ML20213G564

Forwards Onsite Class 1E Power Sys Design Features Review Status Rept Based on FSAR & NRC 860814 Meeting W/Licensee & Inel Draft Review of Fort St Vrain Onsite AC 'Standby' Power.... Resolution to Problems Requested Before Restart

ML20213G564
Person / Time
Site:	Fort Saint Vrain
Issue date:	11/12/1986
From:	Heitner K Office of Nuclear Reactor Regulation
To:	Robert Williams PUBLIC SERVICE CO. OF COLORADO
Shared Package
ML20213G565	List: ML20213G564 ML20213G581
References
TAC-59801, NUDOCS 8611180203
Download: ML20213G564 (10)

Text

_

h, [ UNITED STATES y' [ g NUCLEAR REGULATORY COMMISSION L j WASHINGTON, D. C. 20555

% ,, November 12, 1986 Docket No. 50-267 Mr. R. O. Williams, Jr.

Vice President, Nuclear Operations Public Service Company of Colorado Post Office Box 840 Denver Colorado 80201-0840

SUBJECT:

FORT ST. VRAIN'S EMERGENCY ELECTRICAL POWER SYSTEM DESIGN COMPLIANCE WITH THE SINGLE FAILURE CRITERION - REVIEW STATUS REPORT

References:

1. NRC, Region IV letter (E. H. Johnson) to PSC (O. R.

Lee), dated July 10, 1985.

2. PSC's letter (D. W. Warembourg) to NRC, Region IV (P.R. Hunter),datedSeptember 13, 1986.

In Reference 1, we identified certain design discrepancies in the automatic control circuitry of the emergency diesel generator's (EDG's) circuit

, breakers, which compromised the independence requirements that Fort St.

Vrain (FSV) has committed to meet in the FSAR. Because of the inherent capability of the FSV design to withstand the total loss of AC power (i.e.,

all offsite power sources and the two class IE EDGs) for at least two hours without the need for cooling the core, the plant was allowed to operate in the interim, while the necessary modifications in the breaker's automatic control circuitry were being incorporated. These modifications eliminate the single failure problems. Also, the FSV design provides for an alternate cooling method (ACM), which includes a non-class IE power source that is independent from the offsite power sources and class IE EDGs. Furthermore, Reference 1 indicated that no single failure in the automatic control circuit of the EDGs' circuit breakers (preventing both of them from closing) would result in the loss of manual capability to close at least one EDG circuit breaker. The manual operation of these EDG breakers or the manual initiation of the ACM could readily be accomplished within the time frame available to assure core cooling.

In Reference 2, Public Service Company of Colorado (PSC) submitted a response to our concerns and proposed certain wiring changes to eliminate the discrepancies identified in Reference 1. The submittal was reviewed by our contractor, EG8G Idaho, Inc., whose findings are contained in the enclosed draft Technical Evaluation Report (TER) (Enclosure 2).

At FSV, the class IE electric power system is comprised of three buses (two redundant and one swing bus) with two 100% load capacity EDGs and an 8611180203 861112 PDR ADOCK 05000267 P PDR

)

. _- .- - - .- .. - . - - - - - _ .~ .

/

.I Mr. R. O. Williams, Jr. 4 1

offsite power source connection to each bus. A loss of voltage or degraded voltage condition from the offsite power sources reflected on any two of the three class 1E buses would result in the automatic starting of both EDGs.

The EDG that attains the rated voltage and frequency first is automatically connected to its asscciated bus and the swing bus. The DC control power i

for breakers on each of the three buses is provided from two redundant, 125 volt class IE battery supplies. The FSV design also provides for a non-class

IE, non-redundant system, which includes the ACM diesel generator.

In Reference 1, we identified that the automatic closing circuit of one

, redundant EDG circuit breaker is dependent on the operation of relays or contacts associated with the other redundant EDG circuit breaker. As such, the interlocks from one division used in the breaker close circuitry of the other division, could potentially prevent the operation of both circuits due 4 to a single interlock failure. In the case of the DC control supply to the 1

breakers on each of the three buses, the FSV design provides automatic switching between the redundant divisions of the DC power supplies. We noted that a fault in one division could be propagated to the redundant l counterpart leading to the total loss of DC power.

1 To discuss your proposed modification (Reference 2) and the draft TER (Enclosure 2), a meeting was held among NRC staff EG8G's representatives, 2

and PSC's personnel on August 14, 1986. The staff explained why the proposed modification (Reference 2) fails to provide the required

, independence in the automatic control circuitry of redundant EDG circuit breakers. The staff also stated its concerns that the automatic switch-over of DC control power from one redundant division to the other can lead to i

the total loss of DC power.

1 In this meeting, the PSC personnel proposed a temporary modification in the i DC control power supply to the loss of voltage and degraded voltage logic i circuitry that provides signals to start the EDGs. This modification was

necessary to eliminate a single failure problem in the logic, which PSC had recently identified (discussed in Enclosure 1). The staff noted that this 1

modification resolved a specific design problcm. However, the staff

, remains concerned about the vulnerability of.this design to the total loss of DC power from the existing automatic switch-over scheme. The PSC personnel agreed to examine the design and propose to implement a solution that will preclude the total loss of DC power as a result of a single j failure before restart of the plant. The addition of a third battery

(preferred) or manual operation instead of the automatic switch-over scheme i between the redundant DC buses were presented as possible alternatives for

! resolving this problem. It is noted that these modifications must be done in such a manner that would not degrade the capability of the design to isolate the onsite AC system from the offsite power source during degraded grid conditions assuming a single failure. Also, the redundant portions of the standby AC system (EDGs) and the redundant portions of the DC supply

, should meet the single failure criterion. Since the proposed modifications i do not achieve the required independence in the automatic control circuitry

of the EDG circuit breakers, the PSC personnel were requested to demonstrate that no single failure will disable the manual capabilities to r

i 1

j Mr. R. O. Williams, Jr. start the diesel generators, to close the EDG circuit breakers, and to start all necessary safety loads. In addition, PSC was requested to demonstrate that no single failure can cause paralleling of the redundant diesel generator sets, which may lead to the loss of both diesel generators. The acceptability of the design in these two cases must be established before restart of the plant.

Our discussion with your personnel identified differences among the actual design, system operation, and the FSAR. Also, the analysis performed by Proto Power Corporation (Reference 2) contained incorrect information, which PSC did not identify before submittal to the NRC. Our understanding of the proposed modifications and the operation of the class IE standby electric power systems, and its operation as described in the FSAR and by PSC in the meeting of August 14, 1986 is contained in our status report (Enclosure 1).

We request that PSC submit to us resolutions to these problems before restart of the plant. Your proposal should cover the major concerns addressed herein and contain a commitment to complete these changes on a well defined schedule. We would hold a second meeting with your staff approximately two weeks after your submittal was received to discuss and potentially accept your proposal as a basis for plant restart and continued operation.

A full description of the proposed modifications, the analysis to demonstrate manual capabilities as identified above, and the necessary FSAR changes to reflect the design capabilities of the as-built systems, should s be submitted for NRC review and approval prior to the actual changes being made.

The information requested in this letter affects fewer than 10 respondents; therefore, OMB clearance is not required under P.L.96-511.

Sincerely, R J 1-. h Kenneth L. Heitner, Project Manager Standardization and Special Projects Directorate Division of PWR Licensing-B Office of Nuclear Reactor Regulation

Enclosures:

As stated cc w/ enclosures:

See next page

November 12, 1986 Mr. R. 0. Williams, Jr. start the diesel generators, to close the EDG circuit breakers, and to start all necessary safety loads. In addition, PSC was requested to demonstrate that no single failure can cause paralleling of the redundant diesel generator sets, which may lead to the loss of both diesel generators. The acceptability of the design in these two cases must be established before restart of the plant.

Our discussion with your personnel identified differences among the actual design, system operation, and the FSAR. Also, the analysis performed by Proto Power Corporation (Reference 2) contained incorrect information, which PSC did not identify before submittal to the NRC. Our understanding of the proposed modifications and the operation of the class 1E standby electric power systems, and its operation as described in the FSAR and by PSC in the meeting of August 14, 1986 is contained in our status report (Enclosure 1).

We request that PSC submit to us resolutions to these problems before restart of the plant. Your proposal should cover the major concerns addressed herein and contain a commitment to complete these changes on a well defined schedule. We would hold a second meeting with your staff approximately two weeks after your submittal was received to discuss and potentially accept your proposal as a basis for plant restart and continued operation.

A full description of the proposed modifications, the analysis to demonstrate manual capabilities as identified above, and the necessary FSAR changes to reflect the design capabilities of the as-built systems, should be submitted for NRC review and approval prior to the actual changes being made.

The information requested in this letter affects fewer than 10 respondents; therefore, OMB clearance is not required under P.L.96-511.

Sincerely, Original signed by Kenneth L. Heitner, Project Manager Standardization and Special Projects Directorate Division of PWR Licensing-B Office of Nuclear Reactor Regulation

Enclosures:

DISTRIBUTION:

As stated Docket File PNoonan HBerkow NRC PDR KHeitner cc w/ enclosures: -

Local PDR 0 Lynch See next page PBSS Reading JCalvo P PBSS -

an KHeitner:ac ch PBPE /}%

JCalvo HBer PBS@kow lj /86 11/12/86 11/p/86 11/ n/86 11/ D/86

Mr. R. O. Williams Public Service Company of Colorado Fort St. Vrain cc:

Mr. D. W. Warembourg, Manager Albert J. Hazle, Director Nuclear Engineering Division Radiation Control Division Public Service Company Department of Health of Colorado 4210 East lith Avenue P. O. Box 840 Denver, Colorado 80220 Denver, Colorado 80201 Mr. David Alberstein, 14/159A Mr. J. W. Gahm, Manager GA Technologies, Inc. Nuclear Production Division Post Office Box 85608 Public Service Company of Colorado San Diego, California 92138 16805 Weld County Road 19-1/2 Platteville, Colorado 80651 Mr. H. L. Brey, Manager Nuclear Licensing and Fuel Division Mr. L. W. Singleton, Manager Public Service Company of Colorado Quality Assurance Division P. O. Box 840 Public Service Company of Colorado Denver, Colorado 80201 16805 Weld County Road 19-1/2 Platteville, Colorado 80651 Senior Resident Inspector U.S. Nuclear Regulatory Commission Mr. R. F. Walker P. 0. Box 840 Public Service Company of Colorado Platteville, Colorado 80651 Post Office Box 840 Denver, Colorado 92138 Kelley, Stansfield & 0'Donnell Public Service Company Building Commitment Control Program

, Room 900 Coordinator 550 15th Street Public Service Company of Colorado Denver, Colorado 80202 2420 W. 26th Ave. Suite 100-D Denver, Colorado 80211 Regional Administrator, Region IV U.S. Nuclear Regulatory Commission 611 Ryan Plaza Drive, Suite 1000 Arlington, Texas 76011 Chairman, Board of County Commissioners of Weld County, Colorado Greeley, Colorado 80631 Regional Representative Radiation Programs Environmental Protection Agency 1 Denver Place 999 18th Street, Suite 1300 Denver, Colorado 80202-2413

Enclosure 1 ONSITE CLASS 1E FORT ST. VRAIN (FSV)

POWER SYSTEMS DESIGN FEATURES REVIEW STATUS REPORT BASED ON THE FSAR AND AUGUST 14, 1986 MEETING WITH THE LICENSEE PUBLIC SERVICE COMPANY OF COLORADO DOCKET N0. 50-267

1) System Independence Paragraph 4 of Section 8.2.5.1 of the FSAR states:

"The onsite power supplies are completely independent and meet the single failure criterion."

Our review of emergency diesel generator (EDG) circuit breaker control circuitry revealed that single permissives or interlocks compromised the independence of redundant systems. In the August 14, 1986 meeting, the licensee indicated that the FSAR will be revised to indicate that the independence will be met only where it is consistent with the existing design. This would require a thorough review of all class IE Systems and an analysis to demonstrate that no single failure can disable both redundant systems.

Section 8.2.5.2 of the FSAR states:

" Loss of a DC Bus. The loss of a DC bus does not result in an unsafe condition, since two separate, normally independent systems are provided. A bus-tie switch is used to reenergize a DC bus from the other battery, if required.

The switchgear is provided with redundant DC control power supplies, so that failure of any one battery would not affect the operation of control circuits of any critical load. If one of the 125 V DC systems fails, control power to the switchgear affected is restored by switching to the alternate supply."

From this statement in the FSAR and its commitment to meet the redundancy and single failure criterion, it is inferred that the FSV design, which uses a bus-tie switch to restore the DC control power to one division equipment from the redundant division, will involve only a manual operation. However, the licensee has informed the staff that it is an automatic feature. This could propagate the fault in one division to the redundant counterpart and could lead to the total loss of DC power.

2) EDG Operation And Loading The following sections of the FSAR show automatic loading of 480 volt class IE buses 1, 2 and 3:

(a) Section 8.2.2.2 states:

"The essential 480 VAC load center buses 1, 2, and 3 are energized from the standby generators and essential loads are restarted by automatic sequencing programs."

, (b) Section 8.2.3.5 states:

"Two load-sequencing programmers are provided for each diesel generator set. For the first diesel generator in service, one programmer sequences the starting of essential equipment required for the safe shutdown of the plant (Sequence "A" loads shown in Tables 8.2-4 and 8.3-5). When the second diesel generator starts, a load-sequencing programmer will sequence the starting of sequence "B" loads (shown on Tables 8.2-6 and 8.2-7). Should the programmers become inoperable, the operator can manually sequence the restarting of essential equipment from the main control board."

Besides the automatic loading feature on each of the two divisions, sequence "A" or sequence "B", the data in Tables 8.2-4 and 8.2-5 indicate that the swing bus 2 loads are automatically energized along with the loads on bus 1 or 3 (sequence A or sequence B).

l

In the meeting of August 14, 1986, the licensee informed the staff that the swing bus 2 loading is only manual. Also, the EDG with both engines working is the one that is automatically connected to the bus. The other EDG, either with only one engine working or being second in line to reach rated voltage and frequency, is connected only manually to bus 1 or 3, whichever is second in line. When both EDGs are driven by only one engine each, the automatic closure of their output breakers is automatically inhibited. In this state, closing of the EDG breakers and loading of the EDGs is designed to be manual.

. 3) Additional Concerns a) Physical, Electrical Independence: A review of the electrical schematic diagrams for the 480 VAC essential buses indicated cases where the system physical and electrical independence appears to have been compromised. Redundant circuits are physically wired to common terminal blocks such that the circuits are in close proximity to each other. The electrical independence is compromised in those cases where the redundant circuits are wired to common devices such as relays. These relays are used for both control functions and permissive functions.

It has been the staff's practice not to accept such commonality in the case of the permissives, and has required electrical independence. It is possible for the contact block on a relay or circuit breaker to fail and thus disable all circuits connected to the control block.

b) Degraded Grid and Loss of Voltage Protection: During the licensee's study of FSV's degraded grid and loss of protection logic system, they discovered that two of the three logic trains (one on each 480 volt buses 1, 2 and 3) were powered from the j same 125 VDC source.

l

This 2-out-of-3 logic combination will start both EDGs. If the above stated DC power fails, the EDGs will not get a signal to automatically start on degraded grid voltage or loss of voltage as intended.

The licensee proposed to correct this situation by powering each of the three logic trains from the associated DC power supply circuit used for the control of the 480 VAC switchgear, rather than directly from the two DC buses. In this way, if one of the DC buses failed, the auto-throw-over (A-T-0) circuit would switch the affected logic train to the remaining DC bus. The A-T-0 scheme is an existing automatic control circuit that was

, installed at each of the three switchgear sets (bus 1, 2 and 3) to switch control power between the two redundant DC buses in the event that one of the buses fails.

The staff noted that this temporary modification resolved a specific design problem. However, the vulnerability of the design to the total loss of DC power still remains in the existing A-T-0 scheme.

The licensee agreed to examine and implement a solution that will preclude the loss of DC power as a result of a single failure.

Some of the possible solutions discussed during the meeting involved using the existing "C" battery as a third DC bus, changing relay logic from nonnally de-energized to normally energized, and manually switching the DC buses. In all cases, the proposed solutions involve plant modifications to existing circuits and the installation of additional equipment and hardware.

4 ACTION ITEMS At the conclusion of the meeting, the Public Service Company of Colorado (PSC) and the NRC agreed to the following actions items:

, 1. The NRC will write a memorandum to PSC regarding the FSV design i

of the EDGs and 480 VAC essential buses. This will contain the staff's position and concerns, regarding the licensee's proposed l

l

temporary modification involving the DC supply to the undervoltage relay logics. (This review status report completes this action).

2. The licensee will draft a letter outlining the actions that they are going to take to resolve the staff's concerns expressed in this review status report and discussed during the August 14, 1986 meeting.

3. The licensee will provide analyses that will show:

a. Manual capability exists to control the 480 VAC circuit breakers;

b. The EDGs can not be paralleled;

c. No single failure in the automatic circuits will inhibit the manual controls for the EDGs or for the 480 VAC essential component circuits breakers, s

4. The licensee will remove common relays DEV-86RT and DEV-86ET1 from the EDG circuits prior to re-start. [Ref:

PSC letter dated 7-1-86 from D. W. Warembourg (PSC) to H.

Berkow(NRC).]

Prepared by: I. Ahmed, DPWRL-B Date:

l