ML20133D024

Safety Evaluation Supporting Emergency Electrical Sys,Per Problems Encountered During 841218 Testing of Emergency Diesel Generator Sets

ML20133D024
Person / Time
Site:	Fort Saint Vrain
Issue date:	07/05/1985
From:	Office of Nuclear Reactor Regulation
To:
Shared Package
ML20133C984	List: ML20133C982 ML20133D024
References
TAC-51955, NUDOCS 8507220075
Download: ML20133D024 (3)

Text

e I

.#  % UNITED STATES JUL 0 51985

[ $ NUCLEAR REGULATORY COMMISSION REGION IV 8 811 RYAN PLAZA DRIVE, SUITE 1000

% 8 ARLINGTON TEXAS 70011 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION  !

PUBLIC SERVICE COMPANY OF COLORADO FORT ST. VRAIN (FSV) NUCLEAR GENERATING STATION DOCKET NO. 50-267 EMERGENCY ELECTRICAL POWER SYSTEM INTRODUCTION By task interface agreement (TIA) No. 85-02, Rev.1, dated February 5,1985 the KRR staff was requested to review the subject design with reference to the j problems encountered during the testing of the emergency diesel generator sets 1 (EDGS) on December 18, 1984. The staff has reviewed FSV's latest revision of the FSAR and electrical schematic drawings of the emergency power systems. The review focused primarily on the compliance of the design with the redundancy, independence and single failure criterion established in the FSAR.

BACKGROUND Emergency electrical distribution system at FSV is a 3 bus (two redundant and I 1

one swing bus) system with two 100% load capacity EDGs. Each EDG has two j tandem engines each rated to 1/2 of the generator output capacity. If only one j of the two engines operates in one EDG system, the other redundant EDG must also be operative to supply the shutdown load with at least one of its engines ,

operating. The intended logic at FSV is to start both EDGs simultaneously and '

let the first EDG with rated voltage, frequency and 100% output (both engines '

operating) be connected to its assigned 480 volt bus together with the swing bus. The first generator on line assumes sequence "A" loading which is sufficient for an orderly shutdown and continued maintenance of the plant in a safe shutdown condition. The second generator, if available with rated voltage and frequency, will assume sequence "B" loading.

On December 18, 1984, with the reactor shutdown and the PCRV depressurized, the loss of offsite power and turbine trip semiannual surveillance test was initiated by blocking one EDG (EDG-A) to intentionally make the other EDG (EDG-B) first on line and assume sequence A load. Due to the nonavailability of one of the two engines with EDG-B, this logic could not be completed and breaker did not close. The logic should have made the intentionally blocked EDG-A as the second generator in line and should have closed its supply breaker to initiate sequence B loading on EDG-A. The EDG-A breaker also did not close, thus causing loss of both redundant emergency power supplies to the essential buses. EDG-A failure to supply power was attributed to the inadvertent trip of exhaust temperature switches on both engines of EDG-A due to the loss of instrument power to these switches. This event necessitated a review of the  ;

FSV emergency electric system to establish the following:

(1) Independence and redundancy of the onsite AC power supply distribution system and the safety loads to perform their safety function.

8507220075 850710 7 DR ADOCK 050

1

. l l

- JUL 05 1gg (2) -Reasons for EDG-B's inability to get connected to the bus when only one of l its two engines failed and the other was available to supply 1/2 of the j designed capacity of EDG-B. l 1

EVALUATION l

The FSAR maintains in Section 8.2.5.1 that the AC and DC power systems in FSV design are each redundant systems; the onsite power supplies are completely independent and meet the single failure criterion. Our review of FSV's onsite electric system drawings (EDG breaker and bus tie breaker schematic diagrams and auxiliary tripping relays control diagrams), on sample basis revealed the following information.

1.- Automatic closure of one redundant EDG breaker is dependent on the operation of components associated with the other redundant EDG.

Interlocks from one division providing permissive in the breaker close circuitry of the other could potentially prevent the required operation of both circuits and render both emergency power supplies incapable of performing their safety function.

2. Each redundant EDG should be capable of supplying 100% of its rated power when both engines operate and 50% of its rated power when only one is operative. The EDG breaker should close for rated voltage and frequency irrespective of whether one engine is operating or both. FSV design (EDG breaker schematic) indicates that the breaker will not close if one of the two engines is inoperative.

Both identified discrepancies, were explained to the licensee in detail in a meeting held on May 16, 1985. Based on the available information, it is the staff's understanding that the automatic operation of the redundant EDG circuit ,

breakers is dependent on each other which is contrary to the FSAR requirement. ,

This discrepancy could potentially render both emergency power supplies incapable of automatically performing their safety function. However, in case the EDG breaker fails to close automatically, manually operated electrical control breaker closing circuitry is available in FSV design to initiate closure of the breaker immediately after identifying the failure of the automatic circuitry. The licensee confirmed that the manual circuitry is not affected by the failure of the automatic breaker closure circuitry. I Our review of the FSAR indicates that besides the EDGs, the FSV design includes an alternate means of providing electric power for cooling the reactor, in case both offsite power and EDGs are not available. This power source is capable of operation, independent of disruptive faults or events, such as a major fire in the congested cable areas. This system is named " Alternate Cooling Method (ACM)" and manually started to restore 480V electric power at the control terminals of the required safety equipment within two hours (1 to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />).

The ACM power source is a non Class 1E, 4160 volt, 60 Hz AC diesel generator, rated at 2500 kW (equal to the combined rating of both EDGs) and is located w 1

. JUL 0 5198F away from the existing plant structure. The ACM is designed to accomplish the following functions by means of local manual initiation:

(a) To maintain the reactor subcritical using Reserve Shutdown System.

(b) To resume PCRV liner cooling, thereby cooling the core and the PCRV.

(c) To allow depressurization of the PCRV through the helium purification system.

(d) To establish operation of the Reactor Building Exhaust System and radiation monitoring of the exhaust effluent to the atmosphere.

l Additionally, the ACM can power the plant lighting, fire pumps, service water pumps and plant ventilation system.

The staff reviewed Section 8.2.8.5 of the FSAR and noted that in the unlikely event when both EDGs are not available coincident with the loss of offsite power, and the ACM power is restored to the emergency equipment by manual means within two hours, then adequate core cooling and depressurization of primary coolant system can be achieved maintaining integrity of the core and the PCRV.

CONCLUSION The staff's evaluation of the FSV EDG electric system has identified some discrepancies in EDG breaker control logic regarding independence of the redundant EDG system. However, the inherent capabilit core with an alternate non-Class IE power source (ACM)y providesofanthe PCRV and added assurance of safe shutdown capability.

In the interim, until the licensee proposes any necessary modification in the EDG breaker automatic control circuitry, manually operated switches are available to override the automatic control circuit failure and close the breakers to provide power to operate equipment necessary for safe shutdown of the plant. This can readily be accomplished well within the time frame available to prevent damage to the reactor.

It is the staff's conclusion, as it relates to the emergency power system prob-lems identified, that the plant operation may resume without undue risk to the health and safety of the public. However,'the licensee should establish a sche-dule, without undue delay, for the review and resolution of the potential single failure and independence problems for EDGs identified in this report.

Date: JUL 0 51985 Principal Contributor:

I. Ahmed. DSI 4

- -,,-.- ,,