NRC-23-0062, Response to Request for Additional Information for License Amendment Request to Revise Technical Specification 3.8.1, AC Sources - Operating, Surveillance Requirement SR 3.8.1.12
| ML23286A120 | |
| Person / Time | |
|---|---|
| Site: | Fermi  |
| Issue date: | 10/12/2023 |
| From: | Peter Dietrich DTE Electric Company |
| To: | Office of Nuclear Reactor Regulation, Document Control Desk |
| References | |
| NRC-23-0062 | |
| Download: ML23286A120 (1) | |
Text
Peter Dietrich Senior Vice President and Chief Nuclear Officer DTE Electric Company 6400 N. Dixie Highway, Newport, MI 48166 Tel: 734.586.6515 Email: peter.dietrich@dteenergy.com October 12, 2023 10 CFR 50.90 NRC-23-0062 U.S. Nuclear Regulatory Commission Attention: Document Control Desk Washington, DC 20555-0001 Fermi 2 Power Plant NRC Docket No. 50-341 NRC License No. NPF-43
Subject:
Response to Request for Additional Information for License Amendment Request to Revise Technical Specification 3.8.1, AC Sources - Operating, Surveillance Requirement SR 3.8.1.12 In Reference 1, DTE Electric Company (DTE) submitted a License Amendment Request (LAR) to revise the Fermi 2 Technical Specifications (TS). In Reference 2, an email from Mr. Surinder Arora to Mr. Eric Frank dated September 1, 2023, the NRC sent DTE a Request for Additional Information (RAI) regarding the LAR. The response to the RAI is provided in. Sections of Reference 1 that are revised to address the RAIs are included in.
No new commitments are being made in this submittal.
Should you have any questions or require additional information, please contact Mr. Eric Frank, Manager - Nuclear Licensing, at (734) 586-4772.
References:
- 1) DTE Letter NRC-23-0002, License Amendment Request to Revise Technical Specification 3.8.1, AC Sources - Operating, Surveillance Requirement SR 3.8.1.12, dated May 5, 2023 (ML23128A017)
- 2) NRC E-mail Capture, Fermi 2 - Request for Additional Information for License Amendment Request to Revise TS 3.8.1, "AC Sources -
Operating," Surveillance Requirement 3.8.1.12, (EPID L-2023-LLA-0069)
USNRC NRC-23-0062 Page 2 I declare under penalty of perjury that the foregoing is true and correct.
Executed on October 12, 2023 Peter Dietrich Senior Vice President and Chief Nuclear Officer
Enclosure:
- 1. Response to Request for Additional Information
- 2. Revised LAR NRC-23-0002 Pages cc: NRC Project Manager NRC Resident Office Regional Administrator, Region III Michigan Department of Environment, Great Lakes, and Energy to NRC-23-0062 Fermi 2 NRC Docket No. 50-341 Operating License No. NPF-43 Response to Request for Additional Information to NRC-23-0062 Page 1 By letter dated May 5, 2023 (Agencywide Document Access Management System (ADAMS) Accession No. ML23128A017), DTE Electric Company (DTE, the licensee) requested an amendment to the Renewed Facility Operating License No. NPF-43 for Fermi 2 Power Plant (Fermi 2). The proposed amendment would revise technical specification (TS) 3.8.1, AC Sources - Operating, surveillance requirement (SR) 3.8.1.12. Specifically, the proposed amendment would add a requirement to verify the crankcase overpressure automatic trip for each emergency diesel generator (EDG) is bypassed on an actual or simulated emergency start signal. The U.S. Nuclear Regulatory Commission (NRC) staff has determined that the following additional information is needed to complete its review of the license amendment request (LAR).
Regulatory Requirements (EEEB):
Appendix A to Title 10 of the Code of Federal Regulations (10 CFR) Part 50, General Design Criterion (GDC) 17, Electric power systems, requires, in part, that an onsite electric power system and an offsite electric power system shall be provided to permit functioning of structures, systems, and components important to safety. GDC 18, Inspection and testing of electric power systems, requires, in part, that electric power systems important to safety shall be designed to permit appropriate periodic inspection and testing. The systems shall be designed with a capability to test periodically the operability, functional performance of the components of the systems onsite power source and the operability of the systems as a whole, and the full operation sequence that brings the systems into operation.
Regulatory Guide (RG) 1.9, Revision 2, Selection, Design, and Qualification of Diesel-Generator Units Used as Standby (Onsite) Electric Power Systems at Nuclear Power Plants, endorses IEEE Standard (Std) 387-1977, IEEE Standard Criteria for Diesel-Generator Units Applied as Standby Power Supplies for Nuclear Power Generating Stations. RG 1.9, Regulatory Position C.7 states, in part, that a trip may be bypassed under accident conditions, provided the operator has sufficient time to react appropriately to an abnormal diesel-generator unit condition.
DTE Clarification:
Fermi 2 is not committed to RG 1.9. Although per the Fermi 2 UFSAR, Fermi 2 conforms to RG 1.9, Regulatory Position C.7 as follows in part:
Fermi 2 meets most of the requirements of this position. The EDG protective trips are automatically bypassed (except for overspeed and generator differential, in accordance with Position C.7). In addition, the crankcase overpressure and low lube-oil pressure trips, although not bypassed, require coincidental signals to trip, again in accordance with Position C.7. Fermi 2 also has a start failure relay trip which, during the startup of the unit, does not require coincidental signals to trip.
The bypass circuits are initiated by either relay ESA or ESB [the redundant emergency start relays activated by Loss of Offsite Power on the respective busses or ECCS Initiation signal],
to NRC-23-0062 Page 2 such that a single failure will not prevent a bypass of the trips. The bypass function is testable and the emergency mode operation of the EDG is annunciated in the main control room. Any trip that is bypassed will still annunciate in the control room.
Request for Additional Information (EEEB)
EEEB RAI #1 Revision 2 of RG 1.9 states:
Section 5.6.2.2, Automatic Control, of IEEE Std. 387-1977 pertains to automatic startup requirements and their relationship to other operating modes. In conjunction with Section 5.6.2.2, engine-overspeed and generator differential trips may be implemented by a single-channel trip. All other diesel-generator protective trips should be handled in one of two ways:
Either, (1) a trip should be implemented with two or more independent measurements for each trip parameter with coincident logic provisions for trip actuation, or (2) a trip may be bypassed under accident conditions, provided the operator has sufficient time to react appropriately to an abnormal diesel generator unit condition.
In its LAR, the licensee stated:
DTE is performing a modification for Fermi 2 that will change the high crankcase pressure trip from an essential trip to a non-essential trip for all four EDGs 11, 12, 13, and 14. This will ensure that during an emergency run (such as during a [loss of offsite power] LOOP and tornado event), the EDG will not trip on high crankcase pressure and all essential loads fed from the EDGs will remain powered.
The licensee further stated RG 1.9, Rev. 2 provides design guidance for handling of diesel generator protective trips. Fermi 2 has not committed to this regulatory guide, however, the plant does conform to it with exceptions, as described in the Fermi 2 Updated Final Safety Analysis Report (UFSAR) Appendix A.1.9.
The NRC staff notes that Revision 2 of RG 1.9 allows an EDG protective trip (except for engine-overspeed and generator-differential trips) to be bypassed to prevent an undesired EDG shutdown under accident conditions. However, the LAR proposed bypassing an EDG protective trip during an emergency run (such as during a LOOP and tornado event). The NRC staff requests the following:
- 1. A clarification of whether Fermi 2 defines a LOOP and tornado event as an accident condition.
- 2. If a LOOP and tornado event is not an accident condition, explain how bypassing an EDG protective trip during this condition would satisfy RG 1.9. Further, if bypassing an EDG trip under a non-accident condition results the EDG damage and rendering the EDG unavailable for an accident, explain how the proposed change meets the requirement of GDC 17.
to NRC-23-0062 Page 3 DTE Response:
Question 1:
Fermi 2 does not define the Loss of Offsite Power (LOOP) and a tornado event as an accident condition.
Question 2:
The EDG crankcase high pressure trip modification is changing the crankcase high pressure trip from an essential trip to a non-essential trip. After the modification is implemented, the EDG crankcase high pressure trip will be bypassed during an actual or simulated emergency start signal. Bypassing the trip during an actual or simulated emergency start signal prevents an EDG shutdown due a spurious operation of a protective trip circuit such as may occur due to the pressure drop in the RHR complex during a tornado. In addition, bypassing the crankcase high pressure trip during an actual or simulated emergency start signal will ensure that the EDG will keep operating and will perform its intended safety function until either the emergency condition has been resolved or the EDG fails.
Fermi 2 is not committed to RG 1.9. Per Fermi 2 UFSAR Section A.1.9, although the EDG protective trips do conform to portions of RG 1.9 Rev. 2 Position C.7 with exceptions.
Specifically, the EDG crankcase high pressure trip will be automatically bypassed in the same manner as all other non-essential trip circuits are bypassed during an actual or simulated emergency start signal. A single failure of the bypass circuit will not prevent bypassing of the crankcase high pressure trip. Also, the crankcase high pressure trip will still provide annunciation locally and in the main control room if a high EDG crankcase pressure occurs when the non-essential crankcase high pressure trip is bypassed in the same manner as other existing non-essential trip functions.
During the performance of routine manual EDG testing or manual start surveillances the EDG crankcase high pressure trip will not be bypassed. Keeping the crankcase high pressure trip active during manual EDG testing or manual start surveillances, ensures that if any of the five failure modes occur during manual start testing, the crankcase high pressure trip will actuate and trip the EDG. The EDG crankcase high pressure trip will also be alarmed in the main control room to alert Operations of high crankcase pressure. If the EDG trips during manual start testing or during a manual start surveillance, Operations will declare the EDG out of service and enter the appropriate Technical Specification Limiting Condition of Operation.
Simulated EDG emergency start surveillances are required by Technical Specification are usually performed during refuel outages. During the simulated emergency start surveillance, the non-essential EDG crankcase high pressure trip will be bypassed. During the surveillance, Operators monitor the EDG and will respond to any alarms received including manually tripping the EDG, if needed. If a high crankcase pressure occurs to NRC-23-0062 Page 4 during a simulated emergency start surveillance, Operations will perform any needed actions in response to the alarm, declare the EDG out of service and take appropriate actions in accordance with Technical Specifications Section 3.8 Electrical Power Systems.
The modification supporting the LAR does not introduce any change to the onsite or offsite power system that would deviate from the existing Fermi 2 commitments to GDC 17. The changing of the crankcase pressure trip from an essential trip to a non-essential trip ensures the associated EDGs continue to supply essential loads during an emergency condition.
EEEB RAI #2 In the second paragraph of Section 3.0 of the LAR, the licensee stated, in part (underline added):
The EDG manufacturer, Fairbanks Morse Engine, has identified five failure modes which could result in high crankcase pressure. Any one of these failure modes could occur from a random single failure mechanism. These failure modes are:
- 1. Broken piston rings;
- 2. Cracked pistons;
- 3. Blower seal failure;
- 4. Liner water seal failure; and,
- 5. Failed crankcase vacuum system.
Further, Section 3.0 of the LAR states, in part:
The fifth mode of failure, failed crankcase vacuum system, is the most common and does not lead to immediate engine degradation. Therefore, in the current configuration, the effect of a crankcase vacuum system failure would be an unnecessary EDG shutdown in Emergency mode, resulting in a failure of the EDG to perform its safety-related function. The NRC staff notes that there are differences between, both in meaning and the impact of, the terms failed crankcase vacuum system and high crankcase pressure. The failure of the crankcase vacuum system is one of five failure modes that contribute to the EDG high crankcase pressure. High crankcase pressure, on other hand, contributes to crankcase explosion and catastrophic damage to the EDG engine. It appears that the LAR uses the two terms interchangeably.
The discussion of failed crankcase vacuum system without sufficient evaluation/justification of the other failure modes is not sufficient basis for removing high crankcase pressure from the automatic trip bypass exceptions in SR 3.8.1.12. Explain how the proposed change demonstrates that allowing the crankcase overpressure trip to be bypassed, is acceptable for the purpose of protecting the EDG from further internal engine component failures caused by the other four failure modes.
DTE Response:
The meaning of the terms failed crankcase vacuum system and high crankcase pressure were not intended to be used interchangeably in Section 3.0 of the LAR. A random failure to NRC-23-0062 Page 5 of the crankcase vacuum system results in pressurization of the crankcase due to normal leakage at various gaskets, seals and combustion gas leakage past the piston compression rings. The other four failure modes (1. Broken piston rings; 2. Cracked pistons; 3. Blower seal failure; or 4. Liner water seal failure) will also result in crankcase pressure increase.
The rate and magnitude of the crankcase pressure increase is dependent on the failure mode and the extent of the failure.
During an actual emergency start, the EDGs are required to perform their intended safety function until the emergency condition is mitigated. If one of the five failure modes occurs and prevents the EDG from performing its intended safety function, the failure would be considered a single random failure of a safety train. A single random failure of an EDG is accounted for in Fermi 2 safety system design by having two independent and redundant safety trains. If an EDG fails to operate, the fully redundant safety train will allow the reactor to be placed and maintained in a safe shutdown condition.
Occurrence of any of the five failure modes impact the EDG crankcase pressure but, may not be significant enough to cause an immediate failure of the EDG. Depending on the extent of the internal damage when one of the five failure modes occur, the EDG may be capable of operating for a significant duration with the high crankcase pressure trip bypassed. Operation of the EDG when needed to perform its intended safety function is a higher priority than tripping the EDG on high crankcase pressure to minimize potential internal EDG degradation. To ensure that safe shutdown of the Fermi 2 reactor can be performed and maintained, the EDG, if needed, will be run to failure. Bypassing the high crankcase pressure trip during an actual emergency EDG start and subsequent operation ensures that the EDGs will continue to perform their intended safety function as long as possible or until the emergency condition is resolved. Once the emergency condition is mitigated, the EDG would be shut down and repaired.
Sections 2.3 and 3.0 of the LAR has been edited in response to this question to add clarity.
EEEB RAI #3 The third paragraph of Section 3.0 of the LAR states, in part:
However, by the time any of these four failure modes would activate a high crankcase pressure trip, significant damage to the affected engine would have already occurred requiring a lengthy repair process. As such, the EDG out-of-service time is not significantly affected by blocking the high crankcase pressure trip for the first four failure modes.
The LAR does not include the evaluation and justification to support the above statements.
Provide analysis available to support the claims that:
- 1. By the time any of the four failure modes would activate a high crankcase pressure trip, significant damage to the affected engine would have already occurred.
- 2. The EDG out-of-service time is not significantly affected by blocking the high crankcase pressure trip for the first four failure modes.
to NRC-23-0062 Page 6 DTE Response:
Question 1:
The occurrence of any of the first four failure modes could cause enough damage to EDG to require extensive repair or overhaul of the EDG. For example, a broken piston ring would require the affected cylinder liner and piston to be repaired or replaced and possibly replacement of the remaining pistons, piston sleeves and rings to prevent similar failures.
The occurrence of any of these the four failure modes may not degrade the EDG to a point that the EDG stops functioning. If the EDG is needed to perform its intended safety function, the high crankcase pressure trip will be bypassed to allow the EDG to perform its intended safety function even though the EDG may be degraded. To ensure the safety of Fermi 2, the EDG will continue to perform its intended safety function until the emergency condition is resolved or until the EDG fails to function.
Question 2:
Any of the four failures will require extensive repair and possible complete overhaul of the EDG. Running the EDG after one of the four failure modes occurs may result in more extensive internal damage to the EDG and will still require extensive repair and possible complete overhaul of the EDG. Therefore, the EDG out-of-service time may or may not be significantly affected by blocking the high crankcase pressure trip if one of the first four failure modes occurs.
If the EDG is needed to perform its intended safety function, bypassing the high crankcase pressure trip will allow the EDG continue to operate until the emergency condition is resolved or until the EDG fails. If the continued operation of the EDG is needed to protect the health and safety of the public, any subsequent impact on the length EDG out-of-service time to perform EDG repairs has no impact on the decision to bypass the high crankcase pressure trip.
The discussion in section 3.0 has been revised to remove the discussion of the out-of-service time.
EEEB RAI #4 In Section 2.3 of the LAR, the licensee stated:
Within the current design, one of the essential trips of the EDGs is high crankcase pressure.
During any mode of operation, the EDG will trip on high crankcase pressure to prevent crankcase explosion and catastrophic damage to the diesel engine.
The third paragraph of Section 3.0 of the LAR states, in part:
to NRC-23-0062 Page 7 Furthermore, it has been determined that allowing an EDG to operate in a high crankcase pressure condition would not increase the possibility of failure of any of the three unaffected EDGs.
The LAR does not provide an analysis that supports the claim that theres no increase in possibility of failure for any of the three unaffected EDGs. Provide any analysis available to support the claim that the unaffected EDGs would not have increased failure possibility. Also, with respect to missile protection (i.e., crankcase explosion due to high pressure), explain how the three unaffected EDGs would not be impacted, provide their locations, and provide the distance from each of these EDGs to the affected EDG.
DTE Response:
The EDGs are located in the RHR complex, which is a safety related and seismically qualified building. The EDGs are in rooms separated by concrete walls. See the figure provided below that shows the layout of the EDGs in the RHR complex.
As seen in the figure below, Fermi 2 has four EDGs in dedicated rooms. Each divisional safety train consists of two EDGs. The wall between the Division 1 EDGs (EDG 11 and EDG 12) and wall between the Division 2 EDGs (EDG 13 and EDG 14) consists of a one-foot-thick concrete wall with #5 reinforcement bar at 12-inch spacing. The wall between the Division 1 and the Division 2 EDGs (EDG 11 and EDG 14) consist of a four-foot concrete wall with #8 reinforcement bar at 12-inch spacing. Each EDG is approximately 15 to 16 feet from the walls of their individual rooms.
In addition, Fermi 2 UFSAR section 9.5.7.3 states the following:
The diesel engines are designed to contain a crankcase explosion. The manufacturer conducted actual crankcase explosion tests (20 lb/in.2) and then designed the crankcase inspection cover and fasteners to contain such explosions (100 lb/in.2). These tests showed that the explosion was not harmful to the engine and posed no danger to the operators.
Given the design of the walls between the EDGs, any missiles from a failure of an EDG will not impact the other EDGs. Also, per the UFSAR, missiles from an EDG failure are not expected to exit the EDG crankcase. Therefore, a failure of an EDG will not impact the other EDGs.
to NRC-23-0062 Page 8 17 VN V "'l
~
=
!:?
!Si e;~
I!',~
l!ii
~<
~
y~....
~~....
~
~~g
~~a
~
~a
~~cl
~~cl
~cl
..J::,
)l
~~
- l"'-
- lo..
t:F iS s
iS iS 1*
ii't~
I '
ii':1-~
)C~
jt*M,.,
- ~ AT 12*
"*t.b.
~ AT 12' 2l.§ AT 12'
~ AT 12*
n r
I 1*- 1*
I
<TYP,>
i 1*
\\IAU.
REBAR
- a AT 12' I'
\\11\\LL VALL
- !~1 12*
~B~ 12*
16'-(,'
15*
16*
15*
15*
16' 15' 16*- 6*
APROX APRO >C, APROX.
APROX.
APROX APROX.
APROX.
APROX.
(0
~..
t; ~
I NY NY i
i i i I
i f E~t~c"'CY f ;mct<tY
' ~"t~NCY f EMC"£?iENCY
~E"ERAf R 12 NEIIA/jOR II NERAbOR I l~h '-..~o" 1J ND PA NO PA NO PA ND PA 2? fE
~
4t
/'
NERATDRS APROX. P O S ITl N S to NRC-23-0062 Page 9 EEEB RAI #5 Revision 2 of RG 1.9 states, in part:
a trip may be bypassed under accident conditions, provided the operator has sufficient time to react appropriately to an abnormal diesel-generator unit condition.
In Section 3.0 of the LAR, the licensee stated, in part:
In the event of an engine malfunction in which the EDG crankcase pressure reaches the alarm setpoint, operators would be alerted of the condition by annunciation in the Main Control Room and at the local control panel. Local indication is available to monitor the high crankcase pressure condition. Plant operating procedures instruct the operators to monitor certain EDG parameters when an emergency start signal is present. A precaution will be added for monitoring high crankcase pressure conditions as part of the modification process. This will ensure the operator has sufficient time to react appropriately to this condition.
The LAR does not contain an evaluation to support the claim that the added precaution will ensure that an operator will have sufficient time to react to the stated condition. Provide an analysis that demonstrates there is adequate operator response time to the EDG crankcase high pressure alarm to support this claim.
DTE Response:
The Fermi 2 UFSAR (Reference 9) exception to Regulatory Position C.7 indicates that, Fermi 2 meets specific portions of this position. The exception states that Fermi 2 conforms to Regulatory Guide 1.9 Position C.7 by having the EDG protective trips automatically bypassed except for overspeed and generator differential. Also, the exception states that the EDG crankcase overpressure and low lube-oil pressure trips, although not bypassed, require coincidental signals to trip. The exception continues to state that the bypass circuits are also designed to ensure that a single failure will not prevent a bypass of the trips. The statements of conformance in the Fermi 2 UFSAR do not require Fermi 2 to have an Operator action in response to a non-essential EDG alarm during an actual emergency.
Bypassing the EDG crankcase overpressure trip on an actual or simulated emergency start signal will make the crankcase overpressure trip a non-essential protective EDG trip. The EDG crankcase overpressure trip will meet the same requirements as the other non-essential protective EDG trips as described in Fermi 2 UFSAR. Specifically, the crankcase overpressure trip will retain its alarm function when it is bypassed to allow the operators to be alerted to an abnormal condition in accordance with Fermi 2 UFSAR section 8.3.1.1.12.2 and Fermi 2 UFSAR section A.1.9 exception to RG 1.9 position C.7.
If the EDG is operating while performing its intended safety function and the high crankcase pressure trip alarms, no response by the Operators is required. The EDG will be allowed to continue performing its intended safety function until either the emergency condition requiring the operation of the EDG is resolved or until the EDG fails.
to NRC-23-0062 Page 10 The EDG is tested by manually starting the EDG or by a simulated emergency start signal.
The EDG crankcase high pressure trip will not be bypassed during routine manual EDG testing or during performance of manual start surveillances. Keeping the automatic crankcase high pressure trip active during manual started testing ensures that the crankcase high pressure trip will actuate to trip of the EDG if the crankcase pressure increases. During performance of simulated emergency start signal surveillance, the EDG crankcase pressure trip will be bypassed with all other non-essential trip functions. Operators monitor the EDGs during simulated emergency surveillance testing and will respond to any alarms received during the surveillance and will manually trip the EDG if needed. Having the ability to manually trip the EDG in the event of a high crankcase alarm during simulated emergency start surveillance testing ensures that the EDG is shut down. Thereby ensuring that any potential to incur additional internal damage from one of the five failure modes during EDG testing is minimized. If the EDG trips or is tripped due to high crankcase pressure during testing or during the performance of a surveillance, Operations will declare the EDG out of service and enter the appropriate Technical Specification Limiting Condition of Operation.
Regulatory Requirements (EMIB):
10 CFR 50.36, Technical Specifications, establishes regulatory requirements related to the contents of the TS. Specifically, 10 CFR 50.36(c)(2) states, in part, Limiting conditions for operation are the lowest functional capability or performance levels of equipment required for safe operation of the facility. In addition, 10 CFR 50.36(c)(3) states, Surveillance requirements are requirements relating to test, calibration, or inspection to assure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions of operation will be met.
10 CFR Part 50, Appendix A, General Design Criterion 18, Inspection and Testing of Electrical Power Systems, states the following:
Electrical power systems important to safety shall be designed to permit appropriate periodic inspection and testing of important areas and features such as wiring, insulation, connections, and switchboards, to assess the continuity of the systems and the condition of their components.
The system shall be designed with a capability to test periodically (1) the operability and functional performance of the components of the systems, such as onsite power sources, relays, switches, and buses, and (2) the operability of the systems sequence that brings the systems into operation, including operation of applicable portions of the protection system, and the transfer of power among the nuclear power unit, the offsite power system, and the onsite power system.
to NRC-23-0062 Page 11 Request for Additional Information (EMIB)
EMIB RAI #1 The LAR proposes to revise the TS to specify that the crankcase overpressure automatic trip will be bypassed for an actual or simulated emergency start signal for each EDG. If the EDG start signal is generated by a simulated emergency, why will the crankcase overpressure automatic trip be bypassed if there is no emergency?
DTE Response:
The proposed change to Surveillance Requirement (SR) 3.8.1.12 eliminates reference to the crankcase overpressure trip as active (not bypassed) during an actual or simulated emergency EDG start signal. Each EDG is started automatically on a loss of offsite power (loss of voltage to its respective bus) or from an emergency core cooling system (ECCS) start signal (low reactor water level or on high drywell pressure). Any one of these parallel inputs energize the emergency start relays which in turn bypass non-emergency mode (non-essential) EDG trips.
Technical Specification SR 3.8.1.12 requires verification that each EDG automatic trip, with the exception of the essential trips listed in SR 3.8.1.12, are bypassed on an actual or simulated emergency start signal. DTE testing methodology simulates an ECCS start signal by installing a jumper switch to allow initiation of an EDG start signal in the emergency mode. The identified EDG essential trips are then activated one at a time, followed by closing the jumper switch to verify that the EDG does not start, proving each essential trip functions properly. The jumper switch is opened and then the essential trips are reset. Then the EDG is started by closing the jumper switch. While the EDG is running in the emergency mode with the non-essential trips automatically bypassed, the non-essential trips are activated one at a time to verify alarming of the non-essential trip and continued operation of the EDG. This methodology proves that the emergency start mode bypass is functional for each non-essential trip.
The surveillance testing methodology described above complies with the requirements of SR 3.8.1.12. In the modified condition, the EDG trip function for crankcase overpressure, in addition to the other non-emergency mode trips will be tested to ensure that the trip is bypassed to satisfy SR 3.8.1.12.
EMIB RAI #2 The justification for the LAR focuses on an inadvertent trip of the EDG on crankcase overpressure during a tornado with a loss of offsite power (LOOP) because of the atmospheric pressure drop caused by the tornado. Based on this justification, why is the request applicable to all actual or simulated emergency signals for the EDGs?
to NRC-23-0062 Page 12 DTE Response:
The emergency start logic for the EDGs, as described in the response to EMIB RAI #1, involves a parallel start input scheme for the loss of offsite power and ECCS start signals.
This results in the EDG starting in the same operational mode (emergency mode) regardless of the specific emergency start signal. Operation in the emergency mode automatically bypasses all non-essential trips that could prevent the EDG from performing its intended safety function. To ensure the EDGs remain available during a tornado event, which may result in a high crankcase pressure relative to the pressure within its room, the trip will be bypassed.
The EDG high crankcase pressure trip will be automatically bypassed during all actual or simulated emergency signals to ensure that the EDG will continue to perform its intended safety function anytime the EDG is needed for an emergency condition. The five failure modes may occur anytime that the EDG is operating in response to an emergency condition and having the non-essential trips bypassed prevents an unnecessary shut down of the EDG while performing its intended safety function.
The simulated emergency start condition only occurs during the performance of surveillance testing to satisfy the simulated emergency start for the Loss of Power or ECCS initiated automatic start per Technical Specification SR 3.8.1.10, 3.8.1.11, 3.8.1.12 and 3.8.1.15. Operations personnel monitor the condition of the EDG during all surveillance testing activities and can intervene to manually trip the EDG in response to a high crankcase pressure alarm and crankcase pressure indication.
EMIB RAI #3 The LAR Section 3.0 includes a brief discussion of operator activities when an EDG is started.
Please provide more specificity regarding the operator actions to monitor crankcase pressure during operation of the EDGs to provide assurance that timely operator action can be taken to avoid damage to each EDG from crankcase overpressure conditions.
DTE Response:
See the response to EEEB RAI #5
to NRC-23-0062 Fermi 2 NRC Docket No. 50-341 Operating License No. NPF-43 Revised LAR NRC-23-0002 Pages to NRC-23-0062 Page 1 Proposed changes to section 2.3:
2.3 Reason for the Proposed Change During the 2022 Design Basis Assurance Inspection (DBAI), the NRC identified that during a Loss of Off-Site Power (LOOP) in conjunction with a tornado event, the Emergency Diesel Generators (EDGs) could trip on a high crankcase pressure (Reference 4). During a tornado, the atmospheric pressure inside the RHR complex could drop faster than the internal pressure of the associated EDG crankcases, which in turn would cause a high crankcase differential pressure trip of the EDGs.
The current design of the EDGs and the exciter include automatic and manual trips to protect the EDG from various abnormal conditions. For example, the exciter is tripped off to prevent damage to the excitation system as the engine slows down following a trip. The automatic trips are divided into two categories: essential and non-essential trips. Non-essential trips are inhibited when the EDGs are running in the emergency mode to prevent an undesired EDG shutdown during a LOCA or LOOP. Within the current design, one of the essential trips of the EDGs is high crankcase pressure. During any mode of operation, the EDG crankcase pressure is monitored to detect for five specific types of internal failures that can increase crankcase pressure. Should one or more of these failures occur, the EDG will be tripped when EDG crankcase pressure exceeds the predetermined high crankcase pressure setpoint (0.500 inches water column) to prevent further, potentially significant, internal damage to the diesel engine.
Information requested from the EDG vendor (Fairbanks Morse Engine,) concluded that the depressurization rate of the EDG crankcase is limited because of the 3/16 (nominal) ejector orifice in the crankcase vacuum system. The EDG rooms in the RHR Complex are equipped with gravity dampers that open to rapidly depressurize the building in the event of a tornado. Based on this EDG and RHR Building configuration, one or more EDG crankcase high pressure trip(s) would be falsely activated (not by mechanical failure) if the EDGs were running prior to a depressurization of the RHR complex.
Therefore, DTE is performing a modification for Fermi 2 that will change the high crankcase pressure trip from an essential trip to a non-essential trip for all four EDGs 11, 12, 13, and 14.
This modification will ensure that during an emergency run (such as during a LOOP and tornado event), the EDG will not trip on high crankcase pressure and all essential loads fed from the EDGs will remain powered. The existing Main Control Room and local alarms for Crankcase Pressure High and EDG AutoStart functions are unchanged by the modification to retain existing conformance with applicable portions of RG 1.9, Regulatory Position C.7, as stated in UFSAR Appendix A.1.9 (Reference 9) The associated annunciator response procedures for each EDG will be revised to reflect the change in the high crankcase pressure trip from an essential trip function to a non-essential trip function.
The physical modifications that will change the EDG high crankcase pressure trip from an essential trip to a non-essential trip were reviewed for potential effects on the affected EDG and other plant structures, systems, and components under the 10 CFR 50.59 process in support of to NRC-23-0062 Page 2 the engineering design package. However, the proposed change to SR 3.8.1.12 is required to verify that, after implementation of the modification on each EDG, the high crankcase pressure trip is bypassed on an actual or simulated emergency start signal in accordance with the Surveillance Frequency Control Program.
Proposed changes to LAR section 3.0:
3.0 TECHNICAL EVALUATION
The proposed change to TS SR 3.8.1.12 will ensure verification that the high crankcase pressure trip is bypassed on an actual or simulated emergency start signal and that this is performed for EDGs 11, 12, 13, and 14 in accordance with the Surveillance Frequency Control Program. The proposed trip bypass verification is the same type of verification that is applied to other non-essential protective EDG trips per SR 3.8.1.12. The surveillance frequency applied will be the same as that of the other verifications performed per SR 3.8.1.12.
The EDG manufacturer, Fairbanks Morse Engine, has identified five failure modes which could result in high crankcase pressure. Any one of these failure modes could occur from a random single failure mechanism. These failure modes are:
- 1. Broken piston rings;
- 2. Cracked pistons;
- 3. Blower seal failure;
- 4. Liner water seal failure; and,
- 5. Failed crankcase vacuum system Failure of any EDG during a Loss of Offsite Power or a Loss of Offsite Power coincident with design basis accident would be single failure of a safety train. Any one of these five failure modes are considered a single random independent failure of the EDG that does not preclude plant safe shutdown in the event of a Loss of Offsite Power coincident with a Design Basis Accident.
These five failure modes have different outcomes. Although uncommon in the industry, the first four failure modes could lead to further internal engine component failure. The fifth failure mode is a loss of the crankcase vacuum system that prevents detection of the first four failure modes and does not contribute to engine failure. The common effect of these five failure modes is an increase in crankcase pressure. In the existing configuration, EDG crankcase pressure is monitored by three pressure switches connected in a coincident logic arrangement to detect these five modes of failure. Should any of these failures occur, the resultant increase in EDG crankcase pressure will initiate an automatic EDG trip when any two of the three crankcase pressure switches exceed the setpoint of 0.500 inches water column.
Bypassing the EDG high crankcase pressure trip for an actual (or simulated) emergency start signal will allow the EDG to operate when the EDG is needed to perform its intended safety to NRC-23-0062 Page 3 function until the EDG degrades to the point that the EDG fails to operate, or the emergency condition is resolved. Depending on the extent of the internal damage from a failure mode, the EDG could continue to perform its safety function for a significant amount of time. As an example, a broken piston ring will result in additional blow-by the piston rings increasing the EDG crankcase pressure, but the EDG may continue to operate for a significant duration with the broken piston ring. Tripping the EDG when the EDG is still capable of performing its intended safety function is not desirable from a nuclear safety aspect. When the EDG is needed for safe shutdown of the reactor, the EDG must perform its safety function if the EDG is capable of operating.
The purpose of the high crankcase pressure trip is to minimize engine degradation resulting from one of the first four failure modes. In the current configuration with the high crankcase pressure trip active during both emergency and manual modes of EDG operation, the EDG is conservatively tripped on high crankcase pressure. Allowing the high crankcase pressure trip to be active during an emergency condition makes the EDG susceptible to the occurrence of false high crankcase pressure trips such as an onsite tornado causing the EDG room pressure to rapidly depressurize resulting in a false EDG high crankcase pressure trip.
Changing the EDG high crankcase pressure trip to a non-essential trip allows the EDG to continue performing the intended safety function preventing an immediate trip if high crankcase pressure occurs. Per the EDG vendor, high crankcase pressure is an early indication of an EDG internal problem and that the EDG will continue run with a positive pressure in the crankcase.
Also, per the Fermi 2 UFSAR, the EDG manufacturer conducted actual crankcase explosion tests at 20lb/in2 without harming the engine. Therefore, if the EDG is needed to perform its intended safety function, the EDG can continue to operate during emergency conditions after the high crankcase pressure trip setpoint is exceeded until the emergency condition is mitigated or until the EDG fails.
After implementation of the proposed change, the EDG high crankcase pressure trip will be bypassed during an actual or simulated EDG emergency start; and will not be bypassed during routine EDG testing and manual start surveillances. During performance of a manually started EDG surveillance or test, the reconfigured high crankcase pressure trip from an essential to a non-essential trip ensures that the EDG is automatically tripped and alarmed should the crankcase pressure exceeds 0.500 inches of water column setpoint. Manual EDG starts are the most frequent surveillance and testing activities performed. The proposed modification, therefore, ensures that during performance of a manually started EDG surveillance or test, an automatic EDG trip and alarm is enforced upon detection of high crankcase pressure. This trip ensures timely identification of one of the five failure modes and preserves, to the extent practicable, the availability of the EDG for accident mitigation while minimizing the potential for additional internal EDG damage if one of the failure modes occurs during manual start EDG testing. If the EDG trips during manually started EDG surveillance or testing, Operations will declare the EDG out of service and take appropriate actions in accordance with Technical Specifications Section 3.8 Electrical Power Systems.
to NRC-23-0062 Page 4 Simulated emergency start surveillances are also performed per Technical Specification surveillance requirements typically during refuel outages. During these surveillances, the reconfigured high crankcase pressure trip is bypassed with all other non-essential EDG trip functions. During a simulated emergency start surveillance, Operators monitor operation of the EDGs during performance of the surveillance and will respond to any alarms received, including if necessary, manually tripping the EDG. If a high crankcase pressure occurs during a simulated emergency start surveillance, Operations will declare the EDG out of service and take appropriate actions in accordance with Technical Specifications Section 3.8 Electrical Power Systems.
The EDGs are in the RHR complex in dedicated rooms that have reinforced concrete walls. The walls between the EDG in the same safety train are one-foot thick with #5 reinforcement bar with a 12-inch spacing and the wall between the EDGs of two redundant safety trains is four feet thick with #8 reinforcement bar with a 12-inch spacing. The walls between the EDGs provide adequate protection to the remaining three EDGs in an unlikely event that catastrophic failure of an EDG could create a missile. Therefore, a failure of an EDG would not increase the possibility of failure of any of the three unaffected EDGs.
Regulatory Guide 1.9, Rev. 2 (Reference 1), provides design guidance for handling of diesel generator protective trips. Fermi 2 has not committed to this regulatory guide, however, the plant does conform to the regulatory guide positions with exceptions described in UFSAR Appendix A.1.9 (Reference 9).
Automatically bypassing the EDG crankcase overpressure trip during emergency start conditions makes the high crankcase pressure trip a non-essential trip. After implementation of the proposed modification, the trip will meet the same requirements as described in Fermi 2 UFSAR Appendix A conformance discussion to Regulatory Guide 1.9, Position C.7, as other non-essential protective EDG trips. The crankcase overpressure trip will retain its alarm function when it is bypassed during an actual or simulated EDG emergency start to allow the operators to be alerted to an abnormal condition in accordance with Fermi 2 UFSAR section 8.3.1.1.12.2, and Fermi 2 UFSAR section A.1.9 exception to RG 1.9, position C.7.
Bypass of the crankcase high pressure trip during EDG operation in the emergency mode is supported by the Fairbanks Morse Owners Group (FMOG). The trip will continue to be utilized for operation in the manual (test) mode. In the event of an engine malfunction in which the EDG crankcase pressure reaches the trip setpoint, operators would be alerted of the condition by annunciation of alarms in the Main Control Room and at the local control panel. During an actual emergency start condition to mitigate a Loss of Offsite Power or ECCS initiation signal, no Operator response is required for the high crankcase pressure alarm when the EDG is performing its intended safety function because the EDG will remain in operation to perform its safety function. Once the EDG is no longer needed to perform its intended safety function, Operations will take appropriate action in response to the high crankcase pressure alarm.
to NRC-23-0062 Page 5 Proposed changes to LAR section 4.0:
4.0 REGULATORY ANALYSIS
4.1 Applicable Regulatory Requirements/Criteria The following regulatory requirements have been considered:
10 CFR 50.36, Technical Specifications, establishes regulatory requirements related to the contents of the TS. Specifically, 10 CFR 50.36(c)(2) states, in part, Limiting conditions for operation are the lowest functional capability or performance levels of equipment required for safe operation of the facility. In addition, 10 CFR 50.36(c)(3) states, Surveillance requirements are requirements relating to test, calibration, or inspection to assure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions of operation will be met.
The proposed change to the EDG SR does not affect compliance with these regulations.
The applicable 10 CFR Part 50, Appendix A, General Design Criteria, was considered as follows:
Criterion 18 - Inspection and Testing of Electrical Power Systems. Electrical power systems important to safety shall be designed to permit appropriate periodic inspection and testing of important areas and features such as wiring, insulation, connections, and switchboards, to assess the continuity of the systems and the condition of their components. The system shall be designed with a capability to test periodically (1) the operability and functional performance of the components of the systems, such as onsite power sources, relays, switches, and buses, and (2) the operability of the systems sequence that brings the systems into operation, including operation of applicable portions of the protection system, and the transfer of power among the nuclear power unit, the offsite power system, and the onsite power system.
Regulatory Guide 1.9, Revision 2 - Selection, Design, and Qualification of Diesel-Generator Units Used as Standby (Onsite) Electric Power Systems at Nuclear Power Plants, as described in the Fermi 2 UFSAR was considered as follows:
The guidelines presented in Regulatory Guide 1.9, Revision 2, apply to nuclear power plants whose construction permit applications were docketed after December 1979.
Because the application for Fermi 2 was docketed in 1969, the revised versions of the guidelines do not apply to Fermi 2.
to NRC-23-0062 Page 6 The EDGs for Fermi 2 are acceptable as discussed on page 31 of the AEC Staff Safety Evaluation Report of May 17, 1971. The Fermi 2 design conforms to the regulatory guide positions except those in paragraphs C.4, C.5, C.7, C.9, and C.11 of Regulatory Guide 1.9 (December 1979, Revision 2). Exceptions taken to Positions C.4, C.5, C.7, C.9, and C.11 are described below, along with Edison's compliance with Position C.14.
Exception To Position C.7 Fermi 2 meets most of the requirements of this position. The EDG protective trips are automatically bypassed (except for overspeed and generator differential, in accordance with Position C.7). In addition, the crankcase overpressure and low lube-oil pressure trips, although not bypassed, require coincidental signals to trip, again in accordance with Position C.7. Fermi 2 also has a start failure relay trip which, during the startup of the unit, does not require coincidental signals to trip. (Once the unit is up to speed, two speed contacts bypass the relay.) This approach, as presented in Subsection 8.3.1.1.12.2 and Table 8.3-12 is in compliance with EICSB 17 of the Standard Review Plan (SRP) and was found acceptable in the interim safety evaluation report, NUREG-0314.
The bypass circuits are initiated by either relay ESA or ESB, such that a single failure will not prevent a bypass of the trips. The bypass function is testable and the emergency mode operation of the EDG is annunciated in the main control room. Any trip that is bypassed will still annunciate in the control room. Fermi 2 does not have manual reset of the trip bypass, but the trip bypass automatically resets when the emergency start signals are picked up.
The proposed change is consistent with Criterion 18 and Regulatory Guide 1.9 Rev. 2, Position C.7. as described in the Fermi 2 UFSAR. (Reference 9)