ML20213G581

Draft Review of Fort St Vrain Onsite AC 'Standby' Power Sys W/Regards to Compliance to Single Failure Criterion & Ser

ML20213G581
Person / Time
Site:	Fort Saint Vrain
Issue date:	08/07/1986
From:	Jacobsen J, Nolan A IDAHO NATIONAL ENGINEERING & ENVIRONMENTAL LABORATORY
To:	NRC
Shared Package
ML20213G565	List: ML20213G564 ML20213G581
References
CON-FIN-D-6023 TAC-59801, NUDOCS 8611180209
Download: ML20213G581 (23)

Text

.

.': Enclosure 2 EGG-NTA-k Uy US$ 7,/996 m <

m dd iL WL d i REVIEW OF THE FORT ST. VRAIN ONSITE AC " STANDBY" POWER SYSTEM WITH REGARDS TO COMPLIANCE TO THE SINGLE FAILURE CRITERION AND THE SER DOCKET NO. 50-267 TAC NO. 59801

, INEL Reviewers - J. F. Jacobsen/A. E. Nolan .

NRC LEAD Reviewer - I. Ahmed INEL PROGRAM Manager - C. 1. Nalezny NRC FSV Project MANAGER - K. Heitner NRC Program Manager - M. Carrington Idaho National Engineering Laboratory EG&G Idaho, Inc.

Prepared for the U. S. Nuclear Regulatory Comission Washington, D.C. 20555 Under DOE contract No. DE-AC07-76ID01570 FIN No. D6023 P

CONTENTS A c k n owl e d gme n t s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . i i Abstract...................................................... iii Summary.......................................................

iv

1. INTRODUCTION........................................... 1

2. DESIGN BASE CRITERIA..................,................. 2

3. E VA LU AT I O N . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 3.1 System Description................................. 3 3.2 Event Analysis..................................... 5 3.3 Licensee Response to NRC Concerns.................. 6 3.4 Additional Examples of Single Mode Failures........ 9 3

4. CON C LU S I O N S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

5. R E F E R EN C ES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 a'

APPENDIX A...................................................... A-1 l

J i

\

i 1

s ACKNOWLEDGMENTS .

TheauthorwouldliketoacknowledgeD.-J.5endersonforhis assistance in analyzing emergency diesel generator systems, A. D. ,

Hill for his assistance in functional operation of electrical s '

distribution equipment, and B. L. Collina and R. E. Polk for ,

their technical assistance throughout the review. -

'r j

n '

I 3

/

.i I

j .

en

• I 11 l

1 a \' .

l ABSTRACT This report was prepared for the U.S. Nuclear Regulatory

[ , Commission (NRC) to assist them in evaluating the Fort St. Vrain (FSV) Nuclear Power Generating Station onsite AC " standby" power systen for compliar.ce with 10 CFR 50, Appendix A, General Design Criteria 17 (Single Failure Criteria).

This report also evaluates the Public Service Company of Colorado

. - (PSC) respr.nse to concerns expressed by the NRC in their Safety Evaluation Report (SER), which evaluates the December 18, 1984, failure of- the onsite AC " standby" power system (Licensee Event Report [LER] 50-267);

i i

S f

ei i

{ O e

P e

r O

4

'l 4 ;

4 SurMARY The Fort St. Vrain onsite AC'" standby" power system failed during a semi-annual loss-of-offsite-power and turbine trip surveillance test on December 18, 1984. Subsequent to this event, the Nuclear l Regulatory Commission (NRC) asked EG&G Idaho to review the responses of the licensee for compliance to the single failure criteria and for compliance to the Safety Evaluation Report (SER) issued by the NRC.

EG&G Idaho has reviewed the Licensee Event Report (LER), supporting documentation, electrical diagrams, FSAR, and correspondence submitted by the licensee to the NRC in connection with this event. '

The review determined that the proposed modifications to the

~

system by Public Service Company of Colorado'(PSC) did not resolve the concerns as pointed out in the SER. The diesel engines and their associated generator cusput breakers remain susceptible to a single failure that will result in the loss of all " standby" power.

l iv 1

l

s 1. INTRODUCTION On December 18, 1984, the Fort'St. Vrain Nuciear Power Generating Station (FSV) experienced a total failure of the onsite AC " standby" power system during a semi-annual test of the system.1 1

As'a result of this failure and of other NRC con'cerns about the independence of redundant power sources in the " standby" system, the NRC evaluated the FSV emergency electrical systems. 'The results of this evaluation were contained in a Safety Evaluation (SE), which was transmitted to the licensee on July 10, 1985.2 The SE addressed two safety-related concerns, raised the question of possible '

nonconformance to the FSAR, and concluded that the plant could be u

operated, relying on manual controls, for an interim period while actions to correct the safety-related concerns were being pursued.

s The licensee responded by letter, dated September 13, 1985,5 which transmitted the Proto-Power Corporation's evaluation of the FSV's l

.. onsite " standby" power system and their recommendations.

l The NRC then contracted EG&G Idaho to: 1) review the emergency diesel generator (EDG) system for compliance to the single failure criteria;

2) review FSV's proposed resolution to the NRC's concerns, as raisSd in the SER;.and, 3) evaluate the independence of redundant " standby"

~

power sources.

1 A

2. DESIGN 8ASE CRITERIA The following design base criteria were applied in the evaluation of the Fort St. Vrain " standby" AC power system:

1. General Design Criterion 17 (GDC), " Electrical Power Systems," of 10 CFR 50 Appendix A, " General Design Criteria for Nuclear Power Plants."

2. IEEE Standard 279-1971, " Criteria for Protection Systems for Nuclear Power Generating Stations."

3. IEEE Standard 308-1974, "IEEE Standard Criteria for Class IE Power Systems for Nuclear Power Generating Stations."

4. IEEE Standard 384-1981, "IEEE Standard Criteria for Independence of Class 1E Equipment and Circuits."

5. IEEE Standard 352-1975, "IEEE Standard Criteria for Class IE Power Systems for Nuclear Power Generating Stations."

6. IEEE Standard 379-1977, "IEEE Standard Application of the i Single Failure Criterion to the Nuclear Power Generating Station Class 1E Systems."

2

i ,

3. EVALUATION 3.1 System Description As shown in Figure 1, the FSV onsite AC power system consists of two 1210 kW emergency generators (each driven by two diesel engines),

output breakers', redundant primary buses (No. I and No. 3), and a smaller swing bus (No. 2). The buses are common to both the offsite

. power source and the emergency diesel generators (EDG).

The swing bus automatically connects to the first primary bus energized. Interlocks prevent the swing bus from connecting to both primary buses at the same time. With both diesel engines connected, 3

each generator is designed to supply the combined loads of its respective primary bus and the swing bus. If required, each generator can be manually connected to its primary bus and the swing ,

i bus.

The FSV Final Safety Analysis Report (FSAR)3 states that if either one of the two diesel engines fails, it will be declutched from the generator, and the remaining engine should continue to drive its respective generator at 50% of the generator's rated capacity.

i 3

J h

Offsite Power Offsite Power 252BT12 252BT32 1

m 2 A 3 (SwingBus) 252DG1A 252DG1B Diesel -

Diesel Diesel ~ Diesel Engine Engine Engine Engine 1A -

IB IC ID Generator Generator IA IB 3

FIGURE 1 FORT ST. VRAIN ONSITE AC

,' " STANDBY" POWER SYSTEM l

4

3.2 Event Analysis In an effort to determine FSV'S compliance to the single failure criteria and to the provisions of the SER, a simplified fault tree

~

analysis was performed on the diesel engine and load breaker sequencing logic based on control diagram E-1203, page P.1601.4 This analysis is presented in Appendix A.

The results of the analysis confirmed the statements in the SER that unless both diesel engines associated with a given generator are running that generator will not pick up the load upon loss of off-site power. However, the analysis also showed that, when one of the redundant generators has '

picked up the load (both diesel engines running), the off-line generator can be placed on-line with only one of its diesel engines running.

In the December 18th event, diesel engine 1A of generator IA had l been disconnected as part of the test. Shortly after the test was initiated, diesel engine IC of generator IB shut down and declutched. Since neither generator had both engines running, the output breakers could not close.

The results of the reliability calculations in the Fort St. Vrain FSAR are based on an operational dstandby" system with a i two-out-of-four failure. PSC has stated that a two-out-of-fout 5

diesel engine failure cannot disable the " standby" power system.

However, our analysis shows that a two-out-of four failure can cause a total failure of ' standby" power.

3.3 Licensee Response to NRC Concerns In response to the concerns expressed by the NRC in the SER, PSC contracted the Proto-Power Corporation to conduct an overall evaluation of the FSV onsite " standby" power system. This study

~

evaluated the 480 VAC essential bus tie breaker control scheme. The study included the 480V essential bus undervoltage relays ard sensors, the 480V switchgear bus supply breakers, the 480V essential -

~

bus tie breakers, the diesel generator circuit breakers, the load sequencer, timers T1 and T2, and the diesel engine start /run circuitry.6 s

As a result of their evaluation, Proto-Power Corporation recommended that PSC rewire certain terminal blocks to provide

. physical separation of the essential circuits. This recommendation is superficial at best, as it does not achieve the independence between the two redundant systems. The relays and their contacts still interact with the two redundant systems, and the potential for common mode failures remains.

~

6

In addition to recommending the rewiring of the terminal blocks, the Proto-Power report disclosed a potential failure associated with the synchronizing (sync) switch with respect to a degraded bus condition. Under normal operating conditions, when the voltage of the on-line bus drops to the 77.5% level, the associated output

^

breaker is tripped and the associated tie breaker is closed to transfer the previously degraded bus to another operating bus.

The report pointed out that if the sync switch is failed, or if the operator neglected to return the sync switch to the "0FF" position, the degraded bus associated output breaker would be inhibited from tripping, and the possibility would exist for paralleling the degraded bus to a normal operating bus by closing the associated tie breaker.

As a result, Proto-Power reconnended that a normally closed contact on the output breaker be wired in series with the applicable contact that closes the associated tie breaker. This modification will a prevent the associated tie breaker from being closed if the associated output breaker has not been opened.

The sync switch is used only during load testing to sync the diesel generator frequency and phase with off-site power. The sync switch at FSV is of the maintained-contact type, as opposed to the spring return to off, or normal, position which is usually used.

7

PSC stated that, in addition to the recommendations made by the Proto-Power Corporation, other analyses performed on the " standby" system showed that automatic closure of each EDG output breaker is provided for through two diverse paths. Therefore, the automatic operation of a redundant power supply (EDG) is assured.

This statement is essentially in error, since " diverse" means to have different forms or components. The paths for the closure of each EDG output' breaker are idential in their design, function, and

~

components, and both paths are subjected to the potential for common mode failures. The Proto-Power recommendation did not remove the  ;

components that are common to the two paths. ,

3.3.1 Analysis of the Licensee's Response An analysis of the licensee response determined the following:

1. The rewiring of certain terminal blocks achieves only l physical separation of the wiring of redundant circuits and does nothing to create electrical independence of the redundant circuits. No functional l changes to the existing circuits were made.

2. The rewiring of the sync switch removed the potential for paralleling a degraded bus to an operating bus.

8

3. In spite of the claim of there being two diverse paths to provide for the automatic closure of the EDG supply breakers,[theanalysisshowsthatthebreakerswillnot close if either of the generators does not have both diesel engines connected (running).

4 3.4 Additional Examples of Single Mode Failures From the se'h ematic diagrams provided by the licensee, it appears that system independence has been comprised many times. For example, on PSC drawing E-1203, page P-1601, the plant design allows for the following devices to be supplied from both redundant instrument buses '

ESSBILO and ESS.82LO, and CR-9200-A and CR-9200-B, contacts from breakers 252DG1A and 252DG1B; TIMERS T1 AND T2; CR-9240, CR-9228, CR-9215, and TR-9212. On print E-1203, page p-1600, CR-9228, s

CR-9201, CR-9202, TR-9205, TR-9206, CR-9205, CR9206, T1, T2, 286G1A,

~

and 286G1B also appear to compromise the independence of the redundant systems.

Page P-30 of E-1203 indicates that auxiliary relay DEV86RT, through its contacts, initiates the start /run logic of all four diesel engines. The single failure of this control relay could prevent all four diesel engines from being started automatically and,

! in the case of a credible design basis event, the relay could prevent l -

the diesel engines from being started manually, i .

9 l

4. CONCLUSIONS The review of the Fort St. Vrain documents and drawings revealed the following deficiencies in the onsite AC." standby" system.

1. As discussed in section 3.2, the present breaker control circuit design may prevent the automatic energizing of the 480V essential buses.

l

2. Asdiscussedinsection3.3,PSChssnotcompliedwith

.l j the NRC concerns. The potential for a single failure disabling the " standby" power system still exists. '

E

. Independence between the two emergency diesel generator power systems has not been achieved.

As stated earlier, the proposed modifications (re-wiring of the terminal blocks) do not eliminate the f, potential for a single failure disabling the standby -

power system, and do not provide the required independence between the redundant power systems. '

3. As discussed in section 3.4, there are a number of control interconnections between the redundant generators and circuit breakers that may allow a single failure to result in the loss of beth " standby" power systems.

10

It is recomended that the licensea perform a detailed single failure analysis and propose any necessary corrections in the design to the NRC for review and concurrence.

e 4

e O-11

5. REFERENCE DOCUMENTS

1. Licensee Event Report, Fort St. Vrain Unit No. 1, Docket No.

50-267, " Failure of Diesel Generator to Close-In During Loss of Outside Power Test," December 18, 1984.

2. NRC letter, E. H. Johnson to 0. R. Lee, with enclosed Safety Evaluation of Emergency Electrical Power System, July 10, 1985.

3. Fort St. Vrain, Final Safety Analysis Report, Updated FSAR, Revision 2,Section VIII.

4. Fort St. Vrain Unit No. 1 Schematic Diagram, Drawing No. E-1203.

5. PSC letter, D. W. Warembourg to D. R. Hunter, P-85318, September 13, 1985.

6. Proto-Power Corporation, " Truth-Analysis / Action-Reaction

' Review of 480V Essential Bus Tie Breaker Control Scheme," '

August 1985.

3 e

e 12

i l

1 l

j i

J e

I APPENDIX A FAULT TREE ANALYSIS OF DIESEL AND LOAD BREAKER -

SEQUENCING LOGIC g

I l

l l

l A-1

APPENDIX A FAULT TREE ANALYSIS OF DIESEL AND LOAD BREAKER SEQUENCING LOGIC A fault tree analysis was performed on the diesel engines and output breaker sequencing logic based on control diagram E1203, page P-1601. The analysis was performed using the methodology presented in IEEE Standard 352-1975.

The analysis, as presented in Figures A-1 through A-3, shows that the events leading to failure of the essential buses are as follows:

1. Loss of all power sources. '

2. Loss of the output breakers from the emergency diesel generators.

On generator IA, for example, breaker 252DG1A will not be closed

! if relays CR-9203 and TR-9201 have not been energized. Relay CR-9203 i

will not be energized if any of the following occurs: The contacts of IRSX1A or CR-9201 are open; P1 or P2 is open; timer circuits are open; the contacts of TR-9212, TR-9211, or 286G1B are open.

A-2 l

l

Since the contacts of all these relays are in series, either contacts CR-9252-A or CR-92522-B can be open and relay IRSX1A will not be energized. Relays CR-9252-A and CR-9252-8 are energized only when both engine 1A and engine IB are running. Therefore, in order to close DG output breaker 252DG1A, both engines (1A and IB) must be running. This same logic condition exists on generator IB (breaker 252DG1B) and on engines 1C and 10.

9 9

9 e

i l

A-3 I

(

1

l e o I e

f i

l 5 l

- *8:

-~o w

a C55 l

$ 5 w .9 *s w and C;a 1M EB

$8 25

- m2 gb

! U$

W WF e5 ee 8

.g g -

aw <a gw g

$I ~

.5

~w bM k o< d~

mE g Eoo e--

Md Iw b

. 3 488 E _g o "We m g

. ~ w $"= A <

W=-

g Wa uBY ~ o

-a -u.5.W. 6 E s.

b 2

M a E .y wh @

am

" E="E 7 u .

U em.

mgg N

e. =- =

=<

era <

Wm

= s

=

"We

-w E ~8 m

55 "

i ram g..-

oge d

I

=a

=

m C55 M-

_ 5

= <,-

=_g _

a .

5

• WI

$N "N

- e a- 8

-w W l- -

g g-i

~w ka~ >

a WE 2n .

i-ImM O"

WW g

W

=.-

5

_ s$=E

~

<=

g NW l

l 5E uw A-4

1 CONTINUED ON FIGURE Al .

RELAT CR-9203 NOT ENERGilEO WHEN REQUIRED i

i (b -

r%

I I I I RELAY CR-9201 EINAUST MAN RELAY TR-92f2 TI AND T2 TIMER ENGINE 1A 8 13 OR TR-9211 INTERLOCK RELAT RELAY IRSIIA NOT ENERGilED CIRCUITS NOT 286G1B NOT NOT ENERGIZED (f*O PMR FRON API AND AP2 NOT ENERGlZED FUNCTIONING ENERGlZED GEN 14) BEYOND LIMITS l

ENGINE 1A INGINE 18 Ti TIMER T2 TIMER DELAY CR-9252 A '

EINAUST MAN EIHAUST MAN RELAY CR-9252-8 circuli NOT circuli NOT NOT ENERG12ED API BEYOND LIMIT 5 AP2 8EYONO LIMIT: FUNCTIONING NOT ENERGIZED FUNCTIONING ENGINE 1A ENGINE 18 NOT RUNNING e NOT RUNNING e i

• If engine 1A or IB iS f1Ot rusming 2520G1A will not Cl0Se.

i e% e%

i 1 -

TI IIMER RELAT CR-9215 RELAT CR-9228 T1 TIMER CONTACTS NOT RELAY CR-9240 CONTACTS OPEN NOT ENERGIZED CONTACTS NOT NOT ENERGIZED FUNCTIONING FUNCTIONING l

Fault Tree Diagram Continued Figure A2

CONTINUED ON FIGURE Al RELAT CR.9204 NOT EERGIZED e WHEN REQUIRED 1 I I RELAY CR.9202 EXHAUST MAN i

RELAY TR-9212 71 and T2 INTERLOCK RELAY IMSIl8 NOT ENERGIZED ENGIME IA & 15 OR TR-9211 TIER CIRCUITS RELAY 286GIA NOT EPET.! ZED (NO POWER FROM AP3 AN04 P4 NOT ENERGIl[D NOT FUNCTIONileG NOT ENERGIZED GLN 1A BEYONO LIMITS y .

9

• r%

em I I ENGINE IC ENGINF ID Tl TINER T2 TIMER RELAY CR-9252-C RELAY CR-9252-0 EXHAUST stal EIHAUST Hall CIRCUlf NOT CIRCUIT NOT NOT ENERGIZED NOT ENERGIZED 6P3 KYD40 6P4 BEYOND LIMITS FUNCTIONING FUNCTIONING ENGINE lA ENGINC 18 LIMITS NOT RUNNING , NOT RUNNIN!G ,

• If engine IC or ID iS f10t

~~

, running 252DG1B will not be Closed.

1 I I -

l TI Tl'ER RELAY CR.9215 RELAY CR-9228 il TINER RELAY CR-9240 r0NTACTS NOT CONTACTS OPEN NOT EERGIZED CONTACTS NOT NOT ENERGIZED FUNCTIONI%

NOT FUNCTIONING Fault Tree Dfagram Continued Figure 3

..