ML20009H339

Forwards Request for Addl Info Re Power Sys.Info Should Be Provided by 811001

ML20009H339
Person / Time
Site:	Perry
Issue date:	07/22/1981
From:	Tedesco R Office of Nuclear Reactor Regulation
To:	Davidson D CLEVELAND ELECTRIC ILLUMINATING CO.
References
NUDOCS 8108070278
Download: ML20009H339 (55)

Text

"

i. Ij 4

DISTRIBUTION:

l

~

DocketFile(2)

LBf2 Fil.e

'JUL 2 2 19 gy Attorney, OELD DEisenhut/RPurple Docket Nos. 50-440 RTedesco and 50-441 ASchwencer DHouston MService l

I&E(3)

Mr. Dalwyn R. Davidson NTrehan Vice President - Engineering RGiardina l

Cleveland Electric Illuminating Company l

P. O. Box 5000 BCCS:

l Cleveland, Ohio 44101 Local P_DR TIC l

NRC'P_DR2 ACRS (16)

Dear Mr. Davidson:

NSIC

. TERA

SUBJECT:

REQUEST FOR ADDITIONAL INFORMATION - POWER SYSTEMS In the performance of the Perry licensing review, the staff-has identified concerns in regard to power systems. The information that we require is identified in the enclosure. These questions concern Chapters 8, 9 and 10 of the FSAR and were generated by the staff's consultant. The staff has indicated that they will have additional questions on Chapter 8 to submit by the end of July.

We request that you' provide the infomation not later than October 1.1981.

If you require any clarification of this request, please contact M. D. Houston, Project Manager, (301) 492-8593.

Sincerely,

% '4med W l~ % :,,aa Robert L. Tedesco, Assistant Director for Licensing Division of Licensing

Enclosure:

Request for Additional f.g.

W A

Information

@W -

J f,.f\\Mg h 2.

cc w/ enclosure:

See next page

{

JUL29 80 u

p

-3 g u.s.gssson

%v 9

8109070278 810722' PDR ADOCK 05000440 A

PDR

/1 g D

B#2, DL:L DL:fA

..L

.......N orncap

- - - - - -.~..

- - -. - - - ~ ~.

-.... - - -. ~. - - -

,f

...... ~

.........'.aa-a-RLTe sco

.D..........t.o 6 p h.,AS c...w..e.n SURNAMEh

.~.a..-..~...-

... -a-aa-aa a

~ ~ " ~ ~ ~ ~ * * * " " " *

.u....

1./...#4... 401 7L. tr../.81... ZL.QAd.8.1..

om,

........... ~.........

OFFIClAL RECORD COPY usopo:isei-es see Nac ronu sia (10-80) NRCu CNQ

e Mr. Dalwyn R. Davidson Vice President, Engineering The Cleveland Electric Illuminating Company P. O. Box 5000 Cleveland, Ohio 44101 cc: Gerald Charnoff Esq.

Shaw, Pittman, Potts & Trowbridge 1800 M Street, N. W.

Washington, D. C.

20036 Donald H. Hauser, Esq.

Cleveland Electric Illuminating Company P. O. Box 5000 Cleveland, Ohio 44101 U. S. Nuclear Regulatory Commission Resident Inspector's Office Parmly at Center Road Perry, Ohio 44081 Donald T. Ezzone. Esq.

Assistant Prosecuting Attorney 105 Main Street Lake County Administration Center Painesville, Ohio 44077 Tod J. Kenney 228 South College Apt. A Bowling Green, Ohio 43402 Daniel D. Wilt Wegman, Hesiler & Vanderberg 7301 Chippewa Road, Suite 102 Brectsville, Ohio 44141 4

Jeff Alexander 920 Wilimington Ave.

Dayton, Ohio 45420 Terry Lodge, Esq.

915 Spitzer Building 1

Toledo, OH 43604 l

f

9 REQUEST FOR ADDITIONAL INFORMATION~

PERRY UNITS 1 AND 2 DOCKET NUMBERS 50-440 AND 441 NOTE: Unless otherwise specified in the question, questions pertaining to the diesel generators and their auxiliary systems apply to both the emergency standby diesel generators and the HPCS diesel generator.

430.6 Operating experience at certain nuclear power plants which have two (8.3) 4 RSP '

cycle turbocharged diesel engines annufactured by the Electromotive Division (EMD) of General Motors driving emergency generators have experienced a significant number of turbocharger sechanical gear drive failures. The failures have occurred as the result of running the emergency diesel. generators at no load or light load conditions for l

extended periods. No load or light load operation could occur during periodic equipment testing or during accident conditions with availability of offsite power, ilhan this equipment is operated under no load conditions i

j insufficient exhaust gas volume is generated to operate the turttacharger.

j As a result the turbocharger is driven sechanically from a gear drive in i

(

order to supply enough combuston air to the engine to maintain rated speed. The turbocha:ser and mechanical drive gear no-mally supplied with

~,---

l these engines are not dasigned fer standby service encountered in nuclear power plant application where the equipment may be called upon to operate

.l I

at no load or-light load conattion and full rated speed for a prolonged period. The EMD equipeent was originally designed for locomotive service l

where no load speeds for the engine and generator are auch lower than full load speeds. The locomotive turbocharged diesel hardly ever runs at full speed except at full load. ~The EMD has strongly recommended to users 1

r of this diesel engine design against operation at no load or light load i

conditions at full rated speed for extended periods because of the short l

life expectancy of the turbocharger mechanical gear drive unit nonna11y 4

i..

?

furntshed. No loa'd or Itght load operatton also causes. general deterioration in any diesel ' engine.'

To cope with the severe servica'the equipment is'nonnally subjected to and l

fn the inta:est of reducing failures and t.tcreasing the availability of j

their equipment EMD has developed a heavy duty turbocharger drive gear This is available as a unit that can replace ~ existing equipment.

1 replacement kit, or engines can be ordered with the heavy duty turbo-i charger drive gear assembTy.

l To assure optimum availability of emergency diesel generators on de:nand, l

Applicant's who have in place, on order or intend to order emergency generators l

\\

1 driven by two cycle diesel engines manufactured by EMD should be provided j

l

(

with the heavy duty turbocharger mechantcal drive gear assembly as i

j recomerided by EMD fbr the class of service encountered in nuclear power i

plants. Confira your contp1f ance with this requirement for your HPCS J

l diesel generator.

i

~

^

_ ~-

l i

i j

i i

f' I

i

1 l

430.7 Provide a detati discussion (or plan) of the level of traint,ng proposed (8.3) i for your operators, maintenance' crew, quality assurance', and supervisory personnel responsible fbr the operation and maintenance of the amargency i

diesel generators. Identify the number and type of personnel that will

^

be dedicated to the operations and maintenance of the emergency diesel 1

generators and the number and type that will be assigned from.your general plant operations and natntenance groups to assist when needed.

In your discussion identify the amount and kind of training that will be I

received by each of the above categories and the type of ongoing training program planned to assure optimum availabtitty of the emergency generators.

~

i l

Also discuss the level of education and nintmum experience requirements fbr the various categories of operations and maintenance personnel associated with the emergincy. diesel generators.

~

1 1

I f

f I

I

r

_4_

430.8 Fartodic testing and test loading of an emersency diesel generator.

(8.3) nSP in a nucient power plant. is a necessary function to' demonstrate the operability, capability and availaht1 tty of the unit on demand. Pertodic

)

testing'co'upled with, good preventive maintenance'practtees will assure optimum equipment readiness ar.d availabtitty on demand. This is the desired goal.

To achieve this optimum equipment readiness status the the following j

requirements should be met:

j

\\

1.

The equipment should be tested with a etntmum loading of 25 percent

(

of rated load. No load or 1.tght load operttion will cause incomplete combustion of fuel resulting in the formation of gum and varnish deposits on the cylinder walls, intake and exhaust valves, pistons j

and piston rings, etc., and accumulation of unburned fuel in the

~

turbocharger and exhaust system. The consequences of no load or light load operation are potential equipment fatlure due to the gum and varnish depostts and fire in the engine 2xhaust system.

i 2

Periodic surveillance testing should be perfonned in accordance with the appitcable NRC guidelines (R.g.1.108), and with the recomendations of the engine si.nufacturer. Confitets between any such recomendations and the NRC guidelines, particularly with respect to test frequency, loading and duration, should be identifled and justifled, g.

• -=

.*h.

1 e

d '. :, '

(

3.

Preventive mintenince'should..go beyond the normal routine adjust-ments, servicing and repair $f' components when'a malfunction occurs.

I Preventive maintenance'sho'ld encompass investigative testi.ng of u

i components which have a history of repeated malfunction 1.n2 and i

]

require c6nstant attention and repair. In such cases consideration 1

should'be 'giv'en to replacement of those components with otner products which have a record Sf demonstrated reliability, rather than q

repetitive repair and maintenince'of the existing components." Testing of the unit after' adjustments or repai::: have been made only confirms j

that the equipment is operable anddoes not necessarily meangthat the l

root cause of the protles has, wen eliminated or alleviated.

q

~

4 Upon completion of repairs or maintenance and prior to an actual start, run, and ' load test a final equipment check shculd be made to

~

assure that all electrical circuits are functional, i.e., fuses are in place, switches and circuit breakers are in their proper position, no

^~~

i I

loose wires, all test leads have been removed, and all valves are in.

the proper position to pennit a manual start of the equipment. After.

l the unit has been satisfactorily started and load tested, return the l

unit to ready automatic standby service and under the centrol of the r

4 control room operator.

Provide a discussion of how the above requirements have been implemented l

in the emergency diesel generator system design and how they will be considered when the plant is in comercial operation, i.e., by what means i

)

will the above requirements be enforced.

e w--

-y-

(_

~

430.9 The availability on demand of,an emergency diesel. gt:.wrator is (8.3)

RSP dependent upon, among other things, the proper functioetng of its controls and monttoring instrumentation. This equipment is. generally panel mounted and in sort instances the panels are pounted directly

~

on the diesel, generator sktd. Major diesel engine damage has occurred at some operating plants from vibratton induced wear on skid mounted contml and monttoring instrumentation [ This sensitive instrumentation l

1s not made to withstand and function accurately for prolonged periods under continuous vibrational st[ esses'normally encountered with internal combustion engines. Operatton of senstive instrumentation unde { this environment rapidly deteriorates calibration, accuracy and control r

{y s.ignal output, j

Therefore, except for sensors and other equipment that must 2e directly 1

j mounted on the engine or associated piping, the controlc and monitoring instrumentation should be installed on a free standing floor mounted panel separate from the engine skids, and located on a vibration free 4

floor area. If the floor is 'not vibration free, the panel shall be equipped'

'th vibration mounts.

i Confiru your compliance with the above requirement or provide justification a

j for noncompitance.

... / ~.

.J f

(

f

,=

7 i

430.10 The information regarding the ansita ceumunications system (Section

(:.J.2) 9.5.2) does not" adequately cover the system capabilities during transients and a'ccidents. Provide the following information:

(a) Identify all working stations on the plant site where it may l

be necessary for,, plant personnel to comunicata with the control room or the amiergency shutdown panel during and/or following transients and/or accidents (including fires) in order to mitigate the consequences of the event and to attain a safe cold plant shutdown.

(b) indicate the maximum sound levels that could exist at each of the above identified working statfor.s for all transients 4

and accident conditions.

3 (c) Indicate the types of ccer.iunication systams available at each of the above identified working stations.

i (d) Indicate the maximus background noise level that could exist at each working station and yet reliably expect effective comunication with the control roca using:

1.

the page party comunications systems, and 2.

any other additional ccuraunication system provided that working station..

e g g.

y' s@@

ge 4

e

.s.

('e) Describe tN pe'rformance requirements and tests that the above onsite working stations connunication systams will be required to pass in order to be assured that effective

~

communica' tion with the control room or emergang shutdown panel is possib1$ under all, conditions.

(f) Identify and describe the power source (s) provided for each

~

of the cceaunications systans.

(g) Discuss the protective measures taken to assure a functionally operable onsite comunication system. The discussion should i

include the considerations given to ecmponent failurer, loss of power, and the severing of a comunication line or trunk as a result of an accident or fire.

i I

1 i

s I

430.11 Identify the vital areas and hazardous areas where emergency lighting (9.5.3) is needed for safe shutdown of the reactor and the evacuation of personnel in the event of an accident. Tabulate the lighting system provided in your design to acconnodate those areas so identified.

Include the oegree of compliance to Standard Review Plan 9.5.1 regarding emergency lighting requirements in the event of a fire.

430.12 You state in Section 9.5.9 "High Pressure Core Spray Diesel Generator" (9.5.4)

(9.5.5) that the descriptions for the auxiliary systems (fuel oil, cooling water, 9.5.6) 9.5.7) lubrication and air starting) are contained in Reference 1 and/or 3 of 9.5.8) l9.5.9)

Section 9.5.11

" Fire Protection Evaluation Report" and NED0-10905 "HPCS System Power Supply" respectively. Reference 1 does not provide any descriptive information and Reference 3 provides only a brief general description witc no specific details on how the air starting, lubricating oil and fuel oil systems operate or the system design characteristics.

No description is provided for the cooling water and combustion air intake

~

l and exhaust systems. An adequate review of the HPCS diesel engine cannot j

be performed without this information.

i I

l l

1 w

. 430.13 Describe the instruments, controls, sen: ors and alarms provided for (9.5.4) monitoring the diasel engine fuel oil storage and transfer system and describe their function. Discuss the testing necessary to main-tain and assure a highly reliable instnseentat10.7. controls, sensors and alam system and where the alams are ar.aunciated. Identify the tempereture, pressure and level sensors which alert tra operator when these parameters are exceed the ranges reconnended by the engine manufacturer and describe what operator actions are required during af am conditions to prevent harmful effects to the diesel engine.

Discuss the sy: tan interlocks previded. (SRP 9.5.4, Part III, i tmo l').

~

1 The diesel generator structures are designed to seismic and j

430.14 (9.5.4) tornado criteria and are isolated from one another by a reinforced Describe the barrier (including openings) concrete wall barrier.

in more detail ar.d its capability to withstand the effects of o

internally gena. rated missiles resulting from a crankcase explosion.

i failure of one or all of the starting air receivers, or failure of any high or moderate energy line and initial flooding from the l

cooling system so that the assumed effects will not result in loss (SRP 9.5.4, Pa m I*!, Item 2).

of an additional generstor.

i

e 430.15 You state in Section 9.5.4.3 and in Figure 9.5.8 that the diesel fuel oil (9.5.4)

(RSP) storage and transfer system vents, overflows, fill, dipstick, and water removal lines are non safety lines, and are therefore non-seismic. A seismic event or a tornado missile with or without a single active failure would cause degradation of the fuel oil due to water entering the system or potential loss of fuel due to tank overflow. We require that these lines be design seismic Category I, ASME.Section III Class 3, and be protected from tornado missiles, Comply with this position.

430.16 In section 9.5.4.3 you state that corrosion protection for the tanks (9.5.4) and piping will include providing a corrosion allowance as well as external coatings. This statement is unacceptable. Expand the FSAR to include a more explicit description of proposed protection of under-ground piping. Where corrosion protective coatings are being considered (piping and tanks) include the industry standards which will be used in their application. Also diccuss what provisions will be made in the design of the fuel oil storage and transfar system storage tanks in the use of internal corrosion protection, in addition to external water proof protective coatings.

(SRP 9.5.4, Part II and Part III, item 4).

h 9

. 430.17 The FSAR text and Table 3.21 states that the components and piping systems (3.2)

(9.5.5) for the diesel generator auxiltaries (fuel oil system, cooling water, 9.5.4)

(

(9.5.6) lubrication; air starting, and intake and combustion system) that are mounted (9.5.7)

(9.5.8) on the auxiliary skids are designed seismic Category I and are ASME Section III Classu3 qual.ity. The engine mounted components,and piping are designed and manufactured to OEMA standards, and are seismic Category I.

This is not in accordance with Regulatory Guide 1,26 which requires the entire diesel generator puxiliary systems be designed to 'SME Section III Class 3 or A

Quality Group C.

Provide the industry standards that were used in the k

design, manufacture, and inspection of the engine mounted piping and components. Also show on the appropriate P&ID's where the Quality Group i

Classification changes from Quality Group C.

i 430.18 In Section 9.5.4.1 you state that diesel fuel oil is available from local

~

(9.5.4) distribution sources in the Cleveland area.

Identify the sources where diesel quality fuel oil will be available and the distances required to be travelled from the source (s) to the plant. Also discuss how fuel oil will be delivered onsite under extremely unfavorable environmental conditions.

(SRP 9.5.4, Part III, Item Sb).

430.19 Of scuss what precautions have been taken in the design of the fuel (9.5.4) oil system in locating the fuel oil day tank and connecting fuel oil piping in the diesel generator room with regard to possible exposure to ignition sources such as open flames and hot surfaces.

(SRP 9.5.4, Part III, Itan 6).

. 430.20 Section 1.8 and 9.5.4.1 " Emergency Diesel Engine Fuel Oil Storaga and (9.5.4)

Transfer System (EDEFSS)" references ANSI Standard N195 "/uel Oil Systems for Standby Diesel Generators" and Regulatory Guide 1.137 " Fuel Oil Systems for Standby Diesel Generators" with certain exceptions. Adequate justification for items la, 2a, 2b and 2c in Section 1.8 regarding conformance to Regulatory Guide 1.137 is not provided. Provide your justification for the above or comply with those positions in Regulatory Guide 1.137.

4 430.21 Discuss the precautionary measures that will be taken to assure the quality (9.5.4 )

and reliability of the fuel oil supply for emergency diesel generator operation.

Include the type of fuel oil, impurity and quality limitations as well as diesel index number or its equivalt.'t, cloud point, entrained moisture, sulfur, parti-culate:. and ot%r deltterious insoluble substances; procedure for testing newly delivered fuel, periodic sampling and testing of on-site fuel oil (including

}

interval between tests), interYal of time between periodic removal of Conden-sate fmm fuel tants and periodic systam. inspection. In your discussion in-wi-

5---

clude reference to industry (or other) standard which will be followed to

)

assure a mitable fuel oil supply to the amargency generators. (SRP9.5.4, Part III, items 3 and 4).

l 6

l i

, 430.22 Discuss the design considerations that have detemined the physical location (9.5.4) of the diesel engine fuel oil day tanks at your facility. Assure that the selected physical location of the fuel oil day tanks meet the requirements of the diesel engine manufacturers.

(SRP 9.54, Part III, item 5(c).)

430.23 Assume an unlikely event has occurred requiring operation of a diesel (9.5.4) generator for a prolonged period that would require replenishment of fuel oil without interrupting operation of the diesel generator. What provision will be made in the design of the fuel oil storage fill system to minimize the creation of turbu'ence of the sediment in the bottom of the storage tank.

Stirring of this sed ment during addition of new fuel has the potential of causing the overall quality of the fuel to become unacceptable and could potentially lead to the degradation or failure of the diesel generator.

~

430.24 Provide the source of power for the fuel oil storage tank motor driven (9.5.4) fuel oil transfer pumps and diesel engine motor driven fuel oil booster pump and the motor characteristics, i.e., motor hp., operating voltage, phase (s) and frequency. Also include pump capacity and discharge head.

.~

Revise the FSAR accordingly.

4 430.25 Expand your description of the diesel engine fuel oil system. The FSAR (9.5.7) text should include a detail system description of what is shown on figures 9.5-8 and 9.5-15.

The FSAR text should also describe; l) component:

and their function, and 2) a diesel generator starting sequence for a normal start and a emergency start. Revise your FSAR accordingly.

430.26 Section 9.5.5 indicates that the function of the diesel generator cooli.g (9.5.5) water system is to dissipate the heat transferred through the: 1) engine water jacket, 2) lube oil cooler, and 3) engine air water coolers. Provide information on the individual component heat removal rates (but/hr), flow (1bs/hr) and temperature differential (O ) t.nd the total heat removal rate F

required. Also provide the design margin (excess heat removal capacity) included in the design of major components and subsystems.

(SRP 9.5.5, PartIII, Item 1).

430.27 Expand your description of the diesel engine cooling 1:ater system. The (9.5.7)

FSAR text should include a detail system description of what is shown on figures 9.5-9 and 9.5-16.

The FSAR text should also describe; 1) components and their function, and 2) a diesel generator starting sequence for a normal start and a emergency start. Revise your FSAR accordingly.

430.28 Indicate the measures to preclude long-tenn corrosion and organic fouling (9.5.5) in the diesel engine cooling water system that would degrade system cooling performance, and the compatability of any corrosion inhibitors or antifreeze compounds used with the materials of the system.

Indicate if the water chemistry is in conformance with the engine manufacturers recommendations.

(SRP 9.5.5, Part III, Item Ic.)

4

- 16 Describe the instrumentation, t.ontrols, sensors and alams provided 1

1 430.29 (9.5.5) for monitoring of the diesel ergine cooling water system and describe their function. Discuss the testing necessary to maintain and assure a highly reliable instroentation, conprols, sensors, and alam sys-tam, and where the alams rare annunciated. Identify the temperature,

.i pressure, level, and flow (where applicable) sensors which alert the operator when these parameters exceed the ranges reconsnended by the engine manufacturer and describe what operator actions art required during alam conditions to prevent hamful effects to the diesel en-gine. Discuss the systans interlocks provided. (sri 8 9.5.5 Part III,itanIc).

i 430.30 Describe the provisions made in the design of the diesel engine j

(9.5.5) cooling water system to assure that all components and piping are l

filled with water. (SRP 9.5.5. Part III Item 2).

4 The diesel, generators are required.to start automatically on loss of 430.31 (9.5.5) all offsite power and in the event of a LOCA. The diesel generator i

sets should 'e capable of operatton at less than full load fer extended u

Should a periods without degradition of perfomance or reliabtitty.

i LOCA occur with availabiltty of offsite power, discuss the design l

provistons and other parameters that have been considered in the selection of the diesel generators to enable them to run unloaded (on standby) for extended periods without degradation of engine perfomance or reliability.

Expand your PSAR/FSAR to include and expttettly define the capability of your de*.t;n with regard to this requirement. (SRP 9.5.5, Part III Item 7).

l I

430.3?

The diesel engine cooling water systen (9.5.5) is provided with an expansion tank to provide for system expansion and for venting air from the systas. In addition to the items leaks mentioned, the expansion tank is to provide for minor system at pump ihafts seals, valve stems and other components, and to Provide maintain required NPSH on the system cirmlating pump.

the size of the expansion tank and location. Demonstrate by analysis that the expansion tank size will be adequate to maintain required pump NPSH and make up watc? for saven days continuous operation of the diesel engine,at full rated load without makeup, or provide

~

1 a seismic Category I, safety class 3 make up water supply to the ex-panston tank.

430.33 Provide the source of power for the diesel engine motor driven (9.5.5)

Pro-jacket water keep wann pump and electric jacket water heater.

i vide the motor and electric heater characteristics, i.e., motor hp.,

l operating voltage, phase (s), frequency and kw output as applicable.

~,--.

Also include the pump capacity and discharge head. Revise the FSAR accordingly.

430.34 Figure 9.5-16 shows an innersion heater in the diesel engine cooling (9.5.5) water system attached directly to the lube ci cooler; and to the l

i engine driven pumps' suction and discharge lines. The FSAR in sect cn 9.5.9 dces not provide a detailed description of how the diesel ergine cooling water system operates during standby conditions nor dces the design of this system seem to provide for preheating of the jacket water to enhance engine start capability. Provide a detailed description of hcw the diesel t..gine cooling water system operates on standby conditions, j

J

• WW 4

18 -

430.35 Provide a discussion of the seasures that have been' tak.en in the design (9.5.6) of the standby diesel generator air starting system,to preclude the fouling of the air start valve or filter with moisture and contaminants i

such as oil carryover and nst.- (SRP 9.5.6, Part III, item 1).

E 4

a 430.36 Describe the instrumantation, controls, sensors and alarms pro-(9.5.5) vided for monitoring the diesel engine air starting system, and describe their function. Describe the testing necessary to asin-tain a highly reif able instrtmentation, control, sensors and alam system and where the alams are annunciated. Identify the j

tamperature, pressure and leval sensors which alert the operator when these parameters exceed the ranges recommended by the engins j

manufacturer. and describe any operator actions required during 3

alann conditions to prevent harmful effects to the diesel engine.

Discuss systam interlocks provided. Revise your FSAR accordingly.

~

4 (SRP 9.5.6 Part III, itas 1).

1 i.

i 430.37 Ycu state in Section 9.5.11 (Reference 3) that each HPCS diesel engine (9.5.6)

RSP is provided with two independant air starting systems eaca with its own air receiver tank.

au aise < tate that this air start system has i

sufficient capacity for three successful starts. This is not acceptable.

4 We require, as a minimum, che air start'ing system for each MPCS diesel l

f generator snould be capable of cranking a cold diesel engine five times without the use of the air compressor. Revise your design accordingly.

(SRP 9.5.6, Part III, item 9b).

J d

-,s

• s

• I 430.38 Expand your description of the diesel engine starting system. The l

(9.5.6)

FSAR text shcald provide a detail system description of what is shown on figures 9.5-10 and 4.1 of Reference 3 of FSAR Section 9.5.11.

The FSAR text should also describe: 1) components and their function, and 2) a diesel engine starting sequence. In describing the diesel engine starting sequence include the number of air start valves used and whether one or both air start systems ara used.

430.39 A study by the University of Dayton has shown that accumulation of 2

(9.5.6) water in the starting air system has been one of the most frequent RSP 1

j causes of diesel engine failure to start on demand. Condensation of entrained moisture in compressed air lines leading to control and 1

l starting air valves, air start motors, and condensation of moisture on the working surfaces of these components has caused rust, scale and water itself to build up and score and jam the internal working i

j parts of these vital components thereby preventing starting of the j

diesel generators.

1 In the event of loss of offsite power the die:t? generators must function since they are vital to the safe shutdown of the reactor (s). Failure of the diesel engines to start from the effects of moisture condensation in a

i air starting systems and from other causes have lowered their operational reliability to substantially less than the desired reliability of 0.99 as specified in Branch Technical Position ICSB (PSB) 2 " Diesel Generator Reliability Testing" and Regulatory eJida 1.108 " Periodic Testing of i

Diesel Generator Units Used as Onsite Electric Power Systems at Nuclear i

l Power Plants."

i

)

s

o In an effort toward improving diesel engine starting reliability we require 1

that compressed air starting system designs include air dryers for the removal of entrained moisture.iThe two air dryers most cosamnly used are the dessicant and refrigerant types. Of,these two types, the refaf gerant

~

4 type is the one most suited fo this appitcation and therefore is pre-8 Starting air should be dried to a dew point of not more than 50 F ferred.

when inetalled in a nomally controlled 700F enytronment, otherwise the starting air dew point should be controlled to at least 100F less than the lowest expected ambient temperature.

1 Revise your design of the HPCS diesel engine air starting system accordingly, describe this feature of your design.

?

I i

1 l

I i

s.

.I Ei) v. C..

1 430.40 For the diesel engine lubrii:ation sistem in Section 9.5.7 provide the (9.5.7) following information: 1) define the temperature differentials, flow rate, and heat removal rate of the interface (ooling system external to o

the engine and verify that' these are in accorcance with reconmendations of the engine manufacturer; 2) discuss the measures that will be taken j

to maintain the required quality of the oil, including the inspection and a

3 replacement when oil quality is degraded; 3) describe the protective i

features (such as blowout panels) provided to prevent unacceptable crankcase explosion and to mitigat'e.the consequences of such an event; and 4) describe the capability for detection and control of system leakage.

(SRP 9.5.7, Part 11. Items Sa, 86, 8c, Part III, Item 1.)

430.41 What measures have been taken to prevent entry of delitarious (9.5.7) mate.1als into the engine lubrication oil system due to operator i

er or during recharging of lubricating oil or ncrmal operation.

4 (SRP 9.5.7, Part III, Item 1c).

4 Describe the instrtmentation, conbb, sensors and alams pro-430.42 (9.5,7) vided for monitoring the diesel engine lubrication oil system

_ m_

j and describe their function. Describe the testing necessary to maintain a highly _ reliable instrwentation, control, sensors and l

alam system and where the alams are annuniciated. Identify the temperature, pressure and level sensors which alert the operator when these parameters exceed the ranges recomended by j

the engine r.anufacturer and describe any operator action required during alarm conditions to prevent harmful effects to the diesel engir.e. Discuss systens inter 10cks pre ided. R afse your FSAR accordingly. (SRP 9.5.7 Part III, itam le).

\\..

4 4 430.43 Expand your description of the diesel engine lube oil system. The FSAR (9.5.7) text should include a detail system description of what is shown in figures 9.5.11, and 4.4 of Reference 3 of section 9.5.11. The FSAR text should also describe; 1) components and their function, and 2) a diesel generator starting sequence for a nomal start and a emergency start and standby operations. Revise your FSAR accordingly.

t 430.44 Provide the source of power for the diesel engine prelube and keep warm (9.5.7) oil pump, and motor characteristics, i.e., motor hp, oparating voltage, 4

phase (s) and frequency. Also provide the pump capacity and discharge head. Revise your FSAR accordingly.

I 430.45 Sever:1 fires have occurred at some operating plants in the area of (9.5.7)

RSP the diesel engine exhaust manifold and instde the turbocharger housing which have resulted in equipment unavailability. The fires were started from lube oil leaking and accumulating on the engine exhaust manifold and accumulating and,tgniting inside the turbocharger housing.

Accumulation of lube oil in these areas, on some engines, is apparently l

2 caused from an axcessively long prelube pertod, generally longer than 1

five minutes, prior to manual starting of a diesel generator. This condition does not occur on an emergency start since the prelube period is minimal.

k When manually starting the diesel generators for any reason, to minimize l

the potential fire hazard and to improve equipment availabiltty, the prelube period should be limited to a maximum of three to five minutes unless otherwise recomended by the diesel engine manufacturer. Confirm l

i

_-,n

.. i i

your compliance with this requirement for the HPCS diesel generator or 4

provide your justification for requiring a longer prelube time interval prior to manual starting of the diesel generators. Provide the prelube time interval your diesel engine will be exposed to prior to manual start.

4 430.a6 An emergency diesel, generator untt in a nuclear power plant is normally (9.5.7)

RSP in the ready standby mode unless there is a loss of offstte power, an j

accident, or the diesel, generator is under test. Long periods on standby i

have a tendency to dratn or nearly empty the engine lube oil piping,

system. On an emergency start of the engine as much as 5 to 14 or mort

{

seconds may elapse frem the start of crankt.ng until full lube oil pressure is attained even though full engine speed is generally reached in about i

five seconds. With an essentially dry engine, the momentary lack of 7

lubrication at the various soving parts may damage bearing surfaces pro-ducing inciptent or actual component failure with resultant equipment

~

unavailability.

^ -

l The emergency cond'ition of readiness requires this equipment to attain i

j full rated speed and enable automatte sequencing of electric load within j

ten seconds. For this reason, and to improve upon the availabiltty of this equipment on demand, it is necessary to establish as quickly as possible j

an oil film in the wearing parts of the diesel engine. Lubricating oil is nonna11y delivered to the engine wearing parts by one or more engine driven j

pump (s). During the starting cycle the pump (s) accelerates slowly with the engine and may not supply the required quantity of lubricating oil where needed fast enough. To reedy this condition, as a etntmum, an electrically i

driven lubricating oil pump, powered from a relf able DC power supply, should be installed in the lube oil system to operate in parallel with the engine driven main lube pump. The electric drtyen prelube pump should operate onlyduring the engine cranking cycle or antti satt: factory tube oil pressure is established in the engine main lube distribution header.

The installation of this prelube pump should be coordinated with the respective engine manufacturer, Some diesel engines include a lube oil l

ctreulating pump as an tr.tregal part of the lube oil preheating system i

which is in use while the diesel engine is in the standby mode. In this case an' additional prelube oil pump may not be needed, j

Confirm your compliance with the above requirement for the HPCS diesel generator for provide ~ your justification for not installing an electric.

prelube oil pump.

i 430.47 Describe the instrumentation., controls, sensors and alarms pmvided in 4

(9.5.8) the design of the diesel engine combustion air intake and exhaust system which alert the operator when parameters exceed ranges recommended by

[

the engine manufacturer and describe any operator action required during i

alarm conditions to prevent harmful effects to the diesel engine.

Discuss systems interlocks provided. Revise your FSAR accordingly, (SRP 9.5.8, Part III, item 1 & 4).

i i

)

j i

1 l

, 430.48 You state in section 9.5.8.3 that "there is no storage of gases in the (9.5.8) imediate vicinity of the air intakes, accidental release of these gases could affect the minimum quantity and oxygen content requirements for intake combustion air." This statement is contradictory.

If there are gases stored on site whose accidental release could cause degradation of diesel generator operation. Respond to the following. Provide the results of an analysis that demonstrates that the function of your diesel engine air intake and exhaust system design will not be degraded to an extent which prevents developing full engine rated power or cause engine shutdown as a consequence of any meteorological or accident condition.

Include in your discussion the potential and effect of fire extinguishing (gaseous) medium, recirculation of diesel combustion products, or other gases that may intentionally or accidentally be released on site, on the performance of the diesel generator.

(SRP 9.5.8, Part III, item 3).

430.49 Show by analysis that a potential fire in the chart storage room or the

~

(9.5.8) diesel generator building together with a single failure of the fire protection system (i.e., fire damper fails to close or CO2 systems fails to operate) will not degrade the quality of the diesel combustion air so that the remaining diesel will be able to provide full rated power.

i

- 430.50 ' Experience at some operating plants has shown that diesel engines have (9.5.8) failed to start due to accumulation of dust and other delttarious material on electrical equipment associated with starting of the diesel generators (e.g., auxiliary relay contacts, control-switches - eter).

Describe the provisions that have been made in your diesel generator building design, electrical starting system, and combustion air and ventilation air intake design (s) to preclude this condition to assure 4

availability of the diesel generator on demand.

Also describe under normal plant operation what procedure (s) will be used to minimize accumulation of dust in the diesel generator room; specifically address concrete dust control. In your response also consider the condition when Unit 1 is in operation and Unit 2 is i

j under construction (abnormal generation of dust).

1 e

i 430.51 Expand your description of the diesel engine combustion intake and (9.6.7) i exhaust system. The FSAR test should include a detail system -

description of what is shown on figures 1.2-5, 1.2-6, 1.2-13, 9.5.12, 9.5.13 and 9.5.14.

The FSAR test should also describe; I

1) components and their function, 2) location of equipment (provide clear drawings), and 3) a diesel generator starting sequence for a normal start and a emergency start. Revise your FSAR accordingly.

4

430.52 Figure 1.2.5 of the Perry FSAR shows the ESF transformers located near (9.5.8) the control / diesel geneator building complex. An ESF transformer fire with the right meteorological conditions could degrade engine operation by the products of combustion being drawn into the D/G ventilation system which supplies D/G combustion air. Discuss the provisions of your design (site characteristics, ventilation system and building des-gn, etc) which preclude this event from occurring.

430.53 You state in section 9.5.8.3 of the FSAR that "If the carbon dioxide (9.5.8) fire extinguishing system is activated for the chart storage room in the control complex, or in a diesel generator room, the fire dampers for the respective room are automatically closed and the area isolated 4

to prevent air, emoke or carbon dioxide from being exhausted. The isolated area wi',1 be cleared of these gases using strict administration controls to ensure that no possibility exists for large concentraticns of gases to be ejected into the atmosphere and be drawn into the diesel generator air intakes." Describe the administrative procedures for

[ _

venting the above areas. Include in the description the venting time duration (the time the dampers are open for venting), frequency, the means used to dilute the vented gases, the design criteria used to determine these values, and any design margins included in the procedures (i.e., vent time durati.:n can be exceeded for X amount of time before combustionairbecomesdegraded,etc.).

1 4

. I 430.54 Provide a general discussion of the criteria and bases of the various (10.1) steam and condensate instrumentation systems in section 10.1 of the FSAR. The FSAR should differentiate between normal operation l

i instrumentation and required safety instrumentation.

l 430.55 Expand your discussion of the turbine speed control and overspeed (10.2) protection system. Provide additional explanation of the turbine l

and generator electrical load following capability for the turbine speed control system with the aid of the system schematics (including turbine control and extraction steam valves to the heaters). Tabulate l

the individual speed control protec3 ion devices (normal emergency and backup) the design speed (or range of speed) at which each device begins operation to performs its protective function (in terms of percent of normal turbine operating speed). In order to evaluate the adequacy of the control and overspeed protection system provide schematics and include identifying numbers to valves and mechanisms (mechanical and electrical) on the schematics. Describe in detail, with references to the identifying numbers, the sequence of events in a turbine trip including response times, and show that the turbine l

stabilizes. Provide the results of a failure mode and effects analysis l

l for the overspeed protection systems. Show that a single steam valve failure cannot disable the turbine overspeed trip from functioning.

(SRP 10.2, Part III, items 1, 2, 3 and 4).

l l

l l

430.56 Provide the closure times for the quick acting extraction steam and (10.2) motor operated stop valves installed in the extraction steam lines to the third, fourth, fifth and sixth point heaters. The first and second point heaters steam supply lines are not provided with shutoff and extraction steam valves. Show that stable turbine operation will result after a turbine trip. (SRP 10.2, Part III, Item 4).

i 430.57 Discuss what protection will be provided the turbine overspeed control (10.2) system equipment, electrical wiring and hydraulic lines from the effects of a high or moderate energy pipe failure so that the ':urbine overspeed protection system will not be damaged to preclude its safety function.

(SRP 10.2, Part III, Item 8).

1

~.

430.58 In section 10.2.3.6 you discuss in-service inspection and exercis-(10.2) ing of the main steam turbine stop and control and reheater stop and intercept valves. You do not discuss the in-service inspection, testing and exercising of the extraction steam valves. Provide a detail description of: 1) the extraction steam valves, and 2) your

~

inservice inspection and tas.ing program for these valves. Also provide the time intenal beaveen periodic valve exercising tc assure the extraction steam valvc3 will close on turbine trip.

I 1

j i

430.59 Provide a complete list of turbine generator protective trips.

(10.2)

Separata these trips into two categories,1) those that will trip the turbine due to mechanical faults, and 2) those that will trip the turbine due to generator electric faults.

i 430.60 DescrThe with the aid of drawings, the bulk hydrogen storage (10.2) i facility including its location and distribution systam. Include 1

the protective measures considered in the design to prevent fires and explosions during operations such as filling and purging tne

~

generator, as weil as during noma'. operations.

1 I

430.61 Provide a tabulation in your FSAR showing the physical characteristics (10.4.1) and perfomance requirements of the main condensers. In your tabulation include such items as; 1) the number of condenser +wbes, 4

material and total heap transfer surface, 2) overall dimensions of the cor. denser 3) nunber of., pauses, 4) hot well capacity.

5) special design features, 6) minimum heat transfer, 7) nomal 7 --

f and maximun steam flows, 8) nomat and maximum cooling water j

temperature, 9) nomal and maxinmm exhaust steam tamperature with no turbine by-pass ficw and with maximun turbine by-pass flow,

10) limiting oxygen content in the condensate in ec per liter, i

and 11) other pertinent data. (SRP 10.4.1, Part III, itam 1).

i

. 430.62 Discuss the effect of main condenser degradation (leakage, vacuum, (10.4.1) loss) on reactor operation. (SRP10.4.1,PartIII, Item 1).

430.63 Indicate and describe the means of detecting and controlling radioactive (10.4.1) leakage into and out of the condenser and the means for processing excessive amounts.

(SRP 10.4.1, Part III, item 2).

430.64 Discuss the measures taken for detecting, controlling and correcting I.

(10.4.1 )

condenser cooling water leakage into the condensate stream.

(SRP 10.4.1, Part III, item 2).

430.65 Provide the permissible cooling water inleakage and time of opera-(10.4.1) tion with inleakage to assure that condensate /feedwater quality can be maintained within safe limits. (SRP 10.4.1, Part III, item 2).

i 430.66 In section 10.4.1.5 you have discussed tests and initial field in-(10.4.1) spection but not the frequency and extent of inservice inspecation i

of the main condenser. Provide this information in the FSAR.

(SRP 10.4.1, Part II).

430.67 Indicate what design provisions have been made to preclude failures (10.4.1) of condenser tubes or components from turbine by-pass blowdown or other high temperature drains into the condenser shell.

(SRP 10.4.1, Part III, item 3).

n

. 430.68 Discuss the effect of loss of main condenser vacuum on reactor operation l

(10.4.1) and operation of the main steam isolation valves (SRP 10.4.1, Part III, item 3).

430.69 Provide additional description (with the aid of drawings) of the turbine (10.4.4) l by-pass valves and associated controls. In your discussion include the number, size, principle of operation, construction, setpoints, and capacity of each valve and the malfunctions and/or modes of failure considered in the design of the turbine by-pass system.

(SRP10.4.4, Part III Item 1).

430.70 Provide the results of an analysis indicating that failure of the (10.4.4) turbine by-pass system high energy line will not have an adverse j

effect or preclude operation of the turbine speed control system.

(SRP 10.4.4, Part III, item 4).

430.71 Provide the results of a failure mode and effects analysis to (10.4.4) determine the effect of malfunction of the turbine by-pass system l

l on the operation of the reactor and main turbine generator unit.

(SRP 10.4.4, Part III, item 4).

430.72 In section 10.4.4.4 you hava discussed tests and initial field l

(10.4.4) l inspection but not the frequency and extent of inservice testing l

and inspection of the turbine by-pass system. Provide this infor-mation in the FSAR.

(SRP10.4.4,PartII).

- 040.73 Incidents have occurred at nuclear power stations that indicate a (7.0, 8.0) deficiency in the elec: Meal control circuitry cesign. These inci-dents included the inadvertent disabling of a component by racking out the circuit breaiters for a different component.

As a result of these occurrences, we request that you perforu a review of the electrical control circuits of all safety. elated equipment at the plant, so as to assure that disa01ing of one comoonent does not, through incorporstion in other interlocking or sequencing con-trols, render other components inoperible. All modes of tast, ocers-tion and failure shoald be considered. VeMfy and suta ce results of your review.

Also your procedures should be reviewed to ensure they provida -

cat, whenever a part of a redundant system is removed from service, the :ortion remaining in service is' functionally tested indiately after the disabling of the affected portion. YeMfy that your crocedures include the above cited provisions.

1 040.74 Cefine the facility's ocerating limits (real and reactive :ower, (8.2) voltage frecuency and other) whicn have been esualished and i

provide a brief description as to hcw these limits wert esucif shed.

Also, describe the operating procacures or other provisicas (pre-sently planned) for assuring that the facility will be acertted within tadse limits i

- s 040.75 Cata11ed reviews of electrical control circuitry ass,ociated with (8.3) the safety systams of nuclear stations shows that these circuits may differ from station to station, in that, for some stations these control circuits are arrsnged so that an accident signst will override a tast mode condition wiertas in other stations (due to those circuits) the tast mode condition will take precedence.

In this regard, identify any redundant electrically controlled components in the Perry design 'whereby an accident signal will not override a test.mde condit'an. Also, for each component identified, provide tecnnical infor nation which supports the j

adequacy of this design feature.

i 1

040.76 Concerning me emergency load sequencers wnica are associated with (8.3) the offsita and, ensita power sourcas we require that you either provide a separata sequencar for offsita and onsita power (per electrical division) or a detailed analysis to demonstrata that there are no credible sneak circuits or connon failures modes in the sequencar design that could render both onsita and offsita

ower sources unavailable. In addition provide infonnation con-i carning the reliability of your secuencer and reference design detailed drawings.

e e

s.,

e e-

~ 1 l

l 040.77 Adecuacy of seation zieetric Distribucion system vol:ases (8.3)

Events at the Millstone station have shown that adverse effects on the Class II loads can be caused by sustained low grid voltage condition when the Class II buses are connected to offsite power. These lov voltage conditions will not be detected by the loss of vol: age relays (loss of offsite power) whose low voltage pickup setting is generally in the range of.7 per unit voltage or less.

1 The above events also demonstrated that improper vol: age protection logic can iraelf cause adverse effects on the Class II systems and equipmen:

such as spurious lead shedding of Class II loads from the standby diesel generators and spurious separation of Class II systans from offsite power I

due to normal notor starting :ransients.

A more recent event at Arkansas Nuclear One (ANO) station and the subsequent analysis performed disclosed the possibility of degraded voltage condi: ions existing on the Class II buses even wP,h normal grid vol: ages, due to

_[

deficiencies in equipment between the grid and the C)_.;.; II buses or by 4

the starting transients experienced during certain accident eve

.s not originally considered in t' e siaing of these circuits.

i.

3ased upon these above events, we have. developed the following four part i

technical posi:1on.

1 i

1.

In addition to the undervol: age scheme provided to detect loss of offsi:e power at :he Class l' buses, a second level of undervol: age protection vi:h tine delay should also be proviced to protect the Class II equipment ; this f

a a

e

. i second level of undervoltage protection shall satisfy the following criteria:

a) The seleccian of undervoltage and time delay setpoincs shall be determined from an analysis of th.a voltage requirements of the I

Cla.s 1Z loads at all onsite system distribution levels; b) Two separate time delays shall be. selected for the second level of ander<oltage protection based on the following conditions:

1) The first time delay should be of a duration that establishes 4

the existance of a sustained degraded voltage condition (i.e.,

1 something longer than a motor starting transient). Followhg I

this delay, an alarm in the control roon should alert the operator to the degraded condition. The subsequent occurrence of n safety injection actuation signal (SIAS) should 1:nmediately i

separate the Class 1E di.stribution system from the offsite power systen.

i 4

4

2) The second time delay should be of a limited duration such that t

the pernanently connected Class II loads will not be damaged.

Following this delay, if the operator has failed to restore 1

ae.;uate voltages, the Class 1E distribution system should be I

automatically separated from the offsite power sys em.

Bases and justification : mast be prJvided in support of the actual 1

delay chosen.

I 4

h

=

I c) The vcitage sensors shall be designed to satisfy the following i

applicable requirements derived from IZZE Std. 279-1971, 5

"Criter_ for Protection Systems for Nuclear Power Generatir.g Stations:"

i 1

1) Class 1E equipment shan be utilized and shall be physicany s

a i-located at and electrically connected to the Class 1E a

switchgear;

2) An independent schuma shall be provided for each division o[

t the Class 1E power system;

3) The undervol: age protection sha n include coincidence logic on i

)!.

a per bus basis to preclude spurious ::1ps of the offsita power sourca; 1

2 j

4) The vol: age sensors shan automaticany initiata :he disconnection l

ci offsite power sources whenever the voltage set. point and time 1

i delay limi:s (cited in item 1.b.2 above) have been exceeded; l

j

5) Capability for test 'and calibration during power operation shan

..A, j

be provided;

}

6) Annunclation must be, rovided in the control room for any bypasses incorporated in the design.

d) as Technical Specifications shall includa limiting conditions for

~~

of. ora;1ces, surveillance reqvirements, trip setpoin:s wi:h minimum and max 1.aum limits, and allowabla values for the second-level vol: age 1

l protectica sensors and associated time delay devices.

i 4

5 4

1 i

l

=

,-.,,..._..,m,,,.,_...,.n,-,n,,..,w,,e.,.,_,

.m-

a 38 -

J 1

2.

na Class 1E bus load shedding scheme should automatically prevent shedding during sequencing of the emergency loads to the bus. ne load shedding feature should, however, be reinstated upon completion of the load sequencing action. ne technical specifications must

- include a test tequirement to demonstrate the operab,ility of the automatic bypass and reinstatement features at least ence per 18 months during shutdown.

4 In the event an adequate basis can be provided for retaining the load shed feature during the above transient conditions, the setpoint value j

in the "echnical Specifications for the first level of undervoltage protectiu (loss of offsite power) must specify a value having maximm and minimum limits. ne basis for the seepoints and limits selected i

l nust be documented.

3.

ne voltage levels at tha safety-related buses should be optimized for the maximum and m4a4 ~ load conditions that are expected throughout the anticipated range of voltr.ge variations of the offsite power sources i

j (fbyappropriateadjustmentofthevoltagetapsettingsoftheintervening transforme.rs. S e cap settings selected should be based on an analysis of the voltage at the tern h t= of the Class II loads. ne analyses perfor=ed to decernine 4 4-operac'.ng voltages should typically consider oaximum unit steady state and transiene loads for events such as a unit trip, loss of coolant accident, startup or shutdown; with the offsite power supply (3 rid) at r inimum anticipated voltage arJ only the

. offsite sourts being considered available. Maximum voltages should be analyzed with the offsite power supply (grid) at maximum expected voltage concurrent with minimum unit loads (e.g. cold shutdown, refuelug). A i

separate set of the above analyses should be performed for uch available connectica to the offsite power supply.

4.

The analytical techniques and assumptions used in the voltage analyses A

cited in item 3 above must be verified by actual measurement. The verification 2nd test should t e performed prior to initial full power reactor operation on all sources of offsite power by:

i d

a) loading the station distribution buses, including all Class E buses down to the 120/208 v levei, to at least 30%;

b) recording the existing grid and CIsss E bus voltages and bus loading down to the 120/208 volt level at steady state conditions and during the starting of both a large Class E and acn-Class E motor (not concurrently);

Note: To minimi=a the number of inst:usented locations, l

(recorders) during the motor starting-transient f

tests, the bus voltages and loading need only be tecorded on. hat string of buses which previously showed the lowest analyzed voltages from item 3 above.

1 f

vv

, c) using the analytical techniques and assumptions of the previous voltage analyses cited in item 3 above, and the measured existing grid voltage and bus loading conditions recorded during conduct of the test, calculata a new set of voltages for all the Class 1E buses down to the 100/208 volt level; i

d) compara che analytical derived voltage values against the tact results.

i

'Jith good correlation between the analytical results and the test results, the test verification requirement Vill be mat.

Ihat is, the validity of i

3 the mathematical model used in performance of ths. analyses of iten 3 v111 i

have been established; therefora, the validity of the results of the analyses is also established. In general the test results should not be i

~

mera than 3" lover than the analytica3. results; however, the diffaranca 4,

between the two when subtracted from the voltage levels deternised in

~.

the original analyses should never be less than the C1:ss II aquipment a

rated voltages.

1 i.

4 1

i I

- - - ~

040.78 Provide a listing of all switchgear (by bus nomenclature) within (8.3) the design and specifically address the source of tontrol power to each. This is needed to facilitate an independent review of how jour emergency power system design meets the single failure criterion and to determine the extent of lors due to postulated failures.

)

040.79 Provide a listing of all motor operated valves within your design (8.3) that require power lock out. in order to meet the sing'ie failure criterion and provide the details of your design that accomplish 2

this requirement.

1 040.80 Recent experience with Nuclear Power Plant Class lE electrical (8 3.1) system equipment protective relay appl' cations has ;ttablished that relay trip setpoint drifts with coi..$ntional type relays have resulted in premature trips of redundant safety related i

system pump motors when the safety system was required to be operative. While the basic need for proper protection for feeders / equipment against permanent faults is recogni:ed, it is the 2taff's position that total non-evailability of redundant J

safety systems due to spurious trips in protective relays is not acceptable.

Provide a descri;tten of your cfreutt prttacticn crttarta 'er safety systams/ equipment to avoid incarnet initf al sat::ofr.: selection and the acove cited ;rctactive relay :r1p set;;otnt drtft problems,

~

42 -

040.81 Provide a listing of the following for the containment electri-(8.3.1) 2 cal penetrations by voltage Class: I t ratings, maximum predicted faults currents, identification of maximizing faults, protective equipment setpoints, and expected clearing times.

1 Provide a description of the physical arrangement utilized in your design to connect the field cables inside containment to the containment penetrations, e.g. connectors, splices, or terminal blocks. Provide supportive documentation that these physical interfaces are qualified to withstand a LOCA or steam line break environment.

040.82 We request that you perform a review of the electrical control (8.3) circuits for all safety related equipment, so as to assure that disabling of one component does not, through incorporation in other interlockiag or sequencing controls, render other componsnts inoperable. All modes of test, operation, and failure should be 1

considered. Describe and state the results of your review.

l i

i l

=

3

, l 040.83 You state that HPCS system emergency diesel generator unit consists (8 Ti of two diesel engines driving one generator. Expand the FSAR to include a detail descripcion of the duel diesel drive for each l

l generator. Provide justification for the selection of dual diesel drives per generator as opposed to the more conventional single diesel engine driven generator. Demonstrate that the proposed dual diesel engine drive units has an equivalent reliability as a single diesel 6 comon mode failures as well as engine drive unit.

In your analysi random single failures should be considered.

l l

l w

j a

I I

l l

1

- 44 040.84 Section S.6.2.2(1) of IEII.387-77 (endorsed by Regulatory Gutde 1.9 Revision -

f-(8.3)

2) r.equires that a start. diesel sf gnal shall override all other operating i

modes and' return control of the diesel generator unit to the automatic 1

control systas. De description of your design is insufficient to assess.

whether your design meets this requirement. Yarify that your design meets l

this requirement and provide a revised description in sufficient detail to 4

1 l

perfeit independent evaluation of this design capability.

ne following discussion and recomendations are presentad for your consideration:

f A design which does not meet the above cited requirement would necessitate 1

operator action, of varying levels of complexity depending on the circumstances,

~

in order to enable a diesel generator (0/G) in the test mode to respond to a i

bona fide emergency demand signal such as Loss of Offsite Power (LCOP), Safety Injection (SI), or sfmultaneous SI and LOOP. The concern here is the high I

probability of human fatlure under these stress conditions, and the possible i

consequent disabling of a D/G or other action which degrades safety margin y

l at a time when it fs est needed.

4 i

Each O/G must be periodically tested at a frequency as speciff ed in R. G.1.1C8, nis test frequency is nomally once per month but could be as high as once every theta days. De duratton of each test is one hour. During a normal successful test the 0/G wculd be sequentially in the following states:

starting, running disconnected from its bus, running loaded on its bus, i

j tripping and coasting to a stop. However, durfng almost all of the one hour test period the 0/G is loaded on its bus with the governor operating in a droop node, and the load carried by the diesel engine is a function of i

I 1

s governor speed setting and speed droop setttfig, 1

Nrtng any of the abo fe ef ted test states, a D/E start sfgnal should return control of the D/G to the automatte contml system, thereby enabitng it to respond automatically to an emergency demand sf gnal (SI or LOOP) without need for any operator action. Designs provfdtng this capability have already been implemented in some nuclear plants. Such designs include the J

following features:

I On receipt of a SI signal:

a) The D/G breaker (if closed) is tripped.

)

b) The D/G tf running rematns running, or is started, and remains operating f

in the tsochronous mode in ready-standby.

i.

c), The D/G protective trips are bypassed per design.

I d) The offstte power feed breaker remains closed and ESF loads are

~

connected to 'the bus per design,

~

1 i

f On recetpt of a LOOP signal following a SI signal:

l a) The offsite pver feed breaker is trtyped, j

b) Loads are shed from the bus per design.

c) The 0/G breaker is closed connecting the D/S to the bus pr design, i

d) ESF loads are sequenced to the bus per design.

4 e

i On receipt of simultaneous SI an'd LOCP signals:

)

e j

a) The 0/G breaker (tf closed) is trtpped (on SI signal).

I b) The 0/G. f f running remains running, or is started, operating in the 1sochronous mode, c) The offiste power feed breaker is tripped.

J d) Loads are shed from the bus per design.

e) The 0/G protective trips are bypassed per design, f) The 0/G breaker is closed connecttng the 0/G to the bus per destgn.

I g) ESF loads are sequenced to the bus per destgn, t

On occur-ence of a LOOP condition while a 0/G is on test and connected to its I

bus, an LOOP signal would probably not be generated because the 0/G would j

attempt to provide power to the bus and to the offsite system through the closed offsite power feed breaker. In this case, the 0/G breaker :nust be t

relied upon to trip on overcurrent, underfrequency or undervoltage. This 3l would deenergi:e the bus thereby producing an LOOP signal. In this case:

a) The offsite power feed breaker is tripped.

t b) The 0/G remains running in the tsochronous mode (or if stalled it is' i

automatically started),

i c) The 0/G breaker is closed connecting the 0/G to the bus per design.

j t

j d) ne shutdown loads are connected to the bus per design.

e) On occurrence of a LOOP condition while a 0/G is on test but is not connected to its bus, a LOOP signal will be genersted tmediately, and i

this should initiate above actions.(a) through (d),

j i

~ 47 -

2 040.85 Ofesel gr.stsr alarms in the control room:

A review of malfunction (8.3) reports of diesel generators at operating nuclear piants has uncovered that in some cases the information available to the control room I

T operator to indicate the operational status of the diesel generator may

}

be imprecise and csuid lead to misinterpretation. This can be caused by the sharing of a single annunctator station to alann conditions that render a diesel generator unahie to respond to an aut:matic emergency j

start signal and to also alam abnormal, but not disabling, conditions.

Another cause can be the use of wording of an annunciator window that does not specifically say that a diesel generator is inoperable (i.a.,

unable at the time to respond to an aut:matic emergency start signal) when in fact it is inoperable fr. that purpose.

j Review and evaluate the alam and c:ntrol circuitry for the diesel generatsrs at your facflity to detennfne hew each condition that renders a diesel generator unable to respond to an automatic emergency start l

signal is alarmed in the control room. These conditions include not i

only the trips that lock out the diesel generat:r start and require manual reset, but also control switch or mode switch positions that r

block aut:matic start, loss of control voltage, insufficient starting air pressure or battery voltage, etc. This review should consider all I

aspects of possible diesel generator operatienal conditions, for example test c:nditions and operation from local control stations. One area of particular concern is the unreset condition felicwing a manual s sp i

I e

..., at thi local station which teminates a diesel generator test and prior to reseting the diesel generator contrais for enabling subsequent automatic opa ation.

Provide the details of your evaltation, the results and conclusions, and a tabulation of the fo11cwing infomation:

i (a) all conditions that render the diesel generator incacable of responding to an automatic emergency start signal for each operating mode as discussed above; i

(b) the wording on the annunciator window in the control room that is alamed for each of the conditions identified in (a);

(c) any other alam signals not included in (a) above that also cause the same annunciator to alam (d) any condition that renders the diesel g2nerator.ccapable of I

responding to an automatic emergency start signal which is not alamed in the control room; and 7

i 1

(e) any proposed modifications resulting from this evaluation.

i i

i i

i a

{

4 1

4 1

s s.

040.86 It has been noted during past reviews that pressure switches or otner (8.3) i devices were incorponted into the final actuation control ' circuitry for large horsepower safety-related motors which are used 'a drive pumps. These switches or devices preclude aut:matic (safety I

signal) and manual operstion of the motor /pumo c:mbination unless permissive conditions such as lube oil pressure are satisfied.

1 Ac:srdingly, identiff any safer /-related motsr/pumo comoinations which are used in the Perry design that operates as noted i

acove. Also, describe the redundancy and diversity wnich is pro-4 i

vided for the pressure switces or permissive devices that are used i

in this manner.

Identif all electrical equipment, oth safety and non-safety, that 040.87 f

(6.3, 8.3) may bec:me suhmerged as a result c,1 a LOCA. For all such equi: ment tnac is not qualified for service in such an environment provide an anab..a w de.armine the fo11cwing:

3 1.

The safety significance of the failure of this electrical equip-

~

nent (e.g. spurious actuation or loss of actuation function) as a result of f1 ceding.

2.

The effects on Class 1E electrical pcwer sources serving this 1

Muipment as a result of such submergence, and 3.

Any ;rocesed design enanges resulting from this analysis.

040.88 p svfde **.'e.-esults of Orrtes -f your :sersting, mainmanca, and

}

(8.3) tasting ;r:cacuras tz detarsine ce ex. ant f uage :f jacers r sther tancersry fur =s of bypassing 'ateticas f:r ::ersting, tast.

~

ing, er saintaining cf aafety niatad sys.ams. *danti?/ and juti?/

any :ases wntre =e ue f ce taeve neceds :2nect he avoidad.

j 7 svide ce =ritaria f:r any ue f ft.smers for tasting.

i

r

.g l

040.89 Concerning the Class 1E Direct Current Power Systam address the (8.3.2) following:

1.

As a result of recent reviews on the adequacy of safety-related dire' current power systams of operating plants the felicwing rec:nmendations accif cable to those plants undergoing operating licanse and constraction perrrit reviews have been proposed.

In this regard, state if uad(

design c nferns to these rec:nnendations and explicitly identify any exception.

a.

The position of circuit breakers or fused disc nnect rait:::es associated with the battarf charger, bat. arf and direct curnnt bus supoly should be mer.itared to c:nform to the recemencations of Regulatory Guide 1.47, "3ypassed anc Inocersale Status Indication for Nuclear Pcwer Plant Safety Sys.ams," (May 1973).

5.

The technical specifications should include peModic tast-ing of battarf chargers to veHfy that the current limiting

~

characteristics has not been c:moremised or 1 cst.

1 c.

The technical specifications shculd require that cell-to-1 call and tarninal c:nnection resistanca measurements be 4

l ade as ite:mendec in IEEI Standard 150-1972, Mec:menced i

Practica for Maintananca, Testing, and Rectacament, and Large Staticnarf Type Pcwer Plant and Substation Laad 5t:rtge Sat. aries.*

l l

{

4 51 -

d.

The em:ct current power systas design should include the failowing monitors and alarms" (1) An anneter (directional and dual ranga) in the battarf i

cutpuc to monitor the batterf input current wnile the battsry is on ficating and equali:ing enarge and to monitse the batter / autput current.nen it is supplying ;cwer.

(2) An annunciatsr to alarn wnenever the charger goes inti a current limiting c ndition.

(3) A tamcersture indicatar to measure the battarf reem amcient tans:ersture.

1

~

e.

The voltage variation for an associatad battarf bus during any

)

j ex ected accident mcde of ocerstien saculd te within design l

scecifications.

i f.

The direct current equipment saculd be ested and qualified for T-ccersticn at tne equali:ing charge voltage and rated discharge voltage (typically 110 to 14d volts for a nominal 125 valt i

direct current systam).

I 2.

Stata if the battery enarger has sufficient cacacity to ocersta all non-accident shut:cwn leads assuming the battarf is not availacle.

A ;c, stata if tne stabili y of the battarf c arger cut:ut is load decendent and if so describe.

f

' "..i.

f 040.90 Provide a description of the capability of the emergency power (8.3) system battery chargers to properly function and remain stacle I

upon the disconnection of the battery. Include in the description any forseen modes of operation that would require battery discon-nection such as when applying an equali:ing charge.

040.91 Provide the details of your design of the DC power system that assures l

(8.2) equipment will be protected from damaging overvoltages from the battery chargers that may occur due to faulty regulation or operator error.

040.92 The specific requirements for D. C. power system monitoring derive from (0.3.2) the general requirements embodied in Section 5.3.2(4),5.3.3(5)and

~~

5.3.4(5) of IEEE Std 308-1974, and in Regulatory Guide 1.47.

In summary, these general requirements simply state that the D. C. system (batteries, distribution systems and chargers) shall be monitored to the extent that it is shown to be ready to perform its intended function.

Accordingly, the guidelines used by PSB in the licensing review of the D.C. power system designs are as follows:

As a minimum, the following indications and alams of the Class lE 0.C.

power system status shall be provided in the control room:

3attary cur ent (anneter-charge / discharge)

Sattery charger output current (ammeter) 0.C. bus voltage (voltmeter)

Sattery charger output voltage (voltmeter) 3attary high discharge rata alam-0.C. bus undervoltage and eveneltage alam 0.C. bus ground alam (for ungrounded system)

Battary breaker (s) er fuse (s) open alam Sattary charger outout breaker (s) or fuse (s) open alam Sattary charger trouble alam (one alam for a nurter of abnomal conditiens which are usually indicated localJy)

[

..s. y - 040.93 E.xplicitly identiff all non-class 1E electrical loads whica are '

(8.3) or may be powered from ne Class lE a-c and d-c systems (refer to Figures 8.1-1 and 8.3-10). Also, for each load identified pro-vide ne horsepower..or kilowatt rating for 2at load and also identify the cornsoonding bus numoer from wnich Se load is powered.

040.94 C:9 earning Regulatory Guides 1.93 and 1.1C8 we will require that (8.3.1)

(16.0) ce final tocanical scocifications fr.r :nis station include ne acolicable provisiens of case regulatorf guides. Accordingly, verify that these specifications will include case provisions or ff acclicaole exclicitly identiff any excestions.

040.95 Regulatory Guide 1.75, C.10 reccmends that Class lE caoles, (8.3.1) installed in exposed raceways, be marked at intervals not be exceed 5 feet.

Indicate whether this requirement will be incorporated in the design; if not, provide justification for your position.

-