ML20132C344
Text
x
~
- . Eda f.
+
pm4 9h UNITED STATES e
[,y,#( ()
NUCLEAR REGULATORY COMMISSION
- p /,j WASHINGTON, D. C. 20555 i
k.(..../
JUL 2 71984 MEMORANDUM FOR: Thomas M. Novak, Assistant Director for Licensing, DL FROM:
L. S. Rubenstein, Assistant Director for Core and Plant Systems, DSI
SUBJECT:
BEAVER VALLEY UNIT 2, POWER SYSTEMS BRANCH, SAFETY EVALUATION REPORT Plant Name: Beaver Valley Power Station, Unit 2 Docket No: 50-412 Licensing Stage: OL Responsible Branch: LB #3 Project Manager:
L. Lazo/M. Ley Requested Completion Date: July 27,1984 Review Status: Awaiting Information Enclosed is the electrical and mechanical portion of the subject Safety Evaluation Report (Enclosure 3). This report covers Sections 8.1, 8.2, 8.3.1, 8.3.2, 9.5.2 through 9.5.8.10.2,10.3,10.4.1, and 10.4.4 of the standard review plan for which the PSB has review responsibility. This report reflects the results of our review through amendment 6 of the Beaver Valley FSAR for Section 8.0 and through amendment 4 of the FSAR and applicant submittals through March 28, 1984 for Sections 9.0 and 10.0.
A status listing of the electrical and mechanical open items is presented in Enclosure 1.
Following each item listed, the item's SER reference, the item's current status: open-closed, and the open item's category 25 defined in Enclosure 2, have been identified. All mechanical open item:,
were discussed with the applicant at a meeting in Bethesda on March 6, 1984. At that time the applicant was informed of our positions and what information would be required to close out the item. He was also informed as to the latest date by which information should be submitted to close out items in this SER. He has not submitted any information since the March meeting.
l l
l
Contact:
R. Giardina k[T x29484 1 y J. Knox 1
x24568 V
[
wwsn33 xk 1
e i
Thomas M. Novak sh..
204 l
t We request that DL exert the necessary means to obtain the needed infomation so that the staff can close the numerous open issues. The PSB/DSI SALP input is presented in Enclosure 4 shna L.
ubenstein. Assist t Director for Core and Plant Systems Division of Systems Integration
Enclosures:
As stated i
cc:
D. Eisenhut D/DS!
M. Srinivasan G. Knighton M. Ley L. Lazo A. Ungaro J. E. Knight J. Knox R. Giardina i
{
l*
g
[
ENCLO5URE 1 BEAVER VALLEY ELECTRICAL ISSUE STATUS LISTING l
1.
Physical independence of offsite circuits between the grid system and switchyard (Section 4.2.2.1, Question 430.5, closed) 2.
Capability to reestablish power from the offsite power system (Section 8.2.2.2, Question 430.6 Open: Category 3a)
Class It system (Section 8.2.2.3, Question 430.7, Closed) yard and 3.
Independence of offsite power circuits between the switch 4
Independence of control and protective relaying circuits associated with offsite circuits between the switchyard and the 4160 volt Class It busses (Section 8.2.2.3, Question 430.7, Open: Category 3a) 5.
Documentation of description of physical separation of offsite circisits in Section 8.2 of the FSAR (Section 8.2.2.3, Question 430.7, Open: Category 3a) 6.
Independence between onsite and offsite power sources (Section 8.2.2.4, Question 430.8, Open Category 3a) 7.
Capability to test transfer of power between nomal and preferred offsite circuits. (Section 8.2.3.1, Question 430.g. Open Category 34) 8.
Documentation of test capability in Section 4.2 of the FSAR (Section 8.2.3.1, Question 430.9, Open Category 3a) l 9.
Use of automatic load tap changer (Section 4.2.2.5, Question 430.10, Opent Category 3a)
- 10. Voltage analysis (Section 8.3.1.1, Question 430.11, Open: Category 3a)
- 11. Design, qualification, and/or protection of Class It equipment from natural phenomena (Section 8.3.3.1.2, Question 430.12, Open: Category 3a)
- 12. protection of Class 1E equipment from dynamic effects (section 8.2.3.1.3, Question 430.13, Open Category 3a) 13.
Protection of Class 1E equipment fmm fire protection system effluents (Section 8.3.3.1.4, Question 430.16, Open t Category 7) 14 Submerged electrical equipment as a result of a loss of coolant accident (Section 8.3.3.1.1, Question 430.18, Open t Category 3a) 8 '
4.
9 4W8 8MS.*m98 Se e eS &
WM M e.
_w a
l 2
f i
- 15. Use of regulating transformers as isolation devices (Section 8.3.3.3.1, Question 430.19, Open: Category 3a)
- 16. typass of thermal overload protection (Section 8.3.3.1.5, Question 430.20, closed)
- 17. Design and qualification of safety related electric equipment (Section8.3.3.1.5, Question 430.21, Closed)
- 18. Bypass of Diesel Generator Protective Trips (Section 8.3.1.2, Question 430.22, Open: Category 7)
- 19. Load Testing of the diesel generator (Section 8.3.1.3, Question 430.23, Open': Category Ja)
- 20. Compliance to BTP P58-2 (Section 8.3.1.4, Question 430.24, Open: Category 3a)
- 21. Capability of diesel generator to accept design load after prolonged no load operation (Section 8.3.1.5, Question 430.25, Open: Category 3a)
- 27. Diesel generator loading above its continuous rating (Section 8.3.1.6, L
Open: Category 3b)
- 23. Compliance with IEEE 5tandard 387-1977 (Section 8.3.1.7, Question 430.26 Closed) 24 Diesel generator start and load acceptance qualification tests (Section 8.3.1.8, Question 430.27, Opent Category 3a) li
- 25. Diesel generator load capability qualification test (Section 8.3.1.9, Question 430.26, Open: Category 3a) i i;
- 26. Margin qualification test (Section 8.3.1.10, Question 430.26, Open: Category 3a)
- 27. Description of compliance with IEEE Standard 387-1977(section8.3.1.11, l
Question 430.26, Open Category 3a)
- 28. Design for power removal for selected safety related valves (Section 8.3.1.12 Question 430.52, Open Category 3a)
- 29. tiectrical interconnections between redundant Class 1E buses (Section 8.3.1.13 Question 430.50, Closed)
- 30. tiectrical independence between power supplies to controls located in l
the control room and remote locations (Section 8.3.3.5, Question 430.49,Open: Category 3a) l 1
4
.=
..m, t
, 31. Automatic reclosure of 4160 volt circuit breakers after manual trip (Section '8.3.1.14, Open : Category 3b)
- 32. Design provisions for the usmof replacements for Class 1E loads (Section 8.3.1.15, Open: Category 3b)
- 33. Connected accidet loading exceeds capacity of the diesel generator (Section 8.3.1.16, Open : Category 3b) 34 Design for connecting non Class 1E standby service water pumps on the Class 1E system (Section 8.3.1.17, Open: Category 3b)
- 35. Design for connecting non Class 1E alternate intake structure exhaust fan on the Class IE system (Section 8.3.1.17, Open: Category 3b)
- 36. Emergency power supply for pressurizar heaters (II.E.3.1) (Section 8.3.3.4, Question 430.147, Open: Category 3b)
- 37. Emergency power for pressurizer equipment (II.G.I) (Section 8.3.3.4, Question 430.47, Open: Category 3b)
- 38. Description and analysis of compliance to GDC 50 (Section 8.3.3.7.1, Question 430.45, Open: Category 7)
- 39. Compliance with R.G.1.63 (Section 8.3.3.7.2, Question 430.46, Open: Category 3b)
- 40. Separation of containment electrical penetrations (Section 8.3.3.3.2, Question 430.44, Open: Category 3b)
- 41. Use of a single piece of steel as a barrier (Section 8.3.3.3.3, Question 430.43, Open: Category 3b)
- 42. Barrier configurations (Section 8.3.3.3.4, Question 430.42, Open: Category 3b)
- 43. Separation inside panels, cabinets, or enclosures (Secton 8.3.3.3.5, Question 430.41, Open: Category 3b)
- 44. FSAR Description of Physical Separation (Section 8.3.3.3.6, Question 430.34, Open: Category 3b)
- 45. Use of 12 inches of separation versus the recomended 36 inches (Section8.3.3.3.7, Question 430.35,Open: Category 3b) l
- 46. Use of 2 feet versus recomended 5 feet of separation (Section 8.3.3.3.7, Question 430.36, Open Category 3b) i
- 47. Use of 6 inches of horizontal separation between Class 1E and non Class IE cable trays (section 8.3.3.3.7 Question 430.37, Open: Category 3b) l l.
j
. l l
- 48. Use of 12 inches of vertical separation between Class 1E and non Class IE cable trays (Section 8.3.3.3.7 Question 430.38, Open: Category 3b) 1 l
- 49. Loading of RHR pump onto the diesel generator (Section 8.3.1.18, l
Open: Category 3a) l l
- 50. Automatic reconnection of non. safety loads after loss of offsite power (Section 8.3.1.19, Open: Category 3a) l l
l l
l l
t l
l l
l l
l I
i r
l l
f l
l
i j
ENCLOSURE 1 l
1 BEAVER VALLEY UNIT 2 1
OPEN ITEM LIST (MECHANICAL) i 1.
The use of the calibration jack systems to relay messages has not j
been adequately addressed (Section 9.5.2.1) (0 pen: Category 3a) 2.
Communication system description - areas manned, design character-s
)
istics and capabilities of the systems, location of systems, and performance tests, etc. is inadequate (Section 9.5.2.1)
(0 pen: Category 3a) 3.
Discussion of the comunication system failure analysis is inadequate i
on the effects of accidents, loss of power sources, etc.
(Section 9.5.2.1)
(0 pen:, Category 3a) i l
4.
Discussion on the provisions for Class IE power sources for the j
lighting and communications is unacceptable.
(Sections 9.5.2.1 and 9.5.3)
(0 pen: Category 3a) 4
)
5.
Ability of the communication system design to meet GDC 5 has not been i
l addressed (Section 9.5.2.1) (0 pen: Category 3b) l 6.
Frequence of the inservice inspection, tests, preventive maintenance and operability checks is not provided for the communication systems j
(Section 9.5.2.1) (Category 3a) i 7.
Description of interplant (plant-to-offsite) communication system is inadequate.
(Section 9.5.2.2) (0 pen: Category 3a) 8.
Description of lighting systems in safety-related areas is incomplete i
(Section 9.5.3) (0 pen: Category 3a) i 9.
Lighting system description does not adequately discuss lighting i
provisions during a complete loss of ac power.
(Section 9.5.3)
(0 pen: Category 3a)
I
\\
10.
Discussion of the lighting system failure analysis is inadequate on the effects of accidents, component failures, etc. (Section 9.5.3) 11.
Minimum illumination in safety related areas and access and egress i
routes is incomplete (Section 9.5.3)
(0 pen: Category 3a) i 12.
Frequency of lighting system inservice inspection tests is not j
addressed (Section9.5.3)(0 pen: Category 3a) t 4o
13.
Effects of spurious action of fire protection system on D/G controls is not addressed (Section 9.5.4.1) (0 pen: Category 3a) 14.
Dust control - protection of electrical equipment - response is inadequate (Section 9.5.4.1) (0 pen: Category 3a) 15.
Discussion on the training program for initial and requalification training for personnel, as well as replacement personnel, responsible for the operation and maintenance of the diesel generator's (DG's) is inadec,uate. Training program is not equivalent to manufacturer's training program (Section 9.5.4.1) (0 pen: Category 3a) 16.
Loading of the DG following no load operation and during and/or after troubleshooting is not addressed (Section 9.5.4.1)
(0 pen: Category 3a) 17.
Capability of D/G to operate under extreme service conditions and weather disturbances - response is inadequate (Section 9.5.4.1)
(0 pen: Category 3a) 20.
The response for preventive maintenance / root causes failure program is inadequate (Section 9.5.4.1) (0 pen: Category 3a) 21.
D/G floor mounted control and monitoring instrumentation panels is not located in a vibration free floor area, equipped with vibration-free mounts or qualified for the operating conditions (Section 9.5.4.1)
(0 pen: Category 3a) 22.
Results of the fuel oil system capacity analysis is not provided.
(Section 9.5.4.2) (0 pen: Category 3a) 23.
Justification of deviation from ANSI N-195 with regards to fuel pump strainer is inadequate (Section 9.5.4.2) (0 pen: Category 3a) 24.
External corrosion protection of concrete encased fuel oil lines is not adequately addressed (Section 9.5.4.2)
(0 pen: Category 3a) 25.
Description of control, instrumentation, sensor, and alarm testing /
. calibration and operator action upon alarm actuation is inadequate (Section 9.5.4, 9.5.5, 9.5.7 and 9.5.8) (0 pen: Category 3a) 26.
Conformance to ANSI N-195, Regulagory Guide 1.137 and Standard Technical Specifications with regards to fuel oil quality is not addressed (Section9.5.4.2)
(0 pen: Category 3a) 27.
Fuel oil tank sediment control during filling operations -
design is unacceptable (Section 9.5.4.2) (0 pen: Category 3a) 28.
Quality group classification of D/G auxiliary system piping has not been addressed (Section 9.5.4 thru 9.5.8) (0 pen: Category 3a)
h I
3-i 29.
High energy break analysis for the diesel engine system is inadequate (Sections 9.5.4 thru 9.5.8) (0 pen: Category 3a) l 30.
Tornado missile protection for the D/G fuel oil storage tank fill lines I
is unacceptable (Section 9.5.4.2) (0 pen: Category 3a) 31.
Description of algae detection, prevention, and fuel oil tank j
cleaning methods are not provided (Section 9.5.4.2) (0 pen: Category 3a)
{
.s i
32.
Ability to deliver fuel; oil during unfavorable conditions, insufficient j
information is provided (Section 9.5.4.2) (0 pen: Category 3a) i 33.
Description of engine mounted fuel oil accumulator tank is inadequate
]
(Section 9.5.4.2) y i
34.
Design characteristics for the D/G cooling water system response is incomplete (Section 9.5.5) (0 pen: Category 3a) 35.
Analysis showing auxiliary cooling waterflow will be restored to D/G q
prior to overheating is not provided (Section 9.5.5) (0 pen: Category 3a) l 36.
Effect of water spray on locally mounted electrical / electronic equipment
)
is not addressed (Section 9.5.5) (0 pen: Category 3a) 37.
Chemical treatment with regards to precluding organic fouling is not l
addressed (Section 9.5.5) (0 pen: Categtory 3a) 38.
Permissible leakage rates between D/G cooling system and other auxiliary systems has not been addressed (Section 9.5.5) (0 pen: Category 3a) 39.
Capability of the air start system to start the D/G five times from low pressure alarm setpoint is not addressed (Section 9.5.6) (0 pen: Category 3a)
L 40.
Description of procedures, controls, etc. on the use of the air system i
cross-connect is inadequate (Section 9.5.6) (0 pen: Category 3a) 41.
Description of control, instrumentation, and alarm testing / calibration and operator action upon alars actuation is' inadequate, and air system alarm setpoints has not been provided. (Section 9.5.6)
(0 pen: Category 3a) i 1
42.
Discussion of necessity for high pressure air start system is not addressed (Section9.5.6)(0 pen: Category 3a) 43.
Air starting system high energy line analysis and air piping classification has not been provided (Section 9.5.6) (0 pen: Category 3a) 44.
Moisture in the air starting system - no air dryers provided -
design is unacceptable (Section 9.5.6) (Category 3a)
- - - - - - - - - - - - - - - ~ -
, 1 l
45.
Description of control air system - system leakage, description l
of components, and effect of loss of system - is inadequate (Section 9.5.6) (0 pen: Category 3a) 46.
Inability of the diesel generator t'o restart following a failure to start due to fuel oil / air start system interlocks has not been addressed (Section 9.5.6) (0 pen: Category 3b) 47.
Dry starting of the D/G rocker arm lube oil system during emergency conditions - response is unacceptable (Section 9.5.7) (0 pen: Category 3a) 48.
Preheating of the rocker arm lube oil system is inadequately addressed (Section 9.5.7) (0 pen: Category 3a) 49.
Detailed description and drawings of lube oil system has not been provided (Section 9.5.7) (0 pen: Category 3a) 50.
Lube oil system description lube oil consumption rates and seven day supply capability of lube oil system has not been provided (Section 9.5.7) (0 pen: Category 3a) 51.
Ability to deliver lube oil during unfavorable conditions and lube oil supplies is inadequate.
(Section 9.5.7)
(0 pen: Category 3a) 52.
Description of posting of lube oil fill procedures, training of operators, verification of line identification is unacceptable (Section 9.5.7) (0 pen: Category 3a) 53.
Prevention of entry of deleterious materials into lube oil system j
is inadequate (Section 9.5.7) (0 pen: Categoery 3a) 54.
Low level alarm for the rocker arm lube oil reservoir is not provided (Section 9.5.7) (0 pen: Category 3a) 55.
D/G exhaust system protection from clogging due to snow drifts -
f.
is inadequate (Section 9.5.8) (0 pen: Category 3a) 56.
D/G intake and exhaust - Protection, fire, gasses, etc. is inadequate l
(Section9.5.8)(0 pen: Category 3a) 57 Degradation of D/Goperation due to potential fire in D/G building with a failure of the fire protection system (Section 9.5.8)
(0 pen: Category 3a) 58.
Effects of a station service transformer fire on D/G operation has not been addressed (Section 9.5.8) (0 pen: Category 3a)
. 59.
Description of the operation of D/G room ventilation systems during a loss of offsite power is inadequate (Section 9.5.8) (0 pen: Category 3a) 60.
Turbine and extraction valve closure times has not been provided.
(Section 10.2) (0 pen: Category 3a) 61.
Inservice inspection program for the main turbine steam valves is inadequately described (Section 10.2)
(0 pen: Category 3a) 62.
Inservice inspection program for the extraction valves is inadequately addressed.
(Section 10.2) (0 pen: Category 3a) 63.
Inservice inspection frequency for the mechanical and backup turbine overspeed trips is not provided (Section 10.2) (0 pen: Category 3a) 64 Effects of high energy piping failure on turbine overspeed protection is not provided (Section 10.2) (0 pen: Category 3a) 65.
Use of valves downstream of MSIV for limiting blowdown of second steam generator following a main steam line break upstream of the MSIV is inadequately addressed (Section 10.3.2) (0 pen: Category 3a) 66.
Main condenser inservice inspection program frequency is not provided.
(Section 10.4.1) (0 pen: Category 3a) 67.
Inservice inspection program and its frequency for the turbine bypass system is not provided (Section 10.4.4) (0 pen: Category 3a) 68.
Description of turbine bypass control room interlock selector switches is inadequately addressed.
(Section10.4.4)(0 pen: Category 3a) l l
t
o
_.____m DCLOSURE 2 Ca t e r er7 'Id entification 31ssosition 1.
Fundamental technica2 disagressent If agressent cannot be rasched - use between staff and applicazt.
lice.nse condition.
2.
New requirement er Issue.
Elevate for decision en application to case at hand at rate a.
Origin at branch level.
of one annassaast step per three working days.
b.
Origin above branch leval.
3.
Delay because requested information If request goes beyond raasonable not received from applicant.
response period, use license condition if appropriate -
a.
Request for information for otherwise, hold as span items.
applicant outstanding for at least 3 months.
b.
Recent request by staff.
4.
Resource ennstraint, e.g., single reviewer on staff with appropriate expertise in critical path.
l 3.
5 aff review inewsplete.
Easolution required by Division Director.
6.
Generic items.,
subject to' resolution upon generic l
s,taff position.
l 7.
Confirs.atory itans.
Aaraiting completion of agreed upon
~
action by applicant.
8 t
l
=
's j
l l1 ENCLOSURE 3 SAFETY EVALUATION REPORT BEAVER VALLEY POWER STATION UNIT 2 DOCKET NO. 50-412 8 ELECTRIC POWER SYSTEMS 8.1 General The bases for the staff's evaluation of the applicant's designs, design criteria, and design bases for the Beaver Valley electric power systems j
are set forth in the Standard Review Plan (SRP) (NUREG-0800) Section l
8.1, Table 8-1, " Acceptance Criteria and Guidelines for Electric Power
{
Systems." These acceptance criteria and guidelines include the applicable general design criteria (Appendix A to 10 CFR 50) and l
guidelines of branch technical position, regulatory guides, and NUREGs.
l The staff has determined that conformance to the applicable general design criteria and guidelines cited above provides sufficient bases for acceptance of the electric power systems.
The following subsections provide the staff's evaluation of the offsite and onsite electric power system design and how it meets the requirements of the above cited acceptance criteria. The staff will also visit the site to view the installation and arrangement of electrical equipment and cables, to review confirmatory electric drawings, and to verify test results for the purpose of verifying the
adequacy of the design and proper implementation of the design criteria.
The confirmatory site visit will be completed prior to issuance of the i
license and if any problems are found, they will be addressed in a supplement to this report.
The conclusions in the followi'ng subsections are subject to acceptable implementation of design changes that, if any, may be required as a result of the staff's site visit.
8.2 Offsite Electric Power System The safety function of the offsite power system (assuming the onsite power system is not functioning), is to provide sufficient capacity and capability to assure that the structures, systems, and components important to safety perform as intended. The objective of the staff review is to determine that the offsite power system satisfies the s
requirements of General Design Criteria 5,17, and 18 and will perform its design function during all plant operating and accident conditions.
8.2.1 Compliance With General Design Criterion (GDC) 5 The applicant has met the requirements of GDC 5, " Sharing of Structures, Systems, and Components," with respect to sharing of circuits of the s
preferred power system.
4 9
.' 8.2.2 Compliance With General Design Criterion (GDC 17)
The applicant has met (except as noted) the requirements of GDC 17,
" Electric Power Systems," with respect to the offsite power system's (a) capacity and iapability to permit functioning of structures, systems, and components important to safety, (b) provisions to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit or loss of power from the onsite electric power supplies, (c) independence of circuits, and (d) availability of circuits.
The following items address the problem areas revealed during the staff review and ' resolutions or status concerning them.
8.2.2.1 Physical Independence of Offsite Circuits Between the Grid System and Switchyard The description and analysis relating to physical independence of the offsite power system's transmission lines between the Duquesne transmission grid system and the Beaver Valley switchyard, contained in Section 8.2.1.1 of the FSAR, is limited to the following: The transmission lines converge on the switchyard by means of two or more widely separated routes. This description is not sufficient for the staff to conclude that the transmission lines are adequately separated in accordance with the requirements of Criterion 17 of Appendix A to 10 CFR 50.
l
By amendment 3 to the FSAR, the applicant provided additional description with layout drawings of the subject physical separation of offsite transmission lines. Based on the additional description the staff concludes that the offsite transmission lines have adequate physical separation in accordance with the requirements of GDC 17 and are, therefore, acceptable.
8.2.2.2 Capability to Reestablish Power From the Offsite Power System GDC 17 requires, in part, that each of the offsite circuits be designed to be available in sufficient time following a loss of all onsite alternating current power supplies and the other offsite electric power circuit, to assure that specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded. The description in the FSAR as to compliance with this part of GDC 17 is not sufficient to reach a conclusion of acceptability.
By amendment 3 to the FSAR the applicant did not provide the requested description. This item will be pursued with the applicant and the requests of the staff review will be reported in a supplement to this report.
8.2.2.3 Independence of Offsite Power Circuits Between the Switchyard and Class IE System The Beaver Valley design provides two imediate access offsite circuits between the switchyard and the 4.16 KV Class IE busses.
It is the staff
position that these two circuits be physically separate and independent such that no single event can simultaneously affect both circuits in such a way that neither can be returned to service in time to prevent fuel design limits or design conditions of the reactor coolant pressure boundary from being exceeded. The physical separation and independence of these two circuits has not been described or analyzed in the FSAR.
By amendment 3 to the FSAR, the applicant, in response to a request for information, has provided a description of the routing or physical separation and independence of these two circuits.
Based on the description, the staff concludes that these circuits are physically separated, meet the above staff position, the requirements of GDC 17, and are acceptable.
In regard to physical separation and independence of controls and protective relaying associated with these circuits, the applicant, in response to a request for information, addressed controls and relaying for 138 KV circuit breakers, the station service transformers, and the 5 KV cable bus.
Control and relaying for SKV circuit breakers and Busses 2A, 28, 2C, and 2D were not addressed in the applicant's response.
This item will be pursued with the applicant and the results of the staff review will be reported in a supplement to their report.
The description of physical separation of offsite circuits has not been included in Section 8.2 of the FSAR in accordance with the guidelines of Regulatory Guide 1.70, Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants. This item will be pursued with the 8
j
. {
applicant and the results of the staff review will be reported in a supplement to this report.
j i
8.2.2.4 Independence Between Onsite and Offsite Power Sources Each of the 4.16 KV Class 1E buses at Beaver Valley is supplied power from preferred offsite and standby onsite circuits.
It is the staff position that these circuits should not have comon failure modes.
Physical separation and independence of these circuits has not been described or analysed in the FSAR.
The applicant by amendment 3 to the FSAR did not provide a description or analysis that was requested. This item will be pursued with the applicant and the results of the staff review will be reported in a supplement to this report.
8.2.2.5 Use of Automatic Load Tap Changer Section 8.3.1.1.1 of the FSAR indicates that the system station service transformer specified with an automatic load tap changer.
By amendment 3 to the FSAR, the ap'plicant, in response to a request for information, indicated that the automatic load tap changer optimize l
voltage on the 4160 volt Class IE buses for any plant load condition and l
power grid voltage variation. The applicant has further implied that the design is Class IE and meets all the requirements of a Class 1E system. Design criteria with description and analysis as to the systems l
compliance with GDC 2, 4, 5,17, and 18 has not been addressed in the FSAR. This item will be pursued with the applicant and the results of the staff review will be reported in a supplement to this report.
8.2.3 Compliance With Gene'ral Design Criterion (GDC) 18 The applicant has met (except as noted) the requirements of GDC 18,
" Inspection and Testing of Electric Power Systems," with respect to the capability to test systems and associated components during normal plant operation and the capability to test the transfer of power from the nuclear power unit, the offsite preferred power system, and the onsite power system. The following items address problem areas revealed during the staff review and resolutions or status concerning them.
8.2.3.1 Capability to Test Transfer of Power Between Normal and Preferred Offsite Circuits The capability to test the transfer of power from the normal unit station service transformer to the station service transfomer has not been specifically addressed in the FSAR.
By amendment 3 to the FSAR, the applicants, in response to a request for information, described the transfer circuitry, how it is tested during nomal plant operation, and its compliance with GDC 18. Based on the description the staff concludes that the design is testable, meets the requirements of GDC 18, and is acceptable.
It is the staff's concern, however, that periodic testing of the transfer may create transients in
the plant if done during power operation. This concern will be pursued with the applicant and the results of the staff review will be reported in a supplement to this report.
The above description has not been included in Section 8.2 of the FSAR in accordance with the guidelines of Regulatory Guide 1.70, Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants.
This item will be pursued with the applicant and the results of the staff review will be reported in a supplement to this report.
8.2.4 Evaluation Findings The review of the offsite power system for the Beaver Valley Plant covered single line diagrams, station layout drawings, schematic diagrams, and descriptive information. The basis for acceptance of the offsite power system in the staff review was confonnance of the design criteria and bases to the Comission's regulations as set forth in the General Design Criteria (GDC) of Appendix A to 10 CFR 50. The staff concludes that the plant design meets the requirements of GDC 5,17, and 18, and confonns to applicable guidelines of regulatory guides and branch technical positions and is acceptable except as noted in the preceding sections.
8.3 Onsite Power Systems The safety function of the onsite power system (assuming the offsite power system is not functioning) is to provide sufficient capacity and
- -, + - -
+-
+"
_g.
capability to assure that the structures, systems, and components important to safety perfcrm as intended. The objective of the review is to determine that the onsite power system satisfies the requirements of GDC 2, 4, 5, 17, 18, and 50 and will perform its intended function during all plant operating and accident conditions.
The onsite power system consists of an alternating current (ac) power system and a direct current (dc) power system. Compliance with GDC 2, 4, 5,18, and 50 as they relate to both ac and de systems are evaluated in Section 8.3.3 of this report. Compliance with GDC 17 as it relates to ac systems is evaluated in Section 8.3.1 of this report and as it relates to de systems is evaluated in Section 8.3.2 of this report.
8.3.1 Onsite AC Power System's Compliance With General Design Criterion (GDC) 17 The applicant has met (except as noted) the requirements of GDC 17
" Electric Power Systems," with respect to the onsite ac system's (a) capacity and capability to permit functioning of structures, systems, and components important to safety, (b) the independence, redundancy, and testability to perform their safety function assuming a single failure, and (c) provisions to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit or the loss of power from the transmission network, i
L
The following items address the problem areas revealed during the staff review and resolution or status concerning them.
8.3.1.1 Voltage Analysis "The voltage levels at the safety-related loads should be optimized for the maximum and minimum load conditions that are expected throughout the anticipated range of voltage variations of the offsite power sources.
The applicant was requested to perfonn a voltage analysis and verification by actual measurement in accordance with the guidelines of positions 3 and 4 of branch te'chnical position PSB-1 (NUREG-0800, Appendix 8A).
By amendment 3 to the FSAR, the applicant indicated that the requested analysis would not be completed before March 15, 1984. Review schedule for submittal of the analysis, verification of the analysis by actual measurement, and justification for voltages (as determined by analysis) not meeting the specific voltage supply tolerances specified by equipment manufacturers, will be pursued with the applicant and the results of the staff review will be reported in a supplement to this l
report.
8.3.1.2 Bypass of Diesel Generator Protective Trips Sections 8.3.1.1.15 of the FSAR indicates that a number of tripping 4
devices have been provided for each diesel generator. The majority of these tripping devices are bypassed when the diesel generator receives
{
an emergency start signal. Tripping devices that are not bypassed include generator current differential, generator overexcitation, and engine overspeed protection. This design meets the guidelines of position 7 of Regulatory Guide 1.9 except for the generator l
overexcitation tripping device that is not bypassed.
l By amendment 3 to the FSAR, the applicant, in response to a request for information, indicated that the design for generator overexcitation trip has two independent measurements with coincident logic for trip actuation. This design also meets the guidelines of position 7 of Regulatory Guide 1.9 and therefore is acceptable. Surveillance requirements for the protective trips that are bypassed will be included in the technical specifications. The design for the protective bypass will be confirmed as part of the staff drawing review / site visit.
8.3.1.3 Load Testing of the Diesel Generator Section 8.3.1.1.16 of the FSAR indicates that safety related motors are designed with the capability of accelerating the driven equipment to its rated speed with 80 percent of motor nameplate voltage applied at the motor teminals. Section 8.3.1.1.15 of the FSAR indicated that the design of each diesel generator unit is such that at no time during the loading sequence does the voltage decrease to less than 75 percent of nominal.
l.
l.
By amendment 3 to the FSAR, the applicant, in response to a request for A
l additional information, indicated that data extrapolated from diesel l
12-generator load tests implied that 79.3 percent versus 75 percent is the largest voltage drop to be expected during the diesel generator load sequence. Testing of the diesel generator using actual load and loading sequence to demonstrate the voltage will not drop below 80 percent will be pursued with the applicant and the results of the staff review will be reported in a supplement to this report.
8.3.1.4 Compliance to BTP-PSB-2 Section 8.3.1.1.15 of the FSAR describes the surveillance instrumentation provided to monitor the status of the diesel generator.
In this regard, the applicant was requested to describe how the Beaver Valley design complies with the guidelines of Branch Technical Position PSB-2. By amendment 3 to the FSAR the applicant did not provide the requested description. This item will be pursued with the applicant and the results of the staff review will be reported in a supplement to this report.
8.3.1.5 Capability of Diesel to Accept Design Load After Prolonged No Load Operation
~
Section 6.4.2 of IEEE Standard 6.4.2 of IEEE Standard 387-1977 requires, in part, that the load acceptance test consider the potential effects on load acceptance after prolonged no load or light load operation of the diesel generator. The applicant was requested to provide the results of load acceptance tests or analysis that demonstrates the capability of
fl.
1 i
the diesel generator to accept the design accident load sequence after l
prolonged no load operation.
By amendment 3 to the FSAR the applicant did not provide the requested test or analysis results.
This item will continue to be pursued with the applicant and the results will be reported in a supplement to this report.
I 8.3.1.6 Diesel Generator Loading Above its Continuous Rating Section 8.3.1.1.15 of the FSAR states that the maximum load imposed on the diesel generator is less than the continuous rating. The continuous rating has been defined to be 4238 KW.
In contradiction, Table 8.3-3 of the FSAR states that the worst case loading is 4261 KW.
4261 is greater than the stated maximum load of 4238 KW imposed. Justification for this contradiction will be pursued with the applicant and the results of the staff review will be reported in a supplement to this report.
8.3.1.7 Compliance With IEEE Standard 387-1977 Table 1.8-1 of the FSAR indicates that the diesel generators have been selected, designed, and qualified following the guidance of IEEE Standard 387-1977 as. augmented by Regulatory Guide 1.9 with the exception that the diesel generators were procured with the specification that they comply with the 1972 version of IEEE Standard 387. By amendment 3 to the FSAR, the applicant, in response to a request for information, stated that the diesel generators are in l
conformance with IEEE Standard 387-1977 and Regulatory Guides 1.9 and 1.108. Based on this statement of compliance, the staff concludes that even though the diesel generators may have been procured to 1972 guidelines, they have been designed, tested, and qualified to 1977 guidelines, and are, therefore, acceptable.
8.3.1.8 Diesel Generator Start and Load Acceptance Qualification Tests Section 6.3.2 of IEEE Standard 387-1977 requires that a series of tests be conducted to establish the capability of the diesel generator unit to start and accept load within the period of time to satisfy the plant designs requirements.
By amendment 3 to the FSAR the applicant documented that the diesel generator voltage and frequency were monitored, recorded, and verified when starting the unit and applying a 50 percent load for each of the 300 start-load tests in full compliance with IEEE Standard 387-1972.
In regard to this item the following items will continue to be pursued with the applicant:
1.
Testing to the 1972 versus 1977 versions of IEEE Standard 387, 2.
Definition for specified frequency, voltage, and required time interval, and 3.
Confonnation of test results.
The results of the staff review of these items will be reported in a supplement to this report.
8.3.1.9 Diesel Generator Load Capability Qualification Test Section 6.3.1 of IEEE Standard 387-1977 requires that one test be conducted to demonstrate the capability of the diesel generator to carry and reject rated loads. By amendment 3 to the FSAR, the applicant, in response to a request for information, indicated that these tests were not performed by the manufacturer but will be performed after installation of the diesel generators at the plant site. Confirmation of these test results will be pursued with the applicant and the results of the staff review will be reported in a supplement to this report.
8.3.1.10 Margin Qualification Test Section 6.3.3 of IEEE Standard 387-1977 requires at least two margin tests to demonstrate diesel generator capability to start and carry loads that are greater than the most severe step load change within the plant design loading sequence. By amendment 3 to the FSAR, the applicant did not provide the requested description as to how the Beaver Valley testing meets the margin test requirements of Section 6.3.3 of IEEE Standard 387-1977. This item will be pursued with the applicant and the results of the staff review will be reported in a supplement to this report.
8.3.1.11 Description of Compliance With IEEE Standard 387-1977 A description as to how the Beaver Valley design complies with the guidelines of IEEE Standard 387-1977 as augmented by Regulatory Guide
+
1.9 and 1.108 has not been presented in the FSAR nor was the description provided in amendment 3 to the FSAR as requested. This item will be pursued with the applicant and the results of the staff review will be reported in a supplement to this report.
8.3.1.12 Design for Power Removal for Selected Safety Related Valves Table 8.3-5 of the FSAR identifies valves from which' power is to be removed in order to meet the single failure criterion. By amendment 3 to the FSAR, the applicant indicated that removal of a banana plug located in the control room provides the necessary power removal and will prevent inadvertent operation of the valves. Details of the design for power removal will be pursued with the applicant and the results of the staff review will be reported in a supplement to this report.
8.3.1.13 Electrical Interconnections Between Redundant Class 1E Buses Section 8.3.1.1.4 of amendment 3 to the FSAR identifies a number of Class IE loads that can be electrically connected to both redundant Class IE power supplies. To prevent the electrical interconnection of
=
redundant Class IE power supplies, a key-interlocked manual transfer switch design is provided. Based on the description presented in the FSAR, the staff concludes that the design provides reasonable assurance that suffficient independence will be maintained between redundant electrical systems, meets GDC 17 and is, therefore, acceptable. The design will also be reviewed as part of the staff's confirmatory site c
, visit.
If problem areas are identified they will be reported in a supplement to this report.
l 8.3.1.14 Automatic Reclosure of 4160 Volt Circuit Breakers After Manual Trip I
t Section 8.3.1.1.3 of the FSAR implies that when a Class 1E 4160 volt circuit breaker is tripped manually while a safety injection signal is present,- the breaker control scheme is such that automatic reclosure f
will occur.
e In order to understand how this automatic reclosure design may affect operation of other safety systems, the following items will be pursued y
with the applicant:
(a) details of the design for automatic reclosure, (b) the extent and purpose of the design, (c) justification for bypass of anti-pump design feature and (d) design provisions to preclude I
1 automatic reclosure during diesel generator operation or analysis which demonstrates that overload of diesel generator will not occur. The results of the staff review will be reported in a supplement to this report.
l 8.3.1.15 Design Provisions for the Use of Replacements for Class 1E Loads Section 8.3.1.1.4 and Table 8.3-3 of the FSAR indicates that for a number of Class IE loads, there is a replacement load provided to allow maintenance to be perfonned while satisfying the single failure i
.l.'
i l 8.3.17 Design for Connecting Non Class IE Standby Service Water Pumps on the Class IE System Section 8.3.1.1.8 of the FSAR indicates the following in regard to the non Class IE standby service water pumps when there is a safety injection signal:
a.
Non Class 1E loads are stripped and blocked from starting with the possible exception of the standby service water pump motors.
If these motors are running, they will not be tripped, l
b.
During the automatic loading sequence of safety loads, the standby service water pumps will be blocked from starting until the automatic loading sequence is complete.
l Clarification of the design for the loading of the non Class IE standby service water pumps onto the Class IE power supplies and its purpose will be pursued with the applicant and the results of the staff review will be reported in a supplement to this report.
By Table 8.3-2 of the FSAR, the design for the non-safety alternate intake structure exhaust fan load appears to be the same or similar as j
that of the standby service water pump load.
Clarification for the l
loading of this non Class IE load onto the Class IE system and its purpose will also be pursued with the applicant and the results of the staff review will be reported in a supplement to this report.
6 r
, 4 8.3.1.18 Loading of RHR Pump onto the Diesel Generator Table 8.3-3 of the FSAR indicates that the RHR pumps are not needed for DBA mode of operation and are not needed for four hours after a loss of offsite power or after loss of offsite power with a safety injection signal. Specific reference to RHR system description in the FSAR and justification for this power availability to RHR pumps will be pursued with the applicant and coordinated with the Reactor Systems Branch. The results of the staff review will be reported in a supplement to this report.
l 8.3.1.19 Automatic Reconnection of Non-Safety Loads After Loss of Offsite Power i
i Table 8.3-3 of the FSAR indicates that the non Class IE pressurizer i
heater backup load is automatically reconnected to the Class IE system after a loss of offsite power. The staff has been accepting design wherein non-Class IE loads were reconnected manually after loss of offsite power as well as after an accident signal. Justification for non-compliance with the accepted practice will be pursued with the applicant and the results of the staff review will be reported in a supplement to this report.
(
l 8.3.1.20 Physical Independence Physical independence criteria for the redundant onsite ac power system is the same as that for the onsite de system and is, thus, addressed in Section 8.3.3 of this report.
8.3.2 Onsite DC System's Compliance With General Design Criterion (GDC)17 The applicant has met (e$ cept as noted) the requirements of GDC 17,
" Electrical Power Systems," (a) capacity and capability to permit functioning of structures, systems, and components to safety, (b) the independence, redundancy, and testability to perform their safety functionassumingasinglefailure,and(c)provisionstominimizethe probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit or the loss of power from the transmission network.
The following items address the problem areas revealed during the staff review and resolution or status concerning them.
8.3.2.1 Physical Independence a
Physical independence criteria for the redundant onsite de power system is the same as that for the onsite ac system and is, thus, addressed in l
Section 8.3.3.3 of this report.
t
. 8.3.3 Comon Electrical Features and Requirements i
This section presents common electrical features and requirements of the onsite ac and de power system which deal with distinct aspects of the onsite alternating current and direct current power systems. The comon i
electrical features and requirements addressed in this section are as follows:
i 8.3.3.1 Compliance With General Design Criteria (GDC) 2 and 4 The applicant has met (except as noted) the requirements of GDC 2, l
" Design Basis for Protection Against Natural Phenomena," and GDC 4,
" Environmental and Missile Design Bases," with respect to structures, systems, and components of the onsite ac and de power system being capable of withstanding the effects of natural phenomena such as earthquakes, tornadoes, hurricanes, and floods, missiles, and environmental conditions associated with normal operation and postulated accidents. The onsite power system and components (1) are located in seismic Category I structures which provides protection from the effects of tornadoes, tornado missiles, turbine missiles, and external floods, (2) have been given a quality assurance designation " Class IE," (3) have been designated to be seismically and environmentally qualified, and (4) are to be designed to acccomodate or are to be protected from the r
l effects of missiles and environmental conditions associated with nonnal i
operation and postulated accidents.
F
l The following items address the problem areas revealed during the staff review and the resolution or status concerning them.
8.3.3.1.1 Submerged Electrical Equipment as a Result of a Loss-of-Coolant Accident 4
It is the staff's concern that following a loss-of-coolant accident, fluid (from the reactor coolant system and from operation of the emergency core cooling systems) may collect in the primary containment and reach a level that may cause certain electrical equipment located inside the containment to become submerged and thereby rendered inoperable. Both safety and nonsafety-related electrical equipment is of concern, because their failure may cause electrical faults that could compromise the operability of redundant energency power sources or the integrity of containment electrical penetrations.
In addition, the safety-related electrical equipment that may be submerged is also of concern if this equipment is required to mitigate the consequences of the accident for both the short-tem and long-tem emergency core cooling system functions and for containment isolation.
The staff's position, in regard to submerged equipment, is that all electrical equipment must be located above the maximum possible flood level or be qualified for submerged operation, or the lack of qualification must be justified.
By amendment 3 to the FSAR, the applicant provided a listing of safety l
class equipment that may become submerged as a result of a LOCA and are i
not designed and qualified for submergence.
In justification of the lack of qualification, the applicar+ stated that the design of the Class IE distribution system satisfies the isolation criteria by ensuring that the failure of the submerged equipment will not degrade the Class 1E power source. Clarification of the isolation criteria and how it ensures that Class IE systems will not be degraded will be pursued with the applicant and the results of the staff review will be reported in a supplement to this report.
8.3.3.1.2 Design, Qualification and/or Protection of Class IE Equipment From Natural Phenomena Sections 8.3.1.2 and 8.3.2.2 of the FSAR states, in regard to compliance with General Design Criterion (GDC) 2 of Appendix A to 10 CFR 50, that Class IE ac and de systems are housed in structures that are designed to, and are capable of, withstanding the effects of natural phenomena such as earthquakes, tornados, hurricanes, and floods without loss of capability to perform its function.
Based on this statement of compliance, the staff is unable to conclude that all instrumentation, control, and electrical structures, systems, and components important to safety have been either designed and qualified to operate in an environment caused by natural phenomena or have been adequately protected from its effects.
i By amendment 3 to the FSAR, the applicant did not provide the requested inforsation for an expanded analysis of compliance with GDC 2.
This
item will continue to be pursued with the applicant and the results of the staff review will be included in a supplement to this report.
8.3.3.1.3 Protection of Class IE Equipment From Dynamic Effects In Section 8.3.1.2 and 8.3.2.2 of the FSAR, it has been stated, in regard to compliance with General Design Criterion (GDC) 4 of Appendix A to 10 CFR 50, that Class IE ac and de power systems are designed to accommodate the effects of the environmental conditions associated with normal operation and postulated accidents and that the structures, the ac and de systems are housed in, are pretected against internally-and externally-generated missiles, pipe whip, and jet impingement forces associated with pipe breaks such that safety functions will not be precluded. Based on this statement of compliance, the staff is unable to conclude that all instrumentation, control, and electrical structures, systems, and components important to safety have been appropriately protected against dynamic effects in accordance with the requirements of GDC 4.
By amendment 3 to the FSAR, the applicant did not provide the requested information for an expanded analysis of compliance with GDC 4.
This item will be pursued with the applicant and the results of the staff review will be reported in a supplement to this report.
4
8.3.3.1.4 Protection of Class IE Equipment From Fire Protection System Effluents l
Section 0.3.1.4 of the FSAR indicates that fire suppression systems are installed in a number of plant areas at Beaver Valley that contain Class IE systems and components.
For the design basis event " fire protection system operation," it is the staff position that Class 1E systems and components located in areas with fire suppression systems should be capable and qualified to perform their function when subject to the effects of the subject design basis event (Section 4.2 and 4.7 of IEEE Standard 308-1974).
4 By amendment 3 to the FSAR, the applicant (in response to a request for information) provided a positive statement of compliance to the above stated position.
Pending documentation in Section 8 of the FSAR, this item is considered resolved.
8.3.3.1.5 Bypass of Thernal Overload Protection Section 8.3.1.1.11.2 of the FSAR, indicates that thermal overload protection is provided for continuous and intermittent duty motors.
By amendment 3 to the FSAR, the applicant, in response to a request for information, provided a description of their thernal overload protection l
l bypass design for all motor operated valves that are required for safe
}
shutdown. Accident signal contacts in parallel with the thermal overload relay contacts, provide the required design for bypass. The j
1
. design meets the guidelines of position 1 of Regulatory Guide 1.106, meets the requirements of GDC 4, and is acceptable.
8.3.3.1.5 Design and Qualification of Safety Related Electric Equipment I
Section 8.3.1.2.1 of the FSAR states that qualification of Class IE equipment is addressed in Section 3.11 of the FSAR.
By amendment 3 to the FSAR, the applicant stated, in response to a request for information, that all safety-related equipment is designed Class IE, is included in a qualification program, and is designed and qualified to perform its safety function in normal and design b' asis event environments. Based on these statements, the staff concludes that Class 1E equipment will meet the design requirements of GDC 4, qualification requirements of 10 CFR 50.49, the guidelines of Sections 4.2 and 4.7 of IEEE Standard 308-1974, and therefore is accceptable.
8.3.3.2 Crampliance With General Design Criterion (GDC) 5 l
The applicant has met (except as noted) the requirements of GDC 5, l
" Sharing of Structures, Systems, and Components," with respect to structures, systems, and components of the ac and de onsite power i
systems.
b b
L l
'9 im
8.3.3.3 Physical Independence - Compliance With General Design
~
Criterion (GDC) 17 8.3.3.3.1 Use of Regulating Transfomers as Isolation Devices Table 8.3.2 and Section 8.3.1.1.17 of the FSAR indicates that there are six Class 1E isolating voltage regulation transfomers allocated to the l
four vital bus systems. They serve to isolate either certain designated non-Class 1E loads from the Class IE portion of the system or to isolate Class 1E train loads from the Class 1E channel portion of the system.
The FSAR further states that each of the isolating transfomers is fully qualified and is designed such that a continuous bolted short circuit on the secondary winding will not be reflected on the primary winding. By i
amendment 3 to the FSAR, the applicant, in response to a request for infomation, indicated the following:
a.
Oscillograph traces of transformer input current showed 101.6 to 109.4 percent of the transfonner's full load rating current being input with the output teminals shorted.
b.
The transformers were specified to limit input current to the transformer to 150 percent of its full load rating under short circuit.
c.
The vital bus UPS system can supply the full burden of the transfomer with a shorted secondary, i
I
.. 1 l
l d.
Output circuits are run in dedicated conduit from the transfomer 1
to the connected load l
l l
l e.
The non-Class 1E loads are composed of control and instrument
{
circuits.
Based on the above infomation the staff is unable to conclude the l
acceptability of these transfomers as isolation devices. Areas that require additional information or clarification include:
l a.
Duration of. time to which the isolation transfomer was tested with i
justification of its adequacy.
1 b.
Qualification test report that demonstrates the capability of the transfomers to withstand anytime during its design life the continuous bolted short circuit on its secondary winding.
c.
Analysis that demonstrates the capability of the vital UPS system
)
to supply its normal loads plus the 150 percent load specified for i
the shorted transfomer.
d.
Extent of compliance of the Non-Class IE output circuits from the transfomer to and including the load to all the requirements placed on Class 1E circuits.
This item will be pursued with the applicant and the results or the staff review will be reported in a supplement to this report.
>1
i 8.3.3.2 Separation of Containment Electrical Penetrations Section 8.3.1.4 (part 2, item 2b(5)) of the FSAR stated that containment electrical penetrations meet separation requirements of currently approved design procedures which comply with the intent of IEEE Standard 384-1981 for limited hazard areas. Section 5.5 of IEEE Standard 384-1974 (which is the currently approved NRC guideline for this subject) requires that redundant penetrations be widely dispersed around the circumference of the containment. Recent designs, approved by NRC on this subject, locate redundant electrical penetrations in different a
rooms or on opposite sides of containment. The Beaver Valley design, l
however, locates redundant penetrations in a single room in a 21 by 5 matrix with eight feet (center to center) between redundant l
penetrations. The Beaver Valley design does not meet the requirements nor the intent of IEEE Standard 384-1974 (or IEEE Standard 384-1981) as stated in the FSAR.
In response the applicant by amendment 3 to the FSAR, stated that containment electrical penetrations are physically separated over a 120-degree arc of the containment and are located on two distinct building elevations. This statement contradicts the above design description for Beaver Valley penetrations. This item will be pursued with the applicant and the results of the staff review will be reported in a supplement to this report.
0 l0 o
le
I 8.3.3.3.3 Use of a Single Piece of Steel as a Barrier Section 8.3.1.4 of the FSAR has been interpreted to mean that a single piece of steel or steel tray cover is to be installed as a barrier between raceways that are separated by less distance than allowed by Beaver Valley separation criteria. The objective of the barrier is to j
preclude failures of cables located in one raceway from causing failure of cables located in another raceway.
The applicant by amendment 3 to the FSAR and in response to a request for infonnation stated that additional analysis and testing will be submitted on or before June 30, 1984. This item will be pursued with the applicant the results of the staff review will be reported in a supplement to this report.
8.3.3.3.4 Barrier Configurations Section 8.3.1.4 (part 2, item 2a(9)) of the FSAR, stated that barriers will extend to the maximum extent practical beyond the area of exposure.
The applicant was requested to identify each location where a barrier will extend less than 12 inches beyond the area of exposure and provide an analysis for each identified location that demonstrates the adequacy of the lesser separation.
j i
In response the applicant by amendment 3 deleted item 2a(9) from the FSAR and stated that the requested infonnation and analysis will be developed and submitted in a future amendment to the FSAR. This item f
r-will continue to be pursued with the applicant and the results of the staff review will be reported in a supplement to this report.
8.3.3.3.5 Separation Inside Panels, Cabinets, or Enclosures Section 8.3.1.4 (part 2 item 2b(6)) of the FSAR stated that wiring within control switchboards and cabinets has been specified in currently approved design procedures to meet the intent of the independence requirements of IEEE Standard 384-1981. Based on this statement it appears that neither 6 inches of spatial separation or a barrier need be installed between redundant cables or between Class IE and non-Class IE cables inside panels or cabinets.
l The applicant by amendment 3 revised the FSAR to state that wiring within control switchboards and instrumentation cabinets has been specified to meet th requirements of IEEE Standard 384-1974. The staff interprets this statement in the FSAR to mean that all redundant cables, wires, or circuits within cabinets or enclosures will be separated by 6 inch or a barrier. This meets staff guidelines, the independence requirement of GDC 17, and is acceptable.
l t
Separation between Class 1E and Non Class IE cables inside panels or enclosures has not been specifically addressed. This item will be pursued with the applicant and the results of the staff review will be reported in a supplement to this report.
f l
l-
+
O -
8.3.3.3.6 FSAR Description of Physical Separation IEEE Standard 384-1974, as augmented by Regulatory Guide 1.75 (Revision 2), provides minimum raceway separation guidelines acceptable to the staff for complying with the physical independence reouirement of Criterion 17 of Appendix A to 10 CFR 50. These guidelines, however,
+
have not been followed in the design of Beaver Valley Power Station, Unit 2.
The unique Beaver Valley designs for separation of raceways was l
only partially described in Section 8.3.1.4 of the FSAR.
Description of separation at Beaver Valley and analysis for lesser separation has not been provided in amendment 3 to the FSAR.
This item will be pursued with the applicant and the results of the staff evaluation will be reported in a supplement to this report.
8.3.3.3.7 Use of 12 Inches of Separation Versus the Reconsnended 36 Inches Section 8.3.1.4 of the FSAR indicated that 12 inches of horizontal separation will be provided between redundant Class IE cable trays located in general plant areas versus 3 feet required by Section 5.1.4 of IEEE Standard 384-1974.
The applicant, by amendment 3 to the FSAR, deleted reference for 12 inches of horizontal separation and stated in its place that physical independence of redundant Class IE circuits throughout the plant is maintained by having redundant raceways physically separated to confonn B
e
. with minimum free air space requirements cited in IEEE Standard 384-1974 as augmented by Regulatory Guide 1.75.
This design meets staff guidelines and physical independence requirements of GDC 17 and is acceptable. However, the applicant in contradiction also states that physical barriers,, tests, and/or analysis are provided to assure the independence of redundant Class IE circuits. The staff is unable to determine what specific design criteria exists for physical separation of circuits at any given area at Beaver Valley Unit 2.
This item as well as the following listed itens will be pursued with the applicant with the results of the staff review reported in a supplement to this
- report, a.
Section 8.3.1.4 of the FSAR indicated that approximately 2 feet of vertical separation will be provided between redundant Class IE cable trays versus 3 or 5 feet required by Sections 5.1.3 and 5.1.4 of IEEE Standard 384-1974. The applicant by amendment 3 to the FSAR, deleted reference to the 2 feet of vertical separation.
b.
Section 8.3.1.4 of the FSAR indicated that 6 inches of horizontal separation will be provided between Class IE and non-Class 1E cable trays versus 12 inches or 3 feet required by Sections 5.1.3 and 5.1.4 of IEEE Standard 384-1974.
The applicant, by amendment 3 to the FSAR, deleted all reference to specific design separation requirements between Class IE and non Class IE cables.
l c.
Section 8.3.1.4 of the FSAR indicated that 12 inches of vertical I
separation will be provided between Class IE and non Class 1E cable L
r trays versus 3 or 5 feet required by Sections 5.1.3 and 5.1.4 of IEEE Standard 384-1974.
8.3.3.4 Compliance With the Guidelines of NUREG-0737, " Clarification of TMI Action Plan Requirements" Two TMI items relating to GDC 17 are identified in NUREG-0737. These items are II.E.3.1, " Emergency Power Supply for Pressurizer Heaters,"
and II.G.1, " Emergency Power for Pressurizer Equipment." The background, the NUREG position, and clarification of the positions are included in the NUREG report.
Emergency Power Supply for Pressurizer Heaters (II.E.3.1)
Description of compliance to each of seven clarifications associated with this TMI item have not been included in the FSAR as stated in response to a request for information. Description of compliance will be pursued with the applicant and the results of the staff evaluation will be reported in a supplement to this report.
Emergency Power for Pressurizer Equipment (II.G.I)
Similarly description of compliance to each of four clarifications associated with this TMI item have not been included in the FSAR.
Description of compliance will be pursued with the applicant and the results of the staff evaluation will be reported in a supplement to this report.
I*
l:
- 8.3.3.5 Electrical Independence Between Power Supplies to Controls Located in Control Room and Remote Locations Section 8.3.1.1.10 of the FSAR indicates that controls for the diesel generator and Class IE circuit breakers are located in the control room and at remote locations.
By amendment 3 to the FSAR, in response to a request for information, the applicant indicated that independence of controls between these locations is provided by transfer relays operated by transfer pushbuttons. The details for the electrical independence between power supplies to these controls will be pursued with the applicant and the results of the staff review will be reported in a supplement to this report.
8.3.3.6 Compliance With General Design Criterion (GDC) 18 The applicant has met the requirements of GDC 18. " Inspection and Testing of Electric Power Systems," with respect to the onsite ac and de power system. The onsite power system is designed to be testable during operation of the nuclear power generating station as well as during those intervals when the station is shut down.
8.3.3.7 Compliance With Ger.eral Design Criterion (GDC) 50 The applicant has met (except as noted) the requirements of GDC 50,
" Containment Design Bases," with respect to electrical penetrations y
containing circuits of the safety and nonsafety onsite power systems.
1 Criterion 50 requires, in part, that the reactor containment structures, i
, including penetrations, be designed so that the containment structure and its internal compartments can accomodate without exceeding the design leakage rate, and with sufficient margin, the calculated pressure and temperature conditions resulting from any loss-of-coolant accident.
The following items address the problem revealed during the staff review and resolution or status concerning them.
8.3.3.7.1 Description and Analysis of Compliance to GDC 50 In regard to electrica.1 containment penetrations, a description as to how the Beaver Vality design meets the requirements of Criterion 50 of Appendix A to 10 CFR 50, with analysis demonstrating compliance, has not been provided in Section 8 of the FSAR.
By amendment 3 to the FSAR, the applicant, in response to a request for i
infonnation, provided a description with results of test and analysis to show compliance to GDC 50. Based on this infonnation, the staff considers this item resolved. Documentation of the description and analysis in Section 8.0 of the FSAR will be pursued with the applicant and the results of the staff review will be reported in a supplement to this report.
8.3.3.7.2 Compliance With RG 1,63 Section 8.3.1.2.1 of the F3AR indicates that primary and backup containment electrical penetration protection is provided only where the
i I
. available fault-current exceeds the current-carrying capabilities of penetration conductors. This design for containment electrical penetration protection does not meet the guidelines of position 1 of Regulatory Guide 1.63.
Position I requires primary and backup protection where maximum available fault-current exceeds the current-carrying capability of the penetration versus capability of the conductors.
By amendment 3 to the FSAR, the applicant indicated that the Beaver Valley design provides primary and backup protection as required by RG 1.63 and that the following additional information would be provided by March 1984:
a.
fault-current versus time curve for each representative type cable conductor which penetrates primary containment b.
test report which verify the capability of penetration to withstand the total range of time versus fault current for worst case environmental conditions Revision to the FSAR to indicate compliance to RG 1.63 without exception and review of the above additional information will be pursued with the applicant. The results of the staff review will be reported in a supplement to this report.
r s
P
F'
. 8.3.4 Evaluation Findings The review of the onsite ac and de power system for the Beaver Valley plant covered single line diagrams, station layout drawings, schematic diagrams, and descriptive information. The basis for acceptance of the onsite power systems in the staff's review was conformance of the design criteria and basis to the Commission's regulations as set forth in the General Design Criteria (GDC) of Appendix A to 10 CFR 50. The staff concludes that the plant design is acceptable, meets the requirements of GDC 2, 4,17,18 and 50, and confonns to applicable guidelines of regulatory guides, branch technical positions, and NUREG reports and is l
acceptable except as noted in preceding sections.
I I
I
9.5.2 Comunication Systems The communication system is designed to provide reliable intraplant and interplant (or plant-to-offsite) comunications under both nonnal plant operation and accident conditions.
9.5.2.1 Intraplant Systems The design basis for the intraplant communication systems is to provide sufficient equipment of various types so that the plant has adequate comunications to startup, continue safe operation, or safely shut down.
The intraplant systems include:
(1) Page Party System The five channel page party system (PPS) system provides comunications from the main control room to all buildings and control areas within BVPS-2, and from one building or control area to any other. The PPS, is normally used during daily plant operation to allow individuals to comunicate between PPS stations and to provide for public address within the plant.
In an emergency, the system is used to alert personnel on the site and to comunicate messages between individuals. The evacuation / standby alarms are manually initiated from the comunication console in the main control room or from the auxiliary comunications station adjacent to the emergency or alternateshutdownpanel(ESP). The alanus are carried on the PPS loud-speakers to ensure audibility throughout the plant.
Evacuation alarm lights are provided in lieu of loudspeakers in areas of high noise levels where audibility of alarms would be difficult.
The PPS consists of amplifiers, handset stations, loudspearers, and special components, such as alarm tone generators, merge / isolate cabinets, and various controls. Two communication consoles house page party equipment, one located in the main control room and one located in the Shift Supervisor's office. Controls for merging or isolating the BVPS-1 and BVPS-2 page party systems are located at the communication console in the main control room, at the auxiliary shutdown panel in BVPS-1 and at the alternate shutdown I
panel (ASP) of BVPS-2.
The main plant PPS is powered from the essential bus panels SD and 6D, which are located on the 707 feet-6 inches elevation of the control building. The essential bus is fed from 480 V unit substation 2-5, which is ultimately backed by the onsite, nonsafety-related diesel generator. Outlying buildings, such as the cooling tower pumphouse, obtain power from the PPS from norum1 ac distribution panels.
(2) Calibration Jack System A calibration jack system is installed in the plant.
It is a two-channel system with a network of plug-in jacks. Headsets, consisting of earphones and a microphone, are connected through the plug-in jacks to permit direct communication between persons in
dif ferent areas. This system is normally used for maintenance, during' instrument and equipment calibration, and during construction and start-up.
The major components of the system are headset / amplifiers, system power supplies (one for each of two channels), phone jacks, and a tie to the PPS to enable paging via any headset /anp11fier set connected at any jack location in the system.
The calibration jack system is powered from the essential bus panel 2-60, which is backed by the onsite nonsafety-related diesel generator.
The applicant stated in the FSAR that during emergency or accident conditions the calibration jack "... system can be used as an alternate means to relay messages between different areas of the plant." The applicant was requested to describe how the relaying of messages using the calibration jack system would be accomplished within the plant. The description was to include the maximum number of plant personnel needed to relay the messages, the procedures, if any, that will be used in setting-up and using the relay, and assurances that adequate station personnel will be onsite in the event that the relay system must be used. The applicant has not provided this information.
i
, i (3) Radio System l
The radio system for Beaver Valley 2 is shared with Beaver Valley
{
1.
T' system consists of handheld portable radios, two base i
radio / stations, and five remote consoles.
The hand-held portable radios are available for use during normal and emergency conditions. The radios operate on one very high frequency (VHF) band frequency and two 450 MHz band frequencies.
The hand-held radios are powered by rechargeable batteries and, once charged, are not dependent on any electrical system until recharging is necessary. The VHF frequency is used for normal maintenance and operating comunications and can be used as an alternate means of relaying messages between areas of the plant during an emergency. The 450 MHz band frequencies will also be used by security for both normal and emergency operations.
The VHF remote consoles are located at the comunications console 1 in the main control room, consnunications console 2 in the Shift Supervisor's office, the BVPS-1 auxiliary shutdown panel, the emergency shutdown panel areas of BVPS-2 at the Emergency Response Facility (ERF) and at the Secondary Emergency Response Center
'approximately 10 miles away from BVPS-2 at South Heights, Pennsylvania. All of the above remote consoles are connected to two separate control lines. One control line is connected to VHF high band radio transmitter / receiver and is the primary radio station for BVPS-1 and BVPS-2. The other control line, selectable by a switch, is connected to a VHF low band radio transmitter
receiver and is a secondary radio system for BVPS-1 and BVPS-2.
Both of these base radios are in the radio building. Each remote console has two speakers so that messages can be received from both the primary and secondary base stations.
The switch selection is 4
'dentified by lights on the console.
The primary radio station can communicate directly with the DLC System Control Center, the Pennsylvania Emergency Management Agency, the West Virginia Emergency Services Agency, and the Ohio Disaster Service Agency, all of which are within the 10 mile radius of the plant.
The consoles within BVPS-2 are powered from a 120 V ac essential bus backed by the onsite, nonsafety-related diesel generator. The radio control circuits at the plant and the radio building are powered by a 48 V dc dedicated communication battery / charger system. The batteries are sized to run the system 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> if the ac source is lost.
There is also a high band base radio transmitter / receiver in the main control room. The antenna for this station is on the roof of the plant. The radio is for emergency use in the event of losing both radio transmitter / receiver stations.
l,
(4) Private Automatic Exchange (PAX) Telephone System The PAX system for BVPS-2 is a commercial-type telephone network consisting of an onsite switchboard located in the communication area of BVPS-1 that provides telephone service to BVPS dial-type telephone handsets.
PAX telephones are located at the communication consoles in the main control room, at the Shift Supervisor's office, and at the auxiliary shutdown panel, BVPS-2 alternate shutdown panel, the Emergency Shutdown Panel (ESP), the essential bus inverter and rectifier area, and in other areas of the plant that may be continuously or frequently manned.
The 48 Y de source for the switchyard is obtained from a 120 V ac to 48 Y de converter. The converter supplies 48 V de operating power to the switchboard and current to keep 48 Y battery bank fully charged. The battery bank operates in parallel with the converter and maintains full power to the switchboard for a minimum of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> in the event of a converter failure or a loss of ac power to the converter. The converter is connected to a consafety-related vital ac bus. The converter is sized to provide full power to the switchboard and simultaneously recharge the battery from fully discharged to fully charged within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
This power system is shared with BVPS-1 telephone switchboard, which as an identical 100 line telephone switchboard.
The BVPS-1 and BVPS-2 switchboards are interconnected so that incoming and outgoing calls can be completed even with a failure of either switchboard. All of the comon switchboard equipment for
- I BVPS-2 such as ringers, dial tone, etc, are provided with standby units. The telephone lines from the BVPS-2 switchboard to various parts of the plant are fed radially and are in separate conduits.
This system is tied to connercial telephone lines to allow for calls outside the plant but does not depend on them for intraplant use.
There is an independent telephone system between the BVPS-2 main control room and the containment building. Telephones on this system are located in the main control room, containment building, personnel hatch,, and emergency air lock. The system is powered from a nonsafety-related essential ac bus.
If the telephone handset is lifted at any one of the four locations, it automatically rings at the other two locations.
A direct telephone system is provided between the ERF and the main control room. These lines are established for emergency use.
Personnel in the ERF can access one of six liens to the control room. In the control room, two of these lines appear on the operator's desk, two on the Shift Supervisor's desk, and two in the computer room. Lifting the handset at either end will automatically ring the respective line at the other end. This system is powered from a nonsafety-related essential bus at the ERF end and from a nonsafety-related vital bus at the BVPS-1 end.
l l
. A direct telephone line is connected to the DLC system center from the BVPS-2 control room. This line is powered by dry cell batteries and had a separate signaling system.
The information in the FSAR regarding the onsite communication system did not adequately cover the systems' capabilities during transients and accidents. The applicant was requested to provide the following information:
(a)
Identify all working stations (safety-related areas) on the plant site where it may be necessary for plant personnel to conmunicate with the control room or the emergency shutdown panel during and/or following transients and/or accidents (including fires) in order to mitigate the consequences of the event and to attain a safe cold plant shutdown.
(b)
Indicate the maximum sound levels that could exist at each of the above identified working stations for all transients and accident conditions.
l (c)
Indicate the types of communication systems available at each of the above identified working stations.
l (d)
Indicate the maxinum background ncise level that could exist at each working station and yet reliable expect effective communication with the control room using:
.g.
k 1.
the page party communications systems, and 2.
any other additional communication system provided that working station.
(e) Describe the performance requirements and tests that the above onsite working stations communication systems will be required to pass in order to be assured that effective communication with the control room or emergency shutdown panel is possible under all conditions.
The information submitted by the applicant is insufficient to evaluate i
the capabilities of the onsite communication systems.
In addition to the above the applicant was requested to evaluate his system and discuss the protective measures taken to assure a functionally operable onsite l
and offsite communication system. The discussion was to include the considerations given to compenent failures, loss of power, the severing l
of communication lines or trunks as a result of an accident or fire, and any sharing with the Unit I connunication systems and their power sources. His response was inadequate in that the staff cannot determine that the system / component failures will not result in a total loss of communications at BVPS-2, From information submitted on the intraplant communication system the l
staff concludes that under seismic condition with a loss of offsite power all communications within the plant will be lost. This is not acceptable. The reason being that the power sources for the I
communication system are supplied by an onsite nonsafety-related diesel i
t
- i generator and nonsafety-related de batteries / chargers which are assumed j
to fail as the result of the accident.
l I
i In addition the information submitted by the applicant in Amendment 4 to the FSAR indicates that the connunication systems in particular the page I
party system, the radio system, the microwave system, and telephone
[
systems are shared, interconnected in some manner or can be connected to their counterpart systems in Beaver Valley Unit 1.
From the information l
submitted, the staff can not determine if the conrunication systems are designed to meet the requirements of GDC 5.
1 The FSAR discusses the inservice inspection tests, preventative
[
maintenance, and operability checks that are perfomed periodically to prove the availability of the communication systems. The applicant was requested to provide the frequency of the various tests and inspections to be performed. He has not provided this infomation.
l i
l 9.5.2.2 Interplant (Plant-to-0ffsite) Consunication System The design basis for interplant communications is to provide dependable l
t conmunication for reliable operation. The interplant consnunication systems include:
l (1) Telephone Communication Telephone communication is discussed in Section 9.5.2.1 of this j.
SER.
.a
11 (2) Plant-to-Offsite Radio System The plant-to-offsite radio system is discussed in Section 9.5.2.1 of the SER.
c (3) Microwave System The microwave system is a shared facility with BVPS-1.
It is comprised of microwave radios (located at the switchyard relay house) and their affiliated circuits.
The microwave radios are powered from a 8VPS-148 Y de dedicated switchyard battery / charger system.
(4) System Operator Telephone System i
The system operator telephone is located on the comunication console in the main control room.
It is direct link, via hardwire and microwave radio, to the Duquesne Lighting Company (DLC) dispatcher.
It is separated from all other telephone systems and powered by two dedicated No. 6 dry cells.
The applicant was requested to provide a detailed description for each interplant conpunication system listed in Section 9.5.2.2 of the FSAR.
The detailed description was to include an identification and descript1wn of each system's power source, a description of each system's components (headsets, handsets, switchboards, amplifiers, consoles, handheld radios, etc.), location of major components (power sources consoles, etc.) and interfaces between the various systems.
The applicant has not provided this infonnatier. for the microwave or system l
operator telephone system.
12-The scope of review of the plant comunication systems included the assessment of the number and types of comunication systems provided, assessmer.t of the adequacy of the power sources, and verification of the functional capability of the comunications systems under all conditions of operation.
The basis for acceptance in the staff review was confomance of the design criteria and bases and design of the irstalled comunication systems to the requirements of GDC 5 and the acceptance criteria and guidance of SRP 9.5.2.
Other bases for acceptance was confomance to industry standards, and the ability of the systems to provide effective l
comunications from diverse means within Beaver Valley Unit 2 under i
maximum potential noise levels.
Based on its review, the staff concludes that the installed communications systems at Beaver VaIIey Unit 2 do not meet the requirements of GDC 5 or confom to the above-cited standards, criteria, l
and design bases, they cannot perfom their design functions, and, therefore, are unacceptable. Upon receipt of the requested additional infomation, the staff will report its findings in a supplement to this SER.
Special comunication system requirements for fire protection are addressed in Section 9.5.1 of this SER.
l
t l
l l
9.5.3 Lighting System The lighting system for Beaver Valley 2 is designed to provide adequate lighting in all areas of the station and consists of a normal and backup (essential) ac lighting systems, and an emergency de lighting system.
The design is based on illumination levels that equal or exceed those reconsnended by the Illuminating Engineering Society for central l
I stations, and NUREG-0700 " Guidelines for Control Room Design Review."
9.5.3.1 AC Nonnal Lighting System The normal lighting system provides general illumination for the station. Nonnal ac lighting for the plant is supplied from the 480 V station service system through single-phase, 480-120/240 V, 3-wire grounded, dry-type transfomers, i
In most areas of the plant, nonnal ac lighting is provided from two different sources to enhance reliability. Alternating rows of fluorescent fixtures are supplied from different lighting panels and transfonners which, in turn, are supplied from separate 480 V motor control centers (MCCs) on separate 480 V unit substation buses.
Indoor areas illuminated primarily with mercury vapor (MV) sources have an auxiliary lighting system to provide illumination during the cooling and restrike time of MV lamps. This auxiliary lighting is fed from the same ac circuit as the MV lamp and is a quartz lamp built into the luminaire.
l
f 14 9.5.3.2 AC Standby (Essential) Lighting System The essential lighting system supplements the normal lighting system and provides illumination for operation only in the control room, the emergency switchgear rooms, the emergency shutdown panel area, and the essential bus inverter and rectifier area in the rod control vault building. The backup ac lighting subsystem is connected to non-Class IE 480 V MCCs through 480-120/240 Y dry-type transformers.
In the event of a loss of nomal ac power, this subsystem is automatically connected to and receives power from the onsite, nonsafety-related diesel generator.
All lighting fixtures connected to this lighting subsystem are 120 V or 240 V fluorescent and are continuously energized.
9.5.3.3 OC Emergency Lighting System i
Backup de emergency lighting consists of 125 V de incandescent fixtures supplied from the non-Class IE station batteries which are designed for a 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> duty cycle. These fixtures are normally energized from the nonsafety-related diesel backed, 480 V unit substation through 480 V MCC and 480-120 V dry type transformers. Automatic transfer switches connect the backup dc lighting to the station batteries upon a loss of nomal ac supply and will then retransfer back to the 120 V ac power when the nonsafety-related diesel generator is supplying load or normal ac power returns. These switches have a 3-second time delay on transfer from nonnal to backup sources to prevent nuisance operation caused by momentary vol,tage dips. These switches have also been sized to l
withstand expected levels of fault current. Separate circuit-breaker-type panel boards are used for this lighting system.
I
F.
The backup ac lighting in the four areas listed above will also be supplemented by sealed beam lamps, each with an individual. battery pack rated at a minimum 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> of operation, to allow safe shutdown operations, to illuminate the means of egress, and to aid in providing lighting for the fighting of fires. Backup lighting required for personnel safety in the balance of the plant is provided by local, self-contained, battery-powered, backup lighting units with a 1.5-hour minimum operation rating.
The applicant was requested to identify the vital (safety-related) areas and hazardous areas where emergency lighting is needed for safe shutdown i
I of the reactor and the evacuation of personnel in the event of an accident. He was to tabulate the lighting systems provided in the design to accommodate those areas. The applicant has not provided this l
l information.
Based on the inforwation provided in the FSAR, in the event of an accident concurrent with the loss of offsite ac power, numerous safety related areas of the plant are illuminated only by the emergency de lighting system powered from the non-Class IE station battery designed for a 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> duty cycle. For loss of offsite power transients exceeding l
l two hours, the applicant was requested to discuss how he proposed to l
\\
l provide lighting in those safety related areas. He has not provided the requested information.
The applicant was requested to provide a discussion on the protection measures taken to assure a functionally operable lighting system,
\\
I
.Cb " '
l
16-including considerations given to component failures, loss of ac power, and the severing of lighting cables as a result of a accident or fire.
He has not adequately. responded to this request.
The FSAR stated that the lighting systems provide adequate illumination in all access areas and in all areas required for control of safety-related equipment. The staff found this statement to be too general. The staff has determined and requires that a minimum of 10 foot candles at the work station is required to adequately control, monitor and/or maintain safety related equipment during accident and transient conditions,:and 2 to 5 foot candles based on activity level for access and egress to safety related plant areas. The applicant has not shown that he is in conformance to the position.
Section 9.5.3.5 of the FSAR states that the backup ac lighting system will be tested when the onsite nonsafety diesel generator is tested under load. The applicant was requested to describe the procedures of how the lighting system test will be performed and the frequency of the test. He has not provided the test frequency.
Section 9.5.3.2 of the FSAR describes the emergency lighting system as composed of three subsystems. They are the 125 V de, 480-120/240 V ac, and 1.5 to 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> battery lighting systems. A number of areas in the plant are served by one or more of these systems. All these systems are classified non-Class 1E and receive power from non-Class IE sources, i.e., non-Class IE station batteries for the de lighting and the non-Class IE emergency diesel generator for the ac lighting. Assuming a i
l l
H..
failure or non-availability of any or all of these systems following a seismic event, it is possible that portions of the plant particularly the control room may be without sufficient lighting or without lighting for an extended period of time during this design basis event. This is unacceptable.
It is our position that adequate lighting be provided 'to all vital, hazardous, and safety-related areas needed for the safe shutdown of the reactor and the evacuation of personnel in the event of an design basis event. Since the nonsafety-related emergency diesel generator also provides power to comunication systems as discussed in Section 9.5.2 of the report, we required that emergency lighting and communication systems required for plant shutdown under accident conditions be powered from Class 1E ac or de power supplies.
The scope of the review of the lighting system for Beaver Valley Unit 2 included assessment of all components necessary to provide adequate lighting during both normal and emergency operating conditions, the adequacy of the power sources for the nonnal and emergency lighting systems, and verification of functional capability of the lighting system under all conditions of operation.
The basis for acceptance in the staff review was confonnance of the design bases and criteria and confonnance of the design of the lighting systems and necessary auxiliary supporting systems to the acceptance criteria and guidance of SRP 9.5.3.
Other bases for acceptance were confonnance to industry standards, NUREG-0700, and the ability to provide effective lighting in all conditions of operations.
Based on its review, the staff concludes that the various lighting systems provided at Beaver Valley Unit 2 are not in confomance with the above-cited standards and criteria design basis, they cannot perfom their design function, and, therefore, are not acce,1 table.
Upon receipt l
of the requested additional infomation, the staff will report its I
fundings in a supplement to this report.
l l
Special lighting system requirements for fire protection are addressed in Section 9.5.1 of the SER.
9.5.4 Emergency Diesel Engine Fuel Oil Storage and Transfer System 9.5.4.1 Emergency Diesel Engine Auxiliary Suoport Systems (General)
There are two emergency diesel generators for each unit at Beaver Valley Unit 2 and each diesel engine has the auxiliary systems listed below.
These systems are discussed in detail in the SER sections indicated in parentheses after the system name.
(1) fuel oil storage and transfer system (9.5.4.2)
(2) cooling water system (9.5.5)
(3) starting system (9.5.5)
(4) lubricationsystem(9.5.7)
(5) combustion air intake and exhaust system (9.5.8)
This section of the SER (9.5.4.1) applies to all of the above systems.
i
(
With several exceptions, the diesel generator and its auxiliary support systems are housed in a seismic Category I diesel generator building that provides protection from the effects of tornadoes, tornado missiles, and floods. The exceptions are: the diesel generator exhaust I
stacks, the diesel fuel oil storage tanks, and the fuel oil fill and vent lines. The diesel generator fuel oil storage tanks are embedded in the seismic Category I concrete floor mat of the diesel generator building which provides protection from the effects of tornadoes, tornado missiles, and floods; the fuel oil day and storage tank vents l
and the diesel exhaust stack are located in enclosures and are protected from the effects of tornadoes, tornado missiles, and floods caused by natural phenomena. Therefore, the requirements of GDC 2 and 4 with regard to missiles, and the recommendations and guidance of RGs 1.115 and 1.117 are met. Protection from the effects of tornadoes, tornado missiles, and floods is evaluated in Section 3 of this report.
Tornado-missile protection of the diesel generator fuel oil fill lines discussed in Sections 9.5.4.2.
The diesel generators and their auxiliary systems for Beaver Valley Unit 2 are independent of Beaver Valley Unit i diesel generators. Thus, the requirements of GDC 5 are met.
The diesel engine and its engine-mounted and separately skid-mounted portions of the auxiliary support systems piping and components nonnally furnished with the diesel generator package are designed to seismic
)
Category I requirerems and follow the guidelines of the Diesel Engine Manufacturers Association (DEMA) standards. The diesel engine and its
. mounted auxiliary support systems piping and components conform to the requirements of IEEE Stardard 387-1977, " Standard Criteria for Diesel-Generator Units applied as Standby Power Supplies for Nuclear Power Generating Stations," which endorses the Diesel Engine Manufacturers Association (DEMA) standard and the guidelines of RG 1.9,
" Selection, Design and Qualification of Diesel-Generator Units used as Onsite Electric Power Systems at Nuclear Plants." The diesel engine and 1
its auxiliary support systems meet the quality control requirements of 10 CFR 50,~ Appendix B.
The quality assurance program is evaluated in Section 17.0 of this report.
l Upon completion of repairs or maintenance and prior to an actual start, l
l run, and load test, a final equipment check is made to ensure that all electrical circuits are functional (i.e., fuses are in place, switches l
l and circuit breakers are in their proper position, there are no loose wires, all test leads have been removed, and all valves are in the proper position to permit a manual start of the equipment). After the unit has been satisfactorily started and load tested, the unit is returned to automatic standby service and is under the control of the control room operator.
The applicant will perform preoperational and startup tests of the diesel engine auxiliary support systems in accordance with recommendations and guidelines of RG 1.68, " Initial Test Programs for l
Water Cooled Reactor Power Plants." The adequacy of the test program is
)
evaluated in Section 14.1 of this report.
a
The design of the diesel engine auxiliary support systems has not been fully evaluated with respect to the recommendations and guidelines of BTP ASB 3-1, " Prevention Against Postulated Piping Failures in Fluid System Piping Outside Containment," and MEB 3-1, " Postulated Break and Leakage Locations in Fluid System Piping Outside Containment." The applicant has not evaluated the failure of the high-energy diesel generator air starting system. Therefore the systems are not in conformance with GDC 4.
Protection against dynamic effects associated with the postulated pipe system failures other than the air starting system is evaluated in Section 3.6 of this report. The high-energy failure analysis of the air starting system is discussM in Section 9.5.6.
The primary fire protection system for the diesel generator building is a CO system. The CO is a nonsafety related system, and is not 2
2 qualified for seismic events. The system is seismically supported. The applicant was requested to show that a spurious actuation of the CO2 fire protection system will not affect diesel generator availability and operability. He has not provided the requested information. The adequacy of the fire protection for the emergency diesel generator and
)
associated auxiliary support systems with respect to the reconsnendations and guidelines of BTP CMEB 9.5.1, " Guidelines for Fire Protection for Nuclear Power Plants," is evaluated in Section 9.5.1 of this report.
The design of the diesel generator auxiliary support systems also has been evaluated with respect to the recommendations of NUREG/CR-0660,
" Enhancement of Onsite Emergency Diesel Generator Reliability." This
\\ t
~
report made specific reconsnendations on increasing the reliability of l
nuclear plant emergency diesel generators.
Information requests concerning these recomendations were transmitted to the applicant i
during the review process. The applicant responded in the amendments to the FSAR stating how the recommendations of NUREG/CR-0660 have been or will be met.
i The staff has reviewed these responses and determined that the applicant's'conformance to the recomendations is as shown in the following Table.
t e
i 1
e
TABLE Recommendation Conformance SER Section 1.
Moisture in air starting system no 9.5.6 -
2.
Dust and dirt in diesel generator no 9.5.4.1 room i
3.
Turbocharger gear drive problem N/A 4.
Personnel training no 9.5.4.1 5.
Automatic prelube no 9.5.7 i
6.
Testing, test loading, and no 9.5.4.1 preventive maintenance 7.
Improve identification of root no 9.5.4.1 cause of failures 8.
Diesel generator ventilation and yes 9.5.8 combustion air systems 9.
Fuel storage and handling yes 9.5.4.2
- 10. High temperature insulation 9.5.4.1
- 11. Engine cooling water yes 9.5.5
- 12. Concrete dust control no 9.5.4.1
- 13. Vibration of instruments no 9.5.4.1
- Explicit conformance is considered unnecessary by the staff in view of the equivalent provided by the design, margin, and qualification testing requirements that are normally applied to emergency standby diesel generators.
l i
5
On the basis of its review, the staff cannot conclude that there is sufficient assurance of diesel generator reliability. To ensure long-term reliability of the diesel generator installation, the staff requires that the following issues be resolved and their solutions implemented prior to initial startup.
1.
Moisture in the Air Start System This is discussed in Section 9.5.6 of this report.
3 2.
Dust and Dirt in Diesel Generator Room Experience at some operating plants has shown that diesel engines have failed to start due to accumulation of dust and other deliterious material on electrical equipment associated with starting of the diesel generators (e.g., auxiliary relay contacts, control switches, etc.). The applicant was requested describe the provisions that have been made in the diesel generator building design, electrical starting system, and combustion air and ventilation air intake design (s) to preclude this condition to assure availability of the diesel generator on demand. He was also requested to describe under normal plant operation what procedure (s) will be used to minimize accumulation of dust in the diesel generator room; specifically addressing concrete dust control. The applicant has not provided sufficient information to evaluate the design for this condition.
3.
Personnel Training The applicant was requested to provide a detail discussion (or plan) of the level of training proposed for plant operators, maintenance crew, quality assurance, and supervisory personnel as well as new personnel over the lifetime of the plant who will be responsible for the operation of the emergency diesel generators.
In addition, he was to identify the number and type of personnel that will be dedicated to the operations and maintenance of the emerge'ncy diesel generators and the number and type that will be assigned from the general plant operations and maintenance groups to assist when needed.
In the discussion the applicant was to identify the amount and kind of training that will be received by each of the above categories and the type of ongoing training program plannet and its conformance to the vendor's training program, to assure optimum availability of the emergency generators. The applicant has not provided adequate information to evaluate the training program.
4.
Automatic Prelube This is discussed in Section 9.5.7 of this report.
5.
No Load and Light Load Operation a.
The applicant has discussed the procedures for no load and light load operation of the diesel generator. He states that the manufacturer recommends the following:
U
(1) During extended no load and light load operation (less than 20% full load), the diesel generators will be loaded to a minimum of 50% of full load for 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> following each 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of continuous no load or light load operation.
(2) During periodic testing, the diesel will be loaded to a minimum of 25% of full load as recomended by the manufacturer.
The applicant did not discuss no load operation during troubleshooting. Therefore, we will require the no load /
light load procedures (1) and (2) as well as the following item (3) be included in the plant operating procedures.
(3) During troubleshooting, no load operation will be minimized if the troubleshooting operation takes place over an extended period of time (i.e., up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />),
the engine will be cleared by loading the diesel in accordance with (1) above, b.
The applicant has stated that each diesel generator unit is capable of operating at its maximum rated output under the following outdoor service conditions and for the durations indicated during the following weather disturbances:
(1)
Outdoor Service Conditions
(1.1) Ambient air intake: -17 to 102 F (1.2) Humidity: maximum 100%
(2)
Weather Disturbances (2.1) A tornado pressure transient causing an atmospheric pressure reduction of 3 psi in 3 seconds followed by a rise to normal pressure in 3 seconds; a shorter transient (1.5 seconds) will not affect engine operation and output.
(2.2) A hurricane or northeastern stonn pressure of 26 in. of mercury for a duration of I hour; the engine is capable of continued operation for up to 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> at 26 in. of mercury with no effect on operation and output.
i In a meeting with Colt Industries in Philadelphia on June 9 to 10, i
1982, the diesel engine manufacturer stated that no load and light load operation of the diesel engines at low ambient temperatures is an unacceptable operating condition for Colt engines. The manufacturer stated that, under these environmental conditions, the i
diesel engine would fail to operate properly because there would be insufficient turbocharger preheating of the combustion air and potential' fuel oil degradation. The diesel engine could fail within a short period of time.
Failure under these environmental conditions could possibly prevent diesel engine restart upon a subsequent loss of offsite power. To alleviate this condition, the manufacturer reconnends a minimum loading of the engine based on the outside ambient temperatures
+
',0 (e.g. at -10"F, the diesel would have to be loaded to between 60%
to 66% of full load to prevent engine failure). This would require the paralleling of the onsite (diesel generator) power scurce with the offsite power source for extended periods of time. This is unacceptable to the staff and would violate the independence requirement of GDC 17.
In letters dated February 1 and 14,1983, Public Service of New Hampshire, which has similar diesel engines at its Seabrook Plant, stated that the diesel engine manufacturer had advised them that an air temperature of 50*F or greater at the turbocharger inlet would allow continuous no-load and light-load operation of the diesel generators. Operation with inlet air temperatures below 50*F would require preheating of the combustion air.
Based on preliminary information supplied by Beaver Valley, the manufacturer now states that the diesel engines can operate at no-load, light-load and rated-load conditions with no degradation of the engine's operating characteristics or ability to accept and carry load when operated at stated ambient service conditions. The applicant has not provided formal documentation to substantiate the manufacturer's new statement nor has he shown that the diesels can accept full load.within the required accident load sequence following such operation as stated in Section 8.3.1 of this SER.
We are pursuing this issue with the applicant.
4 9
i 6.
Preventive Maintenance Identification of Root Causes of Failures Preventive maintenance should go beyond the normal routine adjustments, servicing and repair of components when a malfunction i
occurs. Preventive maintenance should encompass investigative testing of components which have a history of repeated malfunctioning and require constant attention and repair.
In such 4
cases consideration should be given to replacement of those components with other products which have a record of demonstrated reliability, rather than repetitive repair and maintenance of the existing components. Testing of the unit after adjustments or repairs have been made only confirms that the equipment is operable and does not necessarily mean that the root cause of the problem has been eliminated or alleviated.
The applicant was requested to address this concern and describe the means he would use to identify the root causes of failures.
The applicant has not provided adequate information for staff evaluation of his programs for preventive maintenance and identification of root causes of failures.
7.
Vibration of Instrument and Controls The availability on demand of an emergency diesel generator is dependent upon, among other things, the proper functioning of its i
controls and monitoring instrumentation. This equipment is generally panel mounted and in some instances the panels are mounted directly on the diesel generator skid. Major diesel engine damage has occurred at some operating plants from vibration induced
,_,,.a
d 8
. ^
l wear on skid mounted controls and monitoring instrumentation. This sensitive instrumentation is not made to withstand and function accurately for prolonged periods under continuous vibrational stresses normally encountered with internal combustion engines.
Operation of sensitive instrumentation under this environment rapidly deteriorates calibration, accuracy and control signal output. Therefore, except for sensors and other equipment that must be directly mounted on the engine or associated piping, the controls and monitoring instrumentation should be installed on a freestanding floor mounted panel separate from the engine skids, and located on a vibration free floor area.
If the floor is not vibration free, the panel shall be equipped with vibration mounts.
The applicant was requested to confirm his compliance with the j
above requirement or provide justification for noncompliance.
The applicant in Amendment 4 to the FSAR stated that the controls and monitoring instrumentation panels are floor mounted on the diesel generator building floor slab and are seismically supported.
Seismically supporting the panels does not qualify this equipment with the associated controls and monitoring instrumentation for continuous operation under severe vibrational stresses that may be transmitted through the floor panels and equipment have been specially developed, tested, and qualified for these conditions.
The staff requires the applicant to either provide test results and results of analyses that validate that the floor mounted control
panels and panel mounted equipment including skid mounted equipment have been developed, tested, and qualified for such operation or isolate the floor mounted control panels and mounted instrumentation from engine vibration that may be transmitted through the floor so that diesel generator availability and reliability is not compromised.
The present diesel generator design meets the requirements of GDC 2 and 4 With regard to tornado - and turbine-missile protection, 5, 17, and 18, and the guidelines of the cited RG and industry standards and is acceptable except as noted above.
Upon submittal of the requested information, the design of the diesel generator and its auxiliary systems will be evaluated for conformance to GDC 21 and the reconnendations of NUREG/CR-0660 for enhancement of diesel generator and the related NRC guidelines and criteria. Our evaluation will be reported in a supplement to this SER.
9.5.4.2 Emergency Diesel Engine Fuel Oil Storage and Transfer System The design function of the emergency diesel engine fuel oil storage and transfer systen is to provide a separate and independent fuel oil supply train for each diesel generator and to permit operation of the diesel generator at ESF load requirements for a minimum of 7 days without replenishment of fuel. The system is designed to meet the requirements of GDC 2, 4, 5 and 17. The meeting of the requirements of GDC 2, 4, and 5 is discussed in Section 9.5.4.1 of this SER.
There are two emergency diesel generators for Beaver Valley Unit 2.
Each diesel engine fuel oil storage and transfer system consists of a 1100-gallon day tank sufficient to power the diesel engine at continuous rated load for approximately 3.0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br />, a 58,000-gallon diesel fuel oil storage tank sufficient to power the diesel engine based on the continuous rated load for 7 days, two ac motor-driven transfer pumps (both pumps powered from the associated diesel), and associated piping, valves, instrumentation, and controls -
Each diesel engine fuel oil storage and transfer system is independent and physically separated from the other system supplying the redundant diesel generator. Thus, a single failure within any one of the systems will affect only the associated diesel generator. Therefore, the requirements for GDC 17 as related to the capability of the fuel oil system to meet independence and redundancy criteria, are met.
Except for the fuel oil tank fill lines, the diesel engine fuel oil storage and transfer system piping and components up the the' diesel engine interface, including auxiliary skid-mounted piping, are designed to seismic Category I, ASME Section III, Class 3 (Quality Group C) requirements. They meet the recommendations of RG 1.26, " Quality Group Classifications and Standards for Water, Steam, and Radioactive Waste Containing Components of Nuclear Power Plants," and RG 1.29, " Seismic Design Classification." The engine-mounted piping and components, from the engine block to the engine interface, are considered part of the engine assembly and are seismically qualified to seismic Category I requirements as part of the diesel engine package. This piping and the 1
associated components--such as valves, fabricated headers, fabricated special fittings, and the like--have not been defined by the applicant.
The applicant had been asked to provide the industry standards to which the engine-mounted piping and components are designed.
Each fuel storage tank is filled from a single fuel oil supply line.
In addition the fill line does not meet the requirements of GDC 2 in that the exposed portions of the diesel oil storage tank fill line external to the diesel generator building are not tornado-missile protected.
Also, the applicant has not defined to which industry standards the fuel oil tank fill line has been designed. We require the fuel oil storage tank fill line be designed to seismic Category I, ASME Section III, Class 3 (Quality Group C) requirements and be tornado missile protected.
Adequate infonnation has not been provided to demonstrate that the design of the emergency diesel engine fuel oil storage and transfer system confonns to ANSI-N195. The applicant was requested to provide specific information for the following sections of the standard:
(1) Section 5.4 It is stated in the FSAR that the 1100 gallon day tank will provide for three hours running time for each engine when loaded to its l
maximum load, and that the 58,000 gallon fuel oil storage has a total capability to operate the D/G for seven days at maximum load and 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> of testing. Based on data provided by other applicants with the same diesel engine, it appears that there is insufficient supply of diesel oil for seven days of operation at
',a rated load as required by SRP 9.5.4, Parts II and III, Regulatory Guide 1.137 and ANSI N-195. The applicant was requested to provide the results of an analysis in accordance with guidelines specified in Section 5.4 of ANSI N-195 to show that his present seven day diesel oil storage supply system will last seven days with the diesel operating at rated load. The applicant has not provided this information.
(2) Section 6.3 The applicant states that a Y-type strainer will be used instead of a duplex strainer as required in the standard. This is an acceptable deviation since two transfer pumps with strainer are provided. However, the function of the strainer is to preclude particulate matter present in the fuel oil storage tanks from passing through the fuel oil system and damaging vital components of the system. The fuel oil transfer pump is considered a vital component of the fuel oil system. Figure 9.5-7 of the FSAR shows the strainers located between the fuel oil transfer pumps and the fuel oil day tank. Normal design practice is to place the strainer before the fuei oil transfer pump to protect the pump. The applicant was requested to justify the location of the fuel' oil strainers as shown or move the strainer to protect the transfer pump. The applicant's response did not provide sufficient information to address this concern.
y s
4
(.
(3) Section 7.5 In Section 9.5.4.2 the applicant stated that all fuel oil lines are adequately protected from external corrosion by encasement in concrete and interior surfaces of the fuel oil storage tanks are protected. These statements were considered too general arid provided insufficient information to evaluate the adequacy of the corrosion protection. The applicant was requested to expand the FSAR to include a more explicit description of proposed protection of underground piping and external and internal tank corrosion protection. Where corrosion protective coatings are being considered (piping and tanks) include the industry standards which will be used in their application and the types of coatings. Also, he was to discuss what provisions would be made in the design of the fuel oil storage and transfer system in the use of a impressed current type cathodic protection system, in addition to waterproof protective coatings, to minimize external corrosion of buried piping or equipment.
If cathodic protection was not being considered, he was to provide justification.
In Amendment 4 of the FSAR, the applicant provided information on the tank internal and external coatings which was found acceptable.
However, he did not provide an adequate justification as to why the concrete encased fuel oil fill and transfer lines do not need corrosion or cathodic protection.
(4) Sections 8 and 9 l
3
4 In Section 9.5.4.5 of the FSAR the applicant described the instruments, controls, sensors and alarms provided for monitoring the diesel engine fuel oil storage and transfer system and their function which alert the operator when these parameters exceed the ranges recommended by the engine manufacturer. He was requested to discuss the testing and frequency of testing necessary to maintain and assure a highly reliable instrumentation, controls, sensors and alarm system.
In addition, he was to describe what operator actions are required during alarm conditions to prevent hamful effects to the diesel engine. The applicant has not provided the requested information.
In addition, the fuel oil quality and tests will conform with the guidelines of RG 1.137, positions C.2.a through C.2.f, and the requirements will be included in the plant Technical Specifications.
Position C.2 9 of Regulatory Guide 1.137 sediment control during refilling was addressed by the applicant. He stated that the fuel oil fill connection and pump suction are located sufficient distances apart to enhance settling of sediment stirred up during fill operations.
Distances between tank fill line and pump suction to allow for sediment settling is not a valid justification. Once the sediment has been stirred up it will remain in suspension for several hours.
In addition, l
the concentration of sediment in the fuel oil during refilling is higher at the beginning than at the end of the filling operation but the amount or quantity of sediment in suspension is relatively the same. Therefore if the transfer pump is taking suction at the same time as the tank is
being filled, large quantities of sediment will pass through the system which could cause damage to components, quickly clog filters and strainers, and result in the unavailability of the engines. This is unacceptable. We will pursue this issue with the applicant.
In addition the applicant was requested to provide the following:
(l') A discussion on the means for detecting or preventing growth of algae'in the diesel fuel storage tanks.
If it were detected, a description of the methods to be used for cleaning the affected storage tanks. The applicant has not provided the requested information.
(2)
In Section 9.5.4.3 the applicant stated that diesel fuel oil is available from local distribution sources.
In Table 9.5.2 he identified the sources where diesel quality fuel oil will be available and the distances required to be travelled from the source to the plant. He was requested to discuss how fuel oil will be delivered onsite under extremely unfavorable environmental conditions. His response provided insufficient information to resolve this concern.
(3) Figure 9.5-7 of the FSAR showed a fuel oil accumulator tank in the diesel engine fuel oil system. The accumulator tank is located somewhere on the engine skid and is connected in parallel with the fuel oil headers. The applicant was requested to provide a description of the tank, and its purpose. The applicant's response
does not provide sufficient information to evaluate the tank's purpose in the diesel engine fuel oil system. We require additional clarification and explanation.
The scope of review of the diesel engine fuel oil storage and transfer system included layout drawings, piping, and instrumentation diagrams, and descriptive information in FSAR Section 9.5.4 for the system and auxiliary support systems essential to its operation.
The basis for acceptance in the staff review was conformance of the design criteria and bases and design of the diesel engine fuel oil-storage and transfer system to the requirements of GDC 17 with respect to redundancy and physical independence, to the guidance of the cited RGs, to the recommendations of NUREG/CR-0660, and to industry codes and standards.
Based on its review, the staff concludes that the emergency diesel
. engine fuel oil storage and transfer system meets, the requirements of GDC 5 and 17 and meets the recommendations of NUREG/CR-0660.
It does not meet the requirements of GDC 2 and 4 as noted in Section 9.5.4.1 and this section; nor the guidance of the cited RGs and SRP 9.5.4, and industry codes and standards, thus, it cannot perform its design safety function and, therefore, it is unacceptable. Upon receipt of the required additional information, the staff will report its findings in a supplement to this SER.
1
~
9.5.5 Emergency Diesel Engine Cooling Water System The design functiu of the emergency diesel engine cooling water system is to maintain the temperature of the diesel engine within a safe operating range under all load conditions and to maintain the engine coolant preheated during standby conditions to improve starting reliability. The system is designed to meet the requirements of GDC 2, 4, 5, 17, 44, 45, and 46. Conformance with requirements of GDC 2, 4, and 5 is discussed in Section 9.5.4.1 of this SER.
The emergency diesel engine cooling water system is a closed loop system and cools the engine jacket, lube oil cooler, governor lube oil cooler, fuel oil injectors, turbocharger and air coolers, and generator bearing.
The emergency diesel engine cooling water system is composed of two subsystems:
the jacket water system and the intercooler water system.
The major components of the jacket water system for each standby emergency diesel engine include an engine-driven jacket coolant water pump, jacket water heat exchanger, an expansion tank (shared by both subsystems), two turbochargers, a governor lube oil cooler, a lube oil cooler, a motor-driven keep warm pump, an electric heater, and thennostatic three-way valves, as well as the required instrumentation, controls, and alarms, and the associated piping and valves to connect the equipment. The major components of the intercooler water system for each standby emergency diesel engine include an engine driven intercooler water pump, an intercooler water heat exchanger, air coolers, and a thermostatic three-way valves as well as the required instrumentation, controls, and alanns and the associated piping and valves to connect the equipment, provide cooling to the fuel injectors
~
. ~.
j,
and generator bearings and connect the system with the jacket water 5
system. When the diesel engines are operating, the heat generated is rejected to the service water system by means of the cooling water heat exchangers.
4 i
During operation of the standby diesel engine, the temperature of the i
diesel engine coolant is regulated automatically through the action of temperature-sensing three-way thermostatic valve. When the standby diesel engine is idle, the engine coolant is heated by an electric
-heater and continuously circulated through the engine. The temperature is controlled by a thermostat to keep the engine wam and ready to accept loads within the prescribed time interval.
Instrumentation, controls, sensors, and alams have been provided to enable the control room operator to monitor the diesel generator cooling while the unit is t
in the standby mode or in operation. However, the applicant was requested to discuss the testing and frequency of testing necessary to i
maintain _and assure a highly reliable instrumentation, controls, sensors, and alam system. He was also requested to describe what operator actions are required during alam conditions to prevent harmful effects to the diesel engine. He has not provided this requested information.
The function of the diesel generator cooling water system is to dissipate the heat transferred through the: 1) engine water jacket,
- 2) lube oil cooler, 3) engine air water coolers, and 4) governor lube i
oil cooler. The applicant was requested to provide information on the i
individual component heat removal rates (btu /hr), flow (1bs/hr) and
~
'., temperature differential ('F) and the total heat removal capacity included in the design of major components and subsystems so that the staff can verify the adequacy of the design. The applicant has not submitted all of the requested information for the staff's evaluation.
In addition proper operation of the standby diesel generator during accident and transient conditions requires that heat removal capability be restored before the diesel engine exceeds its operating design temperature limits.
In Section 9.5.5.2 of the FSAR the applicant stated that "the motor-operated service water inlet valves on the standby diesel generator cooling system heat exchangers are opened on a safety injection signal or diesel generator running signal, but he did not state the time period between engine start and valve opening. The applicant was requested to provide the following:
a.
The time interval between the diesel engine start and the opening of service water inlet valve or service water pump restart (assuming loss of offsite power) whichever is longer.
b.
Results of an analysis which shows that cooling will be restored to the diesel engine before it overheats.
The applicant in Amendment 4 of the FSAR has stated when the power will be restored to the valves and service water pumps, and valve opening time. These times are 14 seconds,18 seconds and 74 seconds respectively after the diesel start signal. The applicant has not l
l
o provided sufficient information to show that the engine will not overheat, before the cooling water is restored.
There are two emergency diesel generators for Beaver Valley Unit 2 and, each diesel generator has a physically separate independent cooling water system.
Therefore, the requirements of GDC 17 and 44 as related to redundancy and single failure criterion are met.
The diesel engine cooling water system piping and components up to the diesel engine interface, including auxiliary skid-mounted piping, are designed to seismic Category I, ASME Section III, Class 3 (Quality Group C) requirements and meet the recommendations of RGs 1.26 and 1.29.
The i
engine-mounted piping and components, from the engine block to the engine interface, are considered part of the engine assembly and are seismically qualified to seismic Category I requirements as part of the diesel engine package. This piping and the associated components--such as valves, fabricated headers, fabricated special fittings, and the like--have not been defined by the applicant. The applicant has been requested to provide the industry standards to which the engine-mounted piping and components are designed.
J The diesel engine cooling water system conforum with RG 1.9, position C.7, as it relates to engine cooling water protective interlocks. The diesel generatcr system protective interlocks are discussed in Section 8.3 of this report.
]
J
!l l
The diesel engine cooling water system has provisions to permit periodic inspection and functional testing during standby and normal modes of power plant operation as required by GDC 45 and 46.
f i
In addition the applicant was requested to provide additional l
information for the following concerns:
(1) Operating experience indicates that diesel engines have failed to start on demand due to water spraying on locally mounted electronic / electrical components in the diesel engine starting system. The applicant was requested to describe what measures have been incorporated in the diesel engine electrical starting system to protect such electronic / electrical components from such potential environment. The applicant's response did not address the concern.
(2) The applicant stated in Section 9.5.5.2 of the FSAR that the diesel -
engine cooling water is treated as appropriate to minimize corrosion. He was requested to provide additional details of the proposed diesel engine cooling water system chemical treatment with l
regards to precluding organic fouling and discuss how the proposed treatment complies with the engine manufacturer's reconsnendations.
j The applicant has not adequately addressed how his chemical treatment program precludes organic fouling.
(3) Recent licensee event reports have shown that tube leaks are being experienced in the heat exchangers of diesel engine jacket cooling
water systems with resultant engine failure to start on demand.
The applicant was requested to provide a discussion of the means used to detect tube leakage and the corrective measures that will be taken. The discussion was to include jacket water leakage into the lube oil system (standby mode), lube oil leakage in-t'o the jacket water (operating mode), jacket water leakage into the engine air intake and governor system (operating or standby mode). He was also requested to provide the permissable inleakage or outleakage in each of the above conditions which can be tolerated without degrading engine performance or causing engine failure. The discussion was to include the effects of Jacket water / service water systems leakage. The applicant has not provided this infonnation.
The scope of the review of the emergency diesel engine cooling water system included layout drawings, piping and instrumentation diagrams, and descriptive information in FSAR Section 9.5.5 for the system and the auxiliary support systems essential to its operation.
l The bases for the acceptance in the staff review were (1) conformance of the design criteria and bases and design of the diesel engine cooling water system to GDC 17 and 44 with respect to redundancy and physical independence, to GDC 45 and 46 with respect to inspection and testability of the system, to the guidance of the cited regulatory guides, and to the recomendations of NUREG/CR- 0660 and industry codes and standards, and (2) the ability of the system to maintain stable diesel engine cooling water temperature under all load conditions.
_ Based on its review, the staff concludes that the emergency diesel engine cooling water system meets the requirements of GDC 2, 5, 17, 44, 45, and 46 and meets the recomendations of NUREG/CR-0660.
It does not meet the requirements of GDC 4 as noted in Section 9.5.4.1; the guidance of the cited regulatory guides and SRP 9.5.5; and industry codes and standards, thus, it cannot perform its design function and is, therefore, unacceptable. After receipt of the requested additional infomation the staff will report its findings in a supplement to this SER.
9.5.6 Emergency Diesel Engine Starting System The design function of the emergency diesel engine starting system is to l
provide a reliable method for automatically starting each diesel I
generator so that the rated frequency and voltage are achieved and the unit is ready to accept required loads within 10 seconds. The system is designed to meet the requirements of GDC 2, 4, 5, and 17. The meeting of the requirements of GDC 2, 4, and 5 is discussed in Section 9.5.4.1 of this SER.
There are two emergency diesel generators for Beaver Valley Unit 2.
Each diesel generator has an independent and redundant air starting system consisting of two separate full-capacity air starting subsystems, l
each with sufficient air capacity to provide a minimum of five H
consecutive cold engine starts. The applicant was requested to clarify the statement regarding the capability of the air start system of five starting cycles without recharging the air receivers. A successful I
diesel generator start is defined as the ability of the air start system I
)
l
. to crank the diesel engine to the manufacturer's recorrnended RPM, to enable the generator to reach voltage, frequency and begin load sequencing in 10 seconds or less. Assuming the receiver at the low pressure alam setpoint and without recharging, the applicant was requested to provide a tabulation of receiver pressure and diesel engine starting times for each of the five consecutive starts.
In addition, 1
1 the applicant was requested to describe the sequence of events when an emergency start signal exists, and to state whether the diesel engine cranks until all compressed air is exhausted, or cranking stops after a preset time to conserve the diesel starting air supply.
He was also requested to describe the electrical features (including interlocks) of this system. The applicant has not provided the requested infomation.
Therefore, the staff cannot evaluate the adequacy of the air start system to perfom its intended function.
Redundancy in the starting system is provided by two emergency diesel generators so that a malfunction or failure in one system does not impair the ability of the other system to start its diesel engine. The dinal generator air start systems for both safety related emergency diesel generators are connected by a nonsafety-related cross-connect with proper isolation valves pn' 4ed. The diesel generator air compressor cross-connect st%s,.hich are nomally closed, permit the supply air compressor from one emergency diesel generator to be used to restore air pressure in the second emergency diesel generator air starting system air receiver tanks. The air receivers between the two emergency diesel generator trains are prevented from being cross-connected due to check valves in the inlet lines; only the air i
I l
- *[ compressor discharge can be cross-connected. When both compressors for.
l the same train are inoperable, a compressor form the other train will be used to supply air pressure as required. The cross-connect valves will be controlled by existing BVPS-2 administrative procedures. The applicant was requested to describe the procedures, administrative controls, and limiting conditions of operation that will govern the use J
of this cross-connect during the above stated conditions, as well as consider the effect of the use of the cross-connect has on the control 3
n air system discussed later in this section. The applicant has not provided sufficient infomation to evaluate this aspect of the air i
starting system. Therefore, the staff cannot conclude that the-independence requirement of GDC 17 is being met.
The air starting system for each diesel includes two air compressors, two receiver tanks, intake air filters, injection lines and valves, air-to-cylinder control and starting valves, a control air tank, i
f instrumentation, controls, alams, and the associated piping to connect i
the equipment.
Alarms annunciate on the local panel and in the main control room to enable the operator to monitor the air pressure of the diesel generator starting air system. Automatic controls are provided to automatically l t start and stop each air compressor when the pressure in its respective air receivers decreases or increases to predetemined levels. The applicant has not provided the requested setpoints for the compressor cut-in and cut-out pressures as well as the high pressure, low pressure l
and low-low pressure alam setpoints.
In addition, the applicant was t
?
a 2
requested to describe the testing necessary to maintain a highly reliable instrumentation, control, sensors and alarm system and where the alams are annunciated and describe any operator actions required during alam conditions to prevent hamful effects to the diesel engine.
)
The applicant has not provided this information.
l The diesel engine air starting system piping and components from the air compressor up to the diesel engine interface, including auxiliary skid-mounted piping, are designed to seismic Category I, ASME Section III, Class 3, (Quality Group C) requirements and meet the reconunendations of RGs 1.26 and 1.29.
The engine-mounted piping and l
components, from the engine block to the engine interface, are considered part of the engine assembly and are seismically qualified to seismic Category I requirements as part of the diesel engine package.
This piping and the associated components--such as valves, fabricated I
headers, fabricated special fittings, and the like--have not been defined by the applicant.
The diesel generator air starting system is a high-energy system (design pressure 450 psig). The applicant has not provided a discussion on the necessity of a high pressure air start system, nor a high-energy line break analysis for the air starting system. He had been asked to provide such a discussion and an analysis. In addition, consnensurate with the safety function performed by the system, the staff requires the L
following:
I f
(1) All air starting engine-mounted piping and components that are pressurized to high-energy pressures (275 psig or greater) during standby, starting, and/or operation will be designed seismic Category I, ASME Code,Section III, Class 3 (Quality Group C).
1 (2) All high energy air starting piping will be adeouately restrainted to prevent damage to other diesel generator piping, components, and equipment from pipe whip. Note: Seismic restraints and seismic supports may not be adequate as pipe whip restraints.
The diesel generator air starting system conforms with RG 1.9, position C.7, as it relates to diesel engine air starting system protective interlocks. The diesel generator system protective interlocks are discussed in Section 8.3 of this report.
The present air start system design does not include air dryers as reconnended by NUREG/CR-0660. The air starting system provided for the diesel generators relies on periodic blowdown of the air receivers for the removal of entrained oil and excess water from the starting air.
Operating experience has shown that accumulation of water in the starting air system has been one of the most frequent caused of diesel engine failure to start on demand. NUREG/CR-0660 has shown that this problem can occur in diesel engines with air start motors as well as air-over-piston started diesel engines. Thus, to assure maximum availability of this equipment, we require that engine starting air for all types of diesel engines be dried. Air in the air receivers is saturated to the system air pressure and temperature. Air flow from
l
. this point accompanied with reduction in system pressure and/or temperature will result in water condensation. Since periodic blowdown of the air receivers will not provide dry diesel engine starting air, we require that air dryers be installed upstream of the air receivers prior to start-up.
In addition we require that a monthly verification and/or maintenance program be established and placed in the plant operating procedures to verify air dryer performance. The above issue will be pursued with the applicant.
The air starting system also provides control air to the diesel engine fuel rack, cooling water system three-way valves, and for other functions. The applicant was requested to provide the following on the control air system:
)
(a) Discuss any diesel engine control functions supplied by the air starting system. The discussion should include the mode of operation for the control function (air pressure and/or flow), a failure modes and effects analysis, and the necessary P&ID's to evaluate the system. The applicant has provided this information.
(b) Since air systems are not completely air tight, there is a potential for slight leakage from the system. The air starting system uses a non-seismic air compressor to maintain air pressure in the seismic Category I air receivers during the standby condition.
In case of an accident, a seismic event, and/or loop, the air in the air receivers is used to start the diesel engine.
After the engine is starting, the air starting system becomes m
. i nonessential to diesel generator operation unless the air system supplies air to the engine controls.
In this case the controls must rely on the air stored in the air receivers, since the air i
compressor may not be available to maintain system pressure and/or fl ow. The applicant was reouested to show that with the compressor not available a sufficient quantity of air will remain in the air receivers, following a diesel engine start, to control engine operations for a minimum of seven days assuming a reasonable leakage rate or that upon loss of air pressure, the contrcls, valves, etc., go to the fail-safe position and do not degrade or prevent the engine from operating and carrying load. The applicant has not provided sufficient infonnation to evaluate this aspect of the design.
Operating experience at two nuclear power plants has shovm that during periodic surveillance testing of a standby diesel generator, initiation of an emergency start signal (LOCA or LOOP) resulted in the diesel failing to start and perfona its function due to depletion of the starting air supply from repeated activation of the starting relay.
This event occurred as the result of inadequate procedures and from a hang-up in engine starting and control circuit logic failing to address a built-in time delay relay to assure the engine comes to a complete stop before attempting a restart. During the period that the relay was timing out fuel to tha engine was blocked while the starting air was uninhibited. This condition with repeated start attempts depleted starting air and rendered the diesel generator unavailable until the air system could be repressurized. This is an unacceptable operating
e condition. The applicant was asked to review his procedures and/or control system logic to assure that this event will not occur at Beaver Valley Unit 2.
Since this request was issued late in the review process, he has not had time to fully evaluate his system. We will pursue this item with the applicant.
The scope of review of the emergency diesel engine starting system included layout drawings, piping and instrumentation diagrams, and descriptive information in FSAR Section 9.5.6 for the system and auxiliary support systems essential to its operation.
The bases for acceptance in the staff review were (1) conformance of the design criteria and bases and design of the diesel engine air starting system to the reconar,endations of NUREG/CR-0660, and industry codes and standards, and (2) the ability of the system to start the diesel generator within a specified time period.
Based on its review, the staff concludes that the emergency diesel engine air starting system meets the requirements of GDC 2 and 5.
The system does not meet the requirements of GDC 4 and 17 as noted above and in Section 9.5.4.1, the guidance of the cited regulatory guides and SRP 9.5.6. the recommendations of NUREG/CR-0660, and industry codes and standards, thus it cannot perform its design safety function and is therefore unacceptable. After receipt of the requested additional infonnation, the staff will report its findings in a supplement to this SER.
. [
9.5.7 Emergency Diesel Engine Lubricating Oil System The design safety function of the emergency diesel engine lubricating oil system is to provide a supply of filtered lubrication oil to the various moving parts of the diesel engine including piston and bearings.
The system is designed to meet the requirements of GDC 2, 4, 5, and 17.
The meeting of the requirements of GDC 2, 4, and 5 is discussed in Section 9.5.4.1 of this SER.
Major components of the emergency diesel engine lubricating oil system include an engine-driven lube oil pump; an engine-driven rocker am lube oil pump; a motor-driven keep wam and prelube pump; a motor-driven rocker arm prelube pump; a lube oil collection sump, strainers, and filters; a lube oil cooler; an electric heater and themostatic three-way valve; instrumentation, controls and alarms; and associated piping and valves to connect the equipment. The diesel engine is equipped with relief (blow-out) ports, as well as a crankcase exhaust system composed of a crankcase vacuum pump, oil separator, and the necessary piping to the outside of the diesel generator building. This system provides protection from crankcase explosion. Alams and protective devices are provided to alert the control room operator to abnormal conditions in the diesel generator lube oil system's during standby, startup, or operating status. The applicant was requested to describe the testing and frequency of testing necessary to maintain a highly reliable instrumentation, control, sensors and alam system, as well as describe any operator action required during alam conditions to prevent hamful effects to the diesel engine. The applicant has not provided the required infomation.
,. l l
The emergency diesel engine lubrication oil system is an integral part of the diesel engine and thus meets the requirements of GDC 17 with regard to system independence and single failure criterion. The engine heat is rejected to the diesel engine jacket water system. The applicant was requested to discuss the capability for detection and i
control of system leakage and the frequency it will be checked. The j
applicant, as stated in Section 9.5.5 of this report, has not provided the requested information with regards to cooling water / lube oil system i
leakage.
The diesel engine lubrication system is composed of two subsystems:
the main engine lube oil system and the rocker ann lube oil system. During engine operation or when the engine is on standby, the main engine lube oil system supplies oil to all main bearings, the camshaft bearings, cam followers, engine wearing parts, and turbocharger. The prelubrication portion of this system is operated when the engine is on standby, at which time the lube oil is heated by an electric heater and circulated through the engine continuously by an ac motor-driven pump to improve the first-try starting reliability. The system has alarms to indicate heater failure, j
During engine operation, the rocker arm lube oil system supplies oil to the rocker am assemblies. The prelube portion of this system is operated manually to prelubricate the engine once a month prior to the periodic test. This is unacceptable. An emergency diesel generator unit in a nuclear power plant is nonnally in the ready standby mode unless there is a loss of offsite power, an accident, or the diesel
., - +
generator is under test.
Long periods on standby have a tendency to drain or'nearly empty the engine rocker ann lube oil piping system. On an emergency start of the engine as much as 5 to 14 or more seconds may elapse from the start of cranking until full lube oil pressure is attained even though full engine speed is generally reached in about five seconds. With an dssentially dry engine, the momentary lack of lubrication at the various moving parts may damage bearing surfaces producing incipient or actual component failure with resultant equipment unavailability.
The emergency condition of readiness requires this equipment to attain full rated speed and enable automatic sequencing of electric load within ten' seconds. For this reason, and to improve upon the availability of this equipment on demand, it is necessary to establish as quickly as possible an oil film in the wearing parts of the diesel engine.
Lubricating oil is delivered to the rocker am wearing parts by an engine driven pump. During the staring cycle the pump accelerates l
slowly with the engine and may not supply the required quantity of lubricating oil where.needed fast enough. To remedy this condition for the rocker arm assembly lubrication system, as a minimum, the staff requires an electrically driven lubricating oil pump, powered from a 3
reliable de power supply shall be installed, prior to startup, in the i.
I rocker am lube oil system to operate in parallel with the engine driven rocker am lube pump. The electric driven prelube pump should operate only during the engine cranking cycle or until satisfactory lube oil l
pressure is established in the engine rocker am lube distribution header. The installation of this prelube pump should be coordinated i
- ~ - - ~ - ~ ~ ~
' ~-~~- ~
with the respective engine manufacturer. Alternate means of rocker ann assembly lubrication, during an emergency staring cycle, may be proposed as recommended by the engine manufacturer.
Section 9.5.7.1 of the FSAR states that the temperature of the lubricating oil is automatically maintained above a minimum value by means of an independent recirculation loop including its own purp and heater, to enhance "first try" starting reliability of the engine in the standby condition." The rocker arm lubrication system is an independent subsystem of the diesel lube oil system which is connected to the main system by a float valve in the rocker am oil reservoir; thus the lube oil in the rocker ann lubrication system will never be preheated unless the oil level is low enough to open the float valve.
The applicant was requested to discuss the means that have been provided to preheat the rocker arm lubricating oil. The applicant has not provided sufficient j
information to evaluate this aspect of the design.
I The diesel engine lubrication oil system piping and components up to the diesel engine interface, including auxiliary skid-mounted piping, are designed to seismic Category I, requirements and meet the reconsnendations of RGs 1.26 and 1.29. The engine-mounted piping and components, from the engine block to the engine interface, are considered part of the engine assembly and are seismically qualified to i
seismic Category I requirements as part of the diesel engine package.
The engine-mounted lube oil system and crankcase vacuum system piping and associated components--such as valves, fabricated headers, fabricated special fittings, and the like--have not been defined by the
+
l applicant. The applicant has been requested to provide the industry standards to which the engine-mounted lube oil system and crankcase l
vacuum system piping and components are designed.
In addition, we require the seismic classification of the crankcase vacuum system. The applicant has not provided this infonnation.
The diesel generator lubricating oil system conforms with RG 1.9,
)
a position C.7, as it relates to diesel engine lubrication system l
protective. interlocks. The diesel generator system protective i
interlocks are discussed in Section 8.3 of this report.
i Section 9.5.7 and Figure 9.5.11 of the FSAR does not give an adequate representation of the lube oil system.
Very few valves and pipe on the i
figure sizes are shown. As an example, a number of lines from the lube I
oil heat exchanger, oil filter and oil strainers lead directly back to the lube oil sump, leading to the conclusion that engine may not be adequately lubricated due to the oil being diverted to the sump. The applicant was requested to provide a detail description (including j
instrumentation) of the lube oil flow paths as well as a more detailed P&ID of the lube oil system showing pipe sizes, valves, instrument locations, and quality group classification and seismic boundaries. The applicant has not provided this information.
The lube oil used to lubricate the engine is stored in a lube oil sump.
During diesel engine operation a certain amount of lube oil is consumed as part of the combustion process. Since the diesel generator may be
(
required to operate for a minimi:a seven days during a loss of offsite i
power or accident condition, sufficient lube oil should be stored the sump and/or site to preclude diesel generator unavailability due to lack of lube oil. The applicant was requested to provide the following:
(a) Provide the normal lube oil usage rate for cach diesel engine under full load conditions. Also provide the lube oil usage rates which would be considered excessive, and the sump capacity.
(b) Show with the lube oil in the sump at the minimum recomended level (lube oil sump low level alam setting) that the diesel engine can operate without refilling the lube oil sump for a minimum of seven days at full rated load.
If the sump tank capacity is insufficient for this condition, show that adequate lube oil will be stored onsite for each engine to assure seven days of operation at rated load.
(c)
If the lube oil consumption rate becomes excessive, discuss the provisions for determining when to overhaul the engine. The discussion should include the procedures used and the quality of operator training provided to enable determination of excessive L.O. consumption rate.
The applicant has not provided the requested infortnation.
Providing seven days supply of lubricating oil for the diesel generator only addresses part of the concern. The staff also assumes an unlikely event has occurred requiring the operation of the diesel generator for a
i prolonged period that would require replenishment of lube oil without interrupting operation of the diesel generator. The applicant was requested to provide the following:
(a) What provisions will be made in the design of the lube oil system to add lube oil to the sump. These provisions shall include procedures or instructions available to the operator on the proper addition of lube oil to the diesel generator as follows:
1.
How and where lube oil can be added while the equipment is in operation.
2.
Particular assurance that the wrong kind of oil is not inadvertently added to the lubricating oil system, and 3.
That the expected rise in level occurs and is verified for each unit of lube oil added.
(b) Verification that these operating procedures or instructions will be posted locally in the diesel generator rooms.
(c) Verification that personnel responsible for the operation and maintenance of the diesel are trained in the use of these procedures.
Verification of the ability of the personnel on the use of the procedures shall be demonstrated during preoperational tests and during operator requalification.
. (d) Verification that the color coded, or otherwise marked, lines associated with the diesel-generator are correctly identified and that the line or point for adding lube oil (when the engine is on standby or in operation) has been clearly identified.
(e) What measures have been taken to prevent entry of deliterious materials into the engine lubrication oil system due to operator error during recharging' of lubricating oil or normal operation.
The applicant has not provided sufficient information to evaluate this aspect of the D/G lube oil system design.
The applicant discussed the availability of diesel fuel oil from local distribution sources in Section 9.5.4 of the FSAR, but he did not discuss the availability of lube oil in the FSAR. The applicant was requested to identify the sources where diesel quality lube oil will be available and the distances required to be travelled from the source (s) to the plant, as well as discuss how the lube oil will be delivered onsite under extremely unfavorable environmental conditions. His response provided insufficient infomation to evaluate this concern.
Section 9.5.7.5 of the FSAR discusses the level alarms associated with the lube oil system.
It is stated that the rocker am lube oil reservoir level is monitored for high level and the level is maintained by a level control valve. No mention is made of a reservoir low level alam. A failure of the level control valve to maintain lube oil level in the rocker am reservoir could result in inadequate or no lubricating
~
, oil for the rocker ams, leading to diesel generator unavailability and/or failure. This is an unacceptable condition. The applicant was requested to justify his design or to provide a low level alam for the rocker am lube oil reservoir. He has not provided sufficient infomation to complete our evaluation of this concern.
The scope of review of the diesel generator lubricating oil system included piping and instrumentation diagrams and descriptive information in FSAR Sections 9.5.7 and 9.5.8 for the system and auxiliary support systems essential to its operation.
The basis for acceptance in the staff review was confomance of the design criteria and bases and design of the diesel engine lubricating oil system to the requirements of GDC 17 with respect to redundancy and physical independence, to the guidance and additional acceptance criteria of SRP 9.5.7, to the recomendations of NUREG/CR-0660, and to industry codes and standards.
Based on its review, the staff concludes that, the emergency diesel engine lubricating oil system meets the requirements of GDC 2, 5, and 17.
It does not meet the requirements of GDC 4, as noted in Section 9.5.4.1, the guidance of the cited RGs'and SRP 9.5.7, and the recomendations of NUREG/CR-0660 and industry codes and standards, thus it cannot perfom its design safety function and is, therefore, unacceptable. After receipt of the requested additional information, the staff will report its findings in a supplement to this SER.
t
. {
t 9.5.8 Emergency Diesel Engine Combustier Air Intake and Exhaust System i
f The design function of the emergency diesel engine combustion air intake and exhaust system is to supply filtered air for combustion to the engine and to dispose of the engine exhaust to atmosphere. The system is designed to meet the requirements of GDC 2, 4, 5, and 17. The l
meeting of the requirements of GDC 2, 4, and 5 is discussed in Section j
9.5.4.1 of this SER.
l i
l A separate source of combustion air for each diesel engine is taken from the common tornado missile protected diesel generator air intake structure through an air filter, turbocharger compressor, and combustion air coolers. The path of the exhaust gas discharge is through the l
turbocharger, exhaust silencer, and exhaust ducting to the outside of the building. This meets the requirements of GDC 17 with regard to system independence, redundancy, and single failure criterion.
t' The location of the air intake and exhaust structures meets the j
NUREG/CR-0660 guidelines and the design precludes their being clogged or obstructed during standby or in operation by heavy rain, freezing rain, dust stoms, ice and snow. The air intake is also protected from drifting snow, however, the exhaust structure has not been shown to be f
adequately protected from blockage due to snow drifts. This is unacceptable.
The applicant has not demonstrated that the function of the diesel engine air intake and exhaust system design will not be degraded to an
extent which prevents developing full engine rated power or cause engine shutdown as a consequence of any accident condition, on the performance of the diesel generator, such as the potential and effect of fire extinguishing (gaseous) medium, recirculation of diesel combustion products, or other gases including products of combustion due to a fire that may intentionally or accidentally be released on site.
In addition, the applicant has not fully analyzed and shown that a potential fire in the diesel generator building together with a single failure of the fire protection system will not degrade the quality of the diesel combustion air so that the remaining diesel will be able to provide full rated power.
Figure 1.2-2 of the FSAR shows system station service transfomer 2A located near the diesel generator building. A transformer fire with the right meteorological conditions could degrade engine operation by the products of combustion being drawn into the D/G ventilation system and D/G combustion air intake system. The same conditions apply for the oil storage laydown area and oil separator No. 22, located in the immediate area of the diesel generator building. The applicant was requested to discusstheprovisionsofthedesign(sitecharacteristics, ventilation system and building design, etc) which would preclude this event from occurring. He has not provided this information.
The diesel generator combustion air intake and exhaust system confoms with RG 1.9, position C 7, as it relates to diesel engine combustion air intake and exhaust system protective interlocks. The diesel generator
. q l
system protective interlocks are discussed in Section 8.3 of this report. Section 9.5.8.5 of the FSAR describes the instrumentation, controls, sensors and alarms provided in the design of the diesel engine I
combustion air intake and exhaust system and their function which alert l
the operator when parar.eters exceed ranges recommended by the engine manufacturer. However, the applicant was requested to discuss the testing and frequency of testing necessary to maintain and assure a highly reliable instrumentation, controls, sensors, and alann system and where the alarms are annunciated, and describe any operator action required during alarm conditions to prevent harmful effects to the diesel engine. The applicant has not provided this information.
The diesel engine combustion air intake and exhaust system piping and components up to the diesel engine interface, are designed to seismic Category I requirements, and meet the recocinendations of RG 1.29.
The engine-mounted piping and components, from the engine block to the engine interface, are considered part of the engine assembly and are seismically qualified to seismic Category I requirements as part of the diesel engine package.
The combustion air intake and exhaust piping and associated components--such as fabricated headers, fabricated special fittings, and the like--up to the engine interface are designed, to ASME Code Section III, Class 3 (Quality Group C) requirements and meet the recomendations of R.G. 1.26. The engine mounted combustion air intake and exhaust piping and the associated components have not been defined by the applicant. The applicant has been requested to provide the industry
. 4 standards to which the engine mounted piping and components are designed.
Section 8.3 of the FSAR states that in the event of a loss of offsite power (LOOP), the diesel generator room ventilation system must be manual reconnected to the bus. The diesel generator room ventilation system provides cooling to the diesel generator and its auxiliary equipment during diesel generator operation. Failure to restore the ventilation system to operating condition within a reasonable amount of time will result in diesel generator room temperatures exceeding the 120*F design ambient temperature specified in Section 9.5.4 of the FSAR.
The applicant in a response to the staff's request for information on this aspect of their design stated that " operation of the primary and secondary supply fans, normal exnaust fans and associated motorized dampers is maintained during loss of nonnal station power by automatic connection to the emergency buses." However, Table 8.3-3 " Emergency Diesel Generator Loading" of the FSAR only shows the supply fans and heaters being connected to the buses and not the other equipmer.t. We have discussed this cencern and discrepancy with the applicant and he is evaluating his design. We will pursue this item with the applicant.
The scope of review of the diesel generator intake and exhaust system included layout drawings, piping and instrumentation diagrams, and descripth e information in FSAR Section 9.5.8 for the system and auxiliary support systems essential to its operation.
The bases for the acceptance in the staff review was conformance of the design criteria and design of the diesel engine air intake and exhaust system to GDC 17 with respect to redundancy and physical independence, to the guidance of the cited RGs, to the guidance and additional acceptance criteria of SRP 9.5.8, to the recommendations of NUREG/CR-0660, and to industry codes and standards and the ability of the system to provide sufficient combustion air and release of exhaust gases to enable the emergency diesel generator to perform on demand.
Based on its review, the staff concludes that, the emergency diesel engine intake and exhaur'. system meets the requirements of GDC 2, 5 and 17 and meets the requirements of NUREG/CR-0660.
It does not meet the requirements of GDC 4 as noted above and in Section 9.5.4.1; the guidance of the cited RGs and SRP 9.5.8, and industry codes and standards, thus, it cannot perform its design safety function and is, therefore, unacceptable. Upon receipt of the requested additional information, the staff will report its findings in a supplement to this SER.
-_~
9 10.0 STEAM AND POWER CONVERSION SYSTEM 10.0 Summary Description The steam and power conversion system is designed to remove heat energy from the primary reactor coolant loop via three steam generators and to generate electrical power in the turbine-generator. After the stean passes through the high and low pressure turbines, the main condensers deaerate the condensate and transfer the rejected heat to the closed cycle circulating water system which uses cooling towers to dissipate the rejected heat. The condensate is reheated and returned as feedwater to the steam generator. The entire system is designed for the maximum expected energy from the nuclear steam supply system.
A turbine steam dump (bypass) system is provided to discharge directly to the condenser up to 90% of the main steam flow around the turbine during transient conditions. This bypass capacity together with a 10%
reactor automatic step load reduction capability is sufficient to withstand a 100% generator load loss without tripping the turbine or lif ting the main steam safety valves or tripping the reactor.
10.2 Turbine Generator The turbine-generator converts steam power into electrical power and has a turbine control and overspeed protection system. The design function of the turbine control and overspeed protection system is to control turbine action under all normal or abnormal conditions, to assure that a full load turbine trip will not cause the turbine to overspeed beyond l
L
i t
t acceptable limits, and to minimize the probability of generation of turbine missiles in accordance with the requirements of GDC 4,
" Environmental and Missile Design Bases." The turbine control system and overspeed protection system is, therefore, essential to the overall l
safe operation of the plant.
l The turbine-generator is manufactured by the Westinghouse Electric Corporation and is a tandum-compound type (single shaft) with one double-flow high pressure turbine and two double-flow low pressure turbines. The rotational speed is 1800 rpm and is designed for a gross generator output of 888 MWe at a nominal plant exhaust pressure of 2.0 l
inches mercury (absolute).
l l
The turbine-generator is equipped with an analog type electrohydraulic l
l control (EHC) system. The EHC system consists of an electronic governor using solid state control techniques in combination with a high pressure
[
hydraulic actuating system. The system includes electrical control O
circuits for, speed control, load control and steam control valve positioning.
Overspeed protection is accomplished by three independent systems, i.e.,
l normal speed governor, mechanical overspeed, and electric backup overspeed control systems. The normal speed governor modulates the turbine control valves to maintain desired speed load characteristics and it will start to close the intercept valves and control valves at L
103 percent of rated speed. The mechanical overspeed sensor trips the turbine stop, control, and combined intermediate valves by deenergizing r
\\
l
, p the hydraulic fluid systems when 111 percent of rated speed is reached.
Af ter an overspeed condition is detected, the turbine steam valves' closure times are as follows: main steam throttle valve - 150 milliseconds and, reheat stop valve, 150 milliseconds. The applicant has not provided the closure times for the main steam governor valve, reheat intercept valve, and extraction steam valves. After an overspeed condition is detected, these valves are designed to fail closed on loss of hydraulic system pressures. The electrical backup overspeed sensor will trip these same valves when 111 percent of rated speed is reached by independently deenergizing the hydraulic fluid system. Both of these actions independently trip the energizing trip fluid system. The overspeed trip systems can be tested while the unit is on-line. Because of the lack of information on valve closure times, the staff cannot conclude that the requirements of GDC 4 are met.
P In order to protect the turbine-generator, the following signals will shutdown the turbine:
(1) manual emergency trip, (2) low bearing lubricating oil pressure, (3) low condenser vacuum, (4) feedwater isolaticn, (5) turbine anti-motoring, (6) loss of 110 V de electrical power to EHC system, (7) low hydraulic fluid pressure, (8) generator electric trip, (9) reactor trip, (10) excessive thrust bearing wear, and (11) turbine overspeed at 111 percent of rated speed.
c The applicant proposed in Amendment 6 of the FSAR the following inservice inspection program for the turbine main steam throttle, governor, reheat stop and interceptor valves:
(
I
=
1.
Exercising and observing at least once a month the main steam throttle, control, reheat stop and interceptor valves.
2.
During the first 39 months of operation following initial start-up of the turbine the main steam throttle, control, reheat stop and interceptor valves will be inspected in accordance with the vendor recomendation of 15, 27 and 39 months respectively.
In this s
program some valves are dismantled and inspected 12 to 15 months after startup, others 24 to 27 months and the balance 36-39 months so that all valves are inspected at least once in the 39 month period except for the throttle and reheat stop valves which are inspected twice during the first 39 months of plant operation.
3.
After the initial 39 month inspection program is completed all the turbine valves will be dismantled cnd inspected periodically in accordance with the manufacturer's recomendations.
4.
The mechanical and back-up overspeed trip tests are perfonned periodically while carrying load without tripping the unit by using special test provisions.
We find the above inservice inspection program acceptable except as follows:
The applicant has not provided, (1) justification for the change from weekly valve testing, as specified in SRP 10.2 and the Standard Technical Specifications, to monthly valve exercising, (2) the frequency
of valve inspection following the initial 39 month inspection interval of the valves including a description of this program, (3) proposed changes to the plant technical specifications, and (4) the frequency of the mechanical and back-up overspeed trip tests and description of the special test provisions which allcw testing while carrying load and without tripping the unit. Therefore, we will require the applicant provide, (1) justification for changing the periodic turbine valve testing program from weekly to monthly, (2) a copy of the plant technical specifications marked to show the intended changes, (3) confirmation from Westinghouse that the turbine generator valves (turbinestop,controlinterceptandextractionsteamvalves)atBeaver Valley can be periodically tested on a monthly basis, and (4) a description of the proposed periodic dismantling and inspection program for all turbine valves following the initial 39 month inspection program to be included in the plant technical specification.
In addition we also require that the applicant describe (1) the inservice inspection program for the mechanical and back-up overspeed trips, the frequency of testing and the special provisions that allow testing while carrying load without tripping the unit, and (2) the inservice inspection program for the extraction steam valves. The inspection of the extraction steam valves is neerled to insure that the check valve closing mechanism travels in the closing direction in a free i
and positive manner. This is to alleviate the concern of a turbine overspeed due to back flow of steam from extraction feedwater heaters.
1 I
n.
~
. The applicant will include preoperational and startup tests of the turbine generator in accordance with Regulatory Guide 1.68, " Initial Test Programs for Water Cooled Power Plants." The adequacy of the test program is evaluated in Section 14 of this report.
The applicant has not addressed how the turbine generator system meets the reconnendations of Branch Technical Positions ASB 3-1, " Protection Against Postulated Piping Failures in Fluid Systems Outside Containment" and MEB 3-1, " Postulated Break and Leakage Locations in Fluid Systems Outside Containment," with regards to protection of the turbine overspeed protection system from the dynamic effects associated with postulated piping system failures.
Evaluation of protection against dynamic effects associated with the postulated pipe system failure is covered in Section 3.6 of this report.
The scope of review of the turbine generator included descriptive infomation in Section 10.2 of the FSAR, flow charts and diagrams. The basis for acceptance in our review was conformance of the design criteria and bases and design of the turbine-generator system to GDC 4 with respect to the prevention of the generation of turbine missiles, the additional guidance of Standard Review Plan 10.2 and industry codes and standards.
Based on our review of the infomation provided, we conclude that the turbine generator overspeed protection system does not meet the requirements of GDC 4, the guidance of Standard Review Plan 10.2, it cannot perform its designed safety functions, and is therefore
o unacceptable. Upon receipt of the requested additional information, the i
staff will report its findings in a supplement to this SER.
10.3 Main Steam Supply System The function of the main steam supply system is to convey steam from the steam generators to the high pressure turbine and other auxiliary equipment for power generation. Section 10.3.1 evaluates the safety-related portion of the main steam system including the main steam isolation valves (MSIVS). Section 10.3.2 evaluates the nonsafety related portion of the main steam system downstream of the main steam isolation valves (MSIVS) up to and including the turbine stop valves.
l 10.3.2 Main Steam Supply System (Downstrean of Main Steam Isolation Valves)
This portion of the main steam system is not required to effect or support safe shutdown of the reactor except as noted below.
The main steam system is designed to deliver steam from the steam generators to the high-pressure turbine. The main steam and turbine steam systems provide steam to the auxiliary feedwater pump turbine, auxiliary steam system, turbine gland seal systems, turbine steam bypass system, and steam supply to the moisture separator reheaters.
The main steam system from the MSIV up to the first anchor is designed seismic Category I.
The piping from the MSIV up to the turbine stop valves and all branch lines are designed to the requirements of ANSI B31.1 and are acceptable.
0
8 l
The applicant states in Section 10.3.1 of the FSAR that the main steam system is designed in accordance with Technical Issue No. 1 of NUREG-0138 " Staff Discussion of Fifteen Technical Issues Listed in Attachment to November 3, 1976, Memorandum from Director NRR to NRR Staff," and that credit is being taken for all valves downstream of the HSIV's to limit blowdown of a second steam generator in the event of a steam line break upstream of the HSIV's. Sufficient descriptive information was not provided in the FSAR to confirm satisfactory performance following such a steam line break. The applicant was a
requested to provide the following:
(a)
In the event of the postulated accident, termination of steam flow from all systems identified in Table 10.3-1, of the FSAR except those that can be used for mitigation of the accident, is required to being the reactor to a safe cold shutdown.
For these systems describe what design features have been incorporated to assure closure of the steam shutoff valve (s). Describe what operator actions (if any) are required.
(b) If the systems that can be used for mitigation of the accident are not available or a decision is made to use other means to shut down the reactor, describe how these systems are secured to assure positive steam shut-off. Describe what operator actions (if any) are required.
(c) Show that failure to isolate or secure these systems will not result in a blowdown of more than one steam generator.
l
9 The applicant has not provided sufficient information on the above three requests.
The scope of review of the main steam supply system (between the main steam isolation valves and up to and including the turbine stop valves) included descriptive infomation in Section 10.3 of the FSAR, and flow charts and diagrams. The basis for acceptance in the staff review was conformance of the design criteria and bases and design of main steam supply system to the acceptance criteria of Standard Review Plan 10.3.
Based on our review, we conclude the main steam supply system between the main steam isolation valves and up to and including the turbine stop valves is not in conformance with the above cited criteria and design bases, it cannot perform its designed functions, and is, therefore, unacceptable. Upon receipt of the requested information, the staff will report its findings in a supplement to this SER.
10.4.1 Main Condenser The main condenser is designed to function as a heat sink for the I
turbine exhaust steam, turbine bypass steam, and other turbine cycle flows, and to receive and collect condensate flows for return to the steam generators. The main condenser transfers heat to the circulating water system which uses Long Island Sound to dissipate the rejected heat.
The main condenser is not required to effect or support safe shutdown of the reactor or to perform in the operation of reactor safety features.
iii
, The main condenser has two shells and is designed to produce a turbine back pressure of 2.0 inches mercury absolute when operating at rated turbine output. The main condenser design includes provisions for condensate deaeration and hotwell surge storage of condensate for approximately four minutes supply at design conditions. Off-gas from
{
l the main condenser is processed in the condenser evacuation system which is described and evaluated in Section 10.4.2 of this report.
I The main condenser is designed to accept full load exhaust steam from the main turbine, up to 90% of the main steam flow from the turbine l
steam bypass system, and other cycle steam flows. The main condenser is also designed to deaerate the condensate to the required water quality.
Stainless steel tubes have been used to minimize corrosion and crosion of condenser tubes. Condenser tube leakage could result in degradation
)
of the feedwater quality with potential for corrosion of secondary system components. The applicant monitors the condensate by means of an automatic hotwell sampling system to give an indication of tube leakage.
The applicant, in response to a request for additional information, provided details on the detection, control, and correction of condenser cooling water leakage into the condensate. The adequacy of the secondary sampling system for leak detection is evaluated in Section 9.3.2 of this report.
l The applicant will include preoperational and startup tests of the main condenser in accordance with reconcendations of Regulatory Guide 1.68, i
" Initial Test Programs for Water Cooled Reactor Power Plants." The
~
- ~~
~ "'
. adequacy of the test program is evaluated in Section 14.1 of this report.
The applicant discussed in the FSAR the tests, initial field inspection and the inservice inspection on the main condenser, but he did not specify the frequency of these tests other than to say they would be done periodically. The staff requested a amplification of the term
" periodically," but has not received this clarification. Therefore, we find the inservice inspection program unacceptable.
The scope of review of the main condenser included layout drawings and descriptive information of the condenser in Section 10.4.1 of the FSAR.
The basis for acceptance in the staff review was conformance of the design criteria and bases and design of the condenser to the acceptance criteria in Section II of Standard Review Plan 10.4.1 and industry standards.
Based on our review, we conclude that the main condenser is in conformance with the above cited criteria and design bases, it can perform its designed function and is therefore acceptable, except as noted above. Upon receipt of the requested additional information, the staff will report its findings in a supplement to this SER.
10.4.4 Turbine Bypass System The turbine bypass system is designed to bypass up to 90% of main steam flow to the main condenser. This capacity together with a 10% reactor
i
. 4 automatic step load capability is sufficient to withstand a 100%
generator load loss without tripping the turbine or causing control rod i
movement. The turbine bypass system is used to control coolant temperature as follows: a) during the reactor heatup to rated pressure; b) while the turbine generator is being brought up to speed and synchronized; c) during power operation when the reactor steam generator exceeds the transient turbine steam requirements; and d) during reactor ccoldown. This system is not required to perfom during accident conditions.
The bypass system is composed of the following:
(1)eighteenair operated valves, (2) associated instruments and controls, and (3) piping. Each valve is rated for a capacity of approximately 5.0 percent of the main steam flow at full load pressure and temperature.
The eighteen bypass valves are connected to the main steam header downstrean of the main steam isolation valves by two turbine bypass headers (nine bypass valves per header) and discharge the steam directly to the main condenser. The turbine bypass system is not a safety related system and is not required for plant shutdown following an accident. The turbine bypass valves are designed to fail closed upon loss of electric power or air system pressure to the valve control system. The turbine bypass valves'are designed to close on loss of main condenser vacuum.
The applicant will include preoperational and startup tests of the turbine bypass system in accordance with recomendations of Regulatory Guide 1.68, " Initial Test Programs for Water Cooled Reactor Power
Plants." The adequacy of the test program is evaluated in Section 14.1 of this report.
The turbine bypass system meets the recomendations of Branch Technical Positions ASB 3-1, " Protection Against Postulated Piping Failures in Fluid System Piping Outside Containment and MEB 3-1, " Postulated Break and Leakage Locations in Fluid System Piping Outside Containment."
Evaluation of protection against dynamic effects associated with the postulated pipe system failures is covered in Section 3.6 of this report.
The applicant in Section 10.4.4.4 of the FSAR discussed the initial field inspections and start-up test for the turbine bypass system. He was requested to provide a description of the inservice inspections, tests to be performed on the turbine bypass system and their frequency.
He has not provided this ir. formation. Since this system is usec to prevent unnecessary operation of safety relateo systems and to mitigate the consequences of a steam line break upstream of the MSIV's (Technical Issue 1 of NUREG-0138), an inservice inspection progran for these valves is necessary. Therefore, we require that the applicant describe his inservice inspection program for the turbine bypass system and its frequency. We will continue to pursue this item with the applicant.
In Section 10.3.2 and 10.4.4.3 of the FSAR the applicant states that turbine bypass system interlocks are provided to prevent spurious opening of the turbine bypass valves.
In Section 10.4.4.5 he states that interlock selector switches are provided in the main control room.
e m
..e m
-g*
a
,e.
The applicant was requested to describe the interlocks, the interlock selector switches and their purpose.
In Amendment 4 to the FSAR the applicant described the various interlocks on the turbine bypass system, but he did not describe the interlock switches or their purpose. The staff requires the information in order to evaluate the operability of the turbine bypass system.
The scope of review of the turbine bypass system included drawings, piping and instrumentation diagrams and ' escriptive information of the d
system in Section 10.4.4 of the FSAR.
The basis for acceptance in the staff review was conformance of the design criteria and bases and design of the turbine bypass system to the acceptance criteria and guidance of Standard Review Plan 10.4.4 and industry standards.
Based on our review, we conclude that the turbine bypass system is not in conformance with the above cited criteria and design bases, it cannot perform its designed function, and is, therefore, unacceptable. Upon receipt of the requested additional information, the staff will report its findings in a supplement to this SER.
e ENCLOSURE 4 1
j PSB/DSI SALP INPUT PLANT:
BEAVER VALLEY UNIT 2 LICENSEE:
DUQUESNE LIGHT COMPANY DOCKET NO:
50-412 LICENSE STATUS:
SUBJECT:
ELECTRICAL AND MECHANICAL, POWER SYSTEMS BRANCH, SER PERFORMANCE PARAMETERS:
(1) Management Involvement In Assuring Quality (2) Approach To Resolution of Technical Issues From a Safety Standpoint (3) Response To NRC Initiatives (4) Staffing (Including Management)
(5) Reporting And Analysis Of Reportable Events (6) Training And Qualification Effectiveness (7) Any Other SALP Functional Area PERFORMANCE NARRATIVE DESCRIPTION OF CATEGORY / RATING PARAMETER APPLICANT / LICENSEE'S PERFORMANCE 1
N/A 2
The applicant's approach to resolution of tech-3 nical issues was in almost all cases lacking in thoroughness or no response provided.
3 The applicant's response to NRC initiatives in 3
almost all cases were lacking in thoroughness and in most cases no responses provided.
In some cases considerable NRC effort expended to obtain acceptable resolution.
4 N/A 5
N/A 6
N/A 7
N/A OVERALL APPLICANT / LICENSEE PERFORMANCE RATING 3
,