ML20010H332

Provides Info for Power Sys Branch Review of Applications. FSAR Changes Re Offsite Power Sys,Degraded Grid Voltage & Separation Inside NSSS Cabinets Encl

ML20010H332
Person / Time
Site:	Wolf Creek, Callaway
Issue date:	09/22/1981
From:	Petrick N STANDARDIZED NUCLEAR UNIT POWER PLANT SYSTEM
To:	Harold Denton Office of Nuclear Reactor Regulation
References
SLNRC-81-109, NUDOCS 8109240353
Download: ML20010H332 (9)

Text

e 9

SNUPPS Standardized Nuclear Unit Power Plant System 5 Choke Cherry Road Nicholas A. Petrick Rockville, Moryland 20850 Executive Director (MH 869 8010 September 22, 1981 SLNRC 81-109 FILE: 0541 SUBJ: PSB Review

/ OyQt.,e I IN ,' >

dir. Harold R. Denton, Director ,9 e$ S Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washington, D.C. 20555

'c7 h

3-tk.%

yg [-[ NQ1 y.

Docket Nos. STN 50-482, STN 50-483,

%, p Q Q 6l '

and STN 50-486 ,

g/ y-.

j

\y,

Dear Mr. Denton:

' y.  ; /

In discussions with Dr. Gordon Edison, NRC project manager for the SNUPPS applications, it was learned that additional information was required in order for the Power Systems Branch to complete their review. The purpose of this letter is to provide that information.

Analysis of Offsite Power System The enclosure to this letter includes changes to the SNUPPS FSAR that will be incorporated in the next revision. These char.ges include the additional descriptions and results of analyses for the offsite power system.

Degraded Grid Voltage The enclosed FSAR changes address this topic.

I Separation Inside NSSS Cabinets The enclosed FSAR changes confirm that field run cabling meets the requirements of WCAP-8892A.

Submerged Electrical Equipment The. following Class IE equipment is located telow the post-accident

flood level:

EPHV88088, EPHV8808C - FSAR Fig. 6.3-1 Sheet 4 BBHV80378, BBHV8037A - FSAR Fig. 5.1-1 Sheet 2 og)

D EMHV8823, EMHV8824, EMH'."1881 - FSAR Fig. 6.3-1 Sheet 2 #

Containment Sump Level Instrumentation - FSAR Section 18.2.12.2 7

8109240353 810922 PDR ADOCK 05000482 A PDR

, SLNRC 81-109 Page Two The locating of these valves and instruments below the flood line does not jeopardize the integrity of the Class IE power system. Also, there is no non-Class IE equipment, powered from Class IE sources, located below the flood level. Valves EPHV8808C and EPHV88088 are accumulator isolation M0 valves which are open during power operation. This position is also their safety function position. When these valves are open, both their power and control circuits are de-energized by physically securing their associated circuit breaker in the tripped position. Therefore any spurious shorts of the valve due to flooding cannot cause the valves to close or otherwise prevent them from per-forming their safety function.

Valves BBHV8037A and BBHV8037B are Pressurizer Relief Tank drain M0 Valves. These valves are designated Class lE to enable the plant to achieve cold shutdown using only safety-grade components. They have no accident mitigation requirements. Spuricus travel of these valves will not have any effect on the ability to mitigate any accident. The power circuits to these valves are normally deenergized. The control circuits are doubly fused to ensure adequate penetration protection in the event of control circuit shorts resulting from the flooding.

Valves EMHV8823, EMHV8824 and EMHV8881 are all 3/4" containment isola-tion valves for ECCS test lines. These valves are normally closed with their solenoids deenergized and a CIS signal is provided to also deenergize their solenoids and close the valves. The valves are not required to operate after an accident. Flooding of these valves after deenergization cannot, due te the control circuit. design, cause the valve to spuriously open.

The containment sump level instrumentation is also located below flood level. This equipment is fully qualified for a submerged environment.

Regulatory Guide 1.63, Position 1 The SNUPPS design is committed to satisfying regulatory position Cl of RG 1.63, Revision 1. This position requires that the electrical penetration assemblies withstand, without seal f ailure, the total range of available time-current characteristics assuming a single f ailure of any overcurrent protective device.

SNUPPS is currently reviewing all electrical penetration assembly protective device settings and capabilities to verify that the above position is satisfied. The results of the review will demonstrate that, for all penetrations, both the pri:Ory and backup protection will act to protect the penetration from f ailure for the full range of

~

available f ault current. Available means of obtaining assurance that this protection is achieved include adjustment of settings, using additional fuses, and use of parallel conductors within the electrical penetration asseinbly,

, SLNRC 81-109 Page Three Insulating-Regulating Transformers SNUPPS will provide an analysis, based on transformer tests, demon-strating that the isolating - regulating transformers are qualified isolation devices. If this analysis should be unsuccessful and the isolating - regulating transformers are not acceptable as qualified isolation devices, an alternate method of isolation will be used in this application.

Analysis of Load Sequences The SNUPPS Load Shedder and Emergency Load Sequencer (LSELS) is pro-vided to automatically sequence the required safety loads onto the Class IE busses as determined by the sensed conditions. A separate LSELS is provided for each load group.

A Failure Modes and Effects Analysis (FMEA) and a reliability study have been performed. These studies have conclusively shown that no failxe within a single LSELS can result in the failure of both sources of offsite power. The chief reason for this is that the only time harmful interaction between the onsite and offsite power systems is possible is when the two systems are operating in parallel. This mode of operation only occurs under operator action and supervision.

Otherwise, interlocks prevent the interaction of the two systems at all times. The LSELS cannot cause either the diesel generator breaker or the incoming offsite breaker to close. It can only initiate load shedding, bus tripping, and sequential loading of the Class IE busses.

The alignme,J of the onsite and offsite power systems is determined by design features and operator actions outside the purview of the LSELS.

Thus any failure of an LSELS can affect, at most, one onsite power source and one offsite power source.

To further ensure the reliability and availability of the LSELS, it is provided with an automatic test indication (ATI) feature. This ATI continuously performs self-diagrasis functions on the LSELS circuitry and alarms when a fault is discovered.

Very ul ours,

\ Chec(

Nicholas A. Petrick RLS/bds/11a23 Enclosure cc: J. K. Bryan UE G. L. Koester KGE

0. T. McPhee KCPL T. Vandel NRC/WC W. Hansen NRC/ Cal

Enclosure to SLNRC 81-

SNUPPS .

r

) 8.2 OFFSITE POWER SYSTEM 9 The offsite ac power supply for the startup, nornal operation, and safe shutdown of each of the SNUPPS units is supplied from the transmission network of each system. The principal design bases as applied to the offsite power system are described in Section 8.1.4. The offsite power systems are described in Section 8.2 of each Site Addendum.

The instrumentation associated with the offsite ac power system provides sufficient information to determine the system availability at any time.

Table 1.7-1 of the FSAR contains drawings 10466-E-01NB01 and 10466-E-01NB02, Single Line Meter and Relay Diagrams These for the drawings Safety-Related 4.16-kV busses NB01 and NB02.

show the surveillance details of Table the ESF transformers 8.3-4 andFailure of the FSAR, their associated 4.16-kV bus.

Modes and Effects Analysis, shows the system failure modes and >

the method of such failure detection.

~

hh I

O>

ss-Rev. 6

~  !

i i

II'. d s E R*C l The offsite power systems from the transmission line network to the startup transformer That and ESF transformer XNB01 are discessed in Section 8.2 of each Site addendum.

portior of the offsite power system is not in the SNUPPS " Standardized" design.

Thz portion of the of fsite power system f rom the startup transformer and ESF transformer XNB01 to the 4.16 KV Class TE busses is within the scope of the SNUPPS " Standardized" design and is discussed b. A A *sbae44 4

• n aw A A. 4es.'g Twophysicallyindependentsourcesofoffsitepower{arebroughttotheonsitepower cystem. One circuit is fed from ESF Transformer XNB01 and supplies power normally to its associated 4.16 KV Class IE bus. The other circuit is fed from one secondary winding of the startup transformer, through ESF transformer XNB02, and supplies power normally to its associated 4.16 KV Class *IE bus. In addition, each offsite power circuit can be marually aligned to supply power to[8pposite or both 4.16 KV Class IE busses if required. Each of these offsite power circuits is designed to be available in sufficient time to ensure that specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceejed fol~ awing a loss of all onsite power sources and the remaining offsite power circait.

The two ESF transformers XNB01 and XNB02 are separated by a 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> fire wall. The cables associated with each of these offsite power circuits are routed in separate and distinct rsesways. The duct banks and other routing features of the two circuits are shown on drawings E-OR0224 E-0R3321 E-0R3221 and E-CR3211 for the cables from the ESF transformers to the 4.16 KV Class IE busses, on drawings E-0R0223, E-OR4331, E-OR4321 and E-0R0224 for esbles from the startup transformer to the 13.8 KV switchgear and from the 13.8 KV switchgear to ESF transformer XNB02.

The offsite power circuits, including the tr sformers and cables, pave been sized to carry their anticipated loads continuously. ESF transformers e44 sized to carry both safety related luad groups continuously. The secondary feeder cables to the 4.16 KV Class IE busses are sized in excess of that required to carry their maximum load continuously.

The startup transformer is sized to carry its anticipated load continuously, but may be l

l slightly overloaded under certain abnormal conditions. For additional details of the eizing of these components, refer to Section 8.3.1.

No component of these two of fsite pswer circuits is shared between units at the Callaway Site.

These two circuits are fully testable. Since they are continuously energized and largely possive, they are continusouly tested by their use. When one circuit is shutdown, relays, meters and other instruments can be tested and calibrated as required.

l Control and instrumentation power for these offsite power circuits is provided by the Non-Class IE DC system. A DC power source from separate station batteries is provided to

! each offsite power circuit for control and relaying purposes.

l From the above considerations it is concluded that the installation, sizing and control of l

both of the offsite power circuit are designed so as to minimize the liklihood of their simultaneous failure under operating and accident conditions.

For additiodddetails concerning the compliance of the offsite power system with General D: sign Criteria, refer to Section 3.1 i

) -

SNUPPS LOAD-SHEDDING CIRCUITS - Upon recognition of a loss of or degraded voltage on a 4.16-kV Class IE bus, a logic signal is initiated to effect the foJ1owing on each load group:

a. Shed selected loads

b. Send signal to start diesel

/4 c. Trip 4.16-kV preferred power supply breakers _

l o voltage sensing schemes on each Class IE 4.16-kV bus loyed to initiate the logic signal. One scheme wil:

re nize a loss of voltage, and the other will reco ..ze

(/ l([ degra voltage d voltage conditions. Each scheme is prov' ignals through four potential transfo d

rs located on each .

To sense a 1 of voltage, four instan eous-type under-voltage relays e provided. Logic i rovided to allow load shedding an rip of the inco g breaker on 2-out-of-4 undervoltage signal These rel are cet below the minimum expected voltage duri diese equencing.

i Four additional undervolt logic circuits are provided for i

each bus to recognize d a voltage conditions. These

! circuits are set abov the min ' um motor starting voltage during normal oper _on with a t' e delay set to prevent unwanted trippin Logic is provi d to allow load shedding and trip of th neoming breaker on ut-of-4 undervoltage.

Each incom' g breaker is provided with on time delay under-voltage ay to monitor the voltage on the urce side of the br er. This relay contact closes on und oltage and is i' series with the undervoltage logic describe above to i tr' .

This relay is set above the undervoltage pro -tion scribed above with a time delay sufficient to preve. trip uring motor starting. Closing of the incoming breake r prevented until preferred power is available. /)

As each generator reaches rated voltage and frequency, the generator breaker connecting it to the corresponding 4.16-kV bus closes. With the SIS, connection of the diesel generator to the 4.16-kV bus is not made unless the preferred source of power is lost. The diesel generator is able to accept l loads within 10 seconds after receipt of a starting signal,

.and all automatically sequenced loads are connected to

'the Class IE bus within 35 seconds thereafter. Refer to Figure 8.3-2. Relays at the diesel generator detect generator rated voltage and frequency conditions and provide a permis-I sive interlock for the closing of the respective generator circuit breaker. Upon loss of the preferred source of power lO, without a LOCA, the load segaencer system initiates the starting of the diesel generators and sheds all loads, except the load centers and the centrifugal charging pumps.

l l 8.3-11

h5Elt.T 2.

f Two voltage sensing schemes are employed on each 4.16 KV Class IE bus to initiate the required logic signal. One scheme will recognize a loss of voltage and the other will recagnize a degraded voltage. Four potential transformers on each bus provide the necessary input voltages to the protective devices necessary to achieve the above protection.

In order to recognize a loss of voltage, four instantaneous undervoltage relays are used. The output contacts of these relays are directed to logic circuits that process the four undervoltage input circuits into the 2-out-of-4 logic circuit described above. This scheme is used on each bus.

The loss of voltage logic strnal is set below the minimum bus voltage encountered during diesel generator a gential loading. A brief time delay is employed to prevent false trips arising from transient undervoltage (spike) conditions.

In order to recognize a degraded voltage, a diverse protection scheme is used.

The above four potential transformers each provide an anal'og output signal of 0-120 volts. This signal is directed to logic circuits and processors that convert the analog signals into a 2-out-of-4 logic signal whenever the signal drops below a preset value. This scheme serves only to trip the incoming offsita power circuits breakers when that power source has been determined to be degraded. This design cannot adversely affect the sequential loading of the diesel generators.

The degraded voltage logic signal is set at the minimum permissable continuous bus voltage. A time delay is provided that prevents damage to or spurious tripping of the permanently connected Class IE loads by limiting the amount of time they are exposed to a degraded voltage. The final voltage and time setpoints will be deter-mined based on an analysis of the auxiliary power distribution system, including the Class IE busses at all voltage levels. The use of an SIS contact in series with the degraded voltage logic circuit output contact ensures that the Class IE busses will be immediately separated from the offsite power system whenever an accident occurs and the offsite power system is not able to accept the loads continuously. An alarm is also provided to alert the operator to a degraded voltage condition. It is delayed until any motor starting-induced voltage transient bus had sufficient time to clear.

?

B s---- -. , . - - . . - - - - _ . , _ _

SNUPPS

( e. Load group 1 and protection channels 1 and 3 and load group 2 and protection channels 2 and 4 cables are routed through separate cable chases and cable spreading rooms. The former circuits enter the lower cable spreading room, while the latter cir-cuits enter t. upper cable snreading room.

f. The independence of redundant NSSS safety-related systems is discussed below:

Safety-related reactor trip, engineered safety features actuation, and instrumentation and control power supply systems are designed to meet the independence and separation requirements of Cri-terion 22 of the 1971 General Design CI 'eria and Paragraph 4.6 of IEEE 279, 1971.

Channel independence is carried throughout the system, extending from the sensor through to the devices actuating the protective function. Physi-cal separation of wiring for each redundant channel set is used. Redundant analog equipment is separated by locating modules in different protection rack sets.

Each redundant channel set is energized from a sepa-rate ac power feed.

There are four separate process protection analog rach sets. Separation of redundant analog channels begins at the process sensors and is maintained in the analog protection racks to the redundant trains in the logic racks. Redundant analog channels are separated by locati.lg modules in different rack sets.

Within these racks, field run nonsafety-related shielded cables having a signal level of 100 V or less are routed in common wireways with safety-related shielded cables with no physical separation. Internal cabinet safety and nonsafety-related cables are simi-larly routed. Justificatior for this method of routing cisetosa containea in Reference swue4 caue.5 *e +we581.* Tho omeA5 4Ndd can non-arf. c*dt*d " " *"f"* +'*+(,'4 e st u-a.s r.e. s.

L Two reactor trip breakers are actua ed by two sepa-rate logic matrices which interrupt power to the 1P control rod dr2ve mechanisms. The breaker main

.: contact: are connected in series with the power supply so that opening cither breaker interrupts power to all control rod drive mechanisms, permit-ting the rods to free fall 2nto the core.

Protection system channel inputs are separated from the solid state protection system train out-puts as follows:

8.3-27

. _ _ - -- . . _ . .- . _ . _ - - .