ML20112H490

Testimony of Gf Dawe,Ja Notaro & Ej Youngling Re Diesel Generator Qualified Load.Related Correspondence

ML20112H490
Person / Time
Site:	Shoreham File:Long Island Lighting Company icon.png
Issue date:	01/15/1985
From:	Dawe G, Notaro J, Youngling E LONG ISLAND LIGHTING CO.
To:
Shared Package
ML20112H482	List: ML20112H478 ML20112H490
References
OL, NUDOCS 8501170165
Download: ML20112H490 (45)

Text

.

LILCO, Jcnu:ry 15, 1985 7 Rhr -

UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION ..

Before the Atomic Safety and Licensino Board Nl In the Matter of )

)

LONG ISLAND LIGHTING COMPANY ) Docket No. 50-322 (OL)

)

(Shoreham Nuclear Power Station, )

Unit 1) )

DIESEL GENERATOR QUALIFIED LOAD TESTIMONY OF GEORGE F. DAWE, JACK A. NOTARO AND EDWARD J. YOUNGLING ON BEHALF OF LONG ISLAND LIGHTING COMPANY

1. Please state your names and business addresses.

A. (Dawe) My name is George F. Dave. My business address is Stone & Webster Engineering Corp., 245 Summer Street, Boston, Massachusetts 02107.

(Notaro) My name is Jack A. Notaro. My business address is Long Island Lighting Company, Shoreham Nuclear Power i

Station, North Country Road, Wading River, New York 11792.

(Youngling) My name is Edward J. Youngling. My business address is Long Island Lighting Company, Shoreham Nuclear Power Station, North Country Road, Wading River, New York 11792.

I.

I

2. Please identify your current position and describe l

j your professional qualifications.

A. (Dawe) My current position, to which I was 8501170165 850115 PDR ADOCK 05000322 T PDR

4 t appointed in January 1980, is Supervisor of Project Licensing within the Licensing Division of Stone & Webster (SWEC). I am responsible for technical and administrative supervision of all project licensing personnel assigned to SWEC headquarters projects, including field assignments. My duties include assuring project awareness of regulatory requirements and developments, assuring proper and consistent application of SWEC licensing policies, and consulting with projects and clients on licensing issues.

1 joined Stone & Webster in 1973 as an Engineer in the Licensing Group. In January 1974, I was assigned as Licensing Engineer for the Shoreham Nuclear Power Station (SNPS) under construction, and was Lead Licensing Engineer from 1976 to 1980. In this capacity, I was responsible for all licensing related activities for SNPS including preparation of the Final Safety Analysis Report. I have had additio,nal assignments at Stone & Webster including development of company positions for NRC Regulatory Guides and Lead Licensing Engineer for the Special Projects Group of the Operations Services  :

Division. I am also the Stone & Webster representative to, and participating member of, two subcommittees of the AIF Committee on Reactor Licensing and Safety.

6m

4 t _3_

Prior to joining Stone & Webster, I served seven years as a commissioned officer in the U.S. Navy Nuclear Power Program. My duties included direct supervision of operation and maintenarce of a submarine nuclear propulsion plant. I also served on the staff of the U.S. Navy Nuclear Power School as Director, Core Characteristics and Reactor Physica Division.

While on active duty, I was qualified for assignment as Chief Engineer on nuclear powered vessels.

I received a Bachelor of Science degree from the United States Naval Academy in 1966. I have 18 years experience in the nuclear power field and hold a certificate as Engineer-in-Training in Massachusetts by 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> examination. A copy of my resume setting forth my professional qualifications has previously been submitted on the record in this case.

(Notaro) My current position, to which I was appointed in May 1984, is Outage and Modification Manager for the Shoreham Nuclear Power Station. As such, I am responsible for the implementation of design changes to the plant systems 1

or equipment as required by the regulatory agencies or for plant operational considerations. I supervise the Planning and Scheduling, Modification Engineering and Outage Planning Sec-tions of the plant staff. In my current position, I have been involved with LILCO's diesel generator recovery efforts,

s

', _4_

including the endurance test run of EDG 103 at the qualified load of 3300 KW. I hold NRC Senior Reactor Operator License SOP-4419 for Shoreham, which I obtained November 1982.

I have been employed by LILCO since 1970 and assigned to the Shoreham Nuclear Power Station since 1973. I have held a number of plant staff positions prior to my current position, including Operating Quality Assurance Engineer, Operating Engi.neer and Chief Operating Engineer. In addition, I have been assigned for periods of time to the Vermont Yankee Nuclear Power Station, the Millstone Nuclear Power Station and the Dresden Nuclear Power Station for power operation training.

I have successfully completed numerous LILCO, General Electric Company and industry training programs. I received a Bachelors Degree in Mechanical Engineering from City College of New York, and a Master of Business Administration Degree from Adelphi University. A copy of my resume, setting forth my professional qualifications more fully, is attached to this testimony as Attachment A.

(Youngling) I am the Manager of the Nuclear Engineering Department at LILCO. In this capacity, I am responsible for engineering support at Shoreham, including the three TDI diesel generators. From 1981 until 1984, I was the Start-up Manager for the Shoreham plant. In this position, I

s t was responsible for implementing the preoperational test program for Shoreham, including checkout, initial operation and subsequent preoperational testing of the TDI diesel-generators.

After the failure of the EDG 102 crankshaft, I was designated as the Recovery Manager for the repair and requalification of the diesel engines. In my various capacitier, I have super-vised more than 3,350 hours0.00405 days <br />0.0972 hours <br />5.787037e-4 weeks <br />1.33175e-4 months <br /> of operation of Shoreham's TDI die-sel generators, the development of the program to define the qualified load for'the Shoreham TDI diesel generators, and the development of the conf'irmatory test and inspection program to assess the adequacy of the diesel generators at this qualified load. A copy of my resume setting forth my professional quali- 1 fications has previously been submitted on the record in this Case.

3. What is the purpose of your testimony?

A. (All) The* purpose of this testimony is to respond to the contention of Suffolk County and the State of New York concerning qualified load for the Shoreham TDI emergency diesel operators. That contention, as admitted by the Board, states as follows:

Contrary to the requirements of 10 C.F.R. Part 50, Appendix A, General Design Criterior 17 --

Electric Power Systems, the emergency d4 *sel generators at Shoreham ("EDGs") with a maximtm

" qualified load" of 3300.KW do not provide suf-ficient capacity and capability to assure that

r

+.

t l the requirements of clauses (1) and (2) of the l first paragraph of GDC 17 will be met, in that f (a) LILCO's proposed " qualified load" of 3300 l KW is the maximum load at which the EDG  !

may be operated, but is inadequate to han-die the maximum load that may be imposed on the EDGs because:

(i) intermittent and cyclic loads are excluded; (ii) diesel load meter instrument error

- was not considered; (iii) operators are permitted to maintain diesel load at 3300 KW +/- 100 KW; (iv) operators may erroneously start addi-tional equipment; (v) (subsection not admitted]

(vi) (subsection not admitted]

(b) (subsection not admitted] .

(c) The EDG qualification test run performed by LILCO was inadequate to assure that the

,, EDGs are capable of reliable operation at 3300 KW because:

(i) (subject matter to be covered in block testimony]

(ii) [ subject matter to be covered in block testimony)

(iii) operators were permitted to control the diesel generators at 3300 KW +/-

100 KW during the test; (iv) instrument accuracy was not considered; and (v) (subsection not admitted].

s

• _7_

4. Please summarize your testimony.

A. (All) (1) The qualified load of 3300 KW is ade-quate and appropriate. Three intermittent load groups (motor operated valves, diesel generator fuel oil transfer pumps and diesel generator air compressors) were excluded in establishing the maximum emergency service load for each EDG and thus the qualified load. This exclusion, concurred in by the NRC Staff, was appropriate and justified because these are short term, small magnitude loads.

(2) The accuracy of the diesel generator load instruments to be used during operation does not affect the adequacy of the qualified load. These instruments do not in-troduce errors of sufficient magnitude to impair the ability of the diesel generators to perform their intended function.

(3) A control band of + 100 KW about the 3300 KW qualified load is permitted only during required surveillance testing at the qualified load. This is necessary, as a practical matter, to conduct such tests. This testing is not performed for extended periods of time and therefore any variation of the load about 3300 KW will not affect the ability of the diesel generators to perform their intended function.

(4) As required by regulation, operator error has been considered in the design of the plant. The use of a

-o t

qualified load for interim licensing does not alter the plant's ability to meet this design basis. Operator error remains an unlikely cause of a diesel. generator failure, and failure of a diesel generator is within the design basis of the plant.

(5) The 10 7 loading cycle confirmatory test was adequate to establish the qualified load of 3300 KW. The operators were directed to conduct the endurance run portion of the test on EDG-103 at 3300 KW i 100 KW. The load data obtained at 30 minute intervals throughout the endurance run demonst' rate the adequacy of the test. The accuracy of the EDG-103 load meter was verified before and after the endurance run to be well within the specified calibration limits for the in-strument. Any operation during the confirmatory test that may have been above or below 3300 KW due to instrument error was not substantial, did not affect the validity of the test and is representative of future operation utilizing the installed load meters.

5. Please define " maximum emergency service load" (MESL).

A. (All) The maximum emergency service load, as de-fined in Amendment 52 to the Shoreham License Application (Re-vision 34 to the FSAR) is the maximum load which would exist on an EDG during a loss of coolant accident in conjunction with a loss of offsite power (LOOP /LOCA).

k

• e a _g_

6. How is the MESL determined?

A. (All) The MESL is determined for each EDG by sum-ming the individual loads which will be simultaneously connect-ed to that EDG for more than short periods of time following initiation of a LOOP /LOCA event. These loads are generally en-gineered safety features (ESP) or ESF support equipment, and are powered automatically following diesel generator start in response to a LOOP /LOCA initiation signal. Component nameplate load values are used in the summation except where values mea-sured in the plant are available.

7. What is the MESL for each EDG?

A. (All) The MESL for each EDG is set forth in the Shoreham FSAR, Revision 34, Table 8.3.1-1A. The MESL is 3253.3 KW for EDG-101, 3208.7 KW for EDG-102 and 3225.5 KW for EDG-103.

8. Please define " qualified load."

A. (All) The concept of a " qualified load" was intro-duced in the NRC Staff's Safety Evaluation Report on the Transamerica Delaval, Inc. Diesel Generator Owners Group Pro-gram Plan. The SER states that the Staff and its consultants have not completed their review of the Owners Group efforts.

However, the SER reflects that the Staff has established an

T

• interim licensing basis for TDI diesel engines. The NRC Staff

[ has concluded that engines operating below a BMEP of 185 psig could be licensed in the interim. In considering whether an I engine meets the 185 psig BMEP criteria, the NRC Staff has stated they would consider excepting engines from the require-i ment where the load exceeds the 185 psig BMEP criterion for i

1 brief periods of time. See Safety Evaluation Report, Transamerica Delaval, Inc. Diesel Generator Owners Group Program Plan, pp. 13-14.

For engines where emergency service load require-ments involve a BMEP greater than 185 psig, the NRC Staff has required utilities to demonstrate that certain key components 7

of the engines had been operated successfully for at least 10 loading cycles at or above the maximum emergency service load for those engines. This l'oad level at which 10 7 loading cycles could be demonstrated was called the " qualified, load." For Shoreham's TDI diesel generators, the confirmatory testing was chiefly for the purpose of demonstrating the adequacy of the replacement crankshafts. See Tr. 26292-93 (Berlinger).

9. What is the qualified load for the Shoreham TDI emergency diesel generators?

A. (All) For Shoreham, the qualified load is 3300 KW.

Th!.s.is an upper bound of the maximum emergency service loads for all three TDI diesel generators.

._ .-- _ _ .___._- _ ._ __-_._ - _ ..___._- _ _ . _ ..___..___.__. ~ _

6 10. Were intermittent or cyclic loads included in LILCO's determination of the 3300 KW qualified load?

A. (All) No. Intermittent or cyclic loads are small loads that will operate only once or occasionally following a LOOP /LOCA event. In either case, operation is for a short period of time. Because this equipment does not impose a con-tinuous load on the diesel engines but only small load in-creases for short periods of time, it was not included in LILCO's determination of the qualified load.

11. How did LILCO arrive at the conclusion that intermittent or cyclic loads should not be included in the determination of the qualified load?

A. (Youngling) LILCO concluded that intermittent or cyclic loads should not be included in determining the quali-fled load from review pf the Staff SER for the TDI Diesel Gen-erator Owners Group Program Plan, as well as subsequent discus-sions with the Staff. That SER establishes the concept of a qualified load for diesels which operate at a BMEP greater than 185 psig. Since this SER in addressing qualified loads dis-cussed long term (10 7 cycles) loading conditions, and also pro-vided for exceeding 185 psig BMEP for brief periods of time when applying the BMEP criterion, LILCO concluded that brief, intermittent loads need not be included in establishing the

o

• maximum emergency service loads, and thus the qualified load.

Prior to establishing the qualified load and performing the re-quired testing, LILCO discussed this interpretation with the NRC Staff. The'NRC Staff concurred with LILCO's conclusion that intermittent or cyclic loads should be excluded from the MESL and qualiffed load. Dr. Berlinger restated this position in his December 13, 1984 deposition at pp. 17-19.

12. Which loads were not included in the determination of the qualified load as being intermittent or cyclic loads?

A. (Youngling, Dawe) Only three load groups are ex-cluded as intermittent or cyclic loads. These are (i) automat-ically actuated motor operated valves (MOV), (ii) diesel gener-ator fuel oil transfer pumps and (iii) diesel generator air compressors. As explained more fully below, each group repre-sents a small number of components, a small KW load or both.

13. Please explain why automatically actuated motor operated valves have been categorized as excludable intermittent or cyclic loads.

A. (Youngling, Dawe) The automatically actuated motor operated valves are all of those valves which both receive i power from an EDG and have the ability to operate automatically in the event of a LOOP /LOCA. The connectable load associated

O

• e 13- -

with these valves is included in FSAR Table 8.3.1-1 by the line item " Motor Operated Valves" and a portion of the line item

, "480 V M-G Set."

These valves are valves which may be called upon to reposition automatically following a LOOP /LOCA initiation signal. They include such valves as containment isolation valves, emergency core cooling system injection valves, and various system valves used to isolate redundant trains, unnecessary system loads or unwanted flow paths. A number of factors justify the exclusion of these valves as intermittent loads. Not all of these valves would be expected to reposition following an accident and thus would not actually represent a load on an EDG. Although they all receive automatic actuation signals to ensure proper positioning, many will be in their de-sired post-accident position during normal operation, and thus will not operate even upon receipt of a signal. Those that do operate can generally be expected to operate only once. If subsequent operation is necessary or desirable, it will gener-ally result only from operator action. The automatic operation will occur during the first several minutes after the diesel generators start.

The stroke times of the MOV's are short. Most will complete their stroke, open or close, in less than one minute.

I

- - _ - . - ,.,y- .- . - . -- ,,.s. ,. .,m.- , . . ,, - - - . - - , - - , - . , . - - , -

O

+ The longest stroke times do not exceed three minutes. Further, not all valves which will automatically reposition do so simul-taneously. Inherent time delays in reaching various actuation and permissive set points, bus programming and actuation signal generation will result in sequencing of valve operations.

For all of these reasons, the automatically actuated motor operated valves represent short time, intermittent loads on the EDG's. Because they represent small load increases for short periods of time, they are properly excluded in estab-lishing the qualified load.

14. What load could the automatically actuated motor 4 operated valves impose on the diesels?

A. (Youngling, Dave) For the reasons we have just stated, it is incorrect to take a simple summation of the loads attributable to each individual valve to represent the load a given EDG will supply. Such a summation yields'a load which exceeds any that could reasonably be expected. Even this sum-mation of loads, however, would not result in exceeding the qualified load except in the case of one of the diesel genera-tors and then by only 19 KW.

As can be seen from FSAR Table 8.3.1-1, the category

" Motor Operated Valves" provides a summation of nameplate valve loads of 19.7 KW for EDG-101, 18.3 KW for EDG-102 and 0.7 KW

• for EDG-103. These totals include all automatically actuated motor operated valves except two sets of 4 valves associated with operation of each train of the Low Pressure Coolant Injec-tion (LPCI) System. These LPCI related valves are powered by 480 V motor generator (M-G) sets which are, in turn, powered by the EDG's. By design, no diesel generator will be called on to power more than one of these sets of 4 LPCI related valves.

The 480 V M-G sets are maintained operating, but unloaded, to be ready to power the associated valves. This places a load of 19 KW per M-G set on the associated diesel generators. This 19 KW load per MG set is not an intermittent J

load and was included in determining the qualified load as demonstrated by FSAR Table 8.3.1-1A. Based on the nameplate i

ratings for each of the 4 valves powered by a given 480 V M-G set, the maximum coincident demand for each set of v'alves is less than 46 KW. Since this intermittent 46 KW load could be 1 assigned to any of the three diesels, it can be summed with the previously listed valve loads to establish an upper bound on the valve load for each diesel. This yields a total connected

' valve load of 65.7 KW for EDG-101, 64.3 KW for EDG-102 and 46.7 L

KW for EDG-103. As previously stated, though, such coincident loading is unlikely to occur, nor could it occur for more than a very short period of time, particularly in the context of the

i s

• 10 7 loading cycles for which the qualified load is demon-strated. Moreover, even if these coincinent valve loads are added to the MESL of each EDG, the loads would be 3319.0 KW for EDG-101, 3273.0 KW for EDG-102 and 3272.2 KW for EDG-103.

Thus, there is no significant period of operation above the qualified load level, even assuming the coincident operation of all automatically actuated valves.

15. Please explain why the diesel generator fuel oil l transfer pumps have been categorized as excludable intermittent or cyclic loads.

A. (All) The diesel generator fuel oil transfer pumps transfer fuel oil for the diesel generators from the storage tanks to the day tanks in the diesel generator rooms. Each diesel generator has two associated fuel oil transfer pumps, only one of which is called on to operate. The greferred pump f

only operates after the fuel oil level in the day tank has been i

lowered to a predetermined value by operation of the diesel.

Thereafter, the pump operates to refill the tank and then stops. The second pump will operate only if the first fails.

The pump will operate for approximately 12 minutes every half hour during the operation of the diesel to maintain level in the day tank. The diesel generator fuel oil transfer pump load is only 0.2 KW per pump. Because this load does not operate i

4

-* immediately after the start of an accident when the peak load on the diesel generators would be experienced and because the load is both small and intermittently imposed, it was not in-

! cluded in the determination of the qualified load.

l' l

16. Please explain why the diesel generator air compressors have been categorized as excludable intermittent or cyclic loads.

A. (All) The diesel generator air compressors are used to recharge the air start receivers following the start of the diesel generators. Each diesel generator has two independent,

. redundant air starting systems with each, in turn, having one air compressor. Each air compressor will automatically operate one time following energizing of the emergency bus by its asso-ciated diesel generator. Following one successful start at-i tempt, each compressor will operate for approximately 15 minutes. Each compressor can recharge its associated air sys-tem in 30 minutes following the design capability of five start attempts. The air compressor load is 12 KW per diesel genera-tor. Since this is a one time load of short duration, it was not included in determining the qualified load. This load, if summed with the MESL for each EDG shown on FSAR Table 8.3.1-1A, does not raise the load on any EDG to the qualified load.

e

17. What load would be predicted if all the intermittent or cyclic loads on one EDG operated simultaneously?

A. (Youngling, Dave) As explained for motor operated valves, it is incorrect to postulate all intermittent or cycli~c loads operating simultaneously. In addition to the position and timing questions for valves, the fuel oil transfer pumps will not operate until the day tank level has been lowered by diesel operation. The air compressors will operate only once after a diesel starts; the length of operation depends on the number of start attempts required. As with the valve loads alone, only an upper bound on intermittent loads can be easily predicted and, as before, if it were to occur it would be for a very short period of time. If all the intermittent or cyclic loads above are simply summed and added to the MESL for each EDG, the predicted load would be 3331.4 KW, 3285.4 KW and 3284.6 KW for EDG 101, 102 and 103, respectively. Thus, it is possible to calculate a load greater-than the qualified load for only one EDG, and even then by only a small amount (less than 1%) and for no more than a few minutes even assuming coin-cident operation of all intermittent or cyclic-loads.

18. Given that answer, shouldn't the qualified load have been established above 3300 KW?

}

- A. (All) No. As previously explained, intermittent loads need not be considered in determining the qualified load.

Moreover, the summation of loads to establish the MESL does not take into consideration the actual sequence of operation of, or operating conditions seen by, plant equipment. In summing the loads on FSAR Table 8.3.1-1A to obtain the MESL it is simply assumed that all equipment operates simultaneously at the name-plate or measured value shown. This is conservative.

The extent of this conservatism is indicated by the results of the integrated electrical test (IET). The IET is performed to ensure that each redundant onsite power source and its associated load group can function without dependence upon any other redundant load group or portion thereof. Each portion of the test is of sufficient duration to achieve stable operating conditions and thus permit the onset and detection of adverse conditions which could result from improper assignment of loads, such as lack of forced cooling to a vital piece of equipment. The tests include introduction of an accident signal (LOCA), and isolation from offsite power (LOOP).

Although the IET cannot simulate exactly the conditions that will exist following a LOCA, it does result in the full sequencing of loads, particularly in the short term before an operator would be expected to start responding to I

i l

l I

• particular symptoms from a particular accident sequence. This is significant because it is during the initial stage of the LOOP /LOCA that predicted loads would be at their highest due to initial starting of equipment before operators secure unneeded equipment. Following a LOOP /LOCA, the major loads on the die-sel generators are attributable to the emergency core cooling system (ECCS) pumps, air-conditioning equipment and the service water pumps. During the IET, expected post-LOCA flows are achieved for both the ECCS and service water pumps and the chilled water systems are preheated to simulate design loads on the water chillers. Thus, there is substantial assurance that the IET results are a reasonable approximation of post-LOCA loads.

The IET has been performed at Shoreham with the TDI diesel generators. The peak loads measured for each EDG were 2833.6 KW, 2806.9 KW and 3072.0 KW for EDG-101, 102 and 103, respectively. These loads are significantly lower than the predicted MESL, and the qualified load for each diesel genera-I l tor. Additionally, during the IET, both reactor building ser-vice water pumps powered from EDG-103 were started automatically. Had they been operated then as they now will be during plant operation, only one of these pumps would have l started automatically,'and the peak load on EDG-103 would have l

l l

l I

i

9

. been up to 358 KW less than the recorded 3072.0 KW, Thus, the IET provides confidence that the predicted MESL for each EDG is conservative.

19. What assurance is there that the qualified load of 3300 KW will not be exceeded during plant operation?

A. (All) Diesel generator operation itself can occur in response to plant conditions or as a result of operator ac-tion for surveillance testing in accordance with technical specification requirements. Loads can be placed on the diesel generators in one of two ways: (i) automatically in response to signals generated during events which require operation of the diesels, e.a., LOOP /LOCA, or (ii) manually by the operator when the diesel generators are operating.

Automatic loading of the diesel generators will not l

result in exceeding the qualified load. As previously explained, all automatically connected loads, except the iden- -

i tified short time, intermittent loads, are included in the MESL for each EDG. These loads are bounded by the qualified load.

Operator action will also not result in loads I

greater than the qualified load. There is no condition under which all of the loads shown in FSAR Table 8.3.1-1 are needed or expected to be operated simultaneously. The ability to con-nect manually various loads is provided to ensure the operator l

l I

9 has sufficient procedural flexibility to utilize various plant capabilities in the event of a LOOP or LOOP /LOCA. Some are provided to protect the non-nuclear portions of the plant.

The plant is designed so that operators do not have to take manual action during the first ten minutes of the event. Since this is approximately the time when peak loads are likely to be experienced on the diesel generators, it is unlikely that operator action will result in loads exceeding the qualified load. Due to the redundancy and diversity of ac-cident mitigation equipment, there is initially more equipment l in operation than is needed. Thus, the initial actions taken by the operator in stabilizing the plant are directed towards securing unneeded equipment, redirecting flows, or otherwise reducing flows in such ways as throttling of ECCS once reactor vessel water level is restored.

Those loads which can only be connected manually are not needed or used during the initial response to a LOOP /LOCA.

They are available for later use by the operator. In some cases, this is equipment which may be used in the long term to A

mitigate LOOP /LOCA consequences, such as the post-LOCA hydrogen recombiners for control of combustible gases in the primary containment atmosphere, or the main steam isolation valve leakage control system. In other cases, it is equipment not

used for LOOP /LOCA mitigation such as, for example, turning gears and lube oil pumps for the main and reactor feed pump turbines. In either case, at the time such equipmen_t is con-sidered for use, the loads on the EDGs will have been reduced substantially from the MESL. When manually loading the diesel generators, the operators are directed by procedures and training not to exceed 3300 KW.

The situation is the same for response to events other than a LOOP /LOCA. The automatic LOOP /LOCA loads bound the automatic loads for other events such as a LOOP. Subse-quent operator decisions are limited by the 3300 KW load re-striction, but in no case are cumulative loads in excess of 3300 KW required.

For surveillance tests which confirm the automatic l

load sequencing of the diesel generators, the load experienced f during the test is bounded by the MESL, and thus the qualified load is not exceeded. For surveillance testing of load carrying capability at the qualified load, the operators are directed to conduct the test at 3300 1 100 KW.

l l

Therefore, there is reasonable assurance that the qualified load will not be exceeded following events which ne-cessitate reliance on the diesel generators. To the extent it may be exceeded during surveillance testing, as is discussed l

I.

O

• more fully below, this would not affect the ability of the die-sel generators to perform their intended function.

20. What assurance is there that the operators will not operate the diesel generators at loads in excess of 3300 KW?

A .- (Notaro, Youngling) Procedures and training give ample assurance that the operators will not load the diesel generators above the qualified load of 3300 KW. In addition, the NRC Staff has included in the Supplemental Safety Evalua-tion Report for the Shoreham TDI diesel generators, dated December 18, 1984, a requirement for a 3300 KW limit in the technical specifications. Plant operators are required to be familiar with the technical specifications, and they are trained to maintain the plant so as not to violate those speci-f fications. Thus, it is highly unlikely that an operator would i

manually operate a piece of equipment that would cause the load

~

on a diesel generator to exceed 3300 KW.

21. Please describe the procedural guidance provided for i

the operator to ensure that the qualified load of 3300 KW is not exceeded on any EDG.

l A. (Notaro, Youngling) A number of procedures have been developed or revised to provide the proper procedural guidance to the operator. Included among these are (i) SP

23.307.01, Revision 12, " Emergency Diesel Generators," (ii) SP 29.015.01, Revision 7, " Loss of Off-Site Power Emergency Proce-i dure," (iii) SP 29.015.04, Revision 0, " Loss of Coolant Acci-dent Coincident With a Loss of Off-Site Power," and (iv) SP 29.023.01, Revision 4, " Level Control Emergency Procedure."

The emergency diesel generator procedure, SP 023.307.01, provides instructions for proper operation of the F

EDG's and their associated auxiliaries. This procedure, in Paragraph 6.2.1, establishes as an operating limit that the ,

continuous loading of any EDG should not exceed 3300 KW. Dur-

- ing surveillance testing of the diesel generators' ability to carry a load of 3300 KW, operdtion will be permitted at 3300 1

! 100 KW.

i l The level control procedure, SP 29.023.01, and the LOOP /LOCA procedure, SP 29.015.04, are interrelated procedures.

Individually and together, they provide guidance for the i operator during the initial stages following a LOOP /LOCA. They require the operator to verify proper actuation of automatic loads and, if necessary, to initiate manually actions which should have occurred automatically. They also require the operator to verify that diesel generator loads do not exceed 3300 KW. The loss of off-site. power procedure, SP 29.015.01, i

l L

i is then used to provide the load management guidelines for the i

1 i

diesel generators. This procedure establishes an upper limit for loading on each diesel generator at 3300 KW, directs that non-safety related loads be controlled so as not to exceed this limit, and provides load values for the connectable loads for the operators' use in maintaining the load below this limit.

Since all of the automatic loads are considered in the MESL for each EDG, manual actuation of loads which could result in ex-ceeding the qualified load is unlikely. For subsequent ac-tions, sufficient direction, warnings and guidance are provided by the procedures to allow the operator to manage load without exceeding the qualified load, i

In addition to these procedures, a number of other procedures have been, or will be, modified. SP 24.307.01 1

(Emergency Diesel Generators Start and Load Test), SP 24.307.02 (DG-Emergency AC Power Load Sequencing Test), and SP 24.307.03 (Emergency Diesel Generators Load Rejection Test) provide i

procedural control for surveillance testing. These procedures will implement the technical specification testing requirements at 3300 KW, and provide for a control band during testing of 3300 + 100 KW. Minor revisions have been, or will be, made to operating procedures for the service water, core spray and re-sidual heat removal / low pressure coolant injection systems.

These revisions provide caution and action statements for these systems to ensure that the qualified load is not exceeded.

Thus, during all phases of operation except surveillance testing at the qualified load, operation of the diesel generators is limited to 3300 KW. Only during surveillance testing will operation be conducted at 3300 1 100 KW. This 1 100 KW operating band is necessary because it is not practical to maintain a perfectly constant load throughout a test. This will not adversely affect the diesel generators given the length of the testing and the width of the control band.

22. What training will be provided to the operators to ensure that the qualified load of 3300 KW is not exceeded?

A. (Notaro) The procedures just discussed will be placed on the required reading list for senior reactor opera-tors and reactor operators. Beginning February 1, 1985, training on these procedures will be formally implemented through lesson plans. All licensed operators will receive this training.

23. How does the operator monitor load on the diesel generators to ensure it does not exceed 3300 KW?

A. (Notaro, Youngling) A diesel generator load meter, reading 0 to 5600 KW, is provided for each EDG on the main con-These meters are easily trol board in the control room.

accessible to the operators.

r

24. What is the accuracy of the diesel generator load meters?

A. (Youngling) Each diesel generator load meter is a Weston wattmeter which has a specified measurement accuracy of 2% of full scale. Each meter is used in an instrument loop

) with other components such that the entire loop has an accuracy of 24% of full scale. Therefore, each load meter can measure the kilowatt. load on the diesel generator to an accuracy of 1 140 KW. This would be the maximum error that could be intro-duced by an in-calibration instrument. In fact, the instru-ments currently installed have been measured to perform with a higher degree of accuracy. For example, the vattmeter for EDG-103 has been checked for calibration four times since October 1982. In all four calibration checks, only one data point, the maximum scale reading of 5600 KW during the October 1982 check, was found to be out of calibration, and then by only a very slight amount. In the range of operation corre-sponding to the 3300 KW qualified load, these last four calibration checks have shown the instrument to be well within tolerance. The largest deviations observed at 3000 KW or 4000 KW indicated have been approximately 1 100 KW. Significantly, however, in the calibrations performed just prior to and fol-lowing the endurance run, the instrument was found to be within

60-70 KW (1-1.25% of full scale) at 3000 KW and 4000 KW indi-cated.

25. What steps does LILCO take to ensure that the accu-racy of the load meters is maintained?

A. (Youngling, Notaro) As part of the Shoreham instru-ment calibration program, the diesel generator load meters and their associated instrument loops are required to be calibrated annually. This calibration is performed in accordance with ap-proved station calibration procedures.

26. What assurance is there that the loads on the diesel generators will not exceed the qualified load as a result of diesel generator load meter instrument error?

A. (All) A LOOP /LOCA event results in the maximum au-tomatic demand on the diesel generators and is therefore the event considered in , establishing the MESL for each diesel gen-erator. Upon receipt of a LOOP /LOCA signal, the plant response is automatic. There is no initial operator action based on readings from these instruments other than verification that loads do not exceed 3300 KW on-any EDG, Analysis of the loads to be accommodated during a LOOP /LOCA confirms that this auto-matic loading will not result in exceeding the qualified load.

The results of the IET provide further confidence that the

predicted loads included in the MESL for each EDG are conserva-tive. Thus, the accuracy of these instruments at the outset of the LOOP /LOCA, or the LOOP alone, has no effect on individual EDG loading.

Because the subsequent operator actions after a LOOP /LOCA event initially result in reduction of load on a diesel generator, loads will be significantly reduced by the time the operator considers placing discretionary loads, in a procedurally controlled manner, on the diesel generator. Al-though the technical specifications and plant procedures will allow loading an EDG to 3300 KW indicated, it is nevertheless unlikely that the operator will approach this level to within the accuracy of his instrumentation, and extremely unlikely that it would persist for any appreciable length of time. The-load profile following a LOOP /LOCA is bounded by 3200 KW after i

12 minutes into the event and by 2617 KW after one hour into the event. This profile includes expected manual loading of

the diesel generator. Even if the diesel generator is loaded to 3300 KW indicated, as the testimony of Drs. Pischinger and

(

Rau reflects, the possible additional load due to instrument l

accuracy would have no adverse impact on the ability of the diesel to perform its intended function.

f l

l

Similarly, during surveillance testing of the diesel generators at 3300 KW indicated, the actual load on a diesel generator could differ from that indicated by the amount of in-strument error. This does not invalidate the surveillance testing since the testing is representative of actual op-eration. To the extent the test load may be slightly below 3300 KW due to instrument error, the necessary load carrying j capability of the EDG is adequately demonstrated because the long-term demands on the diesel are not expected to approach 3300 KW. To the extent the qualified load could be slightly exceeded during testing as a result of instrument error, the time duration of such loading is not long. The technical spec-ifications will require that the diesel generators be tested at this maximum load for only one hour per month. Once per 18 months, the diesel generators will be tested at this load for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. As reflected in the testimony of Drs. Pischinger and Rau, this vill have no adverse effect on the ability of the diesel generators to perform their intended function. In ei-ther an operational or testing situation, the relationship of load limits to instrument accuracy is no different in the con-l text of qualified load than in the context of rated load. For example, it is common practice, in performing EDG surveillance tests at design rated loads, to utilize control room instrumentation for conduct of the tests.

i

27. Is it possible for an operator to start additional equipment erroneously, resulting in a total load exceeding the qualified load?

A. Although it is possible, it is unlikely.

28. For'each EDG, what is the single worst case load that could be started erroneously as a result of an operator error following a LOOP /LOCA?

A. (All) For EDG-101 and EDG-102, the largest load which could be manually started is a control rod drive (CRD) pump with a load of 206.1 KW. This would result in loads of 3459.4 KW and 3414.8 KW on EDG-101 and EDG-102 respectively, if superimposed on each diesel generator's MESL. Significantly, the MESL itself is conservative. A more realistic assessment of the effect of these operator errors would be found by con-sidering -the erroneously started load concurrent with the mea-sured IET loads. This would yield loads of 3039.7 KW and 3013.0 KW for EDG-101 and EDG-102 respectively. Thus, even with the operator error, it is unlikely that the qualified load would be exceeded. Moreover, the error itself is unlikely.

The CRD pumps are tripped automatically on a LOCA signal. They are not needed for the reactor scram. The CRD pumps cannot be restarted as long as a LOCA signal is present.

r-i

• For EDG-103, the largest available load would be the service water" pump which does not start automatically. This load of 358 KW, if superimposed on the MESL for EDG-103, would result in a total load of 3583.5 KW. In fact, however, the IET was run with the second service water pump starting automat-ically and the measured load was only 3072.0 KW, well below the qualified load. Starting of this pump is unlikely because only two service water pumps are needed to m.itigate the LOOP /LOCA event. Given the procedural controls, the available indication of diesel generator load in the control room, and the fact that ,

more than one operator is cognizant of plant conditions, there is reasonable assurance that operator action to correct such errors would occur in a matter of minutes.

4

29. For each EDG, what is the single worst case load that could be started erroneously as a result of an operator error following a LOOP?

A. (All) For EDG-101 and EDG-102, the largest avail-able load would be a core spray pump at 998 KW. When added to the predicted automatic load for these diesels following a LOOP, the total load would be 3839.2 KW and 3627.6 KW for EDG-101 and EDG-102, respectively. This is an unlikely error since core spray is only required following a LOCA. Following a LOOP, reactor water level is maintained by the HPCI and/or

RCIC systems. Moreover, the 998 KW load we have assumed for starting a core spray pump is the nameplate load at design flow. To achieve this load, in addition to the action required to start the pump, the operator would have to continue to take action to establish a flow path capable of design flow. Since the reactor remains pressurized following a LOOP, absent other equipment failures or operator actions, the only flow path available to the operator would be the test mode from the sup-pression pool returning to the suppression pool. There would be no purpose for establishing this flow path. If this flow path is not established, the core spray pump would operate in the minimum flow return mode which provides for a small amount of flow to protect the pump. With minimum flow, the core spray pump load would be significantly less than 998 KW. Thus, it is very unlikely that total' loads comparable to those stated above would be seen since multiple operator errors would be required to establish this plant configuration for which there is no need.

For EDG-103, the largest available load is the 1022 KW residual heat removal (RHR) pump which would result in a total load of 3867.3 KW. (This value is conservative because the pump load assumes runout flow which would not exist without a break in the injection path.) This error is also unlikely.

- Following a LOOP, only two out of four RHR pumps are required.

EDG-103 can supply power to two of the four RHR pumps. Each of the other EDGs can provide power to one of the other two RHR pumps. The RHR pump assumed as the worst erroneous load for EDG-103 is the second RHR pump on that diesel generator's emer-gency bus. It would not be considered for operation unless both RHR pumps powered from sources other than EDG-103 were unavailable. This condition would only exist following multi-ple independent equipment failures beyond the design basis of the plant.

As is the case for an operator error following a LOOP /LOCA, and for the same reasons, there is reasonable assurance that operator action to correct these errors would occur in a matter of minutes.

30. Is the quaJified load of 3300 KW adequate when operator error is considered?

. A. (All) Yes. In addition to technical specificiation

+ limits, procedural controls and operator training are used to minimize the potential for operator error. Further, the design

{

of the plant and its automatic response to events requiring diesel generator operation greatly minimize the need for opera-tor action during the time frame in which the diesel generators will be carrying their maximum loads. When operator action is l

I s

e v ='-- , r-- e e -r -, -,-,e- - - * - * --e--,--.rw,*-w- --.r, .,-cm--,-eu,w..-- .-,y-.4, -,---2-w..-,r... ~ . - - ~ . ,ee--, .,,,,>.,,...--r- -, - ~ -,.m -m

• initially directed, other than to verify proper operation of automatic equipment, it is to secure or reduce operating loads.

Consideration of additional loads occurs only after loads have been substantially reduced as a result of implementing the emergency response procedures.

In the unlikely event an operator erroneously added a worst case load to an EDG coincident with maximum intended demand, the design ratings of the EDG would not be exceeded.

Testing and analysis of the diesel generators have demonstrated the ability of these units to carry these loads without tripping or, as shown by the testimony of Dr. Pischinger and Dr. Rau, without adversely affecting the ability of the engines to reliably perform their function. Such an error would be of short duration. Diesel generator load is clearly indicated in the main control room. By procedure, the operator is trained and required to verify diesel generator loading does not to ex-ceed 3300 KW. Such an error would therefore be easily recog-f l nizable and promptly corrected.

Operator error affecting a diesel generator is not made more likely by the potential duration of a post-LOCA recovery period. The necessary electrical loads in the plant i

decrease substantially a short time following a LOCA. Thus, i

there is more capacity available on the EDGs to accept i

t f

additional-loads. Moreover, the diesel generators are only used so long as off-site power is unavailable. In the low power licensing proceeding, offsite power has been shown to be 4

reliable, and restoration time following its loss is short. l I

Lona Island Liahtina Co. (Shoreham Nuclear Generating Plant, Unit 1), LBP-84-45, slip. op. at 40-46 and 82-83 (October 29, 1984). Thus, the diesel generators would be in use, if at all, for only a small portion of the potentially longer post-LOCA l I

recovery time.

Even if an operator error resulting in loading greater than 3300 KW on an EDG were assumed to cause failure of that EDG, that failure would be within the design basis of the plant. There is no single operator error which can simultaneously increase the load on two or more diesel generators. The IET has demonstrated the independence between the,various power sources and their associated load groups.

Shoreham has three independent diesel generators, any two of which provide sufficient capacity to ensure safety for any design basis event. The loss of more than one EDG due to operator error, or other failure mechanism, can be postulated only if multiple, independent failures are assumed. No such assumption is required by NRC regulations. In implementing the single failure criterion embodied in 10 CFR Part 50, Appendix A, an operator error constitutes a single failure.

I a -- r - -- -- -

, , - . . --,.,n. , . . , . , . -. . - _ - - , . , , . - - -

. - ~ . . . , , - . _ . - , , . - - - - - - . , , ~ ,

1

• l For all of these reasons, the potential for operator i

error does not call into question the adequacy of the 3300 KW qualified load.

! 31. What assurance is there that the allowed operating u

band of 3300 1 100 KW did not result in an inadequate con-firmatory test run?

A. (t.ll) The confirmatory test to accumulate 10 7 load-l- ing cycles at or above 3300 KW on EDG 103 was comprised of two parts. First, the number of hours of operation accumulated at i

or above 3300 KW on EDG-103 (221 hours0.00256 days <br />0.0614 hours <br />3.654101e-4 weeks <br />8.40905e-5 months <br />) prior to the decision to establish a qualified load was determined. Then, the re-maining required hours were accumulated during an endurance run I

i conducted solely for this purpose. This endurance run was con-I ducted for 525 hours0.00608 days <br />0.146 hours <br />8.680556e-4 weeks <br />1.997625e-4 months <br />, and it was during this test that an op-erating band of 3300 1 100 KW was established.

The 525 hour0.00608 days <br />0.146 hours <br />8.680556e-4 weeks <br />1.997625e-4 months <br /> endurance run was conducted under oper- P ator control to maintain a load of 3300 KW 1 100 KW on EDG-103.

I Readings were taken of the EDG-103 KW output every 30 minutes.

i of the 525 hours0.00608 days <br />0.146 hours <br />8.680556e-4 weeks <br />1.997625e-4 months <br />, only 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> were recorded at loads below i

l 3300 KW. No load was recorded below 3250 KW. 81 hours9.375e-4 days <br />0.0225 hours <br />1.339286e-4 weeks <br />3.08205e-5 months <br /> were recorded at loads above 3300 KW, with no load above 3400 KW.

This shows that only a short amount of time during the endur-ance run was at loads below 3300 KW. More operation occurred at 4

t i

- _ _ . . , . - - - . ~ . . . , - , , . . - . . _ _ _ . _ . . - . . _ _ _ - _ , . _ _ - . _ _ . - - . . _ _ _ . _ . _ . _ _ _ . - . _ , _ . _

loads greater than 3300 KW than below it. As the testimony of Drs. Pischinger and Rau shows, this test, when combined with previous testing at or above 3300 KW, adequately demonstrates 10 7 loading cycles at the qualified load. Thus, the allowed EDG load control band did not affect the adequacy of the con-firmatory test to demonstrate reliable operation at 3300 KW.

32. What assurance is there that the diesel generator load meter accuracy was adequate for purposes of the endurance run?

A. (All) We have previously testified to the accuracy of the EDG-103 load meter. The EDG-103 load meter was cali-brated on October 1, 1984, one week prior to the commencement of the EDG-103 endurance run, and calibration was rechecked January 4, 1985. It was found, in the range of 3300 KW indi-cated, to be accurate to + 60 to 70 KW during each of these calibration checks.

With respect to the instrumentation, the diesel gen-erator generator was operated during testing, just as it will be operated in the future. Thus, the test was representative of operating conditions and demonstrates that when run at an indicated load of 3300 KW, the diesel vill operate reliably.

The qualified load of 3300 KW, as indicated during the test, is the same indicated load to which the diesel will be limited in

• operation by technical specifications and procedures. Even if the actual load represented by that indicated load is slightly different., it is of no significance because the addition of manual loads will be procedurally restricted by the total load as indicated on the load meter, while the automatically con-nected loads, as demonstrated by the IET, will be well below the qualified load indicated during testing.

ATTACHMENT A JACK A. NOTARO Outage and Modifications Manager Lona Island Lichtino Company Assigned as Outage and Modifications Manager in May 1984.

Responsible for the implementation of design changes to plant systems or equipment as required by the regulatory agencies or for plant operational / reliability considerations. Specific duties include supervision of the Planning and Scheduling, Modification Engineering and Outage Planning sections to i

maximize station availability and to optimize the size of the modification related work forces.

j Graduated from City College of New York in 1970 with a l

Bachelors Degree in Mechanical Engineering. Received a Masters of Business Administration Degree in 1974 from Adelphi University.

Completed the General Electric Co. Boiling Water Reactor i Simulator Program in July 1976, and obtained certification as a Senior Reactor Operator.

1 Obtained NRC Senior Reactor Operator License # SOP-4419 for

Shoreham November 1982.

Completed the following industry seminars and training programs:

~

(a) BWR Design Orientation - General Electric Co.

(b) BWR Technology - General Electric Co.

(c) Nuclear Power Plant Technology - General Physics l Corp.

(d) BWR Observation Training - General Electric Co.

(e) Degrabed Core Conditions - General Electric Co.

i (f) Refueling Activities - General Electric Co.

(g) Radiation Protection - LILCO Evening Institute r

l (h) Basic Applied Health Physics - Brookhaven National Laboratory l

i (i) Vibration Analysis - IRD Mechanalysis, Inc.

t.

I L

- - _ _. _ = _ _ . - - . _ . - . - _. ..-- - - - __

s'

• i l (j) Statics, Strength of Materials & Dynamics - LILCO Evening Institute (k) Management of Maintenance Storekeeping & Inventories

- Management Dynamics Institute f

2 (1) QA for the Nuclear Industry - Stat-A-Matrix and Gen-eral Physics Corp.

(m) Inservice Inspection and QA During Operations -

4 Southwest Research Institute

^

(b) Basic Radiography - Corvair Division of General Dy-namics 4

(o) Magnetic Particle & Liquid Penetrant Testing - Mag-naflux Corp.

(p) Basic Ultrasonics - Automation Industries (q) Nuclear Power QA - Long Island Section of AQSC ll (r) Inservice Inspection Symposium - Mirror Insulation (s) Operations Quality Assurance - Stat-A-Matrix 4

(t) Reactor Research Training - Brookhaven National Lab-oratory 1983 - 1984

[-

Assigned as the Shoreham Chief ~ Operating Engineer in April

! 1983. Responsibilities include the formulation and implementation of the training programs for all Station personnel; development and review of the Operations, Training and Security Sections of the Station Operating Manual; and the overall management of the Operations,. Training and Security Sections of the Station.

1978 - 1983

' Assigned as Operating Engineer of the Shoreham Nuclear Power Station in July 1978. Responsible for the development and implementation of the Station's operational activities

~

including the direction of day-to-day operation of the unit;

-startup, operation and shutdown of all stat on i equ pmen i t; '

implementation of initial, requalification and replacement l -- -_ _ _ . . . _ . . _ . _ . . - _ . _ . _ _ . _ . _ . . . _ _ _ _ _ . _ _ _ . . _ _ _ _ . .

' training programs for licensed and unlicensed operators; the development, review and implementation of the Operations Section of the Station Operating Manual.

June 1981 - Aucust 1981 Assigned to the Operations Section of the Millstone Nuclear Power Station. The scope of this assignment included power operation training at greater than 20% power. The assignment

encompassed three months of actual hands-on experience in a two-month calendar period.

Participated in weekly and monthly routine BOP and NSSS system surveillance testing. Participated in high risk I&C Operations equipment and system surveillance testing. Witnessed TIP traces and conducted heat balances, core flow calculations were conducted with and without main computer available.

Participated in power downs from 100% power to complete control

- rod repositioning and repairs to main condenser cross-over valving. Assisted in maintaining power at less than 25%, as required by Tech Specs, as a result of main computer problems.

Witnessed implementation of emergency notification procedures. ,

Manipulated controls for power downs, return to power, Tech Spec LCO's, control rod repositioning, and stuck control rod surveillance testing. Witnessed and participated in half scram and full scram recoveries, subsequent investigations, evalua-tions and notifications.

In addition to the above, attended daily Plant Manager's Unit and Unit Superintendent's meetings, Operations Department meetings, Plant Operations Review Committee meetings, shift staffing, planning and scheduling evaluations.

I March 1981 - May 1981 Assigned to the Operations Section of the Millstone Nuclear Power Station for the completion of the Unit 1 refueling outage. The scope of this assignment included refueling, cold shutdown to greater than 20% power, and greater than 20% power to cold shutdown. The assignment encompassed three months of actual hands-on experience in a two-month calendar period.

Participated in all significant pre and post refueling outage surveillance testing and inspections. Actively took part in S' refuel bridge operations including control rod removal and replacement, channeled and dechanneled fuel movements, core

1 s-s' .

inspections and verifications, dropped fuel bundle evaluations

. and recovery. Assisted in the evaluations and calibrations resulting from abnormal nuclear instrumentation indications.

Participated in integrated leak rate testing, primary system hydrostatic pressure testing and drywell inspections, assessed .

system status and return to normal. Conducted portions of pre-criticality testing including control rod functional, subcritical checks and friction testing. Actively took part in 1 returning the unit to survive from cold shutdown to greater than 20% power including manipulation of controls during plant heat-up. .

i In addition to the above, participated in daily outage coordination meetings, Operation Department' staff meetings,

~

Plant Operations Review Committee meetings, shift staffing and i scheduling evaluations.

April 1979 - May 1979.

Completed the 160 hour0.00185 days <br />0.0444 hours <br />2.645503e-4 weeks <br />6.088e-5 months <br /> General Electric Company Observation i Training Program at Commonwealth Ediso,n Company's Dresden Nuclear Power Station. Modification-of the standard i

observation training program was effected in this instance including direct assignment to Dresden Operations and Clearance

' for unescorted access.

Dresden Unit 2 was returning from a ' refueling outage and Unit 3 was returning from a forced outage to replace the main transformer during this training assignment.

t- On. Unit'2, observed significant pre and post refueling outage surveillance testing. Witnessed integrated leak rate testing.

Participated in the primary system hydrostatic pressure test and drywell inspections. Observed preparations for an accomplishment of approach to crit!ctiity, plant heat-up, transfer to run, placing the main turbine in service and power operation. Wit 7essed half and full scram recoveries.

Manipulated controls to reduce power from 700 MW to 200 MW in preparation for 1.tator cooling system filter replacement.

Aucust 1978 Assigned to the Vermont _ Yankee Nuclear Power Station to observe startup of the unit following a refueling outage. Witnessed Witnessed the completion of the integrated leak rate test. the primary system hydrostatic pressure test and took part in the '

drywell inspection. Observed preparations for'and l

5

-r,.- -+-4-, y m., _r.m#, ,._n . , . - ~ , . - _ w.,, .,_._.,,,,w, , ,.ww_,,,we _y.m%.y.&___,,, .,,,--mm,my. v._,wwme,_,--.m.m-.-er

~

/. accomplishment of approach to criticality, plant heat-up and transfer to run. Witnessed half scram recovery during plant heat-up.

March 1973 - July 1978 Assigned to the Shoreham Nuclear Power Station in the Quality Assurance Section and subsequently promoted to Station Operating Quality Assurance Engineer responsible for the Section in July 1974.

Responsibility included initial development of the operational quality assurance program. Responsible for all aspects associated with its implementation at the station including reviews, audits, surveillance, inspections, selection and training of personnel, development of procedures and instructions, and the utilization of consultants and contractors. Additional responsibilities included licensing and inspection activities associated with the U.S. Nuclear Regulatory Commission and interfacing with external and inter-nal organizations required to implement the operational quality assurance program.

1970 - 1972 Assigned to the Maintenance Section in the Northpower. Power Station. Assigned duties included assisting in outages of both a scheduled and forced nature as well as maintaining plant equipment and systems, and completing special projects.

Member of the American Society. for Quality Control. Member, Edison Electric Institute - Quality Assurance Task Force (EEI-QATF) and the EEI-QATF Operations Subcommittee.

q

' LILCO, Jcnuary 15, 1985  ;

ELL u .

'97 ,,

c ,.

UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION- > , rm .3. 9 Before the Atomic Safety and Licensina Board

- . ~

In the Matter of- )

)

LONG ISLAND LIGHTING COMPANY ) Docket No. 50-322 (OL)

)

(Shoreham Nuclear Power Station, )

Unit 1) )

LILCO Brief on the Applicability of the Single Failure Criterion to the EDG Load Contention l l On December 28, 1984, Judge Brenner notified LILCO and Suffolk County of the Board's decision concerning the admissibility of the joint Suffolk County and New York State EDG load contention. Section (a)(iv) of the contention admit-ted by the Board was as follows:

Contrary to the requirements of 10 CFR Part 50, Appendix A, General Design Crite-rion 17 -- Electric Power Systems, the emergency diesel generators at Shoreham

("EDGs") with a maximum " qualified load" of 3300 KW do not provide sufficient ca-pacity and capability to assure that the l requirements of clauses (1) and (2) of the first paragraph of GDC 17 will be met, in i that (a) LILCO's proposed " qualified load" of 3300 KW is the maximum load at whicn

' the EDG may be operated, but is inad-

equate to handle.the maximum load that may be imposed on the EDGs be-cause

~_

(iv) operators may erroneously start additional equipment;

- Among other reasons, LILCO objected to this portion of the l contention because it went beyond the single failure criterion of the NRC's regulations. LILCO's Response to Joint Motion to i

Admit EDG Load Contention, at 11 (December 27, 1984). While the Board has admitted this issue for the time being, it has also permitted LILCO to file a brief explaining in more detail why this part of the EDG contention is impermissible. Accord-I ingly, in this brief, LILCO demonstrates that (i) section (a)(iv) of EDG contention al-leges multiple failures beyond the single failure criterion, (ii) the NRC's regulations prohibit the admission of such an issue absent l

special circumstances, and (iii) Intervenors have alleged no special l

circumstances adequate to justify ad-mission of the contention.

I. EDG Contention Section (a)(iv) l Alleges Multiple Independent Failures EDG load contention section (a)(iv), though susceptible of two interpretations,1/ alleges, in effect, that multiple 1

i 1/ As originally proposed by Intervenors, this portion of the contention could have been construed to mean that the operator error'is the single independent failure to be considered under the single failure criterion. If so construed, however, there is nothing to litigate because the diesels are undeniably

designed to accommodate single failures. In the event of a LOOP /LOCA, all three diesels would be available to mitigate the (footnote continued) l I

- independent failures must be considered in analyzing the reliability of the Shoreham diesel generators. More impor-tantly, the thrust of this portion of the Intervenors' conten-

~

tion is that the system for the supp1y of emergency power y to Shoreham must be designed to withstand failures beyond the sin-gle failure criterion. Thus, according to Intervenors, GDC 17 requires that the system be designed so that adequate emergency power is available even assuming a LOOP /LOCA event, the single ,

failure of a diesel, and then, in addition , an operator error.

i which should be assumed to fail a second diesel.2/ For the reasons stated below, absent a showing of exceptional (footnote continued) event. Even if an operator error inadvertently overloaded a

diesel resulting in its loss, the remaining two diesels would be sufficient to supply emergency power to the plant. As the Board has noted, and the County has not disputed, Even in the event of a design basis acci-dent at 100% power and maximum core fission -

inventory, only two out of three diesels

!- are required for safe shutdown. However, i

it is required by-the NRC's " single failure criterion" that there be three operable l

diesels in the event of a failure of one of them upon demand.

Lona Island Lichtino Co. (Shoreham Nuclear Power Station, Unit 1), LBP-83-30,-17 NRC 1132, 1145 (1982),

i 2/ Operator errors of omission or commission are considered single failures when applying the single failure criterion.

i See Nuclear Safety Criteria for the Design of Stationary Boiling Water Reactor Plants, ANSI /ANS-52.1-1983, at S 3.2.6; see also Single Failure Criteria for Light Water Reactor Safety-Related Fluid Systems, ANSI /ANS-58.9-1981, at 5 3.7.

- ~ ~ - - - v- ,-

, -,*,,-y-e,cn--v,,+,.ew-+-ww,-we--er,-e-e,-e-w,

l l

4 circumstances, this contention must be rejected as an attack on the Commission's regulations establishing the single failure criterion as the design basis for the plant.

Absent Special Circumstances the II.

Single Failure Criterion Does Not Require Consideration of Multiple Independent Failures l'

It is well established that the " single failure criteri-

' on" does not require consideration of multiple independent failures in evaluating nuclear plant safety. Thus, in dealing with health and safety contentions in the Partial Initial Deci-sion of September 21, 1983, this Board held that LILCO was not required to assume an " undetectable" failure of a valve when designing against the single failure of another active compo-nent of the system. See Lona Island Lichtino Co. (Shoreham Nu-l clear Power Station, Unit No. 1), LBP-83-57, 18 NRC 445, 482 i

(1983). This Board stated that requiring such analysis "would constitute a postulated double failure of active components" and that "[sluch a reading of 10 C.F.R. Part 50, Appendix A, is

( clearly beyond existing regulatory requirements and inconsis-l tent with regulatory practice." Id. at 481-82.

l Similarly, other Licensing Boards have held that contentions that seek analyses assuming more than a single failure are impermissible challenges to the Commission's regulations and are, therefore, inadmissible. in Grand Gulf, the. Licensing Board denied admission of a contention that i

-- -- - . _ _ - . . _ _ _ _ _ . . - - _ . _ _ . . _ . , - - _ , _ _ _ - . . . _ . , _ . . _ . . . , . _ , - ~ - _ , _ . . _ _ , - .

}

\

- -s-b attacked a safety analysis because it was based on the single

! failure criterion. Mississippi Power and Light Co. (Grand Gulf Nuclear Station, Unit 1), LBP-84-19, 19 NRC 1076 (1984). The Board ex,plained:

In fact, Appendices A and K of Part 50 adopt the single failure criterion as the regulatory standard. Petitioner seeks to impose a different standard upon the Grand Gulf facility . . . because of the as-serted poor past performance of management and the inexperience and lack of training of the operators. Tr. 77-79.

As with regard to the prior two con-tentions, Petitioner has failed to demon-strate any nexus between the asserted poor past general performance of the Licensees and the standard it wishes the Board to impose in place of the regulatory standard imposed on all nuclear plants.

Consequently, it has made no showing of a "special circumstance" which would permit the waiver of the regulatory standard.

Id. at 1082.

The Licensing Board in the Shearon Harris case also rejected a contention alleging the inadequacy of a safety analysis limited to a single failure. Carolina Power and Light Co. (Shearon Harris Nuclear Power Plant, Units 1 and 2),

LBP-82-119A, 16 NRC 2069, 2090 (1982). There, the Board held that the contention was inadmissible as an attack on the NRC's regulations directing the use of a single failure analysis.3/

3/ Ege also Public Service Co. of New Hamoshire (Seabrook Station, Units 1 and 2), LBP-82-76, 16 NRC 1029 (1982). A contention charged that the plant's design had to be revised (footnote continued)

Simply put, then, Intervenors may litigate contentions which assume multiple failures only where special circumstances exist. Grand Gulf, 19 NRC at 1082. Thus, in St. Lucie, the Appeal Board permitted litigation of multiple diesel generator failures stating:

We denied the applicant's motion (for reconsideration of an order requiring tes-timony on the probability of the failure of both diesels to start] because we be-lieved that the single failure criterion might be inappropriate for application to diesel generators.

The diesel generators are " components" of the onsite power system. Under the single failure approach, should one generator fail to operate, the other could be counted upon to supply-the electrical needs of the plant's safety systems. Al-though the single failure concept may well provide adequate assurance of plant safety and public protection when the component in question has a very smali probability of failure, it becomes increasingly sus-pect when the equipment can be expected to fail at a higher rate.

[D]iesel generators are considerably less reliable than most other components.

(footnote continued) because a single failure in the common discharge header of the emergency feedwater system, together with delayed or omitted operator action to correct the failure, would result in a loss of feedwater to all the steam generators. Id. at 1059-60. The Licensing Board rejected this contention "as not having a regu-latory basis." Id. at 1060.

. Florida Power and Licht Co. (St. Lucie Nuclear Power Plant, Unit 2), ALAB-603, 12 NRC 30, 49 (1980). As a result, the Ap-plicant was required to include an analysis of the loss of all AC power at the site as a design basis event in the FSAR, but was permitted to assume that AC power equivalent to the output of one of the diesels would become available for use after "a reasonable period." Id. at 64.

Significantly, the St. Lucie decision does not establish that the single failure criterion is generally inapplicable to diesels generators. To the contrary, when the Commission reviewed the St. Lucie decision, it concluded that the case did not establish a generic guideline requiring that station blackout be considered a design basis event. Florida Power and Licht Co. (St. Lucie Nuclear Power Plant, Unit 2), CLI-81-12, 13 NRC 838, 844 (1981).

More recently, the Appeal Board confirmed this, .

explaining that its holding in - ' Lucie was based upon the ex-ceptional circumstances of that case:

In St. Lucie, we determined that addition-al measures were necessary to mitigate a loss of all AC power (station blackout) because of a history of offsite power loss and the well-documented limited reliability of diesel generators even though the plant's redundant diesel gener-ators met the single failure criterion.

Metropolitan Edison Co. (Three Mile Island Nuclear Station, Unit 1), ALAB-729, 17 NRC 814, 832 (1983) (tootnote omitted).

The Appeal Board noted that while blind adherence to the single

' failure criterion is inappropriate, deviation from it must be well-founded on exceptional circumstances directly applicable to the case in question. See id. Thus, the Appeal Board crit-icized the TMI-l Licensing Board for a departure from the sin-gle failure criterion based upon data that was not clearly ap-plicable to TMI.

The importance of ensuring that plant specific ex-ceptional circumstances exist was highlighted in a recent case involving diesel generators. There, a Licensing Board rejected a contention that the diesel generators should be subjected to a more stringent requirement than the single failure criterion founo in General Design Criterion 17. Washincton Public Power Supolv Svatem (WPPSS Nuclear Project No. 1), LBP-83-66, 18 NRC 780 (1983). The Licensing Board distinguished St. Lucie, stating:

However, in that proceeding the Appeal Board's justification-for not following the GDC was the special circumstance of the location of the St. Lucie plant in the Florida peninsula so that the applicant's ,

electrical distribution system (grid) could be connected to only the grids of other utilities to the north, making the system less reliable than one interconnected with multiple grids.

Here Petitioner has offered no such weighty reason for not following the-Com-mission's rule enunciated in GDC 17 as re-quired by S 2;758(a). The reason given

. . . of emergency diesel unrealiability, is a' generic problem that the commission has already considered and determined not to require designating a station blackout as a design basis event in the absence of exceptional circumstances such as St.

Lucie.

i

- _g_

Id. at 791-92.

Accordingly, before this Board can permic litigation of contention (a)(iv), the Intervenors must demonstrate that there are olant specific special circumstances that justify deviating

( from the single failure criterion.4/

III. Intervenors Have Failed to Show Exceptional Circumstances A County consultant has acknowledged that the issue raised in what is now EDG Contention section (a)(iv) goes beyond the single failure criterion:

I am aware that under normal interpreta-tion of the single failure criteria, such operator errors are not required to be considered in the review.

Bridenbaugh Affidavit at 10. Bridenbaugh attempted to justify the departure from the norm because of the length of time involved in the recovery from a major accident.

However, there is no assurance that the LOOP /LOCA or LOOP events will be termi-nated in any precise short period of time (in fact, such events could continue for hours or days). In actual accident cases (such as at Three Mile Island-2), errors have been subsequent to the initiation of the event. It is unreasonable to ignore the possibility of such events and to fail to provide some conservatism in the load margins, particularly since LILCO proposes 4/ This result is consistent with 10 CFR S 2.758 which pro-hibits challenges to the NRC's regulations unless a showing is made that special circumstances in the particular case differ from those envisioned by the regulation. Section 2.758 re-quires the Licensing Board to refer any decision permitting such a challenge to the Commission for review.

1

• to operate this plant with EDGs having a long history of serious design and quality problems.

Id. But this justification falls far short of a plant specific justification.

First, the alleged circumstance is only general specula-tion about the length of accidents no more applicable to Shoreham than any other plant. No attempt is made to show why

! operator errors are more likely at Shoreham than elsewhere.

Such generalizations are inadequate to justify deviation from

- the single failure criterion. See TMI-1, ALAB-729, 17 NRC at 832. Second, the alleged circumstance is factually incorrect; f it focuses on the wrong time interval. However long it may take to recover fully from a LOOP /LOCA, concerns about operator error causing a loss of a diesel end once the diesels are no longer needed. Consequently, the relevant interval is the time it takes to restore AC. power in a LOCP or LOOP /LOCA. This, as shown below, is not' substantial at Shoreham.

The record in the low power proceeding demonstrates that l

l, "the number and diversity of paths for supplying offsite power to Shoreham far exceed the regulatory requirements." Lona Island Lichtina Co. (shoreham Nuclear Generating Plant, Unit 1), LBP-84-45, 20 NRC , slip op, at 54 (October 29, 1984)

(Initial Decision). Indeed, the Miller Board found it unlikely that normal offsite power would be lost at all.

I I The Board finds that LILCO's substantial and diverse generating capacity, coupled with the multiplicity of paths through which power can be transmitted to the site, more than satisfies the requirements of GDC-17 with respect to nor-mal offsite power and makes it unlikely that '

power would be unavailable to either the NSST or the RSST from normal offsite sources.

Initial Decision at 46.

But even if offsite power is lost, the Board found that restoration of power could be accomplished from multiple sources in from six to twenty-five minutes. Power can be re-stored from gas turbines at Holtsville in six minutes (Initial l

Decision at 82 (1 45)), from a gas turbine at Southold in ten

! minutes (14. at 83 (1 49)), from a gas turbine at East Hampton in fifteen minutes (14. at 83 (1 51)), and from a gas turbine at Port Jefferson in twenty-five minutes (14. at 82 (1 46)).

As these Miller Board findings reflect, the gas turbines sur-round the site geographically. Moreover, LILCO is interconnected with two different power pools, the New York Power Pool through New York City and the New England power ex-change from Connecticut (under Long Island Sound). Id. at 82 (1 47) (citing Tr. 520-24 (Schiffmacher)). In addition, LILCO has available enhanecments to its offsite power system, a 20 MW vas turbine and four 2.5 KW EMD diesel generators, which are located at Shoreham and are capable of restoring power rapidly.

Id. at 87-88 (11 63, 66). Consequently, a finding of special circumstances based upon the period of time that the diesels will be used cannot be made without ignoring the conclusions of the Miller Board.

j

a In sum, the Intervenors have failed to establish the requisite special circumstances to permit consideration of multiple failures in contravention of the single failure criterion. Indeed, the Miller Board findings that offsite ~

power is both highly reliable and capable of rapid restoration preclude a finding here of special circumstances.

}

IV. Conclusion EDG load contention (a)(iv) requires the assumption of multiple failures beyond the single failure criterion. The Intervenors, however, have failed to demonstrate that special circumstances exist that would justify a deviation from the NRC's regulations. Consequently, EDG load contention section (a)(iv) should be dismissed.

Respectfully submitted, LONG ISLAND LIGHTING CO.

hlT. S. ELLIS, ty T. S. Ellis, III Anthony F. Earley, Jr.

Hunton & Williams 707 East Main Street Richmond, Virginia 23219 DATED: January 15, 1985

. *(

LILCO, January 15, 1985 CERTIFICATE OF SERVICE In the Matter of LONG ISLAND LIGHTING COMPANY (Shoreham Nuclear Power Station, Unit 1)

Docket No. 50-322 (OL)

I hereby certify that copies of the Diesel Generator Qualified Load Testimony of George F. Dawe, Jack A. Notaro and Edward J. Youngling on Behalf of Long Island Lighting Company and LILCO's Brief on the Applicability of the Single Failure Criterion to the EDG Load Contention were served this date upon the following by first-class mail, postage prepaid, or by hand as indicated by an asterisk:

Judge Lawrence Brenner, Esq.* Atcmic Safety and Licensing Chairman Appeal Board Panel Atomic Safety and Licensing U.S. Nuclear Regulatory Board Commission U.S. Nuclear Regulatory Washington, D.C. 20555 Commission 4350 East-West Highway Atomic Safety and Licensing Fourth Floor (North Tower) Board Panel Bethesday, Maryland 20814 U.S. Nuclear Regulatory Commission Dr. Peter A. Morris

• Washington, D.C. 20555 Administrative Judge i Atomic Safety and Licensing Martin Bradley Ashare, Esq.

Board Attn: Patricia A. Depsey, Esq.

U.S. Nuclear Regulatory County Attorney Commission Suffolk County Department of 4350 East-West Highway Law Fourth Floor (North Tower) Veterans Memorial Highway Bethesda, Maryland 20814 Hauppauge, New York 11787 Dr. George A. Ferguson* Edwin J. Reis, Esq.*

Administrative Judge Robert G. Perlis, Esq.

Atomic Safety and Licensing Bernard M. Bordenick, Esq.

Board Panel U.S. Nuclear Regulatory School of Engineering Commission Hovard University 7735 Old Georgetown Road 2300 6th Street, N.W. Bethesda, Maryland 20814 Washington, D.C. 20059 Herbert H. Brown, Esq.*

Secretary of the Commission Alan R. Dynner, Esq.

U.S. Nuclear Regulatory Kirkpatrick & Lockhart Commission 1900 M Street, N.W.

Washington, D.C. 20555 Eighth Floor Washington, D.C. 20036

s

-J Mr. Marc W. Goldsmith James B. Dougherty, Esq.

Energy Research Group 3045 Porter Street 4001 Totten Pond Road Washington, D.C. 20008 Waltham, Masschusetts 02154 Fabian G. Palomino, Esq.

MHB Technical Associates Special Counsel to the 1723 Hamilton Avenue Governor Suite K Executive Chamber, Room 229 San Jose, California 95125 State Capitol Albany, New York 12224 Mr. Jay Dunkleberger New York State Energy Office Jonathan D. Feinberg, Esq.

Agency Building 2 New York State Empire State Plaza Department of Public Service Albany, New York 12223 Three Empire State Plaza Albany, New York 12223 Stephen B. Latham, Esq.

Twomey, Latham & Shea Robert E. Smith, Esq.

33 West Second Street Guggenheimer & Untermyer P. O. Box 398 80 Pine Street Riverhead, New York 11901 New York, N.Y. 10005 D<,

[' )

k -

/ /lMl$4 T .'S'.' Ellis,~ III

~

V Hunton & Williams P. O. Box 1535 Richmond, Virginia 23212 DATED: January 15, 1985