ML20095F401
| ML20095F401 | |
| Person / Time | |
|---|---|
| Site: | Davis Besse  |
| Issue date: | 12/13/1995 |
| From: | Stetz J CENTERIOR ENERGY |
| To: | NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM) |
| References | |
| 2346, NUDOCS 9512180434 | |
| Download: ML20095F401 (23) | |
Text
..
t 1
g CENTERf0R
,W ENERGY 300 Mod 6 son Avenue Jehe P. $8ett fo6edo. OH 43652 0001 Vice President. Nuclear 419 249 2300 Davis 8 esse Docket Number 50-346 License Number NPF-3 Serial Number 2346 December 13, 1995 United States Nuclear Regulatory Commission Document Control Desk Washington, D. C. 20555
Subject:
Additional Information for Proposed Modification to the Davis-Besse Nuclear Power Station (DBNPS), Unit Number 1, Facility Operating License NPF-3, Appendix A Technical Specifications to Revise Technical Specification 3.8.1.1 - A.C. Power Sources, Operating
Reference:
License Amendment Request 95-0005 Submitted under Toledo Edison Letter Serial Number 2292, dated June 1, 1995 Ladies and Gentlemen:
By letter dated November 22, 1995, (Toledo Edison Log Number 4645) the Nuclear Regulatory Commission (NRC) issued a request for additional infor-mation (RAI) regarding License Amendment Request (LAR) 95-0005.
The enclosure to this letter contains Toledo Edison's response to the RAI.
License Amendment Request 95-0005 was submitted by Toledo Edison to the NRC as a plant-specific Cost Beneficial. Licensing Action (CBLA).
As identified in the NRC's Administrative Letter 95-02, dated February 23, 1995, the NRC's CBLA Program provides a more expeditious review and increased NRC management attention for requests that seek to modify requirements where the effeet on safety due to the modification is small and the cost savings to a licensee is significant.
License Amendment Request 95-0005 provides justification that the adverse effect on safety due to extending the 1
Allowed Outage Time for a single Emergency Diesel Generator from three days to seven days is insignificant and that this change will achieve a poten-
)
tial savings of $3,150,000 (1995 dollars) over the DBNPS's remaining life exclusive of replacement power costs.
1 This CBLA request meets the situation described in Item 11 of Attachment 1 to NRC Administrative Letter 95-02 with regards to modifying an action which would save time in a refueling outage. Attachment 1 to Administrative Letter 95-02 also states that the NRC Regulatory Review Group /CBLA group will ensure that CBLA's are reviewed before other priority 3 or priority 4 licensing action work.
~ 9512180434 951213 PDR ADOCK 05000346 I
P.
PDR Ope <chng Compenses a y f',,
Og \\i Clevetond Electnc illummahng b 4{U I1 fT Toledo Edison
. ~.
l.
Docket Number 50-346 License Number NPF-3 Serial Number 2346 Page 2 Toledo Edison is appreciative of the NRC staff's efforts to implement the goals of the CBLA program by processing License Amendment Request 95-0005 on a timely basis.
In order to facilitate the planning of the Spring 1996 refueling outage and the following operating cycle, Toledo Edison requests that the NRC approve and issue this change by January 31, 1996.
Should you have any questions or require additional information, please contact Mr. Peter W. Smith, acting Manager - Regulatory Affairs, at (419) 321-7744.
Very truly yours, Enclosure cc:
L. L. Gundrum, DB-1 NRC/NRR Project Manager E. V. Imbro, Director Regulatory Review Group /CBLA Programs H. J. Miller, Regional Administrator, NRC Region III S. Stasek, DB-1 URC Senior Resident Inspector J. R. Williams, Chief of Staff, Ohio Emergency Management Agency, State of Ohio (NRC Liaisoa)
Utility Radiological Safety Board
Docket Number 50-346 License Number NPF-3 Serial Number 2346 Enclosure Page 1 ADDITIONAL INFORMATION FOR PROPOSED MODIFICATION TO THE DAVIS-BESSE NUCLEAR POWER STATION, UNIT NUMBER 1, FACILITY OPERATING LICENSE NPF-3, APPENDIX A TECHNICAL SPECIFICATIONS, TO REVISE TECHNICAL SPECIFICATION 3.8.1.1 - A.C.
POWER SOURCES, OPERATING (TAC No M92532)
Toledo Edison's license amendment application for a seven-day allowed outage time for one emergency diesel generator inoperable is based on the existing design and licensing basis for the Davis-Besse Nuclear Power Station (DBNPS). As stated in the DBNPS Updated Safety Analysis Report (USAR) three independent circuits are provided to supply power to the onsite electrical distribution system, and with two circuits in service, as required by the DBNPS Technical Specifications, the requirements of General Design Criterion 17 are fulfilled. As stated in NUREG-0136, " Safety Evaluation Report for The Davis-Besse Nuclear Power Station," and in the DBNPS USAR the completion of starting and loading of one emergency diesel generator is adequate to satisfy the minimum engineered safety features requirements.
The Station Blackout Diesel Generator installed to meet the requirements of 10CFR50.63, " Loss of All Alternating Current Power," is maintained under appropriate testing and surveillance requirements to ensure operability as required by the NRC Safety Evaluation of the DBNPS Station Blackout Rule dated March 7, 1991, (Toledo Edison Log Number 3421).
It is important to note that the Station Blackout Diesel Generator is not credited in the design basis of the DBNPS for a loss of all alternating current accident as referenced in the DBNPS USAR accident analysis. Toledo Edison's license amendment application did not credit the Station Blackout Diesel Generator, but identified it as existing plant equipment beyond the original DBNPS design basis which further provides assurance that a seven-day allowed outage time for an Emergency Diesel Generator is acceptable.
The questions below were provided by the NRC in its letter to Toledo l
Edison, dated November 22, 1995. Toledo Edison's response follows each question.
1.
In your submittal of June 1, 1995, you stated that the transfer of a 13.8 kV bus between the 'three sources (i.e., three 345 kV lines) can be accomplished either manually or automatically.
However, DBNPS Updated Final Safety Analysis Report (USAR) Section 8.3.1.1.2 states that automatic transfer occurs only from the normal to the reserve sources (i.e., the startup transformers) or between the two reserve power sources; the transfer from either of the startup transformers to the unit auxiliary transformer can only be done manually.
Please describe how the third 345 kV power source (i.e., the unit auxiliary transfor-mer) would become available to supply the 13.8 kV buses automatically in the event that both startup transformers would become inoperable.
If the transfer can only be performed manually please provide an esti-mate of the time necessary to provide powe.r to the 13.8 kV buses.
Would the subject transfer be available in aufficient time following a loss of all onsite alternating current power supplies and the other offsite electric power circuits, to assure thac specified acceptable fuel design limits and design conditions of the reactor coolant pres-sure boundary are not exceeded?
- - -_~.- -
Dochet Number 50-346 License Number NPF-3 Serial Number 2346 l
Enclosure Page 2
RESPONSE
i The following clarifies the automatic or manual transfer of electric power between transformers.
Three offsite powered 345 kV lines connect the Toledo Edison trans-I mission grid to the 345 kV switchyard. The 345 kV switchyard design is a ring bus scheme with ultimate transition to a breaker-and-a-half scheme (see Figures 1, 2 and 3 provided for information only). Three overhead 345 kV lines are provided from the switchyard to the onsite station distribution system.
Each circuit to the onsite distribution system is capable of carrying full station auxiliary loads assuming-the other two circuits are not functioning.
The 345 kV lines to the startup transformers will be available to supply all essential loads automatically following a loss-of-coolant accident.
In addition the 345 kV lines can be made available to supply i
all essential loads by backfeeding through the unit auxiliary transfor-mer in the unlikely event of a loss of all onsite alternating current supplies (i.e., loss of both startup transformers, both emergency diesel generators, and the loss of the station blackout diesel genera-tor) by removal of the generator main leads disconnecting links. The i
use of this method is accomplished manually and is controlled by oper-ating procedure DB-OP-02521, " Loss of A.C. Bus Power Sources.' Toledo Edison estimates that this method could be established as a power source to essential loads through the auxiliary transformer in 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.
The normal supply to the onsite distribution system during reactor power operation is the main generator via the unit auxiliary trans-former.
During normal operation each 13.8 kV bus is fed from one of the 13.8 kV secondary windings of the unit auxiliary transformer. The reserve electrical power supply and the startup electrical power sour-ces are the two startup transformers. Normally each startup trans-former is the reserve power source to one of the two 13.8 kV buses of the onsite distribution system.
During startup and shutdown, each 13.8 kV bus is fed from the 13.8 kV secondary winding of either startup transformer. Automatic transfer occurs only from the unit auxiliary transformer to the pre-selected startup transformer or between the two startup transformers. Transfer of the 13.8 kV buses from either of the startup transformers to the unit auxiliary transformer is manual.
As discussed in Toledo Edison's submittal of June 1, 1995, (Toledo Edison letter Serial Number 2292), the loss of all A.C. power (or station blackout) accident has been previously analyzed in the USAR Section 15.2.9, ' Loss of All A.C. Power to the Station Auxiliaries (Station Blackout)." This accident analysis shows that the loss of all A.C. power does not result in excessive pressure in the Reactor Coolant
Docket Number 50-346 License Number NPF-3 Serial Number 2346 Enclosure Page 3 System (RCS) and the natural circulation characteristics of the RCS will assure core decay heat removal and a minimum core DNBR greater than 1.30.
It is important to note that the Station Blackout Diesel Generator is not credited in this accident analysis or for any other USAR accident analysis.
In summary, the DBNPS has three incoming 345 kV lines connected to a ring bus which is tied to two startup transformers and the main generator / unit auxiliary transformer. The 13.8 kV buses (which supply the 4.16 kV essential buses) can be powered from either startup trans-former or the main generator / unit auxiliary transformer.
Automatic transfer occurs only from the unit auxiliary transformer to the pre-selected startup transformer or between the two startup transformers.
Transfer of the 13.8 kV buses from either of the startup transformers to the unit auxiliary transformer is manual.
If there is a loss of offsite power sources, there are two redundant emergency diesel genera-tors which can provide the essential power requirements.
If these redundant emergency diesel generators are unavailable, then the USAR Chapter 15 loss of all A.C. power analysis shows the reactor can be safely cooled. Although not credited in the USAR, a Station Blackout Diesel Generator is also available to provide power ta either train of essential equipment.
References:
Davis-Besse Updated Safety Analysis Report, Sections 3D.1.13, 8,2.1, 8.3.1.1.2, and 15.2.9.
NUREG-0136 " Safety Evaluation Report for The Davis-Besse Nuclear Power Station," Sections 1.2 and 8.2.
2.
The staff is presently concerned that the extensions of EDG A0Ts may increase the mean core damage frequency (CDF) for the station blackout (SBO) events, and impact its resolution.
Provide the calculated CDF for SB0 sequences without the extended allowed outage time (A0T), and the CDF for SB0 sequences with the extended A0T. Also provide the overall unavailability of the EDGs used to calculate the CDFs for the SB0 sequences requested.
RESPONSE
The basemen core damage frequency (CDF) as reported in the DBNPS Individual Plant Examination (IPE) is 6.6E-5/ year. The IPE report delineated the contributions to core damage froquency into the general categories of Transients (86%), LOCAs (9%), Internal Floods (3%),
ISLOCAs (1%), and SGTRs (1%). The specific contribution of station blackout (SBO) events was not previously separately calculated.
The IPE cutsets were reviewed in detail to determine the fraction of total CDF from station blackout events.
For the purposes of this assessment, a cutset was included if all of the three onsite A.C. power sources (i.e., the two emergency diesel generators and the station blackout diesel generator) were unable to perform their function, given a loss of offsite power.
In addition to direct component failures such 4
i
.. ~, --
.- ~-
Docket Number 50-346 License Number NPF-3 l
Serial Number 2346 l
Enclosure Page 4 as failure to start, support system failures such as a loss of compon-ent cooling water supply to the EDGs, ventilation failures, etc., were also included.
Consistent with Toledo Edison's June 1, 1995, submittal when assessing the impact of the proposed extended EDG A0T the overall unavailability of each EDG was assumed to be the current established 10CFR50.65 Maintenance Rule performance criteria value of 1.5%.
Results are as follows:
Percent of baseline IPE CDF from SB0 with present A0T: 20%
Percent of baseline IPE CDF from SB0 with proposed A0T: 21%
Accordingly, the proposed change from a 72-hour A0T to a 7-day AOT results in only a one percent change in the IPE baseline CDF from SBO.
3.
Provide a discussion of the loss of offsite power events at your facil-ity and include a quantitative discussion on how industry data on offsite power losses is compared with your facility.
Also, provide the major electrical component (i.e., busses, transformers, breakers, and EDG) failure rates for the onsite and offsite power sources which were reviewed in the safety assessment.
RESPONSE contains a summary paragraph from the DBNPS IPE report which outlines the treatment of loss of offsite power events. The subsequent pages in Attachment 1 contain a more detailed discussion of this treatment, and are excerpted from the IPE analysis notebooks.
Failure rates for major electrical components, and the respective IPE Report Table from which they were reported are as follows:
Circuit Breaker Fails to open on demand 5.2E-3 IPE Table 3-3 (13.8 kV)
(Plant Specific)
Fails to close on demand 5,2E-3 Fails to remain closed 3.7E-6/hr Circuit Breaker Fails to open on demand 9.4E-4 IPE Table 3-3 (4160 V)
Fails to close on demand 9.4E-4 Fails to remain closed 2.8E-6/hr Diesel Generator Fails to start on demand 1.4E-2 IPE Table 3-3 Fails to run 6.6E-3/hr Electrical Bus Fails to maintain power 4.6E-7/hr IPE Table 3-3 (13.8 kV)
Electrical Bus Fails to maintain power 9.9E-7/hr IPE Table 3-3 (4160 V)
.. - ~
Docket Number 50-346 License Number NPF-3 Serial Number 2346 Enclosure Page 5 Transformer Fails to maintain power 2.lE-6/hr IPE Table 3-2 (13.8 - 4.16 kV)
(Generic)
Switchyard Faults LOOP after reactor trip 7.3E-3/ demand *
- Note: Plant specific LOOP data contains only one event which occurred
~
in 1979, early in plant operation. No other LOOP events have occurred during the subsequent 15 years of DBNPS operations.
Reference Attachment 1, Table 1.
4.
Given that the majority of the 7-day A0T is required for the 6-year i
EDG surveillance / inspection (as opposed to the 18-month or 3-year d
inspection) would a more appropriate proposal for Davis-Besse be a 7-day A0T for the 6-year EDG inspection, and a 3-day A0T for other required maintenance and/or inspections? If not, why not?
RESPONSE
1 As documented in Toledo Edison's response to request for additional information regarding the requested EDG A0T extension (Toledo Edison Serial Number 2334, dated October 20, 1995), the allowed outage time (A0T) under the proposed license amendment would be increased.
However, the increase in plant risk (i.e., the short-term " spike")
during an A0T is, in effect, unchanged from that permissible under the current plant Technical Specification A0T. Accordingly, the proposed Technical Specification change reflected that from a plant risk perspective, a seven-day A0T is comparable to the 72-hour A0T, j'
and that the seven-day A0T need not be specifically tied by Technical Specification requirements to a specific EDG inspection.
As stated in Toledo Edison's license amendment application dated June 1, 1995, EDG performance criteria have been developed as part of the DBNPS 10CFR50.65 Maintenance Rule implementation. As such, the overall long term average unavailability of each EDG will be moni-tored and trended. A value of 1.5 percent for average EDG unavail-i ability has been established as the level above which actions will be taken to reduce the total unavailability of an EDG (i.e., place the i
EDG into the "a(1)" Maintenance Rule category).
Future work which would be enabled by the proposed A0T extensic7 can be accommodated by j
this criterion. Similarly, this criterion will limit the amount of time the seven-day A0T can be exercised.
The 1.5 percent unavailability criterion represents a factor of two increase in the approximate 0.75 percent unavailability per EDG assumed in the DBNPS PRA. Sensitivity calculations indicate a resul-i tant increase in the baseline plant risk of less than 2.5 percent.
An increase of this order is not considered to be significant given the overall uncertainty associated with the baseline CDF estimation.
In performing EDG planned maintenance at power, material and parts will be pre-staged in order to minimize the likelihood of delays during the performance of maintenance. DBNPS administrative pro-cesses require that this maintenance be performed on a continuous work basis (i.e., around the clock until the affected equipment is
. ~ -
Doc'ket Numbar 50-346 License Number NPF-3 Serial Number 2346 Enclosure Page 6 capable of performing its design function) in order to minimize the A0T actually used. Flexibility in scheduling EDG maintenance will assist in avoiding simultaneous outages of risk significant compo-nents.
In addition, performing planned maintenance on-line, as opposed to during an outage, will allow Toledo Edison to better select and schedule the maintenance personnel and focas on the suc-
.cessful completion of the EDG outage.
Given that the short term and long term risk associated with the extended A0T does not result in a significant increase in CDF, and the total amount of time the EDG can be unavailable is limited by the above unavailability criterion for 10CFR50.65 implementation and administrative processes, the seven-day A0T need not be tied to the six-year EDG inspection. Limiting the seven-day A0T to a particular maintenance or inspection would be similar to limiting the existing 72-hour A0T to a particular maintenance or inspection. Not limiting the 72-hour A0T to a particular maintenance or inspection is appro-priate because, similar to the seven-day A0T, the A0T has been shown to be justified regardless of the reason for outage.
Another potential benefit in not tying the seven-day A0T to the six-year EDG inspection is that a justified seven-day A0T would eliminate the need for a NRC notice of enforcement discretion should a situation arise where a three-day A0T is not sufficient time to allow for the restoration of an inoperable EDG, but between four and seven days is sufficient. Absent enforcement discretion under a three-day A0T, the DBNPS would be forced into the less than desirable situation of hot shutdown (Mode 4) and the early part of cold shut-down (Mode 5) when decay heat is high, only one EDG is operable, the reactor coolant inventory is limited, and only electric pumps are available to provide sources of cooling (i.e., main steam is not available).
5.
The staff has recently granted an extension of an A0T to a plant that has installed a wether-protected tie-line from a hydro station used as an AAC source which will be substituted for the inoperable EDG during the extension. The extension was granted provided the certain conditions were met. As part of the rationale for the extended A0T
)
change you credit the use of the Station Blackout Diesel Generator (SBODG).
Please address each of the points below.
- a. In your submittal of June 1, 1995 you state that an accident analysis shows that the loss of all A.C. power does not result in excessive pressure in the Reactor Coolant System (RCS) and the natural circulation characteristics of the RCS will assure j
core decay heat removal and a minimum core DNBR greater than l.30.
Given the above analysis and the use of the SBODG during postulated accidents please identify the operating procedures and the actions necessary to connect the SBODG to the essential buses in the event of a loss of offsite power and the failure of the other EDG.
Docb.c Number 50-346 License Number NPF-3 Serial Number 2346 Enclosure Page 7
- b. During the special safety inspection (reference NRC Inspection Report No. 50-346/93019) conducted on the implementation of the Station Blackout Rule at Davis-Besse the team identified a concern regarding the DC ground detection system for the SBODG, The detection system may not detect high resistance or multiple grounds. These grounds could impact the operation of affected control circuits such that operators may be able to start the diesel generator.
Identify efforts to address this 1993 inspec-tion observation.
- c. Removal from service of safety systems and important non-safety equipment, including offsite power sources, should be minimized during the EDG PM period. Why not identify this prerequisite in the revision to TS Bases 3.0.5?
- d. Voluntary entry into an LCO action statement should not be scheduled when adverse weather is expected. Why not identify this prerequisite in the revision to TS Bases 3.0.5?
- e. If the SBODG will be utilized during the EDG PM period, the TS should contain requirements to demonstrate, before taking an EDG out for an extcnded period, that the SBODG is functional by verifying that the power source is capable of being connected to the safety bus associated with the inoperable EDG, and by veri-fying this capability every 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> thereafter.
Please identify what means will ensure that the SBODG will be operational and functional during the EDG PM period.
RESPONSE
- a. As previously stated in Toledo Edison's license amendment appli-cation dated June 1, 1995, and the DBNPS USAR, the Station Black-out Diesel Generator (SBODG) is not credited in the referenced accident analysis (DBNPS USAR Section 15.2.9).
Operating proce-dure DB-OP- 02521, " Loss of A.C. Bus Power Sources," provides the steps necessary to connect the SBODG to the essential buses.
The NRC staff's special safety inspection for the implementation of the Station Blackout Rule at the DBNPS, Inspection Report 50-346/93023, verified the SBODG could energize the essential buses in 3 minutes and 50 seconds from the onset of SBO.
DBNPS procedures DB-SC-04271, "SBODG Monthly Test," and DB-SC-0427d "SBODG Dead Bus Load Test," demonstrate the SBODG functional re-quirements,
- b. Although this NRC staff observation did not require action, the DBNPS completed a design modification in June 1995. The modifi-cation makes the ground fault detection system more sensitive to moderate and high resistance ground faults and provides for indi-cation of magnitude and polarity
- c. Technical Specification 3.0.5 maintains the safety function by requiring cross train checks when a system, subsystem, train, component or device is determined inoperable solely because one of its power supplies (normal or emergency) is inoperable.
If the
Docket' Number 50-346 License Number NPF-3 Serial Number 2346 Enclosure Page 8 criteria of Technical Specification 3.0.5 are met the system, subsystem, train, component or device may be considered operable.
Removal of a system, subsystem, train, component or device from service would require verification that the requirements of Tech-nical Specification 3.0.5 have been met.
As documented in Toledo Edison's response to request fcc addition-al information regarding the requested EDG A0T extensicn (Toledo Edison Serial Number 2334, dated October 20, 1995), under the DBNPS Maintenance Rule (10CFR50.65) implementation activities, crit eria have been developed for controlling the short-term in-creases in plant risk due to on-line maintenance. The decision 3
criteria have been incorporated into the DBNPS administrative process which utilizes a matrix to perform an assessment of the total plant equipment that is out of service to aid in determining the overall effect on performance of safety functions. The EDGs i
and offsite power sources are included in this matrix.
Equipment configurations outside the scope of this matrix are evaluated on a case-by-case basis.
i Furthermore, specifically adding to TS Bases 3.0.5 the minimizing of removal from service of safety systems and important non-safety i
equipment during the EDG preventive maintenance period is incon-sistent with any requirements which presently exist for the 72-l
-hour ADT and the Bases con:ained in NUREG-1430, Revision 1, Im-proved Standard TechnicA' Specif'. cations (ISTS) for Babcock and Wilcox Plants.
As a side note, adding this restriction to the TS Bases would not be a TS requirement because as stated in 10CFR50.36(a), the Bases are not part of the TS.
i
- d. The focus of Technical Specification 3.0.5 is upon situations where a system, subsyste:a, train, component or device is deter-mined inoperable solely because one of its power supplies (normal or emergency) is inoperable.
4 Consideration of adverse weather conditions on power supplies is an integral part of the decision process required for safe opera-l tion of the DBNPS. This consideration of the potential impact of adverse weather conditions when selectively removing equipment from service is being added to the DBNPS work process guidelines.
Specifically adding to TS Bases 3.0.5 voluntary entry into an LCO Action statement should not be scheduled when adverse weather is expected is inconsistent with any requirements which presently exist for the 72-hour A0T and the Bases contained in NUREG-1430, Revision 1, Improved Standard Technical Specifications (ISTS) for Babcock and Wilcox Plants.
As a side note, adding this restriction to the TS Bases would not be a TS requirement because as stated in 10CFR50.36(a), the Bases are not part of the TS.
i
Dochet Number 50-346 License Number NPF-3 Serial Number 2346 Enclosure Page 9
- e. Toledo Edison's license amendment application for the EDG seven-day A0T did not credit the Station Blackout Diesel Generator, but recognized it as additional equipment installed beyond the ori-ginal design bases which furthe provides assurance that a seven-day allowed outage time for an EDG is acceptable, i
As documented in NRC special safety inspection 50-346/93023 for implementation of the Station Blackout Rule at the DBNPS. periodic test DB-SC-04971, "SBODG Monthly Test" performs a rated load capacity test that is similar to monthly EDG surveillance testing.
The NRC inspection team considered this monthly SBODG testing acceptable.
Inspection follow-up item 50-346/93023-01 was initi-ated to review and approve the SBODG refueling outage test, DB-SC-04274, "SBODG Dead Bus Load Test".
Inspection report 50-346/94008 closed this item based on the NRC inspector's review that the proc' dure was adequate to demonstrate that the SBODG could be starte3 and loaded to design loads while maintaining voltage and fregancy within design limits.
The NRC staff's Supplemental Safety Evaluation for implementation of the Station Blackout Rule at the DBNPS, dated July 1, 1992 stated that the issue regarding the DBNPS EDG reliability program was resolved.
Inspection Report 50-346/93023 stated that the EDG and SBODG reliability program was detailed, appeared to be func-tioning properly and was consistent with the guidance of RG 1.155,
" Station Blackout," and NUMARC 87-00, " Guidelines and Technical j
Basis for NUMARC Initiatives Addressing Station Blackout at Light
^
Water Reactor," Appendix D.
4 As previously discussed, the starting and loading of one emergency diesel generator is adeqtate to satisfy the minimum engineered safety features requiremeits. The current DBNPS Technical Speci-fications provide for demonstrating the operability of the remain-ing EDG and verification that no common mode failure exists, when one EDG is inoperable, by performance of the appropriate surveil-lance test once within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. With one offsite circuit and one EDG inoperable the required demonstration of operability must be completed once within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. The proposed license amendment for extending the EDG A0T maintains these requirements.
These re-4 quirements assure the availability of one onsite A.C. source during accident conditions with an assumed loss of offsite power and single failure of the other onsite A.C. source.
In addition, Toledo Edison has reviewec' the four criteria of 10CFR50.36(c)(2)(ii) with regards to whrh items must be included within the Technical Specifications. The Station Blackout Diesel Generator is not:
A. Installed instrumentation that is used to detect, and indicate in the control room, a significant abnormal degradation of the reactor coolant pressure boundary. (Criterion 1)
~ ~.
Docket Number 50-346 License Number NPF-3 Serial Number 2346 l
Enclosure Page 10 B. A process variable, design feature, or operating restriction that is an initial condition of a design basis accident or transient analysis that either assumes the failure of or pre-sents a challenge to the integrity of a fission product bar-rier. (Criterion 2)
C. A structure, system, or component that is part of the primary success path and which functions or actuates to mitigate a-design basis accident or transient that either assumes the failure of or presents a challenge to the integrity of a fis-sion product barrier. (Criterion 3)
D. A structure, system, or component which operating experience or probability risk assessment has shown to be significant to public health and safety. (Criterion 4)
Accordingly, the Station Blackout Diesel Generator need not be added to the Technical Specifications, and it would be inappropriate to i
reference the testing of this non-Technical Specification equipment in TS 3.0.5.
6.
In your submittal of June 1, 1995, your rationale for the proposed 3
change cited the use of the SBODG and positive control of maintenance planning and scheduling activities.
Please explain why the proposed revision to TS Bases 3.0.5 do not reflect the above rationale.
RESPONSE
legarding the Station Blackout Die 1el Generator, the NRC Safety Evaluation of the DBNPS Station Blackout Rule dated Earch 7, 1991, (Toledo Edison Log Number 3421) stated the application of Technical Specifications to station blackout equipment was an open item.
(Note: This was prior to the issuance of NUREG-1430, ISTS, dated September 28, 1992, and the NRC's Final Commission Policy Statement
)
on Technical Specification Improvements for Nuclear Power Reactors, dated July 22, 1993, which identified items for inclusion into Tech-nical Specifications and did not identify the Station Blackout Diesel Generator as such). Therefore, Toledo Edison was expected to prepare and maintain adequate procedures to reflect the appropriate testing 4
and surveillance requirements to ensure the operability of the i
station blackout equipment. The implementation of this requirement was verified by the NRC's st9cial safety inspection for implemen-tation of the Station Blacko'it Rule the DBNPS documented in Inspec-tion Reports 50-346/93023 ant 50-346/94008.
Toledo Edison's license amendment application dated June 1, 1995, did not credit the use of the Station Blackout Diesel Generator for any accident analysis, nor did the application's section " Maintenance Planning and Scheduling" credit the availability of the Station Blackout Diesel Generator.
Rather, Toledo Edison's license amendment application identified the Station Blackout Diesel Generator as existing plant equipment beyond the DBNPS's original design basis which further provides assurance that a seven-day allowed outage time for an Emergency Diesel Generator is acceptable.
As discussed in
Docket Number 50-346 License Number NPF-3 Serial Number 2346 Enclosure Page 11 Toledo Ed! son's response to item 5.e above, the Station Blackout Diesel Generator does not meet the 10CFR50.36(c)(2)(ii) criteria-for
..nclusion in Technical Specifications. Therefore., it would be in-appropriate to reference this non-Technical Specification' equipment within Technical Specification 3.0.5.
Positive control of maintenance planning and scheduling is imple-mented as part of the 10CFR50.65 Maintenance Rule administrative process to control the combinations of risk significant systems that
-may be scheduled for on-line maintenance. Combinations of risk significant systems that exceed established guidelines require fur-ther management review to determine if the resultant risk is e.ccep-table. Application of Technical Specification 3.0.5 when a power source is inoperable or when removing Technical Specification equip-ment from service is one factor in determining acceptable risk, however it does not address the scope of the Maintenance Rule.
l 1
TO OH10 TO LEMOYNE TO BAYSHORE EDISON CO.
SUBSTATION SUBSTATION
. P -w 1PH
.IPw 34652 34651 34650 Docket Number 50-346
\\ 34625
\\ 34624
\\ 34623 License Number NPF-3
~
g.(WEST) BUS Serial Number 2346 g
Enclosure
)
.igw, 34649 34562F Figure 1
/34626 1
34562 INFORMATION ONLY 345em
)
345640 345610 34564 34561 34564C 34561C 345638 345608 34563 34560 34563A 34648 34560A
.iPm,
- J - ( E AST ) CUS l
>-- M t.
>--A.
%gi, 44 4
F.622 \\
34621 N 34646 ONE LINE DIAGRAM 3462o 345 KV SYSTEM l
MAIN 7 XFRM 1 TO STARTUP TO STARTUP TO MAIN XFMR 02 XFMR 01 GENERATOR (NOTE 2)
I
j l
4
~
M Y
A R
L G M E
A T
N 63 I
S 4 -
D 3F6 Y
O
- P4 S
E 0N3 N
5 2
R V
r O
K I
N rer T
L ebe A
8 b mb R
E O
mum E
L3 N
uNue E
G E
1 N
Nr2 S
G I
N e
u A
T I
t sl se H
N S
enaor P
A I
keil u OS A
ccrcg SU M
oieni IB M
DLSEF R
I R
O E
F N
YI RI N
A I R NN LE IA M
I I
K 0 A R XR v
A2 M T UO E6 AF R4 S
A o
B3 T N cg l
I A i
RHl NR X
l I C UT H "
AT I
OW wf
)
1 T S w3 A
2
(
O go XH "
R E
1 PR UO A
T F l
RS O
AN 1
K 2 A
T A X
E SR H "
6 4
R T
3
,AM m
B 1
R H CI I
T A
IW O
S T
vx, a
2 B
0
'g l
i R
XH "
E R
P O 1
U F T S 8
R N K2 A A 2
A 2 T R X
0 E6 S T H*
R 4 B3
&m m
}l R H I
g, C
I A T I
B OW 1
T S 0
XH "
1
-l il ll
i l
l l
13.8 KY BUS B 13.8 KV BUS A l
Mr INFORMATION ONLY we M M XFMR BD XFMR AC M 1
DIESEL AD213 AD301 STATION GENERATOR 2
_A A
BLACKOUT DIESEL NC
> a NO DIESEL GENERATOR 1 o
g GENERATOR AACC2)
NC ) ABDD2 g
NC 4.16KV BUS D2 4.16KV BUS C2 AACD1
)AC110 )AC101
)AD101)AD110 )
)ABDC1 NO NC NC NO NO NO 4.16KV 4.16KV BUS D1 BUS C1 1
AD108 T AD109 T T AC108 g AC109 No J
NO J
J NO 2 NO r- _ _
lNO l'
Docket Number 50-346 NO NO NO License Number NPF-3 i
Serial Number 2346 l
ACD3 ACD2 ACD5 ACD4 l j
Enclosure i
i s
Figure 3 B
g B
g 4.16KV BUS CD*
l l
SINGLE LINE DIAGRAM 4160 VOLT AUXILI ARY SYSTEM l
l l
I
-. = _
. Dockst Number 50-346 Licensa Number NPt'-3
- Scrial Number 2346 Enclosure Page-12.
W ATTACHMENT 1 (Six Pages Follow)
FRONT F2!D ANAL.YSIS Loss of condenser vacuum. Loss of condenser vacuum was evaluated as a separate initiating event for the Oconee PRA, since such an event would prevent using the turbine-bypass valves to transfer decay heat to the main condenser (in addition to ca.using the loss of main feedwater). For Babcock & Wilcox plants other than Oconee, however, there are both main steam relief valves and automatic atmospheric vent valves that permit rejection of steam. This event has therefore not been analyzed separately for other plants. The only event for which heat removal via the condenser is potentially important is a SGTR. Loss of condenser vacuum is therefore grouped with the loss of MFW initiator, and is not modeled separately.
Loss of offslte power. Loss of offsite power is a potentially important initiating
{
event, because it renders main feedwater and many other non safety systems unavailable. It also creates a demand for the emergency diesel generators to supply power for safety systems, j
A corresponding initiator is included in all of the PRAs. In the Oconee PRA, three separate
)
initiators involving loss of offsite power were included to reflect site-specific aspects of the j
emergency power configuration (i.e., one pathway for emergency power, which is provided by l
hydro-electric units at Oconee, is through a main switchyard) and to account for differences in l
recovery potential. The loss of offsite power is included in this study as event T. In l
3 estimating the frequency and recovery potential for loss of offsite power, the initiator is further broken down into three primary types of losses: plant-centered (i.e., due to failures of l
the switchyard, transformers, etc.), grid-centered, and weather-related. These three causes are all considered within the context of the single initiating event T.
3 Sourious enaineered safeauards slanal. For all operating Babcock & Wilcox plants except Davis-Besse, the HPI system is also the system used for normal makeup to the RCS The I-LPI pumps at those plants therefore have a shutoff head well above the normal RCS operating pressure. A' spurious actuation in the safety injection mode could cause the HPI system to fill the pressurizer and raise RCS pressure to the setpoints for the pressurizer relief valves. The potential that this could lead to a small LOCA was the primary motivation for including the spurious signal as an initiating event.
l For Davis-Besse, the HPI system is separate from the makeup system. The shutoff head for the HPI pumps is 1600 psig, so that even if the HPI system were to be actuated spuriously, there would be no direct effect on the RCS. Other effects of a spurious initiation l
of the safety features actuation system (SFAS) could, however, be of interest for Davis-Besse.
Upon SFAS actuation, portions of the service water and component cooling water (CCW) systems would be reconfigured. The flow of CCW to the thermal barrier coolers for the seals f
in the reactor coolant pumps (RCPs) would also be isolated, which could increase the potential for a seal LOCA. A unique initiating event was therefore retained for spurious SFAS initiation, and it is designated as event T4 1
Excessive feedwater. The potential for a plant trip due to excessive feedwater was included for some PRAs for much the same reason as was the spurious actuation of the l
engineered safeguards systems: the potential existed for the resulting overcooling to cause l
PART3 15 l
r DATA FOR LOSS-OF.OFFSITE POWER EVENTS Treatment of the potential for a loss of offsite power required consideration of three types of parameters:
(1) The frequencies of loss-of-offsite power events that could initiate an r.:cident sequence, (2) The conditional probability that offsite nower would be lost following a reactor trip that occurred for another ruson, and (3) The probability of power recovery as a function of time after its loss.
Event Freauencies The parameters relating to the initial loss of offsite power were evaluated by making a careful review of relevant events in industry experience and considering Davis Besse experience. Events involving partial or complete losses of offsite power are summarized in the report NSAC-166 (Ref.1), and in that report each event was assigned a category according to its effects on the supply of power to the plant. Each of the events described in that report for the period 1975 through 1990 was examined to determine how it applied to the configuration of the offsite power supplies for Davis-Besse.
In some cases, the categories to which the events were assigned in NSAC-166 were changed to reflect more directly how they might have affected Davis-Besse. Examples of the types of considerations that were taken into account in making this review included the following:
At some plants, a single startup transformer is available to supply offsite power to plant auxiliaries in the event of a loss of the normal supply (e.g.,
from the main generator via an auxiliary transformer). Davis-Besse has two startup transformers which normally supp,1y separate main power buses (buses A and B). In the event that power is not available from one of the transformers after a trip, the buses it was set to feed automatically transfer to the other transformer (either can supply all of the plant's auxiliary loads).
Therefore, events at other plants involving loss of this startup transformer were evaluated on a case by case basis to determine whether or not they could constitute actual losses of both startup transformers at Davis-Besse.
If it could be determined that at iem em of the startup transformers should have been unaffected if the event were tc have occurred at Davis-Besse, the event was rmt coruid: red to be a loss of offsite power.
All offsite power to Davis-Besse is supplied through one switcl vard, which is arranged in a ring-bus configuration. Eventt. at other plants in which the normal offsite power supply was lost but a reserve source from another switchyard (or from another unit at the site) remained available were generally reassessed to be total losses of offsite power for Davis-Besse.
/
DATA FOR LOSS OF OFFSTTE POWER Some plants have a large number of connections (seven or more) to l
different offsite grids. At some of these sites there have been events in which a majority of these sources were lost, but at least one continued to 1
supply offsite power to the plant. Because Davis-Besse has three major connections to offsite grids, such events were examined on a case-by-case basis to consider whether they should be reclassified as actual losses of 4
i offsite power.
l The characterization for each of the events in NSAC-166 is summarized in Table Al of the appendix. For any events whose classifications were changed from those assigned in NSAC-166, a justification for the change is provided, i
In addition to making a separate determination with respect to whether or not each
. event did indeed constitute a loss of offsite power for Davis-Besse, the events were also recategorized to be consistent with the modeling requirements for the PRA. First, the events were meategorized according to whether they were the cause of the plant upsets or the consequence of them. The former events were used to estimate the initiating event frequencies. The initiating events involving loss of offsite power were further classified to l
permit both proper assessment of their frequencies and appropriate treatment of recovery potential. Each event was assigned to one of the following categories:
P Plant-centered (i.e., resulting from an upset within the switchyard or its supplies to the plant buses);
G Grid-centered; or l
W Weather-related.
Each of these types of offsite power losses has been found in the past to have a different characteristic recovery distribution (Ref. 2). Moreover, the experience base for each can be different; plant-centered events were found to be almost exclusively associated with individual units, even at multi unit sites, so that initiating frequencies depended on the number of unit-years of operation.' Grid-centered and weather-related events, on the other hand, were typically associated with a site, irrespective of the number of units present.
a The second general category of events noted above is comprised of events such as those involving failure to transfer from the normal source of power during plant operation (e.g., the main generator) to the post trip source, as well as events in which the unit trip caused a sufficient disturbance of the grid to lead to a loss of offsite power. Events assigned
'In Table 1, plant-centered events are funher categorized as either unit-based (PU) or site-based (PS). Because the vast majority of events were determined to be unit-based, all of the olant-centered events were put into a single category, rather than preserving yet a fourth (anc small in frequency) category.
2
i L,
I DATA FOR LOSS OF OFFSITE POWER 4
to this category are denoted by an "A" in Table A1. Rese category A events were used to estimate the conditional unavailability of offsite power following other initiating events.
4 This was done by determining the number of trips for each operating unit in the data base.
l Only plant trips from levels above 25% full power were used in this assessment, since it was i
judged that low power trips would be less likely to affect offsite power (for power levels below about 15%, the main generators are not typically on line at most plants). To have
. included all plant trips might have resulted in underestimation of the conditional probability l
oflosing offsite power following a trip from nominal full power.
l The data for all units and sites were then aggregated to develop generic frequencies l
for each category. These generic frequencies were used as the prior distributions for performing Bayesian updating, taking into account Davis-Besse experience. The data for
.each plant are summarized in Table A2 of the appendix. The update calculations for each parameter are presented following Table A2. The results, including the Davis-Besse experience, are summarized in Table 1.
Non Recovery Data In addition to the frequencies of the events of interest, a probabilistic assessment of the duration of the events was required. For most of the actual losses of offsite power included in NSAC-166 a duration was also provided. As in the cases of the events themselves, the nature of the power recovery was examined relative to the Davis-Besse configuration. In some cases, recovery was accomplished via a backup source for which no equivalent may exist at Davis Besse. Where it was possible in these cases, the duration associated with the restoration of nonnal offsite power was used in place of the duration assessed in NSAC-166 for the actual event. These durations were then compiled for each of the four categories described in the preceding section to form a cumulative probability distribution for non recovery times (the durations for losses of power after a trip were included wish the durations for the plant-centered initiators). Each set of data was fit to a distribution. Varina disuibudons were investigated, and it was concluded that a lognormal distribution provided the best fit to the data for plant centered events, while a Weibull distribution was most appropriate for the grid and weather-related data sets. The plant-centered distribution was used for consideration of the recovery of power for the cases in which it was lost after r crip for another reason A composite of all three of the distributions was formed by weight'ng each curve by the mean initiating event frequency. This composite curve was used for considering recovery for the loss of offsite power as an initiating event.
The details of the results are provided in the appendix. The composite results are also illustrated in Figure 1.
3
l Table 1 RELIABILITY PARAMETERS FOR LOSS OF OFFSITE POWER Generic Error Updated Updated l
Plant Name Generic Experience Frequency Factor Davis-Besse Experience Frequency Err Factor l
Loss of offsite power (initiating event)
Plant-centered 27 events 1,191 unit-yr 2.27 x 10-2/yr 3.12 0 event:
11 unit-yr 1.97 t 10-2/yr 3.12 l
Grid-centered 7 events 845 site-yr 8.29 x 10-3/yr 11.4 0 events 11 unit-yr 4.81. 10-3/yr 11.4 Weather-related 25 events 845 site-yr 2.96 x 10-2/yr 9.58 0 events 11 unit-yr 1.0:, x 10-2/yr 9.58 Total frequency for loss of offsite power 3.'20 x 10-2/yr 3.63 D
Loss of power after 7 events 4,914 unit-1.42 x 10-3 10 1 event 45 unit trips 7.29 x 10-3 /dem 3.63 x
reactortrip trips
/dem a
5u O
si 2
3
I
!!(
!l i
I
{
eL!
,i pi D>
eM eOM om 0NDh ~9-0
, 2 a
ta D
y r
v e
, 5 e
r 1
ow c
eo RP e
nt oi s
Nf f
eO t
i f
)
s o s
o r
ps u
s o
mo oL
- 0 h 1
(
Cr e
.f m
o 1
iT e
r r
e u
h t
g n
a iF e
w 5
d i
r g
tna l
p S
!l
~
m liJ
~
0 0
9 8
7 6
5 4
3 2
1 0
1 0
0 0
0 0
0 0
0 0
0
)
RN (P
M 1
i