efflet /MMfffJR/91MrfsdM//M f)(Mt/Nt prMP/(Jc/M S) S ' 94/1 ffitH2 (Jiff /MM&f/19t/Mf /J91 / 1= the 4 1 - 150 $ 'se!!!k f/fffMistsyr!!/dR/// [fNf!MHffJ /AfM? Narrar. frants/wittissin Irn!/ssts fM/rfixt? toss. , a..:,naa,- a w w 4-~ - a?un/ ,sufixtsuo rfsfiunst

/~,u-fr

a n ffffMfNrf M/JWaf/2 /4'?ff s ' ss'>0 *

f.~utusfsinn asunos li sa.

,,,y,,,,,y,,,,y, yyyyy y,,yfy up,y, f.s a n n,sa na:i ws. saoo I / f4 WJff P P e /o o e# 1= y K!#' # # u,n, ,,1, an, -,

i.,,,,

,. n 4. u,,,,. _ I e ff/1y /VMP CAM 4/ //JJ?f1 H4M //fMff AUf @f%9F6) a rn u m vm r a m WMN M@ML, .p* "c%[o, UNITED STATES g g NUCLEAR REGULATORY COMMISSION y s E WASHINGTON, D. C. 20555 &ckwe 3 \\j NOV S11978 MEMORANDUM FOR: J. F. Stolz, Chief Light Water Reactors Branch 1, DPM FROM: Faust Rosa, Chief, Power Systems Branch, DSS Rod Satterfield, Chief, Instrumentation and Control Systems Branch, DSS

SUBJECT:

ARKANSAS NUCLEAR ONE; INCIDENT ON SEPTEMBER 16, 1978; AUTO TRANSFER OF AUXILIARY LOADS ON BOTH UNITS TO STARTUP TRANSFORMER NO. 2 WITH CONSEQUENT OVERLOAD; CONFORMNCE TO GDC-17 The incident at Arkansas Nuclear One (ANO) on September 16, 1978 brought into quertion the conformance to GDC-17 of the offsite power system design of this station. We have reviewed the ANO design in light of this inci-dent; this review was conducted in close coordination and consultation with cognizant personnel of I&E, DOR, DPM and the Licensee (Arkansas Power and Light Company) and its AE, As a result of this review we con-clude that the present offsite power system design is not in conformance with GDC-17 with regard to the independence between the two required offsite power circuits. Our rationale and reconnendations are as follows:

A description of the pertinent features of the ANO offsite power system design is provided in the Enclosure.

It is clear from this description that under certain conditions Startup Transformer No. 2 (ST2), which is in the " delayed access" offsite power circuit * (for both units) required by GDC-17, will be automatically overloaded due to a failure in the autotransformer which is the common element in the imediate access off-site power circuit which is also required by GDC-17. More specifically, the automatic overload, i.e., disabling, of ST2 will result when a failure of the autotransfonner circuit occurs concurrently with any of the follow-ing station conditions and events:

a) both units in either startup or shutdown mode, b) trip of one unit while the other is in either the startup of shutdown mode, and

• The design feature of automatic load transfer to ST2 which is provided actually makes this a secor.d imediate access circuit, thus exceeding GDC-17 requirements with regard to access capability; however, the resulting overload of ST2 violates the independence requirenents of GDC-17.

Contact:

F. Rosa x27122

V J.J. Stolz NOV D11978 c) simultaneous trip of both units.

GDC-17 requires, in p.rt, that " Electric power from the transmission network to the onsite electric distribution system be supplied by two physically independent circuits (not necessarily on separate rights of way) designed and located so as to minimize to the extent practical the likelihood of their simultaneous failure under operating and postulated accident and environmental conditions." Sinca in theJiQ_desien a failura in tha ime-Iliate access offsita power circrit resultsin failure of the delayed access circuit, we conclude that the AN offsite power syshdesign is no_t; irl conformance wnn sne 17-hnwever, the Unit I situation is being handled by DDR ar.c Unit 2 is presently shutdown. Prior to Mode 2 licensing of Unit 2 this matter will need to be resolved.

We recorrend that the licensee be advised of the ibove cited non-conformance with GDC-17 and requested to modify nis design to bring it into conformance before Unit 2 goes into Mode 2 operation.

In our opinion, acceptable methods for attaining conformance with GDC-17 include:

1) Replacement of Startup Transformer No. 2 with one capable of carryins the worst case combination of automatically transferred loads.

2) Defeat of all capability for automatic transfer of loads to Start-up Transfomer No. 2.

3) Defeat of capability for automatic transfer of selected loads such that Startup Transformer No. 2 will never experience an overload condition (including excess voltage drcp resulting in unacceptable voltage at the safety buses) due to the worst case combination of the retained automatic load transfer capability.

Development is underway of a PSB Technical Position addressing the detailed application of GDC-17 to offsite power system designs involving similar automatic switching schemes. Pending cc.mpletion of this position (and its 3

approval by the R C if required), acceptable means of implementing option 3 above include:

(1) defeat of automatic load transfer in one unit while re-taininc it in the other, or (2) partial defeat of automatic load transfer in either or both units.

Also, procedural implementation of option 2 or 3 utilizing existing switch-ing cr.pabilities (as opposed to a design change) would be acceptable pend-ing completion of the above cited PSB position. Such procedural implementation should include written procedures for (1) defeat of the required automatic switching capability, (2) manual load shedding and switching including manual loading required to make use of ST2 as the delayed access offsite oower cir-cuit for either or bcth units, and (3) daily logging of the status 0# auto-matic load switching. Unrestricted operation of Unit 2 (and Uni'. ' insofar as automatic load transfer to ST2 is concerned) would be permissable provided the above procedural requirements are approved by I&E and incorporated in the Technical Specifications.

.s J. F. Stolz N OV $ 1 1978 Implementation of the above position regarding automatic load transfer to Startup Transformer No. 2 involves the offsite power system for both units. The pennissable operational status of Unit 1 is being reviewed separately by DOR (see memorandum from G. Lainas to R. Reid dated October 27, 1978, Voltage Degradation At Class 1E 480 Volt Buses).

This review will include consideration of the proposed Millstone fix for degraded grid voltage conditions which includes design changes as well as administrative controls.

(An approved Millstone fix has already been installed in Unit 2).

.r '

,/ )

--f, c-M.

jf t-J A Faust Rosa, Chief Power Systems Branch Divijion of Systems Safety

/

Rod Satterfield, Chief Instrumentation and Control Systems Branch Division of Systems Safety

Enclosure:

As stated cc:

S. Hanauer R. Mattson V. Stello R. Boyd N. Moseley G. L. Madson (Region IV)

T. Westerman (Region IV)

R. Tedesco D. Vassallo D. Eisenhut G. Lainas D. Tondi M. Srinivasan D. Davis L. Engle S. Varga J. Beard ICSB/PSB Menben

d m.

b ENCLOSURE

~

s Description of the Cffsite Poaer System Design for Arkansar Nuclear One Units 1 and 2 The fcliowing design features of the Arkansas Nuclear One (ANO) s ation are pertinent to the evalbation of the design for conformance to GDC-17, in light of the incident which occurred on September 16, 1978.

1)

Each of the two units has a dedicated unit auxiliary transformer (UAT) and a dedicated startup transformer (ST) each of which can supply all a-c power to all the unit auxiliaries, both safety and non-safety. The UAT's are suppligd from their respective unit generator; the two ST's are both supplied through a single auto-transformer which also interconnects the 500 KV and 161 KV sections of the station switchyard.

2) A backup startup transformer, Startup Transformer No. 2 (ST2),

is provided which can serve both units.

This transformer is supplied directly from the 161 KV section of the switchyard.

However, it does not have the capacity for carrfing the full auxiliary loads of both units.

3) On unit trip, all the unit auxiliary loads will be transferred automatically from its UAT to its ST. This will occur in both units, independently.

/

. __ i s.

~.

4) When unit auxiliary loads are being carried by the respective ST and this source of power is lost for any reason, all the unit auxiliary loads will be transferred automatically to the backup ST 2.

This also will occur in both units, indeper.dently.

5) When both units are being supplied by their respective ST's and the common source of power to the.ST's (the autotransfonner) is lost, then the auxiliary loads of both units will be automatically trans-ferred to ST2. This will overload ST2 (exceed MVA rating) and also produce excess voltage drop resulting in a degraded vcitage

+

condition at the buses (safety and non-safety) of both units.

6)

With the existing design, the overloading of ST2 will result automatically on fai. lure of the actotransformer circuit feeding the two dedicated startup trasnformers, when the failure occars concurrently with the following conditions or events:

a) both units in either the startup or shutdown modes of operation, b) trip of one unit while the other is in either the startup or shutdown mode of operation, and c) simultaneous trip of both units.

7) The Millstone fix for degraded grid voltage conditions which-in-cluces a second level of undervoltage trip (at approximately 92% of nominal) was ir,talled in Unit 2; this fix is ' scheduled for in-stallation in Unit 1 at the next refueling outage.

It should be no ec tna; the Milis one fix is intended to protect tne onsite safety related distribution systems from a degraded grid voltage condition not against digraded vcitage due to overload of a startup transformer (although it is also effective in this regard).

There-

~

fore, the Millstone fix is necessary in order to meet the GDC-17 rec.uirements for independence between the offsite and onsite power systems.

However, the Millstone fix is not considered

+

pertinent tc the evaluation of the offsite system design for con-formance to the GDC-17. requirement for independence between the

' two required offsite power circuits.

In this case, the design

' feature in question is the automatic overloading of one of the

'[

required offsite power circuits to both units on failure of the other offsite circuit.

It is noted that item _6(b) above covers the incident which occurred at ANO on September 16, 1978., Specifically, this incident was

~

~~ - -- - - -

O

-4 s

initiated by a spurious trip of Unit I while Unit 2 was in the startup mode. This resulted in automatic transfer of the Unit I auxiliary loads from its UT to its ST.

Since Unit 2 was alreedy on its ST, this transfer loaded the autotransformer with the full auxiliary loads of both units, resulting in trip of an autotrans-former overcurrent relay (which hi.d not been adjusted for two unit operation) and consequent opening of the circuit breakert feeding the two ST's.

Loss of the ST's automatically transferred the auxi-liary loads of both units to ST2 exceeding its MVA rating and pro-ducing a degraded voltage at the auxiliary buses (safety and non-safety) of both units. The overcurfent protect'ive relaying for the autotransformer has since been corrected to preclude recurrence of this type of f.ilure.

The above description does not address those aspectsof the Septea.ber 16, 1978 incident or plant design which are not pertinent to the evaluation of the offsite power system for conformance to GDC-17.

m

'