ML20148G209

Describes 780916 Event at Subj Facil:Auto Transfer of Auxiliary Loads on Both Units to Startup Transformer 2 W/ Consequent Overload.Recommends Licensee Be Advised of Nonconformance w/GDC-17 & Modify His Design

ML20148G209
Person / Time
Site:	Arkansas Nuclear
Issue date:	11/01/1978
From:	Rosa F, Satterfield R Office of Nuclear Reactor Regulation
To:	Stolz J Office of Nuclear Reactor Regulation
References
FOIA-79-149 NUDOCS 7811100178
Download: ML20148G209 (8)

Text

- - - - _____ - __ _ _ _ _ _ _ _ _ _ _ _ __

3l3 -

8

$0%8 7 d' g mRfCuo UNITED STATES 8 o NUCLEAR REGULATORY COMMISSION

$ e

,E WASHINGTON, D. C. 20555

/

NOV 011978 MEMORANDUM FOR: J. F. Stolz, Chief, Light Water Reactors Branch 1 DPM s

FROM: Faust Rosa, Chief, Power Systems Branch, DSS Rod Satterfield, Chief, Instrumentation and Control Systems Branch, DSS

SUBJECT:

ARKANSAS NUCLEAR ONE; INCIDENT ON SEPTEMBER 16, 1978; AUTO TRANSFER OF AUXILIARY LOADS ON BOTH UNITS TO STARTUP TRANSFORMER N0. 2 WITH CONSEQUENT OVERLOAD; CONFORMANCE TO GDC-17 The incident at Arkansas Nuclear One (ANO) on September 16, 1978 brought into quertion the conformance to GDC-17 of the offsite power system design of this station. We have reviewed the ANO design in light of this inci-dent; this review was conducted in close coordination and consultation with cognizant personnel of I&E, D0R, DPM and the Licensee (Arkansas Power and Light Company) and its AE. As a result of this review we con-clude that the present offsite power system design is not in conformance with GDC-17 with regard to the independence between the two required offsite power circuits. Our rationale and recommendations are as follows:

A description of the pertinent features of the ANO offsite power system design is provided in the Enclosure. It is clear from this description that under certain conditions Startup Transformer No. 2 (ST2), which is in the " delayed access" offsite power circuit * (for both units) required by GDC-17, will be automatically overloaded due to a failure in the autotransformer which is the common element in the imediate access off-site power circuit which is also required by GDC-17. More specifically, the automatic overload, i.e. , disabling, of ST2 will result when a failure of the autotransformer circuit occurs concurrently with any of the follow-ing station conditions and events:

a) both units in either startup or shutdown mode, b) trip of one unit while the other is in either the startup of shutdown mode, and The design feature of automatic load transfer to ST2 which is provided actually makes this a second immediate access circuit, thus exceeding GDC-17 requirements with regard to access capability; however, the resulting overload of ST2 violates the independence requirements of GDC-17.

Contact:

F. Rosa x27122 7 8 Il I 0017g i

. < i

,i J. F. Stolz NOV D 11978 c) simultaneous trip of both units.

GDC-17 requires, in part, that " Electric power from the transmission network to the onsite electric distribution system be supplied by two physically independent circuits (not necessarily on separate rights of way) designed and located so as to minimize to the extent practical the likelihood of their simultaneous failure under opersting and postulated accident and environmental conditions." Since in the ANO design a failure in the ime- ..

diate access offsite power circuit resultsin failure of the delayed access circuit, we conclude that the ANO offsite power system design is not in conformance with GDC-17; however, the Unit 1 situation is being handled by D0R and Unit 2 is presently shutdown. Prior to Mode 2 licensing of Unit 2, this matter will need to be resolved.

We recommend that the licensee be advised of the above cited non-conformance with GDC-17 and requested to modify his design to bring it into conformance before Unit 2 goes into Mode 2 operation. In our opinion, acceptable methods for attaining conformance with GDC-17 include:

1) Replacement of Startup Transformer No. 2 with one capable of carrying the worst case combination of automatically transferred loads.

2) Defeat of all capability for automatic transfer of loads to Start-up Transformer No. 2.

3) Defeat of capability for automatic transfer of selected loads such that Startup Transformer No. 2 will never experience an overload condition (including excess voltage drcp resulting in unacceptable voltage at the safety buses) due to the worst case combination of the retained automatic load transfer capability.

Development is underway of a PSB Technical Position addressing the detailed application of GDC-17 to offsite power system designs involving similar automatic switching schemes, pending cc.mpletion of this position (and its approval by the R3 C if required), acceptable means of implementing option 3 above include: (1) defeat of automatic load transfer in one unit while re-taining it in the other, or (2) partial defeat of automatic load transfer in either or both units.

Also, procedural implementation of option 2 or 3 utilizing existing switch-ing ctpabilities (as opposed to a design change) would be acceptable pend-ing completion of the above cited PSB position. Such procedural implementation should include written procedures for (1) defeat of the required automatic switching capability, (2) manual load shedding and switching including manual loading required to make use of ST2 as the delayed access offsite oower cir-cuit for either or both units, and (3) daily logging of the status of auto-matic load switching. Unrestricted operation of Unit 2 (and Unit 1 insofar as automatic load transfer to ST2 is concerned) would be permissable provided the above procedural requirements are approved b) I&E and incorporated in the Technical Specifications.

J. F. Stolz NOV 011978 Implementation of the above position regarding automatic load transfer to Startup Transformer No. 2 involves the offsite power system for both units. The permissable operational status of Unit 1 is being reviewed separately by D0R (see memorandum from G. Lainas to R. Reid dated October 27, 1978, Voltage Degradation At Class 1E 480 Volt Buses).

This review will include consideration of the proposed Millstone fix for degraded grid voltage conditions which includes design changes as well as administrative controls. (An approved Millstone fix has already been installed in Unit 2).

r- /

y _ qf ,h)e+n Faust Rosa, Chief Power Systems Branch Division of Systems Safety Rod Satterfield, Chief Instrumentation and Control

. Systems Branch Division of Systems Safety

Enclosure:

As stated cc: S. Hanauer R. Mattson V. Stello R. Boyd N. Moseley G. L. Madson (Region IV)

T. Westerman (Region IV)

R. Tedesco D. Vassallo D. Eisenhut G. Lainas D. Tondi M. Srinivasan D. Davis L. Engle S. Varga J. Beard ICSB/PSB Members

3' i; i '

$c - 31 '36 6

- I' NOV y 397g V

!- MEMORANDUM FOR: J. F. Stolz, Chief, Light Water Reactors Branch 1, DPM

,FROM: ,

Faust Rosa, Chief, Power Systems Branch, DSS I u Rod Satterfield, Chief, Instrumentation and Control Systems Branch, DSS

SUBJECT:

ARKANSAS NUCLEAR ONE; INCIDENT.ON SEPTEMBER 16, 1978; A

i

~ ..

AUTO TRANSFER OF AUXILIARY LOADS ON BOTH UNITS TO STARTUP TRANSFORMER N0. 2 WITH CONSEQUENT OVERLOAD;

' " ^

. CONFORMANCE TO GDC-17

~

? .

~The incident at Arkansas Nuclear One (ANO) on September 16, 1978 brought

. into question.the conformance to GDC-17 of the offsite power system design of this station. . We have' reviewed the ANO design in light of this inci-i dent; this review was conducted in close coordination and consultation with cogniaant. personnel of I&E, DOR, OPM and the Licensee (Arkansas Power and Light Company) and its AE. As a result of this review we con-clude that the present offsite power system design is not in confornance with GDC-17. with regard to the independence between the two required offsite power circuits.' Our rationale and reconrnendations are as follows:

A description of the pertinent features of the ANO offsite power system design is provided in the Enclosure. It is clear from this description that under certain conditions Startup Transformer No. 2 (ST2), which is in the " delayed access" offsite power circuit * (for both units) required ,

by GDC-17, will be automatically overloaded due to a failure in the l

autotransformer which is the corson element in the inrediate access off-

- site power circuit which is also required by GDC-17. More specifically, t

the automatic overload,1.e., disabling, of ST2 will result when a failure

[

of the autotransfonner circuit occurs concurrently with any of the follow-

' ing station conditions and events:

a) both units in either si!artup or shutdown mode, f trip of one unit while the other is in either the startup

! b) i of shutdown mode, and i

. The design feature of automatic load transfer to ST2 which is provided i

actually makes this a second imediate access circuit, thus exceeding GDC-17 requirements with regard to access capability; however, the j

.resulting overload of ST2 violates the independence requirements of GDC-17.

l ,,,,,,,40 tact: . . . . . . . . . . . . . . . . . , , . ,

p, n. . pg3. . .. . . . . . . . .

(

-ax2m2............ . - . . . . . . . . . . . . . . . .

l ,. . . .

>=c = = m o.m = = m. .

7 g l}Io 0 0 / 2 8 _

• ? . .

W J. F. Stolz . . NOV ~11978

)

c) simultaneous' trip.of both units. ,

GDC-17 requires, in part, that " Electric power .from .the transmission network to the onsite electric distribution system'be supplied by two physically independent circuits (not necessarily on separate. rights of way) designed and located so as to minimize to the extent practical the likelihood of -

~ -their simultaneous falture un6er operating and postulated accident and. .

environmental conditions." Since 'in the ANO design a failure in the ime-diate' access offsite power circuit resultsin failure of the delayed' access circuit, we conc 1'ude.that the ANO offsite power system design is not in conformance with GDC-17; however, the Unit 1' situation is being handled by 00R and Unit 2-is' presently shutdown. Pfior to Mode 2.11 censing of Unit 2, ,

this matter will need to be resolved. ,

We reconmend that the licensee be advised of the above cited non-conformance.with GDC-17 and requested to modify his design to bring it into conformance before Unit.2 goes into Mode 2 operation. In our opinion, i acceptable methods"for. attaining conformance with GDC-17 include:

1) Replacement of' Startup Treasformer No. 2 with one capable of carrying the worst case combination of automatically transferred loads. i g-

2) befeatofallcapabilityfogautomatictransferofloadstoStart-up Transformer No 2.

,  ! 3) Defeat of capability for automatic transfer of selected loads such s that Startup Transfomer No. 2 will never experience an overload .;

j - condition (including excess voltage drop resulting in unacceptable voltage at the safety buses) due to the worst case combination of . .

the retained automatic load transfer capability. -  ;

Development is undemay of a PSB Technical Position addressing the detailed -

application of GDC-17 to offsite power system designs involving similar  ;

automatic switching schemes. Pending completion of this position (and its approval by the R3 C if required), acceptable means of implementing option 3  !

t

) above include: (1) defeat of automatic load transfer in one unit while re-j taining it in the other, or (2) partial defeat of automatic load transfer in either or both units.

6

! i 6 Also, procedural implementation of option 2 or 3 utilizing existing switch-( ing capabilities (as opposed to a design change) would be acceptable pend-

{

ing completion of the above cited PSB position. Such procedural implementation

; .should include written procedures for (1) defeat of the required automatic

! switching capability, (2) manual load sheddincj and switching including manual i loading required to make use of ST2 as the delayed access offsite power cir-cuit for either or both units, and (3) daily logging of the status of auto-matic load switching. Unrestricted operation of Unit 2 (and Unit 1 insofar as a t wmo m. i vou a a n2 Tm w ST: l. uvummom) ,,vwM L W,c.h M k F Md -

. -th+4cre.. m cedurg.1...r.e9uirementi are app.rnes. Ay..pE ,and,, incorporated ir , , , , , , , , , , , , , ,

th echnical Spec tf icat ions. s

===.-= L l i

.m * , . . . . . . . . . . . . . . . . . . . . . . . . . ... . . . . . . . . . . . . . . . . . , . , , , ,.

t .. ......... ~ .,,, m . ,,,,......,..

nac meu m w.m iencu oue

_ _ ~ _ . _ _ , _ _ _ . _ _ . _ . _ . . _ _ _ . . _ . _

- ., . ' f~

g) h

,g -

l  ;

.NOV 1O l

1 J. F. Stolz , l

- - . i Impleme.ntationoftheabovepositionregardingautomaticloadtrans'fer to Startup Transformer. No. 2 involves the offsite power system for both units. The.pemissable operational status of Unit 1 is being reviewed separately by DOR (see memorandum from G. Lainas to R. Reid dated October 27, 1978, Vottage Degradation At Class 1E 480 Volt Buses).  ;

This" review will include consideration of the proposed Millstone fix for degraded grid voltage conditions.which includes design changes as well as administrative controls. (An approved Millstone fix has ' - ' -

C already been installed in Unit 2).

l l

I . ., [ Faust Rosa. Chief- .

~ Power Systems Branch '

Division of Systems Safety

~.

. s t

' Rod Satterfield, Chief

- Instrumentation and Control .

, Systems Branch Division of Systems Safety

Enclosure:

As stated -

cc: S. Hanaue'r - - =

R. Mattson V. Stello DISTRIBUTI.0N:

Ikkbi9'.m. g u be M 'A d 3 ^- N E>

R..Boyd DOCKET FILE -

~

N. Moseley ;u n d f3 que BQ '^. . .

G.. L. Madson (Region IV) HRR READING T. Westerman (Region IV) PSB READING 35)39,4g49c% u.E W - h

, ICSB READING R. Tedesco '

FROSA READING

!' D. Vassallo -

D. Eisenhut G. Lainas g 3 D. Tondi DSS.ICSB y

M. Srinivasan D. Davis MSrinivasan I

L. Engle 18/I/78 l

1 3. verga ,,,,,,,-

DSS:PSB.Y,2,, DSS:ICSBfM m io= > . ..J... Beard... . . . . _ . ,

F .RSat..te.rfi e. l d i ,,,,,,,,,, . ...ICSB .. ... Members

.... ./..PSB . . . . . . . . . . . . . . . . ..R. o.s..a..:.s.1.......

3 10/30/78 .1h/1./.78 . . . . . .

i ==* . . . . . . . . . . . . . . . . .

t -

t rec romu sis (p.76) asteu one

• o........ .., . - ,.. ............ ,

. .. . s __ m _ _ _

ENCLOSURE s

t Description of the Offsite Power System .

Design for Arkansar. Nuclear One .

?

Units 1 and 2

~

The following design features of the Arkansas Nuclear One (ANO)  ;

I station are pertinent to the evalbation of the design for conformance .

to GDC-17, in light of the incident which occurred on September 16, 1978. .

- 1 i

1) Each of the two units has a dedicated unit : auxiliary transformer  ;

(UAT) and a dedicated startup transformer (ST) each of which can supply all a-c power to all the unit auxiliaries, both safety and non-safety. The UAT's are supplied from their respective unit generator; the two ST's are both supplied through a single auto-transformer which also interconnects the 500 KV and 161 KV sections ,

~

of the station switchyard.

2) A backup startup transformer, Startup Transformer No. 2 (ST2),

is provided which can serve both units. This' transformer is ,

supplied directly from the 161 KV section of the switchyard. l However, it does not have the capacity for carrfing the full  ;

auxiliary loads of both units. .

3) On unit trip, all the unit auxiliary loads will be transferred j automatically from its UAT to its ST. This will occur in both units, independently.

/

a 2- .

^

4) When unit auxiliary loads are being carried by the respective ST and this source of power is lost for any reason, all the ' unit auxiliary loads will be transferred automatically to the backup ST 2. This also will occur in both units, independently.

5) When ' aoth units are being supplied by their respective ST's and the coninon source of power to the ST's (the autotransfonner).is lost, .

then the auxiliary loads of both units will be automatically trans-ferred to ST2. This will overload ST2 (exceed MVA rating) and also produce excess voltage drop resulting in a degraded vcitage condition at the buses (safety and non-safety) of both units.

6) With the existing design, the overloading of ST2 will result automatically on failure of the actotransformer circuit feeding .

the two dedicated startup trasnformers, when the failure occurs ,

concurrently with the following conditions or events:

• a) both units in either the startup or shutdown modes  ; ,

of operation, l

b) trip of 6ne unit while the other is in either the startup or shutdown mode of operation, and c) simultaneous trip of both units.

e

,- .-y--..~-- . ,--e ., . , . - . - - . -e--. = . . , , .-%. .,ve-,--,,..-we.e.. ,..-e,..r .. -.--4.,,-. . . . . ~ , - -- --n. -.w.4 ., -e...-.,....yr. . - -

~

7) The Millstone fix for degraded grid voltage conditions which ...in- o cludes a second level of undervoltage trip (at approximately 92% of

~

nominal) was insta11ed in Unit 2; this fix is ' scheduled for in-staliation in Unit 1 at the next refueling outage. It should be noted that the Milistone fix is intended to protect the onsite safety related distribution systems from a degraded grid voltage ,

condition not against degraded vcitage due to overload of a startup ,

transformer (although it is also effective in this regard). There-fore, the Millstone fix is necessary in order to meet the GDC-17 rec,uirements for independence between the offsite and onsite power systems. However, the Millstone fix is not considered pertinent to the evaluation of the offsite system design for con-

. formance to the GDC-17. requirement for independence between the In this case, the design

,' two required offsite power circuits.

! feature in question is the automatic overloading of one of the {2 required offsite power circuits to both units on failure of the ,

~

other offsite circuit.

- - - -- - - y-.. _. .__ ...

~

~~ ~~

It is noted that item [6(b) above covers the incident which occurr$5

• at ANO on September 16, 1978. Specifically, this incident was

~

es. 4 -

em- M .6 h .m 6 a p 4 g, e

1 B .

/

r

~--,,,-* twt'rP'---W '1--'t"-"pM9* y--W=d eerew-'* 9ka*T"*Nea"rryverw t.-gg. ne+-w%*-wy m ere , ,Q-w.-

4 1

?

initiated by a spurious trip of Unit 1 while Unit 2 was in the l l

startup mode. This resulted in automatic tran'sfer of the Unit 1 auxiliary loads from its UT to its ST. Since Unit 2 was alreedy on its ST, this transfer loaded the autotransformer with the full auxiliary loads of both units, resulting in trip of an autotrans-former overcurrent relay (which bz.d not been adjusted for two unit operation) and consequent opening of the circuit breakers feeding the two ST's. Loss of the ST's automatically transferred the auxi-liary loads of both units to ST2 exceeding its MVA rating and pro-ducing a degraded voltage at the auxiliary buses (safety and non-safety) of both units. The overcurrent protective relaying for the autotransformer has since been corrected to preclude recurrence of this type of failure.

The above description does not address those aspectsof the September 16, 1978 incident or plant design which are not pertinent to the evaluation of the offsite power system for conformance to GDC-17.

a 0

5 8

~ - - - - - - - - - - - _ . ~ _ _ _ _ _ _ _ _ . _ _ . _

7 A

)P L

1 N7 V-

' 2' "f

J WM

/-

, #Mg .

'Ag -

1. ^  ?

"AEg A l

P c -

1. Ap / M  ?

'D I

. /c T b 2Wf S

W^A V p -

Kw 1 f h -

S T s 6

1 f 1)AT S L. f' C I/-

'l R

W^O h I l/-

O Tg

}

/ -

/

P w l /

S ). G f t TA S LO f -

f i

r /

-I

}'t t l

V c s _

K 0 p ~

WT R /p -

30 w S S -

G _

l /

I[

w /-

/ c

{

M WK J

AO

\

[

R c

/

T 8

W2 - .

V .

1 _

1 1  ; , .:  : : ' j: i.  :