ML20096G010

Proposed Tech Specs Implementing Generator Time Overcurrent Protection for Diesel Generators

ML20096G010
Person / Time
Site:	McGuire, Mcguire
Issue date:	08/31/1984
From:	DUKE POWER CO.
To:
Shared Package
ML20096G006	List: ML20096G003 ML20096G010
References
TAC-55787, TAC-55788, NUDOCS 8409100311
Download: ML20096G010 (5)

Text

'

Attichment'1 ELECTRICAL POWER SYSTEMS SURVEILLANCE REQUIREMENTS (Continued)

5) Verifying that on an ESF actuation test signal, without loss-of-offsite power, the diesel generator starts on the auto-start signal and operates on standby for greater than or equal to 5 minutes. The generator voltage and frequency shall be at least 4160 volts and 57 Hz within 11 seconds after the auto start signal; the steady-state generator voltage and frequency shall be maintained within 4160 420 volts and 60 i 1.2 Hz during this test;

6) Verifying that on a simulated loss of the diesel generator, with offsite power not available, the loads are shed from the emergency busses and that subsequent loading of the diesel generator is in accordance with design requirements;

7) Simulating a loss-of-offsite power in conjunction with an ESF actuation test signal, and a) Verifying deenergization of the emergency busses and load shedding from the emergency busses; b) Verifying the diesel starts on the auto-start signal, energizes the emergency busses with permanently connected loads within 11 seconds, energizes the auto-connected emergency (accident) loads through the load sequencer and operates for greater than or equal to 5 minutes while its generator is loaded with the emergency loads. After energization, the steady-state voltage and frequency of

.the emergency busses shall be maintained at 4160 1 420 volts and 60 1 1.2 Hz during this test; and c) Verifying that all automatic diesel generator and diesel generator breaker trips, except engine overspeed, lube oil pressure, generator differential, and generator time over-current, are automatically bypassed upon loss of voltage on the emergency bus concurrent with a Safety Injection Actuation signal.

8) Verifying the diesel generator operates for at least 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

Duri'ng the first 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of this test, the diesel generator shall be loaded to greater than or equal to 4400 kW and during the remaining 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br /> of this test, the diesel generator shall be loaded to greater than or equal to 4000 kW. The generator voltage and frequency shall be at least 4160 volts and 57 Hz within 11 seconds after the start signal. The steady-state generator voltage and frequency shall be maintained within 4160 1 420 volts and 60 i 1.2 Hz during this test. Within 5 minutes after completing this 24-hour test, perform Specifi-cation 4.8.1.1.2d.7)b);

8409100311 840831 PDR ADOCK 05000369 P PDR MCGUIRE - UNITS 1 AND 2 3/4 8-5

^

_ 7.;

2 m 74 Attachment II g , , .x e .

-JUSTIFICATION AND SAFETY EVALUATION' he -

' Currently. the.following trips are provided to protect the diesel ele :tric generating , units that are not bypassed during starting ss- .of the di~esel generator by an' Engineered Safeguard Signal:-

a)

Low Lube' Oil Pressure b) Engine Overspeed.

c) Generator Differential Protection

- The rationale for. providing these trips is- that operating a diesel, generator even for a short time without prop.er lubrication or under overspeed conditions results in destruction of the diesel generator without fulfilling its safety function. A redundant diesel generator train is provided to takeover the safety loads of the faulted diesel-generator. These trips.are describ4d in the McGuire FSAR section 8.3.lel.7. Duke Power Company plans to install a Generator Time Overcurrent 1

Protection Device to protect'tha generators from destruction due.to' faults :on ' the switchgear buss.

Operation of a diesel generator with a multiphase; fault on the switch :

gear busswould quickly result in destruction of'the associated generator.

without= fulfilling its safety function. The Generator Time Overcurrent-Protection trips the diesel generator associated with the faulted buss' to prevent its destruction. Three separat's measurements of the over-Lcurrent are provided'by this device and a specific coincident (2 out'of  ;

3) logic is required to initiate a trip of the diesel generator. This:

trip is not bypassed by.the Engineered Safeguard Signal. The-tripping ~ ,

of-the diesel generator associated with the faulted busadoes not compromise safety as the redundant diesel' generator is available to take 'over the safety loads.

The proposed installation of the Generator Time ~Overcurrent Protection Device would not violate the single failure criterion (GDC 17) for ~

class 1E' diesel' generators.' The postulated single failure can disable only'one diesel generator or one buss. The redundant diesel generator would not be exposed to the same fault 'and is presumed to' be available.

Duke Power Company also plans to install a Generator Instantaneous Overcurrent 7

-Protection to protect the diesel generators during testing periods.

'This' trip along with six other' trips for testing. periods are bypassed in '

the event of'an accident condition. The design includes the capability to test the status and operability,.of the bypass circuits and the '

' capability to alarm abnormal. values of bypassed parameters in the control room.

i

• m ___ . __. .____...._______..__.._._____..__.__.___m_.____..._ _ _ _ _ _ _ _ _ _ . _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ . _ . _ _ _ _ _ _ _ _ _ _

i l

l

,..r.

o JUSTIFICATION AND SAFETY EVALUATION (Continued)

. The proposed Technical Specification amendment covers the Surveillance

requirements-for the Generator Time Overcurrent Protection device.

Based on the above analysis, the proposed installation of the Generator Time Overcurrent Protection and the Generator Instantaneous Overcurrent Protection does not have any. adverse impact on safety.

4

• e 9

d d

=

q j

e ATTACHMENT III

. .;- r .

Analysis of Significant Hazards Consideration This' analysis is;provided as required by 10CFR50.91 and is performed according to the standards of 10CFR50.92. The proposed implementation Eof the Time:Overcurrent Protection trip is discussed with reference

'to its potential for causing any significant hazards.

The= consequences of a previously evaluated' accident will not increase due to this modificacion. There are three situations which may occur.

- First, the protective. device will' operate properly. If a fault of two or more of the three phases occurs on the vital buss the device will-trip, disabling the associated D/G 'until the fault is cleared, the re-lays reset and the D/G is restarted. Any, buss fault for which the pro-tactive device would trip would be too large for the'D/G to maintain voltage.on the-buss; by the time the device trips, the D/G is no longer effective in supplying power. If the, protective device were not in the circuit (current configuration) the.D/G would be destroyed and dis-abled indefinitely.

If.the~. protective device operates spuriously, the protection device.

would disable the associated D/G train temporarily (until problem

. diagnosis and device reset) . GDC 17 requires that Class 1E onsite electric power supplies be available assuming a single failure.- Addition of this protective device will not violate the' single failure criteria.

Spurious operation of the protective device is not considered likely

, .- since it is necessary.for two of the three relays (one relay for each phase) to trip on overcurrent before the breaker is tripped.

Finally, if the protective device fails to trip when legitimately

. required to do so, the D/G.will probably be destroyed. The current configuration.(bypassed time overcurrent protection device on a safety' siEnal) will produce the same result. In each of the above cases, the accident mitigation response of the D/G trains is at least as good with the proposed modification as without it so that the consequences of previously evaluated FSAR accidents will not be increased due to this modification.

Initiation of a new accident.due to the proposed modification is not considered credible.' The probability of failure of each of the D/G trains is' increased slightly by the' addition of a new component with

s failure / spurious operation probability' greater than zero. Coincident 2.out of'3 logic within the overcurrent trip device is necessary to

- initiate a: trip of the associated breaker so that the failure probability increase is insignificant. Also, the possibility of failure / spurious

- operation of the time overcurrent protection device which will disable its related D/G train is created. Although the probability of' failure of each of the D/G trains is increased slightly, the consequences of failure of each of the D/G trains remains the same.

w

s  ; >

l .':

f .-

Analysis.of?Significant Hazards'Considerstion (Continued)

This-in$tillationoftheOvercurrentProtectiontripwillnot:

I

1) Involve a significant' increase in the probability

-or consequences of an accident previously evaluated; or

2) Create the possibility of a new or different kind of accident from any accident previously evaluated; or

3) Involve a significant reduction in a margin of

. safety.

Based upon this analysis, Duke Power Company has determined that the l proposed amendment does not involve a ,significant hazards consideration.

F' .

t-l l

l

(

l~

t-

.