ML20107C061

Affidavit of Gc Minor Re Single Failure Criterion & Emergency Power Supplies,Discussed in Board Notification 85-009

ML20107C061
Person / Time
Site:	Shoreham File:Long Island Lighting Company icon.png
Issue date:	02/11/1985
From:	George Minor AFFILIATION NOT ASSIGNED
To:
Shared Package
ML20107C054	List: ML20107C061
References
NUDOCS 8502210157
Download: ML20107C061 (8)

Text

^

i UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION e

Before the Commission

)

In the Matter of

)

)

LONG ISLAND LIGHTING COMPANY

)

Docket No. 50-322-OL-4

)

(Low Power)

(Shoreham Nuclear Power Station,

)

-Unit 1)

)

)

AFFIDAVIT OF GREGORY C. MINOR CONCERNING SINGLE FAILURE CRITERION AND SHOREHAM EMERGENCY POWER SUPPLIES 1.

My name is Gregory C. Minor.

I am Vice President of MHB Technical Associates ("MHB").

My education background is in electrical engineering (with a power systems option) in which I received a Bachelor of Science and Master of Science degrees.

I have over 24 years of experience in the nuclear industry, includ-ing design and testing of systems for use in nuclear power plants.

Since 1976, I have been employed by MHB and have acted as a consultant to domestic and foreign government agencies and other groups on nuclear power plant safety and licensing matters.

Between 1965 and 1976, I was employed by the GE Nuclear Engineer-ing Division as a design engineer and manager of engineering design organizations.

My responsibilities included the design, testing, qualification, and pre-operational testing of safety equipment and control rooms for use in nuclear power plants.

l l

B502210157 850215 PDR ADOCK 05000322 O

PDR _

L

. l 2.

General Design Criterion 17 requires that emergency power systems for nuclear power plants meet the single failure criterion.

It specifically states:

The onsite electric power supplies, including the batteries, and the onsite electric distribution system, shall have sufficient independence, redundancy, and testability to perform their safety functions assuming a single failure.

Therefore, the alternative means of supplying emergency power proposed by LILCO, in order to be as safe as the safety-related system originally proposed for Shoreham, must also meet the single failure criterion.

3.

During the low power proceeding conducted before Judge Miller, testimony was provided by LILCO, the NRC Staff and Suffolk County regarding' single failure vulnerability of the alternate sources of power proposed by LILCO.

In the NRC's I

testimony of John Knox and Edward Tomlinson, the NRC stated that the proposed system does meet the single failure criterion and

' independence which would be required for the normal safety-related diesel generators located at an. operating nuclear power

. plant.

Testimony of Knox and Tomlinson, at page 6.

Their testi-many included their view that the supplemental power sources were not connected to each other and therefore were independent of each other.

The Staff also relied on their SER to conclude that l

the electrical'eross-connections between the two alternate pro-posed power sources had been sufficiently corrected to preclude a single event or single failure causing failure of both sources of power.

SSER 6, at 8-5.

The Board in making its decision regard-

m

. ing low power operation for Shoreham accepted the NRC's position with regard to the single failure criterion.

Board Decision at 50-51, 54-55, 91.

However, the configurations proposed by LILCO as alternate power sources were not acceptable as first proposed.

The NRC in their brief review of this system disclosed at least several potential single failure points which needed to be modi-fied.

The first_was to leave open breakers which interconnect busses lla and 12a, 11b and 12b, lle and 12c, and 11d and 12d, as shown on FSAR Figure 8.2.1-1.

The Staff also required that the Technical Specifications for Shoreham be revised to require verification that these breakers are open once every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

An additional possible interconnection which represented a poten-tial single failure was discovered by the Staff at the point where two breakers feed the 4.16 kV emergency busses, numbered 101, 102 and 103.

To resolve this problem, the Staff required p

that the automatic transfer between the pairs of breakers on i

these busses be eliminated.

This prevented failures in the auto-i matic transfer system or related wiring from causing a single event or single failure which would cause failure of both sources of alternate power.

Here again, the Shoreham Technical Specifi-cations were changed to reflect the absence of the automatic transfer system and therefore to eliminate the need for testing that system.

Another single failure vulnerability related to fire was identified by the Staff and resulted in the requirement of. physical separation of circuits near the RSST and the NSST.

SSER16, at 8-5, 8-6.

r-I

[. l 4.

Despite the fact that the Staff felt the system met the single failure. criterion during the low power hearings, the latest disclosures of yet another single failure point detract from this finding and in fact render it incorrect.

Breaker 460 between the RSST and bus 11 is yet another point whose single failure could interconnect with the alternate power sources and cause both of them to fail in the event of a short.

None of the single failures which have been identified to date and addressed by changes to the Technical Specifications or plant requirements has been part of a formalized, detailed and documented analysis of potential single failures of the alternate configuration pro-posed by LILCO.

Absent such a formalized and documented study, it is impossible to say that these single failures, discovered at different periods of time, represent all the single failures in the system created by the unothordox addition of external power sources to replace inoperative safety-related emergency diesel generators.

5.

The "fix" proposed in Board Notification 85-009 is t-o rack out or effectively remove breaker 460. -This solution does appear on the basis of preliminary review to solve the identified single failure problem, but there is insufficient analysis to show that the "fix" has not created additional problems.

In fact, the documentation provided to date indicates that several problems do exist.

These are described in the following sub-paragraphs.

(a)

There is no evidence that the procedures which govern operator action during a loss of offsite power (LOOP) have been modified to reflect a change created by removing breaker 460.

Thus, the procedures presume that there is a path which would allow the operator to connect RSST to bus 11, when in fact this cannot be accomplished through the ordinary breaker techniques.

If the operator is to follow alternate procedures in order to power bus 11, such procedures have apparently not been written and have not been reviewed by the NRC.

Further, the use of revised procedures specifically l

created to get around the single failure problems introduced by the alternate power sources, would have

-no_ meaning during and in fact may be misleading for full power operation.

Under full power operation, it-is assumed that safety-related emergency diesel gener-ators will be available and such expedient and system degrading techniques as racking out breakers and

-removing automatic transfer functions would not be tolerated.

Thus, the procedures for full power should be different procedures than the ones that would be created for low power.

Thus, the experience gained by l

operators in using the alternate AC power system will in fact be counter productive in terms of training for later higher levels of power.

l

, (b)

Training of the operators to use the procedures created for low power operation also appears not to have been completed at this time.

Once the procedures are pre-pared and reviewed by the NRC, there will need to operator training in their use in order to have any assurance that the procedures will be followed during emergency conditions.

(c)

In the event of a need to power bus 11 during a LOOP event, one option is to re-rack breaker 460 and close it in to bring power from the RSST to the bus 11.

If this action were taken and a short were to occur during the re-racking or closing of breaker 460, the single failure and shorted condition could cause a loss of' both alternate power sources.

In such an event, the alternative routing proposed by Shoreham would be to go through the Wildwood Substation and reenter the plant through the NSST.

This routing involves additional' procedures which have not been developed at this time, and would require a longer time because of the greater number of steps, the necessary precautions, and the-involvement of system operators.

(d)

The loads on bus 11, according to the FSAR, appear to be mainly 4160 volt, normal station service motor loads.

Most of these. loads probably would not be needed during the initial phases of an emergency, but may be useful at later stages.

However, because LILCO

, has presented no study showing whether they are needed or not and if they are, how they would be powered in the event the EMDs did not start, there is no assurance that the operators will not attempt to power bus 11 from alternate sources.

6.

The modification proposed by LILCO of racking down breaker 460 removes one fundamental element of flexibility from the system as proposed in the FSAR.

Originally, the system consisted of two sources (RSST and NSST) and two load centers (bus 11 and bus 12), connected both directly and by cross-linking through breakers.

This is a classic configuration of connecting two loads to two sources.

However, by elminating the one cross-tie possibility (breaker 460), the system has lost flexibility and is therefore not of the same degree of reliability or safety in the event of an emergency at Shoreham.

At the same time, by eliminating some of the system versatility, there has been an element of uncertainty introduced into the operation of the sys-tem due to the unknown method the operator will use to recreate that path if called upon to do so.

When alternate paths are used to replace the routes otherwise provided by breaker 460, other systems, other busses, and even other substations may have to be called into play.

These actions could well introduce new prob-lems which have not been discovered to date.

Until there has been a thorough study, detailed procedures, and operator train-ing, the 'fix" proposed by LILCO for this single failure problem

.. may actually have introduced additional problems, possibly even single failure problems, which are yet to be discovered.

fG "t-Gregorf C.' Minor Sworn to before me this/

day of February 1985.

Mn ].L__, $ A b b

Not'ary Public My commission expires:

y,-

. ;_ ~;

.e :

l l

l l

l l

l I-r

?

,