ML20004F906
| ML20004F906 | |
| Person / Time | |
|---|---|
| Site: | Millstone  |
| Issue date: | 06/16/1981 |
| From: | Clark R Office of Nuclear Reactor Regulation |
| To: | Counsil W NORTHEAST NUCLEAR ENERGY CO. |
| References | |
| TAC-43575, NUDOCS 8106260161 | |
| Download: ML20004F906 (18) | |
Text
_.
khk k
UNITED STATec NUCLEAR REGULATORY COMMISSION i 4....-
a
.,(.;l.7}3' WA SHINGTON, D. C. 20555
%,".T.'N,f -
JUN 161981
' Dock'et No. 50-336 g7t,g
/
):s' r(1 k
'M i e p.
Iy M
d.d Mr. W. G. Counsil, Vice President f } JUN 5 21981m
- 8 Nuclear Engineering & Operations 2
Northeast Nuclear Energy Company 1,.
y,,,,,.
cc=sse P. O. Box 270 Hartford, Connecticut 06101
\\^
DearNr.Counsil:
=
As a result of our review of the January 2, 1981 Loss of DC Power Event at Millstone Nuclear Power Station, Unit No. 2, we request that you review and 2, " Sequence of Events" and " Analysis and Concerns", res-pectively and provide any comments you might have.
In addition, we request that you provide the specific additional information noted in Enclosure 3.
Please provide your response to the three enclosures within 90 days of receipt of this letter.
Sincerely.
7
- f j (c. @'[ E r obert A. Clark, Chief Operating Reactors Branch #3 Division of Licensing
Enclosures:
As stated cc: See next page
- 810 e 2 e o/GI,
5
o.
i
. Northeast Nuclear Energy Company cc:
William H. Cuddy, Esquire Mr. John Shediosky Day, Berry & Howard Resident Inspector / Millstone c/o U.S.N.R.C.
Counselors at Lu!
P. O. Drawer KK One Lonstitution Plaza Niantic, CT 06357 Hartford, Connecticut 06103 Anthony Z. Roisman
.Mr. Charles Brinkman Natural Resources Defense Council Manager - Washington Nuclear 91715th Street, N.W. -
Operations c
Washington, D. C.
20005 C-E Power Systems Combustion Engineering, Inc.
Mr. Lawrence Bettencourt, First Selectman 4853 Cordell Aven., Suite A-1 Town ~of Waterford Bethesda, MD 20014 Hall of Records - 200 Boston Post Road
-Waterford,-Connecticut 06385 Northeas't Nuclear Energy Cohpany ATTN: Superintendent Millstone Plant Connecticut Energy Acency Post Office Box 128 ATTN: Assistant Dir ctor, Research Waterford, Connecticut 06385 and Policy De alopment Department of Planni 2 and Energy Waterford Public Library Policy l-Rope Ferry Road, Route 156 20 Grand Street Waterford, Connecticut 06385 Hartford, CT 06106 l
- Director, Criteria and Standards Division Office of Radiation Programs (ANR-460) l U.S. Environmen',a1 Protection Agency
(
Washington, D. G.
20460 U. 'S. Environmental Protection Agnecy l-Region.I Office ATTN: EIS COORDINATOR John F. Kenne@ Federal Building l
Boston, Massachusetts 02203 Northeast Utilities Service Conpany
.' ATTN:- Mr. James R. Himmelwright Nuclear Engineering and Operations P. O. Box 270 Hartford, Connecticut 06101 L
e e
G-e
- ^*'
,gw_.y,_,..g_,,,,.,
,,,,.%,a..,
,-,,.,_y-,
.,.3w-,,,,
,m-e,.
..m-+,--,
w.,
ENCLOSURE 1 LOSS OF DC BUS AT fifLLSTONE '2 '
~"
~ ~
l SEQUENCE OF EVENTS The Millstone 2 design consists of two redundant and independent emergency-l pow'er systems. These will be referred hereinafter as the A'and B systems.
~
The enclosed Figure 1 depicts a simplified single line arrangement of the ac and de redundant emergency power systems and will be used to support
,the description -of the following sequence of events.
Initial Conditions
~ The reactor wassoperating at 100%. power.
Initiating Event - Time Zero e - The main 125 volts de emergency bus in system A was deenergized 2
when the main feeder breaker connecting the battery and its charger outputs to this bus was inadvertently opened by the L
plant equipment operator.
e The deenergization of this bus resulted in the removal of control power to_ the reactor trip breakeu causing a reactor
~
f scram.
e The turbine trip,which normally follows a reactor trip did not occur.
e System A diesel generator started.
Time Approximately 30 Seconds e Turbine was manually tripped.
e The fast transferring of the in-house loads from the normal station '
service transformer (NSST) to the reserve station service transformer (RSST) which normally follows a turbine trip did not occur because the transfer logic is powered from the de system A.
4
,,-te3.=-+.
.., -, v m, m.-c y
.w-.ww,--.-w.,",mw,,,%...-.,--,-,,*-,,,,,--...,,,--w--,,.4.,.--=,-,ww--.,,-mme, e
_,,--,.--,%..-%-n,-wr..-=~.--.m.
.g.
e The failure of the fast transfer left open the two breakers f.
. through which offsite power is fed to the 4.16 Ky ac emergency 5
bus in system B.
This resulted in the loss of offsite power to
.I t:
system B.
i e The loss of offsite power to the 4.16 Ky emergency bus in I
[
system 8 resulted in the starting of ' system 8 diesel generator.
4 The two breakers through which' offsite power is fed 'to the 4.16 e
'ky emergency bus in system A did not' operate because de control power was not available. Thus, offsite power remained available to system A.
e The automatic opening of the main generator switchyard breakers which normally follows a turbine trip did not occur because the initiating signal to open the breakers could not be generated.
as a result of the. loss of de system A.
Thus, the main generator I
started to motor.
e One of the two 6.9 KV buses which provide power to two of the
-reactor coolant pumps was deenergized when the fast transfer to the reserve trans,former could not be accomplished. The other 6.9 Ky bus remained connected I.o the main generator through the normal transformer.
j I
i.
- Time Aporoximately 50 Seconds e The 125 volts de emergency bus in system A was energized when the main feeder breaker was closed.
l e With de control available, the source of power to the 4.16 Kv emergency bus and to the 6.9 Ky bus in system A was transferred
~
from the normal to the reserve transformer.
L l
l l.
I
.J.-_..,_..
....,.-.;_,.~--~._._,_.-,...a-,--_..-_..-.,....-~._--.--__.----.-..__,_..,,,,----m.--
~
I; 3-f e The 6.9 Ky bus in system 8 was connected to the reserve trans-
'former. This connection was immediately lost due to an overcurrent condition caused by attempting to start all the loads in the bus t
j at the same time. This may have occurred because the design
}
did not include the feature to disconnect the loads from the bus during a 'zero voltage condition.
The supply breaker from the reserve transformer to the 4.16 Ky e
emergency bus in system B could not be closed because the breaker was locked-out when the offsite was previously lost.
The generator output breakers in the switchyard were opened e
and thus, the main generator was removed from the 345 KV switchyard.
I System A diesel generator shut down automatically as a result of e
a design feature which is activated to trip the diesel generator when de control power is restored, Upon restoration of dc to system A, the main steam isolation valves e
closed thereby tripping the main feedwater pumps. The electrical ~
7 4
auxiliary feedwater pumps were started and water was supplied te both steam generators.
Time 10 Minutes System B diesel generator tripped automatically as a result of f
a a water leak which sprayed the electronic governor and caused the trip of the diesel generator set. Thus, the 4.16 Kv emergency bus was deenergized.
The load shed signal was overridden and the 4.16-Ky emergency e
bus in system B was reenergized from the reserve transformer.
Several instruments supplied from a non-vital instrument panel in e
system B were not available as a result of blown fuses.
I
-w-r--c.w.pi-es es-+-
e -%mw ww,-
- y v--
w i-
--w, ww wm,
+
weww 45---,
e es=*-p
+we--py,g4w--
wwey+---
wy---1e+T"w'-wP-'"e*-w**
'mT"'F fM*m
- TP"'f--*TT*wer-'*W9-P'-f v*PO't ?vd'*F'*-W98'T-W*'
i q', - i- - i-i- !.m :
- -f--}- - j j
i i
r i
e e
g l..I 18. 4..
ry;;
rq g
e a
a
,i 3
w_ _q m_ts
+
i-i i
i s
i-,
i 4c
=i
__ Tg--._wg-o.
i.s!
. s.
v.
i i
i N
3mi
~
..y-N mp.
F-
. 1
!. k-._
M.N.___M y
- -- __ q 7
f' T_ g.
. _U,ih'
_. p
= (
_2_
_ _ m.e
- g g.s. N ?,-
s m
=
=
g us
}
._Qg
_gg.._
.s.
w g _.
.).,__.
y i
z
..,w w j
Q 7
2
~
<g h ___
w E
.q
,_y
.y
__ y _. _. y
.1__,.. y 4..__... q g;-(
. _.. _. %__ _.g y.
_ _.. ', g i
N
.g.
i,.
2_ _ _M._..,._5_...
T
_i._...
>J2 u
_"$,7
[h h
,L
_ts y x
w x
. _y s
.s._, 1.
__ g$.,_Q_. __ _.
._.... 3 7.__. y.
/,
S t
...._..2+
g
.._39 g _ _. y.
4 G.
N 3 y
__.. r. I. g_ _._ _ e s.:._
g.
.y __
a l
-_...y w
w
..g e
r Ip.u_e.s e
g 2
. g g.
p.,_
t.
L.2_
4 r
s
- g a
S<
' 5,
,r
- TT c
C 1
'k r
g x
. _. n... =
. < b,
(
4 I
_ __ z.
~
f.
_f y a
.g
. b.
t V)-
A i
M.
- tn l
. s.
't e
Z W
a w
3 A
l
- l i
=
s.
N 4
,,.,,,n.
--.-,.,,.,.,..-,,..,,-,..n-
I l
l l
l l
l l
l l
l l
lf l
i
'iiiI i
'
- 80 V I
-l l - ', - -
l l
l l
l l
l l
' (f /d '/ I l
l 3
6 e
a j- -
H I.!_,)-
i l
}I l
I l
l.
l I
i i
I,i I
I I
I "O, i I
i "=
n,My i
! 4) i i
i
! ue) I
_1.edzey_0 x !
I i
I Iill I
l
~~e i
E sia i I 'ilM],2 o v f
3d "
g7" '
j l'
I _:-
817:
i i
i l
l l
~~ ~fd's 47FD 6//s'g.
l l
U,4ULAffD-cf,,gy
(/M A'-
l l
l
.w.
I l
l l
l kI l
l l
i I
--d-l n
/2r y a c (2otAQ
' p g.s= y a e (to/B) p i
i I
l l
l l
l l
jUU; MO.
l
)^/k.<.<._a nc). < ) ),
.i lNC)tifW
. c).-uc) i 1
l j _;
Nc) ue) ve) ac l
l l
l i
NC
.m.,,
o.
/2 $' V DCl l
l
/23 /bC.
,12 s y ac..
12 r /
bc g
s t
V t/L vtrA L viral
//rA L s
l' t
3 i
hf
/2.5~Y D c w /2 S' s D C,_, /2 5'y oc
/2 5~ v D e t i
i l
l i
b
/VC W.ffff A t N GA/= Vo!'M L NON= V17M 4 Ned= fora A.
l l
l l
l i
oc/
Dc D C.
l l
De Ac Ac i
A' s2a v sc
_/ Ac sla v_ A c....
New. ve rnt Hod.vsr48 I
Iss.t rA'.
.. JW2rM.
-. 1/AC=/)
h, g g.
yc,, go (Phrs ).
PAdfL IM C - 2.
7 v
.Y(.
b 4,
i I
% 3
-.i mg yr.
Y V
/
i
. /2 c v A c_.
i i
I i
i i/2e v n e,
/Z O V AC
/ 2. o v Ac.
l t,,,.g z g g vorne (A3)
. //rns. fnt) v/rne(A4)
I Ac Ac JC DC t
h t
l s
My NC i
= =. _
f / z.5-E a e l
l i
._.. - )
.._.v t
_.... - -. B n x w e c e c____
A sur-..
_._=T _.. B A 2~Zf2f'Y TVZ?fff s4 y g
. f'Y S T f 1 8.
/
t I
2 l
l
~i.cuer_/.4.rer_.2or_2 1
. _.. hair 2ra fLrer:aasa...
_ 1 M W' $tst$,enM. ~
l I
$G t.d*
._ff'/' LF rodi - ?- ' 2///_..
1 t
.t ENCLOSURE 2 l
LOSS OF DC BUS AT MILL 5TCNE 2 ANALYSI3 AND CONCERNS 4
Our analyses, findings and conclusions of this operating reactor event were based oniy on the information listed in the reference.section of this enclosure...-The following discussion identifies those. items of concern.
- Station Blackout The sequence of events showed that pr.ior to restoration of de power to system A, offsite power has been lost to system B and remained connected
- to system A.
In addition, the emergency diesel generators had started and the B diesel generator was supply,ing its emergency bus. The A diesel generator came up to speed and assumed the mode of standby because system I
A was being supplied by offsite power.
In the event that offsite power would pot have been availabl,e to system A, it would have been impossible to connect the diesel generator to the emergency bus in system A automatically l
because of'the' lack of de control power. The restoration of de power to system A resulted in the energization of a shutdown relay in the control
- and circuits of the' diesel generator of system A which caused the shutdown of the diesel. Ten minutes since the occurer.ce of the initiating event, System B diesel' generator was automatically shutdown as a result of a water leak which sprayed the electronic governor.- Irmiediately after the i
L trip of system B diesel generator, the only remaining source of ac power to the emergency buses was the offsite power supply to system A.
It appears from the information available for review that if the operator had waited 10 more seconds to restore de power to system 8., it would have resulted in the automatic loss of the offsite power co:nection to system A.
M i.
~
. Thus, the total loss of ac (station blackout) would have occurred immediately after system ' diesel generator automatically tripped.
Offsite power to system n would have been interrupted when the reverse power relay time delav have elapsed 30 seconds after the main: generator started to motor u.aich was approximately 30 seconds after the,occurrenc.a of the initiating event) and have caused the separation of the main generator from the switchyard. Under the same set of circumstances a station blackout would have also occurred if de power would have been lost to system B.
It should be noted that the' capability to remotely control the removal of decay heat'from the control room would be totally lost ~if the steam driven auxillary feedwater pump dc power requirements were being satisfied from the failed de system. However, this control-of the steam. driven auxiliary feedwater flow can be accomplished remotely.
It should also be note,d that the design' includes the manual capability to restore ac and de power to the emergency buses under these circumstances.
This event also illustrates the possibility of a single event in one of l
the two redundant portions of the dc power system leading to the trip'of the plant and causing loss of the ac emergency power supply associated with the portion of the failed de power system and the total loss of l
offsite power.
It appears that such a design is inconsistent with satisfying tne requirements set forth in General Design Criterion 17 of l
Appendix A to 10 CFR Part 50 with regard to including provisions in the design "to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit, the loss of power from the traasmission network, or the loss of power from the onsite (emergency) ptmer supplies".
1 1
i l
, l System A Diesel Generator Trio
~
r It appeared that the. A diesel generator started when de emergency oower f
to system A was lost. The loss of de control power caused the air start p
l valves to open allowing compressed air to start the diesel generator.
Although the diesel generator was running, it was not. automatically I
f
~
connected to the emergency. bus because system A was being supplied by offsite power.
If offsite power had not been.available, it would 1
have been impossible to close the diesel generator output breaker because of the lack of de control power. However, the output breaker can be manually closed at its :mtor control cabinet and then as the need arises during an emergency condition, the loadscould be manually connected to the diesel
- generator.
i The restoration of de power to system A caused the energization of a
(.
shutdown relay in the control circuits of the diesel generator of s.cem A which resulted in the shutdown of the diesel.
The system design to start the diesel generator automatically as a result of losing de emergency power in the same system has merits in view of the fact that as a consequence of losing de power, offsite power is also lost to the e.,ergency buses. The connection of the diesel generator to
-the emerger.cy bus and the subsequent energization of the loads can be accomplished manually if the need arises during' an emergency condition.
It should be recognized that there are mechanical limitations that
.., =_
u;
- c.
.c.. 2
...c
.a-restrict the amount of-time that a diesel generator can be operated unloaded. Also, without de power available, there is' no protection to the system in the event of electrical fault. Thus, the importance of the emergency situation must be promptly assessed and action taken to either load or trip the diesel generator.
In view of the fact (1) that offsite power could be totally lost to the emergency buses as a result of losing de emergency power and (2) of the unreliability associated with the starting of diesel generators, it is important to safety to! keep the diesel generators running in antici-pation that this power source will be required. This will circumvent the high probability of failure during the starting of the diesel generators in case they are subsequently needed.
It could also lessen the burden of the operator during the initial critical recovering steps for this type of evant.
In addition, the feature of the control circuit design that upon restroation of de power shuts down the diesel generator is l
l inconsistent with Branch Technical Position ICSB (PSB) 17 of the Standard l
Review Plan. The Position requires that protective trips such as this one should not interfere with the ' successful functioning of the diesel generators during accident conditions.
Load Shedding Feature Reinstatement The sequence of events has shown that the design does not have the 1
capability of undervoltage load shed at the 6.0 kv i,us level. After the 6.9 Ky bus in system B was deenergized for 20 seconds, it was connected to the reserve transformer upon restoration of de power. This connection
[
. was inanediately lost due to an overcurrent condition caused by attempting to start all the loads in the bus at the same time. These loads were not disconnected when the :6.9 Ky bus was first deenergized. Although it may appear that the lack of this capability of undervoltage load shed at the 6.9 Ky level may have no safety significance, it is not a desirable ^ design practice.
The reason to bring up this problem of apparently no safety significance is to relate it to a similar situation which may have occurred when the diesel generator in system B tripped.
The sequence of events indicated that after system 8 diesel generator tripped, the load shed signal was overridden and the 4.16 Ky emergency bus in system B was reenergized from the reserve transformec.
It is inferred from this statement that the design may suffer from the same lack of undervoltage load shed capability
- as that at the 6.9 Ky bus level. The automatic reinstatement of the undervoltage load shed feature has been a NRC requirement since 1976 for emergency diesel generator systems. Also, the possibility exists that
' during this event the undervoltage load shed feature may have not functioned I
as designed.
The requirement to automatically reinstate the load shedding feature when i
the emergency source supply breaker's are tripped from the corresponding l
emergency buses arose as a result of a sustained low grid voltage condition which was experienced on July 5,1976 at Millstone 2.
A safety evaluation was prepared following the grid degradation event of -
L g
y-e.#--
g.
-,-.-v-
-4 e.-g
-y-qy-.eq,in9w.,-i_
ew-www wy ey ymre---r e ra.e w e g.9-p,
-cW,.m
-.gm4,wwr-ar-N
-ew---
w%ye-g---,eme,wg-
,eep ww g
ar*4y-4 y
4
. July 5,1976 a'nd reflected that the reinstatement of load shedding was a feature of the Millstone 2 design for emergency diesel generators.
4 L
Instrumentation Blown Fuses
~
. Ten minutes after the initiating event occurred, system B diesel generator i
. experienced a malfunction caused by a water leak which sprayed the speed controller. This resulted in.an underspeed condition followed by a f
low oil-pressure trip of the diesel generator. The low oil pressure
[
f' trip corresponded toan electrical frequency of approximately 45 hertz.
h At approximately the same time, several fuses were blown in the instru-mentation loops being powered from a 120 V ac non-vital instrument panel associated with system B.- This panel has been -identified in the enclosed Figure 1 as IAC-2.
The instrumentation loops received power from a regulated 480/120 V transformer which experienced a frequency of 45 hertz during the under-
~
~ speed condition of system B diesel ger.erator. Since the instrumentation loops consist of inductive loads and have a transformer input, a decrease in power supply frequency will cause the transformer inductive reactance j
to decrease and input current to increase and if this continues the trans-o formers will reach saturation causing a rapid increase in input current.
- NNECO attributed this overcurrent condition as the reason for the blown fuses in the instrumentation loops. The licensee has conducted a test that simulated frequency decay to 50 Hz in a typical instrumentation loop 1
.--m.
.~
power supply. Extrapolating che data to below 50 Hz indicated that the low frequency caused the fuses to blow. A review of the-licensee's
. information in-this regard was found acceptable.
It.should be noted that the instrumentation loops' associated with this j
non-vital bus are considered non-safety related and their failure.should be of no con' sequences to safety. TLare are other instrumentation loops in system B being supplied from 120 V ac vital buses which are considered safeky related and their failure or degradation as a result of this
.underfrequency event could have serious safety consequences.
-Electrical Indeoendence at the 120 V AC Level 1s a result of evaluating the effects of this event, it was noted that the independence between the two redundant electrical systems could possibly be compromised at the 120 V ac level. As shown in the enclosed Figure 1, each system has two vital.120 V ac buses and one non-vital bus.
One vital bus of each system is fed automatically, upon loss of the normal source, from a dc/ac inverter for which the source of de is the l-balance of the plant battery (referred as the turbine battery). The other vital bus of each system is fed automatically from the non-vital bus upon the loss.of the normal supply.
Each non-vital bus can also be supplied L
from the same dc/ac inverter connected to the balance of the plant battery and used as mentioned before as an automatic alternate source l
for one of the vital buses.
Thus, the design provisions to assure continuity of power to the vital buses from the common balance of the plant battery could also result in the compromising of the required independence between redundar.t electrical systens.
i
~
a 8-It is our concern that a single event affecting the non-safety related
^
balance of the plant battery could degrade the battery and/or its associated equipment to a point _that could affect the operability of sufficient vital buses in both systems resulting in the loss of 'protec-tive function when required.
ctuation Power Source ~ to the Main Steam Line Isolation Valves
't The sequence of events indicated that the main steam line isolation valves i
closed upon restoration of de power ta system A.
There are two main steam lines each provided with an isolation valve. These two main steam isolation valves should be mechanically and electrically independent of ~
each other. However, the loss of one of the two redundant de systems f
and subsequent restoration of it have caused the closure of both supposedly l
l electrically independent main steam line isolation valves.
It is our concern that a single failure in the power connections to these valves may result in the loss of capability to perform their intended safety function during a steam line break accident or to maintain at least one of the two steam generators as a heat sink to remove reactor decay and sensible heat.
L References l
1.
Report on the Rev.ctor Trip of Unit 2 on January 2, 1981 dated January 20, 1981. Prepared by Northeast Utilities.
2.
Preliminary Notification of Event -- PNO-I-81-01, January 2,1981.
Subject, Loss of 125 Volt Vital D.C. Bus and Reactor Trip. Facility, Millstone Unit 2.
l 3.
Report on the Sequence of Events, January 2,1981. Reactor Trip of Hillstone Nuclear Power Station.
/
~
~~
- ~
- - 4.. Draft Evaluation of Electrical Problems Associated with the
- Millstone 2 Events of January 2,1981 and January 6,1981.
Prepared by the Chemical, Electrical and Instrumentation Section.
Division of Resident and Regional Reactor Inspection,- Office of Inspection and Enforcement..
. 5.'
Chapter 8.0 of the FSAR for Millstone Unit 2.
6 9
e l
l I
t i
h4^*W-m-me mean g
a*>W--yy-vf gg%-.%,ep repg..y.,
ewgr.ia
-c4,yy9gwg
-y eg
<qp e-a s
.p
- m. g g g aw-gy we.gyg,.-pyg w-em-g 9
9.-
v.wgg9 wen
.gr.f e9 e,-g-e,wp -
-y+e%,u.,-e+g d,--g-mwypym yy -M
~
~ T.
_~
?~_ 1 :_
~
^
1_
l Encfosure 3-4 LOSS OF D.C. BUS AT MILLSTONE 2 REQUEST FOR ADDITIONAL INFORMATION-1.
Provide the results of an analysis that demonstrates the capability i
=of the design.against the requirements of'GDC 17 as discussed in.
This analysis can be made~part of the long term.
corrective action that'NNECO proposed regarding this event, as I
documented in a letter dated January 20, 1981.
2.
Insufficient information is available to determine whether the de power feed to the close and trip circuits associated with the breakers through which offsite power is supplied to the emerpency buses are-independent.
It is our concern that a single 1
-failure in the de power feed to these breakers may result in the -
loss of capability.to open the breakers when required and thus, prevent the emergency power supplies from being connected to these buses. This will result in a station blackout. Verify that this.
is not the case and provide the' results of such a verification.
-3.
Examine the design of the diesel generato'rs and either demonstrate
~
that tripping a running generator during abnormal and accident conditions is accep, table upon restoration of dc power or modify
- the present design to prevent this occurrence from happening.
The design modifications must satisfy the positions set forth in BTP ICSB (PSB) 17.
4.
Confirm that the Millstone 2 design includes the capability fer the automatic reinstatement of the undervoltage load shedding feature at the 4.16 Ky emergency bus level. Submit a typical
. electrical elemenetary diagram that depicts the undervoltage load shedding feature inclusion in the control circuits of a 416 Ky safety related load.
5.
If the automatic reinstatement of the load shedding feature is included in the design, explain why the load shed signal associated with system B diesel generator was overridden as indicated in the sequence of events prepared by NNECO.
6.
State whether any safety loads were automatically sequenced to l
system B diesel generator.
Identify these loads, if any.
f 7.
Explain the reasons why no evaluation or test was performed to i
demonstrate that the capability of the safety related instrumen-L tation loops connected to the vital 120 V ac buses and associated l
battery chargers and. inverters in system B have not been degraded below an unacceptable level as a result of this underfrequency event, even though blown fuses wre not found.
l l
l
?-.
N -.. n... -,..,~,..,.,.--L-...---...
.,..-.-r.._
2-
-8.
Examine the design and recommend modifications (including Technical Specification changes) that will preclude supplying either manually or automatically vital buses in supposedly independent systems from a single non-safety related balance of the plant battery at the same time.
9.
Review the design and verify whether the electrical and air' aspects
~
of it for each main steam line isolatfori valve are independent from those associated with its redundant cNnterpart.
If they are not, the licensee must either demonstrate *; hat the safety consequences of an electrical or i.ir related failur6 disabling both valves are acceptable, or modify the design accordingly. Support the justiff-l cation of the design with a simplified functional diagram showing the electrical and air interfaces for the main steam line isolation i
valves.
/
4 e
g aw 6 en mgis
-m e w-
-*4-
-h
- DER **M**
"* 6 e
er W -y w
v g--*rr
+ry g yya p
-w-yw,,-g iu ya +
y=
gw--g,9 s,.
-n-vg-.g.,,yy-m
,e-w w gmV v-
--y-er*,Pv r we y-+-.-we--7-u-g y -,
-,e,,,-,
y y y-my-M+e.