ML20073K258

From kanterella
Jump to navigation Jump to search
ABWR DC Renewal Supplemental FSER Section 8.2.5 and 8.3.3.17 NRC Bulletin 2012-01 Electical Power Vunerability OGC Final
ML20073K258
Person / Time
Site: 05200045
Issue date: 03/31/2020
From: James Shea
NRC/NRR/DNRL/NRLB
To:
Shea JJ / 415-1388
Shared Package
ML20073J789, ML20105A349 List:
References
Download: ML20073K258 (15)
v • d • e


Text

8-i 8.0 ELECTRICAL POWER Appendix A, Design Certification Rule for the U.S. Advanced Boiling Water Reactor, to Title 10 of the Code of Federal Regulations (10 CFR) Part 52, Licenses, Certifications, and Approvals for Nuclear Power Plants, constitutes the standard design certification (DC) for the U.S. Advanced Boiling Water Reactor (ABWR) design. To document the U.S. Nuclear Regulatory Commission (NRC) staffs review supporting initial certification of the ABWR, the staff issued a final safety evaluation report (FSER) in NUREG-1503, Final Safety Evaluation Report Related to the Certification of the Advanced Boiling Water Reactor Design, in July 1994 and NUREG-1503, Supplement 1, in May 1997.

The staff is documenting its review of the GE-Hitachi Nuclear Energy (GEH or the applicant) application for renewal of the ABWR DC in Supplement 2 to NUREG-1503. Chapter 1 of this supplemental FSER describes the staffs review process for the ABWR DC renewal. This supplemental FSER section documents the NRC staffs review specifically related to Chapter 8, Electrical Power, Section 8.25 and Section 8.3.3.17, NRC Bulletin 2012-01: Design Vulnerability in Electric Power System, of the GEH Design Control Document (DCD),

Revision 7. Except as modified by this supplement to the FSER, the findings made in NUREG-1503 and its Supplement 1 remain in full effect.

8.2.5 NRC Bulletin 2012-01: Design Vulnerability in Electric Power System 8.2.5.1 Regulatory Criteria This discussion pertains to the staffs evaluation of the design information in the GEH ABWR DCD, Revision 7, that addresses the vulnerability identified in NRC Bulletin (BL) 2012-01, Design Vulnerability in Electric Power System (Agencywide Documents Access and Management System (ADAMS) Accession No. ML12074A115).

The staff issued NRC BL 2012-01, to confirm that all holders of operating licenses and combined licenses (COLs) for nuclear power reactors comply with 10 CFR 50.55a(h)(3,) and 10 CFR 50, Appendix A, General Design Criteria for Nuclear Power Plants, (GDC) 17, Electric Power Systems, or applicable principal design criteria specified in the updated final safety analysis report (FSAR). Specifically, the NRC requested licensees to provide information regarding: (1) the protection scheme to detect and automatically respond to a single-phase open circuit condition or high impedance ground fault condition on GDC 17 power circuits, and (2) the operating configuration of engineered safety feature (ESF) buses at power.

The applicant provided the ABWR DCD modifications related to the design vulnerability in the electric power system initiated by an open phase condition (OPC) to ensure compliance with the NRC regulations applicable and in effect at initial certification. Therefore, the changes are modifications, as this term is defined in Chapter 1 of this supplemental FSER and will be evaluated by the staff using the regulations applicable and in effect at initial certification.

The following regulatory requirements provide the regulatory basis for the staffs review of the ABWR DCD Tier 1 and Tier 2, modifications to address NRC BL 2012-01.

  • GDC 17 (1997), as it relates to the electric power systems (1) capacity and capability to permit functioning of structures, systems, and components (SSCs) important-to-safety, 8-1

(2) independence, redundancy, and availability, (3) provisions to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit, the loss of power from the transmission network, or the loss of power from the onsite electric power supplies

  • 10 CFR 52.47(a)(1)(vi) (1997), Contents of applications, states that an application for design certification must contain proposed inspections, tests, analyses, and acceptance criteria (ITAAC) necessary and sufficient to provide reasonable assurance that, if the tests, inspections and analyses are performed and the acceptance criteria met, a plant that references the design is built and will operate in accordance with the design certification The purpose of NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition, (SRP), Branch Technical Position (BTP) 8-9, Open Phase Conditions in Electric Power System, issued July 2015 (ADAMS Accession No. ML15057A085), is to provide guidance to the staff in reviewing various licensing actions of electric power system design vulnerability from OPCs in offsite electric power systems in accordance with GDC 17 or principal design criteria specified in the FSAR, 10 CFR 50.36(c)(2) and 10 CFR 50.36(c)(3), 10 CFR 50.55a(h)(2), and 10 CFR 50.55a(h)(3).

The guidance in BTP 8-9, related to offsite power systems, has the following criteria:

  • Automatic detection of the loss of one or two of the three phases of the independent circuits on the high voltage side of a transformer connecting an offsite power circuit to the transmission system under all operating electrical system configurations and loading conditions: with a high impedance ground fault condition; and without a high impedance ground fault condition; and
  • The automatic alarm in the main control room (MCR) under all operating electrical system configurations and plant loading conditions.

8.2.5.2 Summary of Technical Information The applicant added design features and ITAAC associated with the detection, alarm and response to OPC and unbalanced phase condition (UPC) in the offsite power systems.

Specifically, the modifications include: (1) DCD Tier 1, Section 2.12.1, Electric Power Distribution System, description for monitoring, detection, alarm and response to an OPC in the offsite power system, (2) DCD Tier 1, Table 2.12.1, ITAAC Item Nos. 28, and 29; for verification that OPC and UPC are detected by non-safety-related relays for a designated relay setpoint and that a response is initiated, (3) DCD Tier 2, Table 1.9-1, COL Information Items 8.16 and 8.17 for the COL applicant to develop procedures and train operators on how to detect OPC at the main power transformer (MPT), unit auxiliary transformers (UATs), and reserve auxiliary transformer (RAT), and (4) DCD Tier 2, Section 8.1.2.2.1, Monitoring and Protection Against Design Vulnerabilities, which explains that the ABWR standard plant design incorporates the requirements for mitigation of OPC as identified in BL-2012-01.

8.2.5.3 Technical Evaluation The scope of the evaluation in this section is limited to the detection and alarms, as described in the guidance outlined in BTP 8-9, for the offsite power system. Supplemental FSER Section 8.3.3.17 discusses the mitigation aspects of OPC protection as described in BTP 8-9, for the onsite Class 1E power system.

8-2

Offsite System OPC Detection and Alarm - MPT, UATs and RAT The staff reviewed the ABWR DCD, Revision 7, including responses to requests for additional information (RAIs) and DCD Tier 1 and Tier 2 modifications to the electrical system design to ensure that the design includes features to automatically detect and alarm in the MCR in response to an OPC event and is consistent with the guidance in BTP 8-9.

In a letter dated December 7, 2010 (ADAMS Accession No. ML110040176), GEH submitted ABWR DCD, Revision 5, for renewal of the ABWR DC. The ABWR DCD, Revision 5, did not include information related to Bulletin 2012-01. Following the issuance of BL 2012-01, the staff requested that GEH provide additional information to ensure that the applicant addressed the OPC issues identified in BL 2012-01, as part of the DC renewal. Therefore, in RAI 08.02-1 dated April 24, 2014 (ADAMS Accession No. ML14114A566), and in RAI 08.02-2 dated June 9, 2015 (ADAMS Accession No. ML15154B692), the staff requested that the applicant provide the design details of OPC detection and protection schemes and how they met the requirements specified in GDC 17 and 10 CFR 50.55a(h)(3). Specifically, the staff requested the applicant to provide design features that would (1) automatically detect OPC and alarm in the MCR under all operating electrical system configurations and (2) automatically transfer safety-related buses to alternate offsite power source or onsite standby power system within the time assumed in the accident analysis due to an OPC. In addition, the staff requested that the applicant provide associated ITAAC to ensure that OPC monitoring, detection, alarm and automatic transfer of safety-related buses to the alternate source is accomplished when an OPC occurs.

The applicant responded to RAI 08.02-1 on August 29, 2014, (ADAMS Accession No. ML14241A556). In its response, the applicant stated, in part, that detection of OPC is alarmed in the MCR so that operators can take manual action, as appropriate, and initiate corrective actions to address the loss of phase condition. BL 2012-01 includes guidance for protection systems to automatically initiate protective actions without manual actions as required by 10 CFR 50.55a(h)(3). Since the response to RAI 08.02-1 described manual actions when an OPC is detected, the staff issued RAI 08.02-2 requesting the alarm and automatic response to an OPC and UPC. In the response to RAI 08.02-2 (ADAMS Accession No. ML15271A170), the applicant proposed design features to automatically detect OPC and UPC and alarm in the MCR, under all operating electrical system configurations and plant loading conditions. The applicant also proposed DCD Tier 1, Section 2.12.1, Electrical Power Distribution System, ITAAC Item Nos. 26 through 30 to ensure that both OPC and UPC can be detected and alarmed in the MCR, and that the safety-related buses can be automatically separated from the offsite power source and transfer safety-related loads to the un-affected offsite power source or the emergency diesel generators when an OPC or UPC occurs.

The applicant supplemented its response to RAI 08.02-2 in letters dated May 24, 2016 (ADAMS Accession No. ML16145A346), and December 14, 2016 (ADAMS Accession No. ML16349A171) to provide additional information, clarification, and updates to the ABWR DCD.

Also, in the December supplemental response to RAI 08.02-2, the applicant replaced DCD Tier 1, Table 2.12, ITAAC Item Nos. 26 through 30 with revised ITAAC Items Nos. 28, 29, and 30 to address OPC and UPC, and deleted DCD Tier 1 Table 2.12, ITAAC Items 26 and 27, which are shown as deleted items in DCD Tier 1, Table 2.12.1. The following includes the GEH changed design features and ITAAC:

8-3

ABWR DCD design features to detect and alarm in the MCR:

  • Non-safety-related relays on the primary and secondary side of the MPT are designed to monitor OPC. Alarm is initiated in the MCR if OPC conditions are detected.
  • Non-safety-related relays on the primary and secondary sides of the UATs and RAT are designed to automatically sense the loss of a single phase (or multiple phases) and loss of phase with ground during all plant operating scenarios and loading conditions. Alarm is initiated in the MCR if OPC conditions are detected.
  • Non-safety-related relays on the primary and secondary sides of the UATs and RAT that automatically sense an unbalanced phase during all plant operating scenarios and loading conditions. Alarm is initiated in the MCR if UPCs are detected.

ABWR DCD Revised ITAAC:

  • DCD Tier 1, Table 2.12.1, ITAAC Item No. 28, to verify that the non-safety-related microprocessor based protective relays at the MPT, UATs, and RAT upon detection of OPCs, will: (1) alarm in the MCR; (2) trip or fast transfer, the non-safety-related buses.
  • DCD Tier 1, Table 2.12.1, ITAAC Item No. 29 to verify the non-safety-related microprocessor based protective relays located on the feeders from offsite to the safety-related buses will: (1) detect unbalanced phase condition (UPC); (2) send an alarm to the MCR; and (3) send a trip signal to open the non-safety-related circuit breakers.
  • DCD Tier 1, Table 2.12.1, ITAAC Item No. 30 to verify that the safety-related microprocessor based protective relays located on the safety-related buses will: (1) trip or fast transfer, power to alternate non-safety-related power source if the alternate power source is available; or (2) isolate the safety-related bus, shed safety-related loads, start the safety-related emergency diesel generator if no alternate source is available.

The DCD Tier 1, Table 2.12.1, ITAAC Item No. 29 and ITAAC Item No. 30 are evaluated in Section 8.3.3.17 of this FSER supplement. Additionally, in the response to RAI 08.02-2, the applicant indicated that the ABWR design follows the guidance in BTP 8-9, as stated in DCD Tier 2, Table 1.8-19, Standard Review Plans and BTP Applicable to ABWR.

In summary, the applicant provided design features that would automatically detect OPCs and alarm in the MCR under all operating electrical system configurations and plant loading conditions. The design features include the addition of non-safety-related relays on the primary and secondary sides of the MPT, UATs and the RAT to automatically detect and alarm in the MCR when OPC occurs. ABWR DCD Tier 2, Section 8.3.1.0.6.3, Bus Protection, describes the design features of the relays on the MPT, UATs, and RAT that include automatic sensing for loss of a single phase (or multiple phases) and loss of phase with ground during all plant operating scenarios and loading conditions, and alarm in the MCR. In DCD Tier 1, Section 2.12.1, and Table 2.12.1, describe the design features to detect and alarm an OPC as discussed above.

In addition, implementation of protection features for OPC and UPC offsite power systems would be adequately addressed by providing an ITAAC to verify that the detection/alarm is constructed in accordance with the design. Furthermore, the procedures and the training for the detection/alarm scheme should provide assurance that the electrical power system will address 8-4

the loss of one or more of the three phases of the offsite power circuit during the life of the plant.

These steps would ensure that with adequate capacity and capability, the ac power from the offsite power system would be available to safety-related equipment to meet the intended safety functions in accordance with GDC 17 requirements.

Since the MPT, UATs, and RAT have non-safety-related relays on the primary and secondary sides to automatically detect and alarm in the MCR when OPC occurs, this design feature satisfies the BTP 8-9 criterion for automatic detection and the triggering of an alarm in the MCR upon detection of an OPC. Therefore, the staff finds that the ABWR OPC detection and alarm design as described in the ABWR DCD, Revision 7, is acceptable and conforms to BTP 8-9.

The staff evaluation of the ITAAC is further discussed below.

Offsite System UPC Detection and Alarm - UATs and RAT The applicants response to RAI 08-02, GEH explained that the design features include additional capabilities to detect UPC at the UATs and RAT. It is important to note that the UPC is an additional feature provided by the applicant that is outside the scope of BTP 8-9. A UPC will be automatically detected and alarmed in the MCR under all operating electrical system configurations and plant loading conditions. DCD Tier 2, Section 8.3.1.0.6.3, explains that the relays on the primary and secondary sides of the RAT and the UATs are used to monitor UPCs in any combination on all three phases. Alarms in the MCR alert the operator to an abnormal condition. Therefore, the staff finds that the UPC design described in the ABWR DCD, Revision 7, which includes the UPC detection capabilities at the UATs and RAT and alarm in the MCR, is acceptable.

ITAAC for Offsite System OPC Detection and Alarm The staff finds that the use of DCD Tier 1, Table 2.12.1, ITAAC Item No. 28, to verify that design features associated with detection and alarming of OPC in the MCR described in the ABWR DCD, Revision 7, is acceptable. Specifically, the design commitment of ITAAC Item No. 28, verifies that the non-safety-related relays on the MPT, UATs, and RAT will be able to detect OPC or faults, then trigger an alarm in the MCR and transfer to non-safety-related buses. A COL applicant is required by ITAAC Item No. 28, to perform a test of the as-built relays on the MPT, UATs, and RAT to ensure that OPC and faults can be detected and alarmed in the MCR.

The staff finds that the ITAAC will confirm that the relays used to detect OPC can detect OPC in any combination of the three phases and demonstrate the relay setpoints are set according to the setpoint methodology. The setpoint methodology has been evaluated by the staff in Section 7.2.7 of NUREG-1503, the staff FSER for the original ABWR DC. In addition, DCD Tier 2, Table 1.9-1, Summary of ABWR Standard Plant COL License Information, COL Information Items 8.16, Mitigation of Open Phase Condition on RAT and UATs, and 8.17, Mitigation of Open Phase Condition on Main Power Transformer (MPT), are provided in DCD Tier 2, Sections 8.3.4.10 and 8.3.4.11, requires the COL applicant to develop procedures and train operators on how to respond to MCR alarms and protective actions indicating abnormal conditions including OPC on the MPT, RAT, and UATs. The staff finds that DCD Tier 1, Table 2.12.1, ITAAC Item No. 28, is acceptable because the COL applicant is required to verify that the as-built design can automatically detect an OPC at the high side of the transformers (MPT, UATs, and RAT),

and alarm in the MCR, when an OPC occurs.

The applicant provided the necessary information in the ABWR DCD, Revision 7, which incorporated the changes in the applicants responses to RAI 08.02-1 and RAI 08.02-2.

8-5

Therefore, Confirmatory Item 8.2-1 from the staffs advanced safety evaluation with no open items for the ABWR DC renewal is resolved and closed.

8.2.5.4 Conclusion The staff finds that the ABWR DCD descriptions and design modifications are acceptable because they conform to the guidance in BTP 8-9 for automatic detection and alarm of OPC and therefore, meet the requirements in GDC 17 (1997), for the offsite electric power system to ensure the proper functioning of SSCs important-to-safety, and the ITAAC Item No. 28, meet the requirement in 10 CFR 52.47(a)(1)(vi) (1997), to ensure that the design changes will be constructed and operated based on design changes reflected in the ABWR DCD, Revision 7.

8.3.3.17 NRC Bulletin 2012-01: Design Vulnerability in Electric Power System 8.3.3.17.1 Regulatory Criteria This supplemental FSER section discusses the staffs evaluation of the design information in the GEH ABWR DCD, Revision 7, that addresses the vulnerability identified in BL-2012-01 has been evaluated. As discussed in Section 8.2.5, of this FSER supplement, the staff issued BL-2012-01, to confirm that all holders of operating licenses and COLs for nuclear power reactors comply with 10 CFR 50.55a(h)(3), and GDC 17 or principal design criteria specified in the FSAR. Specifically, the NRC requested licensees to provide information on (1) the protection scheme to detect and automatically respond to a single-phase open circuit condition or high impedance ground fault condition on GDC 17 power circuits, and (2) the operating configuration of ESF buses at power.

The applicant updated the ABWR DCD, Revision 7, with modifications related to the design vulnerability in the electric power system initiated by an OPC to ensure compliance with NRC regulations applicable and in effect at initial certification. Therefore, the updated design changes are modifications, as that term is defined in Chapter 1 of this FSER supplement and will be evaluated using the regulations applicable and in effect at the initial ABWR certification.

The following requirements provide the regulatory basis for the staffs review of the ABWR DCD, Tier 1 and Tier 2, modifications to address NRC BL 2012-01.

  • GDC 17 (1997) Electric Power Systems, as it relates to the electric power systems (1) capacity and capability to permit functioning of SSCs important to safety, (2) independence, redundancy, and availability, and (3) provisions to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit, the loss of power from the transmission network, or the loss of power from the onsite electric power supplies.
  • 10 CFR 50.55a(h) (1997), Codes and Standards - Protection Systems, requires that for construction permits issued after January 1, 1971, protection systems must meet the requirements set forth in editions or revisions of the Institute of Electrical and Electronics Engineers (IEEE) Standard (Std.) Criteria for Protection Systems for Nuclear Power Generating Stations, (IEEE Std. 279) in effect on the formal docket dates of the application for a construction permit. Protection systems may meet the requirements set forth in subsequent editions or revisions of IEEE Std. 279 that become effective.

8-6

  • 10 CFR 52.47(a)(1)(vi) (1997), Contents of applications, which states that an application for design certification must contain proposed ITAAC criteria which are necessary and sufficient to provide reasonable assurance that; if the tests, inspections and analyses are performed and the acceptance criteria met, a plant that references the design is built and will operate in accordance with the design certification.

Acceptance criteria adequate to meet the above regulatory requirements include:

  • Regulatory Guide (RG) 1.75, Physical Independence of Electric Systems, Revision 2, September 1976, as it relates to the isolation between Class 1E buses and loads designated as non-Class 1E.
  • IEEE Std. 279-1971, IEEE Standard: Criteria for Protection Systems for Nuclear Power Generating Stations, as it relates to Class 1E protection systems.
  • IEEE Std. 308-1980, IEEE Standard Criteria for Class 1E Power Systems for Nuclear Power Generating Stations, as it relates to components, equipment, or systems used to provide isolation protection.
  • IEEE Std. 384-1981, IEEE Standard Criteria for Independence of Class 1E Equipment and Circuits, as it relates to the separation of Class 1E and non-Class 1E circuits.

The purpose of BTP 8-9 is to provide guidance to the staff in reviewing various licensing actions related to electric power system design vulnerability due to OPCs in offsite electric power systems in accordance with GDC 17 or principal design criteria specified in the FSAR, 50.36(c)(2), 10 CFR 50.36(c)(3), 10 CFR 50.55a(h)(2), and 10 CFR 50.55a(h)(3).

The ABWR design was approved based on 10 CFR 50.55a(h) (1997), which requires that protection systems meet the IEEE Std. 279 requirements. BTP 8-9 states in part that protection scheme should comply with applicable requirements including 10 CFR 50.55a(h)(2), which require compliance with IEEE Std. 279-1971 or IEEE Std. 603-1991, Criteria for Safety Systems for Nuclear Power Generating Stations. Therefore, both 10 CFR 50.55a(h) (1997) and 10 CFR 50.55a(h)(2) includes the same requirement for the protection systems, in that both regulatory requirements require that the protection systems meet the requirements in IEEE Std. 279-1971.

8.3.3.17.2 Summary of Technical Information The ABWR DCD modifications include (1) DCD Tier 1, Section 2.12.1, Electric Power Distribution System, description of the safety-related design features used to protect the safety-related buses, (2) DCD Tier 1 Table 2.12.1, ITAAC Item No. 30, for verification that the safety-related relays can protect the safety buses when an OPC occurs at designated relay setpoint and (3) DCD Tier 2, Section 8.3.1.0.6.3, Bus Protection, and DCD Tier 2, Section 8.3.1.1.6.3, Bus Protection, provides description of the bus protection scheme in response to an OPC.

8.3.3.17.3 Technical Evaluation The scope of the evaluation in this section is limited to the mitigation aspects of OPC protection as described in BTP 8-9, for the onsite Class 1E power system. DCD Tier 2, Section 8.2.5 discusses the aspects regarding detection, and alarms, as described in the guidance outlined in BTP 8-9, for the offsite power system. In addition, DCD tier 2, Section 8.2.5 provides 8-7

information about the RAIs associated with BL 2012-01 for the OPC. The review of this section associated with the protection features to provide a response to an OPC is to determine whether the design features comply with the 10 CFR 50.55a(h) (1997) and GDC 17 (1997) requirements, conforms with BTP 8-9, and whether the applicable ITAAC meets the requirements in 10 CFR 52.47(a)(1)(vi) (1997).

Safety-Related Protection Features The staff reviewed the applicants responses to RAI 08.02-02, supplemented in letters dated May 24, 2016, and December 14, 2016, and the ABWR DCD, Revision 7 (Tier 1 and Tier 2),

modifications to the ABWR electrical system design to ensure that the design includes features to protect safety-related systems so that power can be transferred from offsite power source to the onsite power sources due to an OPC event. In the discussion provided below, the staff also reviewed the OPC modifications to ensure that electrical isolation between safety and non-safety-related systems were maintained.

The design features incorporated in the ABWR DCD Revision 7, to protect the safety-related systems from OPC, include a safety-related bus protective relay controlling the safety-related circuit breaker. In its response to RAI 08.02-2 dated December 14, 2016, the applicant explained that the safety-related relay controlling the safety-related circuit breaker will automatically separate the safety-related bus from the non-safety-related bus fed by the UAT normal preferred power with detection of OPC or ground faults. The applicants response, included DCD markups to DCD Tier 2, Section 8.3.1.1.6.3, Bus Protection, that stated that the bus protection scheme automatically senses loss of a single, or multiple phases, and loss of phase with ground during all plant operating scenarios and loading conditions. In addition, the safety-related relays include design features to detect UPCs. The applicant has incorporated all these changes into the ABWR DCD, Revision 7.

The guidance in BTP 8-9 states that if offsite power circuit(s) is (are) functionally degraded due to OPCs, and safe-shutdown capability is not ensured, then the ESF buses should be designed to transfer automatically to the alternate reliable offsite power source or onsite standby power system within the time assumed in the accident analysis and without actuating any protective devices, given a concurrent design basis event. In the response to RAI 08.02-2, dated December 14, 2016, the applicant stated that the safety buses are normally loaded such that a fault (including a phase loss) is detected. The staff notes that for a normally loaded bus it is easier to detect a fault (including a phase loss) than for a lightly loaded bus due to the sensitivity of the protection system relays; detecting OPC in a lightly-loaded bus would require sensitivity for lower currents. Further, in the applicants response to RAI 08.02, GEH explained that the two safety-related buses, normally connected to UATs, will fast transfer at the safety bus level.

If the fast transfer is successful, the safety electrical loads will be sequenced to the RAT. If the fast transfer is not successful, the emergency diesel generators (EDGs) will be started automatically and the safety-related electrical loads will be sequenced on to the safety-related buses as part of the EDG loading sequence. In addition, the applicant stated that the above will occur within the time frame assumed in the accident analysis and without actuating any unnecessary protective devices, given a concurrent design basis event.

The modified OPC description in DCD Tier 1, Section 2.12.1, Electrical Power Distribution System, describes the isolation between the safety-related and non-safety-related electric power systems and states that the electric power to safety-related buses is provided through two feeder circuit breakers (one Class 1E and one non-Class 1E) in series. RG 1.75, Revision 2, which endorses IEEE Std. 384-1981 and IEEE Std. 308-1980 for circuit breakers 8-8

or fuses that are automatically opened by fault current, which specifies that Class 1E breakers are an acceptable method for isolation between the Class 1E and the non-Class 1E systems.

The staff evaluated the modification and finds that the safety-related breakers, which are in series with the non-safety breakers provides separation between safety-related and non-safety systems in the two-breaker scheme. Therefore, the staff determined that the safety-related breakers provide adequate separation between the safety-related and non-safety systems and satisfies the guidance described in RG 1.75, Revision 2.

Additionally, in RAI 08.02-02, the staff requested the applicant explain how the design addresses a protection scheme to demonstrate compliance with applicable requirements including single failure criterion for safety-related systems as specified in GDC 17, and 10 CFR 50.55a(h)(3). 10 CFR 50.55a(h)(3) requires compliance with IEEE Std. 603-1991, Standard Criteria for Safety Systems for Nuclear Power Generating Stations, as endorsed by RG 1.153, Criteria for Safety Systems, Revision 1, June 1996. The staff asked the RAI with respect to 10 CFR 50.55a(h)(3), but 10 CFR 50.55a(h) (1997) is applicable for the GEH ABWR design pertaining to the protection systems, which are required to meet the IEEE Std. 279-1971 requirements. In addition, RAI 08.02-2 requested that the applicant explain how the safety-related protection system design addresses a single failure due to OPC or failure in the non-safety-related protection system, such that the safety-related system is not prevented from performing its intended safety function.

In its response to RAI 08.02-2, the applicant explained that the design conforms to the IEEE Std. 603single failure criterion because the safety-related protective relays and safety-related sequencing logic on each of the three safety-related buses are independent of those on the other safety-related buses. The staff notes that both IEEE Std. 603-1991 and IEEE Std. 279-1971 establish the single failure criterion for protection systems. The staff evaluated the response to RAI 08.02-2 pertaining to the single failure criterion, based on meeting the requirements in IEEE Std. 279-1971. IEEE Std. 279-1971, states in part that the protection system shall automatically initiate appropriate protective action, and that any single failure within the protection system shall not prevent proper protective action at the system level. The staff evaluated the information and finds that the safety-related protective relays on the safety buses satisfies the IEEE Std. 279 requirements for ensuring that any single failure within the protection system will not impact the protection system actions, since the safety-related buses and the respective protective relays are independent of each other. The staff finds that the design satisfies the IEEE Std. 279-1971 single failure criterion requirements for the OPC protection scheme, and therefore complies with 10 CFR 50.55a(h) (1997) for safety systems.

The applicant added DCD Tier 1, Table 2.12.1, ITAAC Item No. 30, to verify the safety-related protective relays located on the safety-related buses to protect against loss of phase(s) condition. Specifically, the design commitment of ITAAC Item No. 30, verifies that safety-related relays will protect against OPC by transferring to an alternate source. The DCD Tier 1, Table 2.12.1, ITAAC No. 30, requires the COL applicant to perform a test of the as-built safety-related relays. The established relay setpoint is used to ensure that a transfer to the alternate power source or onsite source is accomplished when on OPC occurs. The staff evaluation of the ITAAC is discussed in the section titled ITAAC for the Transfer Alternate Offsite Power Source, in this SER section supplement below.

Since the ABWR design to mitigate OPC includes features to protect safety-related systems so that power can be transferred from offsite power source to the onsite power sources due to an OPC with or without ground fault conforms to the guidance in BTP 8-9, provides adequate separation between the safety and non-safety systems satisfying the guidance in RG 1.75, 8-9

Revision 2, and satisfies the single failure requirements in IEEE Std. 279-1971. Therefore, the staff finds the ABWR OPC design acceptable with respect to the OPC mitigation.

Technical Specifications Regarding the testing of the safety-related protection features during the operation of the plant, the certified ABWR DCD technical specifications (TS) surveillance (SR) 3.3.8.1.3, requires the performance of a system functional test, which demonstrates that the safety-related relays can actuate at the prescribed setpoint. The setpoint methodology, as discussed in Section 8.2.5 of this supplemental FSER, will establish the setpoints for the safety-related relays used for protection against OPC. In addition, the safety-related relays will be tested to ensure that relays are able to protect the safety-related buses against an OPC. Thus, the methodology for determining the setpoints for the safety-related relays for protection against OPC is established in the ABWR DCD, Revision 7. In addition, TS SR 3.3.8.1.3 requires performance of a system functional test to demonstrate system actuation from a simulated or actual signal. Therefore, the staff finds that the safety-related protection features will be tested per the applicable TS requirements, and the setpoints are established based on the methodology described in the ABWR DC, and therefore, are acceptable.

Non-Safety-Related Protection Features The non-safety-related protection design features includes non-safety-related relays which are located at the MPT, UATs, and RAT. The OPC detection features of the non-safety-related relays protects the safety buses by isolating the incoming feeders through the opening of the non-safety feeder breakers, which are in series with the safety-related feeder breakers.

Therefore, power is disconnected to the safety-related buses by opening the non-safety circuit breaker(s). DCD Tier 1, Table 2.12.1, ITAAC Item No. 28, will then be used to verify that upon a detection of OPC or fault at the transformers, a trip or a fast transfer of the non-safety-related buses to the alternate power source (RAT) will occur. As discussed in the response to RAI 08.02-2, in the event of a fault including loss of phase, the safety buses on the UATs will fast transfer to the RAT, and the fast bus transfer is alarmed in the MCR. If the fast transfer is successful, the safety electrical loads will be sequenced to the RAT. If the fast transfer is not successful, the EDGs will be started automatically and the safety electrical loads will be sequenced on to the safety-related buses as part of the EDG loading sequence as described in the ABWR DCD Chapter 8. The applicant also explained that the sequence of events discussed above will occur within the time frame assumed in the accident analysis and without actuating any unnecessary protective devices, given a concurrent design basis event. The staff evaluated and finds this aspect of the design acceptable because the implemented design features detect an OPC, provide an alarm in the control room, and ensure power is provided from either the RAT or the EDGs, and, therefore, meets the guidance in BTP 8-9.

ITAAC for the Transfer Alternate Offsite Power Source DCD Tier 1, Table 2.12.1, ITAAC Item No. 28, will be used to verify that upon a detection of OPC or fault at the transformers, a trip or a fast transfer of the non-safety-related buses to the alternate power source (i.e., RAT) will occur. In ITAAC Item No. 28, the COL applicant is required to perform a test of the as-built MPT, UAT, and RAT non-safety-related relays at designated setpoints. This design configuration and ITAAC will verify when an OPC is detected, that a trip or a fast transfer of the non-safety-related buses to the alternate power source (RAT) will occur. The staff evaluated this design configuration and finds that DCD Tier 1, Table 2.12.1, ITAAC Item No. 28, is acceptable because the COL applicant will be required to verify that the 8-10

as-built non-safety relays will detect OPC, trip or fast transfer, of the non-safety-related buses to the alternate power source, when an OPC occurs.

ITAAC for the Mitigation of UPC DCD Tier 1, Table 2.12.1, ITAAC Item No. 29 will be used to verify the non-safety-related protective relays located on the feeders from offsite to the safety-related buses will: (1) detect UPC, (2) send an alarm to the MCR, and (3) send a trip signal to open the non-safety-related circuit breakers. The inspection, test and analyses of ITAAC Item No. 29, require the COL applicant to perform a test of the as-built non-safety-related relays for UPC at designated setpoints. The staff evaluated and finds that this design configuration and ITAAC will verify when UPC is detected, that the non-safety-related feeders are disconnected by the opening of the non-safety feeder breakers. The staff also finds that DCD Tier 1, Table 2.12.1, ITAAC Item No. 29, is acceptable because the COL applicant will be required to verify that the as-built non-safety relays will detect UPC, alarm in the MCR, and open the power feeder breakers, when a UPC occurs.

ITAAC for the Onsite System Mitigation of OPC As discussed in Section 8.2.5 of this FSER supplement, the DCD Tier 1, Table 2.12.1, ITAAC Item No. 28, will verify that upon a detection of OPC or fault at the transformers, a trip or a fast transfer of the non-safety-related buses to the alternate power source (i.e., RAT) will occur. In the applicants response to RAI 08.02-2, GEH explains that in the event of a fault including loss of phase, the safety buses on the UATs will fast transfer to the RAT, and the fast bus transfer is alarmed in the MCR. If the fast transfer is successful, the safety electrical loads will be sequenced to the RAT. If the fast transfer is not successful, the EDGs will be started automatically and the safety electrical loads will be sequenced on to the safety-related buses as part of the EDG loading sequence as described in the ABWR DCD Chapter 8. The applicant also explained that the sequence of events discussed above will occur within the time frame assumed in the accident analysis and without actuating any unnecessary protective devices, given a concurrent design basis event. The staff evaluated this information and finds this ITAAC acceptable because it will be used to verify that the relays can detect OPC and initiate a trip, or fast transfer, to an alternate source at the designated relay setpoint.

DCD Tier 1, Table 2.12.1, ITAAC Item No. 30, is used to verify that safety-related protection relays which control the normal and alternate feeder circuit breakers are able to protect the safety-related loads against loss of phase(s) conditions. DCD Tier, Table 2.12.1, ITAAC Item No. 30, requires the performance of a test on the safety-related protective relays to demonstrate that at the designated relay setpoint, the relays will automatically: (1) trip the safety-related circuit breakers or fast transfer, if the alternate power source is available, or (2) start and transfer loads to the EDG if the alternate power source is unavailable. The staff evaluated this information and finds that DCD Tier 1, Table 2.12.1, ITAAC Item No. 30, is acceptable because the COL applicant will be required to verify that the as-built relay design automatically transfers the safety-related loads to the alternate source or EDG when an OPC occurs.

The applicant provided the necessary information in the ABWR DCD, Revision 7, which incorporated the appropriate changes described in the applicants responses to RAI 08.02-02.

Therefore, Confirmatory Item 8.3.3.17-1 from the staff advanced SER with no Open Item for the ABWR DC renewal is resolved and closed.

8-11

8.3.3.17.4 Conclusion The staff finds that the design modifications, to ABWR DCD Revision 7, to add safety-related protection relays to protect against OPC, including ITAAC, and descriptions conform to the guidance in BTP 8-9 as it relates to the protection features to mitigate and provide a response to the OPC event, and hence, complies with GDC 17 (1997) as it pertains to OPC. The staff also finds that the ABWR DCD Revision 7 OPC design complies with 10 CFR 50.55a(h) (1997) for safety systems, since the relays to mitigate OPC events, are separate and independent for each safety-related division.

8-12

References

1. 10 CFR 50.55a, Codes and Standards.
2. 10 CFR 50.36, Technical Specifications.
3. 10 CFR Part 50, Appendix A, General Design Criteria for Nuclear Power Plants.
4. 10 CFR Part 50, Appendix A, GDC 17, Electric Power Systems, 1997.
5. 10 CFR Part 52, Appendix A, Design Certification Rule for the U.S. Advanced Boiling Water Reactor.
6. 10 CFR 52.47, Contents of Applications; Technical Information.
7. NRC,Bulletin 2012-01, Design Vulnerability in Electric Power System, July 2012 (ADAMS Accession No. ML12074A114).
8. NRC, NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants, (LWR Edition), Chapter 8, Branch Technical Position 8-9, Open Phase Conditions in Electric Power System, July 2015 (ADAMS Accession No. ML15057A085).
9. NRC, NUREG-1503, Final Safety Evaluation Report Related to the Certification of the Advanced Boiling Water Reactor Design, July 1994 (ADAMS Accession No. ML080670592).
10. NRC, NUREG-1503, Final Safety Evaluation Report Related to the Certification of the Advanced Boiling Water Reactor Design, Supplement 1, May 1997 (ADAMS Accession No. ML080710134).
11. NRC, RG 1.153, Criteria for Safety Systems, Revision 1, June 1996 (ADAMS Accession No. ML003740022).
12. NRC, RG 1.75, Physical Independence of Electric Systems, Revision 2, September 1976 (ADAMS Accession No. ML003740265).
13. GEH, ABWR Standard Plant Design Certification Renewal Application Design Control Document, Revision 5, Tier 1 and Tier 2, December 2010 (ADAMS Accession No. ML110040323).
14. GEH, ABWR Standard Plant Design Certification Renewal Application Design Control Document, Revision 6, Tier 1 and Tier 2, February 2016 (ADAMS Accession No. ML16214A015).
15. GEH, ABWR Standard Plant Design Certification Renewal Application Design Control Document, Revision 7, Tier 1 and Tier 2, December 2019 (ADAMS Accession No. ML20007E371).
16. IEEE Std. 279-1971, IEEE Standard: Criteria for Protection Systems for Nuclear Power Generating Stations.

8-13

17. IEEE Std. 308-1980, IEEE Standard Criteria for Class 1E Power Systems for Nuclear Power Generating Stations.
18. IEEE Std. 384-1981, IEEE Standard Criteria for Independence of Class 1E Equipment and Circuits.

8-14

Retrieved from "https://kanterella.com/w/index.php?title=ML20073K258&oldid=3514793"