ML20235B235
| ML20235B235 | |
| Person / Time | |
|---|---|
| Site: | Rancho Seco |
| Issue date: | 09/16/1987 |
| From: | Andognini G SACRAMENTO MUNICIPAL UTILITY DISTRICT |
| To: | Miraglia F Office of Nuclear Reactor Regulation |
| References | |
| GCA-87-577, TAC-66305, NUDOCS 8709240029 | |
| Download: ML20235B235 (19) | |
Text
- _ _ _ _, _ - _ _ _ - _ _ -.
issuun SACRAMENTO MUNICIPAL UTILITY DISTRICT C P. O. Box 15830, Sacramento CA 95852-1830,(916) 452-3211 AN ELECTRIC SYSTEM SERVING THE HEART OF CALIFORNIA SEP 16 1m GCA 87-577 U. S. Nuclear Regulatory Commission Attn: Frank J. Miraglia, Jr.
Associate Director for Projects Philips Bldg.
7920 Norfolk Avenue l
Bethesda, MD 20014 j
Docket 50-312 l
Rancho Seco Nuclear Generating Station Unit #1 LOSS OF 0FFSITE POWER TEST
Dear Mr. Miraglia:
Rancho Seco will be conducting a Loss of Offsite Power (LOOP) Test to verify independence within the extensively modified Electrical Distribution System (EDS). To conduct the test during current plant conditions (i.e. cold shutdown with very low decay heat) we will need relief from the plant Technical Specification definition of OPERABLE.
(See Executive Summary
{ ).
As you are aware, the District has made major modifications to the Rancho Seco Electrical Distribution System.
The modifications include the addition of two (2) Emergency Diesel Generaters and the movement of selected safety related loads to the new Diesel Generators.
Following the guidance in Regulatory Guide 1.41, "Preoperational Testing of Redundant Onsite Electric Power System to Verify Load Group Assignments," the District developed a program to test the final configuration of the EDS.
One of the major goals of the test procedure is to verify the independence of the redundant onsite power sources and their load groups.
Based on our 10 CFR 50.59 evaluation, we are requesting relief from a Technical Specification (TS) Limiting Condition for Operation (LCO). Our l
evaluation concludes that operating in excess of the LC0 action statement for the period of time that relief will be granted will not place the plant in an unsafe condition.
8709240029 070916
(
PDR ADOCK 05000312 P
PDR 0
}
i t
I RANCHO sECO NUCLEAR GENERATING STATION E 14440 Twin Cities Road, Herald, CA 95638-9799;(209) 333-2935
GCA 87-577 Frank J. Miraglia, Jr. The ottachment includes a "no significant hazards consideration" (Attachment
- 2) that summarizes our evaluation that the conduct of the test will pose no safety problem. We have also included a more detailed safety analysis (Attachment 3) supporting the need for the requested relief based on the OPERABLE definition in the plant Technical Specifications.
Our current schedule indicates we will conduct the LOOP Test in early November and therefore request your timely review granting the waiver. A draft of the procedure will be available September 25, 1987 and the final approved procedure will be available no later than October 25, 1987.
If you have any questions, please contact Karl Meyer of my staff.
Sincerely,
'/MLo G. Carl Ando ni Chief Executive Officer, Nuclear Attachments cc:
J. B. Martin, NRC - Walnut Creek George Kalman, NRC - Bethesda A. D' Angelo, NRC - Rancho Seco l
l l
l l
I
)
l 4
E_--- -
4 EXECUTIVE
SUMMARY
ATTACHMENT 1 STP.961, Loss of.Offsite_ Power PAGE 1 OF 2 EXECUTIVE
SUMMARY
Special Test Procedure 961 (Loss of Offsite Power Test) conducts a series of tests of the emergency power system.
Regulatory Guides, and Technical Specifications, require that the diesel generators start, load in sequence,. add the largest single load without voltage degradation, and reject the largest single load-
.without an overspeed: trip, for a loss of offsite power and safety-features actuation signal.
One of the major goals of the Test is to verify the independence of the redundant diesel generator trains.
The components powered from the bus being tested will have their emergency power source available at all times (except for. periods of up to one minute, during which time the diesel generators are starting or load shedding and are not closed on their respec-tive buses).
However, during several of the tests conducted as part of STP.961, the emergency buses will, singly or in combina-tion, have their power' removed by means of opening the bus' normal, alternate, and/or emergency power supply breakers. There-fore, both the components on the buses being tested, and the redundant components will not be operable (according to the definition of " OPERABLE" given in Rancho Seco Technical Specifi-cations section 1.3), since their normal power supply and/or emergency power supply will not be available.
At any time during the conduct of STP 961, should an actual loss of onsite power occur (i.e.,
the diesels being tested fail to start), normal power would be restored to the buses being tested j
and the redundant buses, by reclosing the normal / alternate power supply breakers.
Individuals in constant communication with the control room, will be continuously manning these breakers to restore power to the buses.
In the unlikely event that power cannot be restored, and removal of decay heat from the core by forced circulation is precluded, heat removal is available using natural circulation from the reactor vessel to a steam generator.
Given the present plant conditions (cold shutdown, last previous power operation on 12/26/85), the amount of decay heat being generated in the core is very small, as shown by Special Test
. Procedure 1011 (Determination of Decay Heat Load), performed in March of 1987.
For any credible periods during the performance of STP 961, when decay heat removal flow is not available, the low decay heat load precludes a substantial heatup of the reactor coolant system.
1 t.
'1 J
c I
. EXECUTIVE
SUMMARY
(cont.)
ATTACHMENT.1.
l STP.961, Loss of Offsite-Power PAGE 2 OF-2 The removal of. power to the-redundant buses and buses being tested places the. Decay Heat Removal Pumps.and Reactor Coolant
. Pumps.in an " inoperable" status for a finite period of time.
Although these pumps will be functional during'that time, the "inoperability" of the1 decay heat removal system and reactor coolant: system during the performance of STP.961 enters into the A,ction Statement of Technical Specification section 3.1.1.5;
.therefore,-this test requires relief from the plant Technical Specification definition of OPERABLE.
Additionally, the "inoperability" of these systems reduces the margin of safety as defined in the -Bases for Technical Specifi-cations sectionR3.1, which requires two decay heat removal /reac-tor coolant loops'to be operable; therefore, an Unreviewed Safety Question is involved.
However, the performance of STP.961 does Enot involve a significant reduction in a margin of safety since the "inoperability" of the Decay Heat Removal System and RCS
' loops is for.a short period of time-and the District is'taking compensatory measures during the conduct of STP.961.
The reactor
. coolant system will be maintained in a condition which allows the-removal of decay heat by natural circulation to the steam genera-tors if forced circulation is lost.
.If natural circulation cannot be established, observed decay heat loads are. low enough that the margin of safety will not be significantly reduced.
Tnerefore, the District concludes that the performance of STP.961 does not constitute a significant hasard to the public, and in no i
1 vay endangers the public's health and safety.
l
l l
H I
NO SIGNIFICANT. HAZARDS CONSIDERATION ATTACHMENT 2 l
STP.961, Loss of.Offsite Power PAGE 1 OF 2 NO SIGNIFICANT HAZARDS CONSIDERATION f
STP.961--(Loss of'Offsite Power Test) conducts a test of the emer-gency power system.
The test uses guidance provided in various H
Regulatory Guides dealing with emergency power requirements.
These regulations, and Technical Specifications, require that the diesel generators start, load in sequence, add the largest single load without voltage degradation, and reject the largest single load without an overspeed trip, for a loss of offsite power and SFAS signal.
The tests also demonstrate the independence of the diesel' generator trains and that the diesel generators can accept all of the required loads without experiencing undue instability per IEEE Standard 387-1977 (IEEE Standard Criteria for Diesel Generator Units Applied as Standby Power Supply for Nuclear Power
-Generating Stations).
During the performance of STP.961, normal and/or emergency power to various buses will be removed in a controlled manner by proce-dure.
During this period, the. decay heat removal pumps and RCS loops will be without power only momentarily (periods up to one minute), but will be " inoperable" (as defined in Technical Spec-ification section 1.3) for periods up to two hours.
During this period, methods exist to restore power to the appropriate buses by closing the bus normal supply breakers (the SU transformers will remain energised throughout the performance of STP.961) or starting the diesel generators.
If a series of failures prevents this, the primary system configuration will be maintained which allows forced circulation via the reactor coolant pumps or nat-ural circulation cooling.
If natural circulation is unable to be established, STP.1011 has shown that heatup due to decay heat is within acceptable limits, The District has reviewed the Special Test Procedure against each of the critorion of 10 CFR 50.92 and concluded that the perfor-mance of the tests would not:
a.
involve a significant increase in the probability or consequences of an accident previously evaluated because.the loss of normal power for test purposes is bounded by the analysed accident, "Results of Complete Loss of All Unit a-c Power", USAR section 14.1.2.8.4.
The use of steam generators for decay heat removal without forced circulation with RCS temperatures below 280 degrees F is not addressed in the USAR, however, the results are bounded by the " Loss of Electric Power" accident analysed in USAR section 14.1.2.8.
In the event of loss of the Decay Heat Removal System, Operating Procedure B.2A and Casualty Procedure C-12 provide alternate methods of removing heat f rc n the l
reactor core using natural circulation through the OTSGs, where excess heat can be removed with the con-densate system or gravity feed of the CST to the OTSGs.
I
NO SIGNIFICANT HAZARDS CONSIDERATION (cont)
ATTACHMENT 2 STP.961, Loss of Offsite Power PAGE 2 OF 2 b.
create the possibility of a new or different kind of accident from any accident previously evaluated be-cause both the loss of normal power supply for test purposes and the loss of decay heat removal are bounded by the " Loss of Electric Power" accident analyzed in USAR section 14.1.2.8.
c.
involve a significant reduction in a margin of safety since the "inoperability" of the Decay Heat Removal System and RCS loops is a short period of time and the pumps will be functional (the respective pump will be running within ten seconds of the start of each test and will continue running for the duration of each test).
The reactor coolant system will be maintained in a condition which allows the removal of decay heat by natural circulation to the OTSGs if forced circula-tion is lost.
Additionally, if natural circulation cannot be established, observed decay heat loads are low enough that the margin of safety will not be signi-ficantly reduced.
On the basis of the above, the District concludos that the per-formance of STP.961 (Loss of Offsite Power) does not constitute a significant hasard to the public, and in no way endangers the public's health and safety.
1
l l
SAFETY ANALYSIS ATTACHMENT 3 STP.961, Loss of Offsite Power PAGE 1 OF 13
~
l SAFETY ANALYSIS DESCRIPTION:
Special Test Procedure 961 (Loss of Offsite Power Test) tests the l
plant emergency power systems.
STP.961 has the following objec-tives:
c 1
1 l
1)
Section 6.1 -- Demonstrate that each diesel generator l
automatically starts when its associated bus loses vol-l tage.
(Each bus will be deenergized by opening its bus normal and alternate supply breakers to simulate a loss of offsite power; during this test, and all subsequent tests, no oil circuit breakers [OCBs] will be opened and no transformers will be deenergized.)
.;L 2)
Section 6.2 -- Demonstrate that each "A train" diesel generator successfully starts, accelerates to design voltage and frequency in 10 seconds or less, closes its associated output breaker, and sequences the emergency loads on the bus.
This occurs in response to a Loss of Offsite Power (LOOP) followed by a Safety Features Ac-tuation System (SFAS) signal.
Also, demonstrate that, with the "A train" diesels in normal standby, they will start, accelerate to design frequency and voltage, and be ready to load if required.
This occurs in response to an SFAS followed by a LOOP.
These tests use a gen-eral SFAS signal; however, there will be no movement of the reactor building spray valves in response to the SFAS.
3)
Section 6.3 -- Demonstrate that each "B train" diesel generator successfully starts, accelerates to design
~
voltage and frequency in 10 seconds or less, closes its associated output breaker, and sequences the emergency loads on the bus.
This occurs in response to a Loss of Offsite Power (LOOP) followed by a Safety Features Ac-tuation System (SFAS) signal.
Also, demonstrate that, with the "B train" diesels in normal standby, they will start, accelerate to design frequency and voltage, and be ready to load if required.
This occurs in response to an SFAS followed by a LOOP.
These tests use a gen-eral SFAS signa); however, there will be no movement of the reactor building spray valves in response to the SFAS.
4)
Section 6.4 -- Demonstrate that, with the total loss of all Nuclear Service bus power and total loss of buses 4B, 4B2, and 4C and their DC control power, the "A train" emergency diesel generators will start in res-ponse to a LOOP and sequence loads on bus 4A and 4A2 in response to an SFAS, while the majcr pump breakers are
SAFETY ANALYSIS ATTACHMENT 3 STP.961,' Loss of Offsite-Power PAGE 2 OF 13 in the." TEST" position.
Additionally, demonstrate ~
that, with the total loss of all Nuclear Service bus L
power and total loss of buses 4B, 4B2, and 4D and their DC control' power, the "A train" emergency diesel gener-ators will start in response to a LOOP and sequence
-loads on buses 4A and 4A2 in response to an SFAS, while the major pump breakers are in the " TEST" position..
The "B train" emergency diesels will purposely be
" locked out" to demonstrate independence between "A"
and "B" trains.
The method by which the diesel genera-
,O tors will be " locked out" during this test, and subse-quent test 5, is by interrupting 125v DC to the start circuit.
By returning 125v DC to.the starticircuit (an operator manually positions a switch), and depressing the RESET button, the respective diesel generator is available and will start immediately if required to do so.
5)
Section 6.5 -- Demonstrate that "B train" diesel gener-ators will perform the test described above (test.4)
-satisfactorily with "A. train" diesels " locked out".
6)
Section 6~.6 --: Demonstrate that, with a loss of offsite power followed by an SFAS condition, all four diesel generators will start, their buces (4A/4A2 and 4B/4B2) will shed loads with the SFAS, and then sequence the emergency loads on the Nuclear Service buses while the major pump breakers are in the " TEST" position.
REASON FOR. CHANGE EurRDAD Special Test Procedure 961 is being performed using guidance pro-vided in the following Regulatory Guides:
-- " Independence Between Redun-dant Standby (Onsite) Pc.wer Sources and Between Their Distribution Systems" Reg. Guide 1.9
-- " Selection, Design, and Quali-fication of Diesel-Generator Units Used as Standby (Onsite) Electric Power Systems at Nuclear Power Plants" Reg. Guide 1.108 -
" Periodic Testing of Diesel-Generator Units Used as Onsite Electric Power Sys-tems at Nuclear Power Plants' I
i
SAFETY ANALYSIS ATTACHMENT 3-STP.961, Loss of Offsite Power PAGE 3 OF 13 Reg. Guide 1.41
-- " Pre-operational Testing of Redundant Onsite Electric Power Systems to Verify-Proper Load Group Assignments" The above regulatory guides require that the diesel generators start, load in' sequence, add the largest single load without vol-tage degradation, and reject the largest single load without an overspeed trip, for a loss of offsite power and SFAS, signal.
Testing in STP.961 will accomplish a single largest load reject-lon on a per-diesel basis, as opposed to a per-train basis.
One of the major goals of this testing is'to verify the independ-ence of the redundant onsite emergency power sources and their loads.
Regulatory Guide 1.41 states "As part of the initial pre-operational testing program, and also after major modifications or repairs to a facility, those on-site electric power systems..
should be tested as follows 1x) verify the existence of indepen-
'dence among redundant on-site power sources and their load' groups."
Test 2 is described as follows:
"Under the conditions of C.1, above, the on-site electric power system should be func-tionally tested successively in the various possible combinations of power sources and load groups with all d-c and on-site a-c power sources for one load group at a. time completely disconnec-
-ted."
The tests to be conducted under STP.961 use various com-binations of offsite and onsite power with only one train of
-emergency diesel generators available.
l l
The tests also' demonstrate that the diesel generators can accept all of the required loads without experiencing undue instability per IEEE Standard 387-1977 (IEEE Standard Criteria for Diesel Generator Units Applied as Standby Power Supply for Nuclear Power Generating Stations).
EVALUATION AND BASIS FOR SAFETY FINDINGS:
S atemg1 Subsystemni ComE2 Dents Affected t
The loss of offsite power tests affect the diesel generators and the-vital electrical distribution system.
Additionally, the sys-l tems whose Technical Specifications are affected by these tests l
are the Decay Heat Removal System and the Reactor Coolant System.
Limiting Conditions for Operation for onsite electrical power and the electrical distribution system are addressed in Technical i
Specification section 3.7, AUXILIARY ELECTRICAL SYSTEMS, and the.
l Surveillance Standards are given in Technical Specification sec-I tion 4.6, EMERGENCY POWER SYSTEM PERIODIC TESTING.
These Techni-cal Specifications are not applicable in the present Cold Shut-down conditions, with the exception of those components required to maintain the DHR loops and RCS loops operable.
I
SAFETY ANALYSIS ATTACHMENT 3 STP.961, Loss of Offsite Power PAGE 4 OT;13 The Limiting Conditions for Operation for the Reactor Coolant System'are given in. Technical Specification section 3.1.
The re-l quirements for Operational Components for the Decay Heat Removal L
System-(applicable'for present plant conditions) are presented in-j section 3.1.1.5 of. Technical Specifications, with the Bases ad-E dressed-in section 3.1.
L SafatZ EMnnti2Da 9.f Affssied SZatoms/ Comp _quenta The plant electrical distribution system consists of the various
-auxiliary electrical systems required to provide reliable elec-l
.trical power during all modes of operation and shutdown condi-tions.
Safety features auxiliaries are arranged so that loss of a single bus will leave sufficient auxiliaries-to safely perform the required function.
In general, auxiliaries related to func-tions.other than safety features are connected to their respec-L
.tive unit auxiliary bus.
Safety features ~1oads are divided L
between two independent systems according te the single failure l
criterion (USAR section 8.2.2).
l
.Upon loss of all sources of electrical power, power is supplied from two existing, automatic, fast start-up auxiliary diesel gen-erators (GEA and GEB).
The generators are rated at 2750kw at 0.8 power factor.
Each of these auxiliary generators will feed its nuclear services 4160v AC bus.
Two new diesel generators have Lbeen installed to provide additional standby diesel generator power capacity.
The two new 3000kw diesel generators (GEA2 and GEB2) supply new buses S4A2 and S4B2, respectively.
The new diesel generators automatically start and connect to their buses following a loss of voltage to its respective bus.
They also automatically start upon receipt of an SFAS.
The reactor coolant system (RCS) provides heat removal capability to the reactor during all modes of plant operation.
Additional-ly, the reactor coolant system serves as a barrier to prevent radionuclides in the reactor coolant from reaching the atmosphere (USAR section 4.2.1.1).
The Decay Heat Removal System removes decay heat from the core and sensible heat from the reactor coolant system.
The system l
I also provides auxiliary spray to the pressurizer for complete depressurization, maintaining the reactor coolant temperature during refueling, and provides a means for filling and draining
{
the fuel transfer canal.
In the event of a loss-of-coolant accident, the system injects borated water into the reactor j
vessel for long-term emergency cooling (USAR sections 9.5, Decay l
l Heat Removal System, and 6.2, Emergency Core Cooling System).
l 1
l
- _._j
m.
w
=
.,y
+
- L,,j.
'., ^
",j q.
1
%?
SAFETY ANALYSIS'
.\\-
ATTACHMENT S STP.961, Loss of Offsite Power m
PAGE 5 OF 13 Effa9tn 2n histy E9n9119BalAnalzgin 9f Effects' gn Sainty Eunctiona
. Technical Specification References The Bases for Surveillance Standard 4.6, EMERGENCY POWER SYSTEMS PERIODIC TESTING, states:
"The tests specified are designOdxto demonstrate that the diesel generators will'prokide power for operation of safety features equipmend..
They also assure that the emergency generator ccntrol system and the control systems for the, safety features equipment will function automatically in the event O'
of a loss of all normal a-c station service power,
'x, and upon the receipt of.a safety thatures actuation signal."
5 6
STP.961 is a special test procedure which verifies that the.emer-gency diesel generators meet the requirements of the Bases for Technical Specification secticn 4.-6.
The tests conducted by the procedure also demonstrate the independence of the emergency power trains and that the diesel generators can accept all of the above loads without experiencing undue instability per'IEEE Stan4 dard 387-1977 (IEEE Standard Criteria f 6r Diesel Generator yr.its Applied as Standby Power Supply for Nuclear Power Generating-Sta \\
tions).
Technical' Specification section 3.1&1.5', Decay Heat Removal, s
states:
?r i
"A.
At least two of the coolan't loops listed below shall be ' operable whef the" coolant average temperature'is below 2'J0 d6grees F execpt dur-ing fuel loading'and refusQing,
,1 1.
Reactor coolant loop (A) and its associated steam generator and at least ore associated reactor coolant pump, 2.
Reactor coolant loop (B) and its associated steam generator and at least'one associated reactor coolant pump, 3.
Decay Heat Removal Locp (A) 4.
Decay Heat Removal Loop /E)
With less than the above required coolant loops l
OPERABLE, immediately initiate corrective ac-l-
tion to return the required coolant loops to L
OPERABLE status as soor as.possible, be in COLD SHUTDOWN within 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br />."
j I
L
't.
y
' SAFETY ANALYSIS-ATTACHMENT 3 STP.961, Loss of Offsite Power PAGE.6 0F 13 Additionally, the Bases for Technical Specification section 3.1, Operational Components, includes the following statement:
"When Tave is below 280 degrees-F, a single reactor coolant loop or DHR loop provides sufficient heat removal capability for removing decay heat; but single failure considerations require at least two loops be OPERABLE.
Thus, if the reactor coolant loops.are not OPERABLE, this specification requires two DHR loops to be OPERABLE."
Thia' Bases deals with the capability to maintain an adequate heat removal capability for the. reactor core.
As is readily' apparent, what constitutes " operable" is central to these requirements and Bases. Technical Specification section 1.3, OPERABLE,-states:
"A component or system is operable when it is capa-ble of performing its intended function within the required range..
The component or system shall be considered to have this capability when:
(1) it satisfies the limiting conditions for operation defined in Specification 3, (2) it has been tested periodically in accordance with Specification 4, and has met its' performance requirements, (3) the system has available its normal and emergency sources of power, and-(4) its required auxiliaries are capable of performing their intended function.
When a sys-tem or component is determined to be inoperable 3
solely because its normal power source is inoperable a
or its emergency power source is inoperable, it may 1x3 considered OPERABLE for the purpose of satisfying the requirements of its applicable Limiting Condi-tion for Operation provided its redundant system or component is OPERABLE with an OPERABLE normal and emergency power source."
f, In sections 6.1 through 6.3 of the procedure, the normal power supply to the appropriate emergency buses will be removed by i-opening the normal and alternate supply breakers, to demonstrate A
that the respective emergency diesel generators start, load in 3
sequence, add the largest single load without voltage degrada-tion,-and reject the largest single load without an overspeed trip, upon a loss of offsite power and SFAS signal.
At all times during.these tests, the emergency power source to all equipment powered by the buses in question will be available, and all re-dundant systems and components will be operable with both an op-i l
erable normal and emergency power source.
Therefore, t 4 ring this l
period of testing, all decay heat removal components which re-l
.ceive their power from the buses being tested, will remain oper-Jable as required by Technical Specifications section 3.1.1.5,
~ Decay Heat Removal, and the Bases for section 3.1.
s a
I' SAFETY ANALYSIS ATTACHMENT 3 STP.961, Loss of Offsite Power PAGE 7.0F 13' I
In'the remaining three tests performed by STP.961 (procedure sec-l tions 6.4
-_6.6),
buses 4A, 4A2, 4B, 4B2, 4C, and 4D will, singly L
or-in combination, have their power removed by means of opening
-the bus normal, alternate, and/or emergency supply breakers.
The components on the bus being tested will have their emergency pow-L er. source available at all times (except for periods of up to one minute, during which time the diesel generators are starting or load shedding and are not closed in on their respective buses);
'however, the redundant components will not be operable (according l
to the-definition of " operable" given in Technical Specification l
section 1.3 and quoted above) since the normal power supply l
and/or emergency power supply will not be available.
In tests 4 and 5 (procedure sections 6.4 and 6.5), the redundant components' emergency power supplies (the redundant train of diesel genera-tors) will be " locked out" so that they cannot start.
The pur-pose of this is to demonstrate that the redundant trains of emer-gency diesel generators are completely independent of one another L
during a LOOP /SFAS condition.
In the final test (section 6.6),
all normal and alternate power will be removed so that all four emergency diesel generators will start.
During this test, there-fore, the redundant components will not be " operable" since the L
normal power supplies will be unavailable.
L Based on plant conditions (cold shutdown, low decay heat load),
i and the fact that personnel, who are in constant communication with the control room, will be continuously manning the breakers which have been opened to interrupt power to the buses, these compensatory conditions maintain an equivalent degree of protec-tion in meeting criterion 3 of the definition of OPERABLE -
"the system has available its normal and emergency sources of power".
Additionally, the electrical systems and components involved in 1
the testing will have been successfully tested prior to perform-ing sections 6.4 through 6.6 of STP 961, satisfying criterion 2 -
- '"it has been tested periodically in accordance with Specifica-tion 4, and has met its performance requirements".
Description of Tests In sections 6.1 through 6.3 of the procedure (tests 1 - 3), the i
normal power supply to the appropriate emergency buses will be removed, to demonstrate that the respective emergency diesel gen-erators start, load in sequence, add the largest single load without voltage degradation, and reject the largest single load without an overspeed trip, upon a loss of offsite power and SFAS signal.
At all times during tests 1 - 3, the emergency power i
source to the buses in question will be operable and all redun-dont systems and components powered from those buses will be op-erable with both an operable normal and emergency power source.
l Therefore, during this period of testing, all components required for decay heat removal which receive their power from the buses being tested, will remain operable as required by Technical Spec-
)
ifications section 3.1.1.5. Decay Heat Removal, and the Bases for l
SAFETY ANALYSIS-ATTACHMENT 3 STP.961, Loss of Offsite Power PAGE 8 OF 13 section 3.1.
In' tests 4 and 5-(procedure sections 6.4 and 6.5),_the normal l
power supply to the appropriate buses will be' removed, and the L
redundant components' emergency power supplies ~(the redundant
' train of diesel generators) will be " locked out" so that they cannot start.
The purpose of this is to demonstrate that-the re-dundant trains of emergency diesel generators are completely in-L dependent of one another during an LOOP /SFAS condition.
The l
method by which the diesel generators will be " locked out" during these. tests.is by interrupting 125v DC to-the diesel engine start circuit.
By returning 125v DC to the start circuit (an operator manually manipulates a switch) and depressing the RESET button, the respective diesel generator is available and will be able to start immediately if required to do so.
In the final test (section 6.6), all normal power will be removed to demonstrate that, with a LOOP, followed by an SFAS, all four emergency diesel generators will start.
This is done by opening the bus normal and alternate supply breakers.
Individuals, in constant communication with the control room, will be continuous-ly manning these breakers during the performance of this test to restore normal power to the bus if necessary.
i' The proposed duration of STP.961 (Loss of Offsite Power Test),
sections 6-.4 through 6.6, is 7 days.
During this period, the amount of time that any buses will be deenergised or emergency l
diesel generators will be " locked out" will be up to two hours.
During this two-hour period, the amount of time that there is no operational: decay heat removal using a DHR pump is less than two minutes (two 1-minute periods).
With the exception of this short period of time, the decay heat removal pumps will be available for service to remove decay heat. Additionally, with the excep-tion of these periods, the makeup pump will be available for l
maintaining pressurizer level and to establish and provide seal injection for the reactor coolant pumps, should their operation become necessary.
Start / Load Emergency Power Supply
).9 of procedure STP.961 contains the contingency plan
]
for tests 4 and 5 (sections 6.4 and 6.5) should an actual loss of offsite_ power occur during testing.
During these tests, one re-dundant train of emergency diesel generators will be purposely
" locked out" by interrupting 125v DC to the engine start circuit.
The situation could exist where it will be necessary to restore the " locked out" train of diesel generators to operability as quickly as possible..9 is the procedure to restore i
the generators to service.
l l
l
3.
SAFETY ANALYSIS ATTACHMENT 3 STP.961,-Loss of Offsite Power PAGE 9 OF 13
' Restore Normal Power Supply At any time.during'the conduct'of STP 961, should an actual loss of onsite' power _ occur (i.e.,
the diesels being tested fail to start),' attempts would first be made to. restore normal power to the bus from the SU transformers by closing the bus normal supply breakers.
The SU transformers (SUX #1 and #2) will remain.ener-gized, since at no time during the performance of STP.9611will
'the OCBs be opened.
The loss of offsite power will be simulated
-by' opening'the bus normal supply breakers from the control room.
'During the conduct of the tests, personnel in constant communica-tion with.the control room, will be manning the breakers to re-close them if necessary.
Natural Circulation Cooling 11n the unlikely event that restoration of forced circulation us-ing either of the two Decay Heat Removal pumps.is. precluded, al-ternate methods of removing decay heat are available.
Section 5 (Limits and Precautions) of STP.961 contains a step discussing alternate methods of heat removal via forced circulation using a reactor coolant pump (if seal injection is available), or natural circulation from the reactor vessel to the steam generator (OTSG), with the condensate system removing excess heat from the OTSG.
Also, Operation Procedure B.2A (Plant Operation in Cold Shutdown with Both DHS-Trains Not Operable) and Casualty Proced-
.ure C-12 (Loss of Decay Heat Removal System) are available to di-rect the establishment-of alternate methods of decay heat remov-al.
These procedures take into account the RC loops and include methods to keep RCS temperature below 200 degrees F.
Low Decay Heat Load
.Given the present plant conditions (cold shutdown, last previous
]
power operation on 12/26/85), the proposed technical inoperabili-i ty of the decay heat removal system and reactor coolant system (since seal injection, a required auxiliary, will not be avail-I
.able due to the loss of the makeup pump) does not impact nuclear safety.
The amount of decay heat being generated in the core is very small.
Special Test Procedure 1011 (Determination of Decay Heat Load), was performed in March of 1987 to observe the thermal responso of.the reactor coolant system and to determine the a
length of time available for the RCS to heat up without exceeding
- j cold shutdown limits when the Decay Heat Removal System is taken s
out of service for maintenance and repairs.
STP.1011 turned off the Decay Heat Removal Pumps to allow decay heat from the core to heat the reactor coolant.
Results of the test show that, from an initial temperature of approximately 109 degrees F, RCS tempera-ture. increased to approximately 126 degrees F over a three-day j
period.
For any credible periods during the performance of STP.961 when forced decay heat removal flow is not available (periods up to one minute during tests 4 through 6, or the period
_______ _ _ _ _ _ _ _ J
~
SAFETY ANALYSIS ATTACHMENT 3 STP 961, Loss'of Offsite: Power IAGE 10 OF 13 of time necessary to restore normal power or start the emergency
'diese1' generators in the event of an actual loss of power),-the
' low decay heat load precludes a substantial heatup of the reactor coolant system.
The' plant will stay in Cold Shutdown conditions-for the duration of the test, and a large margin of safety will be maintained throughout the test, with respect to RCS tempera-tures.
Limits and Precautions The procedure addresses the chance of excessive cooldown by sta-ting in'the Limits and Precautions section (Section.5.0), that the 10 degree per hour cooldown rate while in Cold Shutdown, should'not be exceeded.
-Pressurizer level will be maintained in a range (100-250") which will provide for natural circulation removal of decay heat to the 0TSGs, if that method of decay heat removal becomes necessary.
.The Limits and Precautions (section 5.0) of STP.961 specifies that pressurizer level be maintained between 100 and 250 inches during the performance of STP.961.
Makeup and letdown flows are to be adjusted if there is a deviation in pressurizer le el.
If, after a loss of offsite power, no.SFAS signal is generated and no emergency diesels start, pressurizer level will begin to drop due to' letdown flow.
If letdown flow has been balanced with seal in-jection flow prior.to the loss of power, the operator will have over one hour before pressurizer level leaves the stipulated band.
If pressurizer level falls to 105 inches, the procedure directs that RCS letdown flow be interrupted by closing SFV-22009.
Appropriate training will be given all personnel participating in the testing.
Pre-test planning, briefings, and training will be conducted in accord with AP 82, Conduct of Special Testing.
During the performance of STP.961, normal, alternate, and/or emergency power to various buses will be removed in a controlled manner by procedure.
During this period, the decay heat removal pumps will be.without power only momentarily (periods up to one minute during the three tests), but will be " inoperable" (as de-fined in Technical Specification section 1.3) for periods up to two hours.
Additionally, the reactor coolant pumps will be "in-operable" for these periods of time since seal injection will not be available.
Throughout the testing period, methods exist to restore power to the appropriate buses by closing the bus normal supply breakers (the SU transformers will remain energized throughout the performance of STP.961) or starting the redundant diesel generators.
If a series of failures prevents this, the reactor coolant system configuration will be maintained which al-lows natural circulation cooling.
STP.1011 has shown that heatup due to decay heat is low enough to allow ample time (more than three days) to re-establish a forced circulation method of decay
t V
' SAFETY' ANALYSIS ATTACHMENT 3 1
'STP.961, Loss'of Offsite Power PAGE 11 0F 13 1
-heat removal.
Effects of: Testing on Design This test procedure will not change the configuration or design basis of either the emergency power system or Decay Eeat Removal System.:.The procedure verifies that the emergency power system performs as intended and as designed.
The Decay Heat f.emoval System will not be " operable" during portions of the performance of the-procedure.
The loss of offsite power is analyzed in chapter 14 of the USAR and does not constitute a new failure mode.
The use of steam generators for decay heat removal without forced circulation with RCS temperatures below 280 degrees F is not ad-dressed in the USAR (section 9.6); therefore, this mode of decay heat removal represents a change to the USAR.
However, the use of the steam generators to remove heat from the RCS is bounded by i
the " Loss of Electrical Power" accident analysis contained in section 14.1.2.8 of the USAR.
(Refer to Safety Analysis Log No.
882.)
The " locking out" of the redundant train of emergency diesel gen-erators for tests 4 and 5, with subsequent removal of. normal pow-er to the emergency buses being tested, places the Decay Heat Re-moval Pumps and reactor coolant pumps (since seal injection will not be-available) in an " inoperable" status for a finite period of time (approximately two hours).
Although these pumps will be operational during that time (one decay heat removal pump will be operating for the tests), the system configuration during the performance of these sections of STP.961 enters into the " Action.
Statement" of Technical Specification section 3.1.1.5; therefore, the conduct of these tests requires relief from Technical Speci-fications.
In certain limited circumstances in which a license amendment would not be appropriate, and when a follow-up emergen-cy TS amendment is not normally needed, authority has been given to the Regional Administrator to grant such relief from Technical Specification LCOs.
Due to the low decay heat loads, and the short length of time during the testing in which the Decay Heat Removal System and reactor coolant loops would be " inoperable" no significant hasard exista due to the performance of STP.961.
_=
SAFETY. ANALYSIS:
ATTACHMENT 3
. STP.961,: Loss of Offsite Power PAGE 12 OF 13'
' Summarz STP,961-(Loss of Offsite Power Test) conducts a test of the emer-gency power system.
The test uses guidance provided in various
- Regulatory. Guides dealing with emergency power requirements.
These regulations, and Technical Specifications, require that the
' diesel generators start, load.in sequence, add the largest single load without. voltage degradation, and reject the largest single load without'an overspeed trip,.for a loss of offsite power and SFAS signal.
The tests also demonstrate the independence of the
' diesel generator trains and that the diesel generators can accept all of the required loads without experiencing. undue instability per IEEE Standard 387-1977 (IEEE Standard Criteria for Diesel Generator Units Applied as Standby Power Supply for Nuclear Power Generating Stations).
Loss of offsite power is an analyzed accident in chapter 14 of the USAR; therefore, interruption of power from offsite for test purposes does'not introduce a new failure mode.
She'STP will-only affect the " operability" of the DHR System and RCS during test sections 6.4 through 6.6.
The Decay Heat Removal Pumps are " inoperable" during those tests because they are sub-ject to single failures (redundant components are without either normal or emergency power) and-the RCS loops are inoperable since their required auxiliary (makeup pump) is momentarily.without power.
In the event that normal or emergency power is actually lost during theLperformance of any of the tests, the bus normal supply breakers may be reclosed or diesel generators started, as necessary, to restore' electrical power'to the buses being tested.
Operating Procedure B.2A and Casualty' Procedure C-12 provide al-ternate methods of removing heat from the reactor core using nat-ural circulation through the OTSGs, where excess heat can be re-moved with the condensate system.
The use of steam generators for decay heat removal, without forced circulation, with RCS tem-peratures below 280 degrees F is not addressed in the USAR (sec-
- tion 9.5); therefore, this mode of decay heat removal at these temperatures represents a change to the USAR.
The results of us-ing the OTSGs for decay heat removal, however, is bounded by the
" Loss of Electric Power" accident analysed in USAR section 14.1.2.8, in which the OTSGs are used to remove decay heat to maintain the plant in hot standby subsequent to a loss of all station AC electrical power.
The " locking out" of the redundant train of emergency diesel generators, with subsequent removal of normal power to the emer-gency buses being tested, places the Decay Heat Removal Pumps and l*
reactor coolant pumps in an " inoperable" status for a finite per-L iod of time (approximately two hours).
Although these pumps will be functional during that time (and one decay heat removal pump will be operating for the tests), the system configuration during the performance of sectione 6.4 through 6.6 of STP.961 enters in-l o
4 RSAFETY ANALYSIS.
ATTACHMENT 3 STP.961, Loss ~of Offsite Power PAGE 13 (HF 13-to the " Action Statement" of. Technical Specification section 3.1.1.5; therefore, this test' requires relief from Technical Specifications.
The probability of occurrence or the consequences of an accident previously evaluated in the safety analysis report will not be increased because under existing plant conditions, sufficient heat removal capability exists via natural circulation to remove decay heat.
The consequences of the loss of forced circulation are bounded by the USAR Chapter 14, Loss of Electric Power acci-dent.
The possibility for an-accident or malfunction of a different type than any evaluated previously in the safety analysis report will not be created because both the loss of normal power supply for test purposes and the loss of decay heat removal are bounded by the " Loss of Electric Power" accident analyzed in USAR section 14.1.2.8.
The margin of safety as_ defined in the basis for any Technical Specification would be reduced because the redundant Decay Heat Removal System and RCS loops (as discussed in the Bases for Tech-nical Specification section 3.1) will be inoperable as a result of the performance of STP.961.
j Therefore, the performance of Special Test Procedure 961 will involve an Unreviewed Safety Question.
Additionally, the perfor-mance of the tests will enter a Limiting Condition for Operation
" Action Statement" and will, therefore, require relief from Tech-nical Specifications.
)
l I
l 1
_