NRC Generic Letter 1988-15
UNITED STATES
VA NUCLEAR REGULATORY COMMISSION
WASHINGTON. D. C. 20555 SEP 1 2 1988
ADDRESSEES
- ALL POWER REACTOR LICENSEES AND APPLICANTS
SUBJECT: ELECTRIC POWER SYSTEMS - INADEQUATE CONTROL OVER
DESIGN PROCESSES (GENERIC LETTER 88-15)
This generic letter informs licensees of the various problems with electrical systems being identified with increasing frequency at commercial power reactors.
The following are the types of problems that this letter addresses: (1) onsite distribution system voltages lower than required for proper operation of safety equipment, (2) diesel generator loads exceeding the diesel engine's load car- rying capability, (3) diesel generator voltage regulating systems unable to maintain voltage at a sufficient level to permit continued operation of safety equipment, (4) overloading of IE buses during a LOCA because of interaction of the fire suppression system and other safety-related systems, (5) lack of proper coordination of protective devices creating the potential for an unacceptable level of equipment loss during 'fault conditions, and (6) electrical distribution system components outside their design ratings for fault clearing capability creating the potentiallfor an unacceptable level of equipment loss during fault conditions. These problems have occurred primarily as a result of inadequate control over the design process.
The problems described call into question the conformance of electrical system designs with General Design Criterion (GDC) 1, "Quality Standards and Records,"
and GDC 17, 'Electric Power Systems." Such areas of weakness could be eliminated if licensees would strictly adhere to the provisions of applicable general design criteria and effectively implement quality assurance control measures for verifying design adequacy. The electrical problems that have been identified and that .are currently undergoing corrective review are presented below.
1. Electrical Distribution System Voltages Less Than the Manufacturer's Recommended Limits for Proper Operation of Connected Equipment As a result of a degraded grid voltage condition discovered in July 1976 at Millstone Nuclear Power Station Unit 2, the Boston Edison Company made a design change at its Pilgrim station to provide automatic protection against degraded grid voltages. In support of this design change, a voltage study was performed for the plant in 1976. This study was made to assure that onsite electric distribution system voltages were maintained within equipment manu- facturers' operating specifications. These specifications were to be maintained notwithstanding fluctuations in the offsite power system's normal voltage or the onsite system's worst-case load conditions. However, in January 1988, the licensee reported that an update of the previous voltage study was performed to reverify the steady state and transient responses of the electrical system.
8809120085 ZA
I
-2- SEP 12 s988 This most recent study showed that. for certain voltages at the lower end of the allowable range of grid voltages,. onsite.voltages at some electrical equipment would be lower than the manufacturer's recommended limit. With voltages below these recommended limits, electric equipment may not have sufficient capacity or capability to reliably perform their intended safety function during a design basis event. Thus. the design of the electrical system was not in full conformance with General Design Criterion (GDC) 17.
"Electric Power Systems."..
2. Diesel Generator Loading In Excess of Design Rating During the original.design phase for Florida" Power Corporation,'s Crystal'River Nuclear Plant Unit 3, a load study for determining the proper sizing of the'
diesel generators was performed'. This',study consisted-of summing the connected kilovolt-ampere (Kva) loads and applying an assumed power factor'of 0.8 to determine the kilowatt .(Kw) component'of the 6onnected loads. The study'
indicated that the design basis load requirementsawould not.exceed the diesel generator's'continuous duty rating of 2750 Kw. Sufficient diesel generator.'
capacity margin was thus considered to be available (up to its 2000-hour rating of 3000 Kw) to supply required loads. On this basis' diesel generator sizing was found acceptable.
In January 1980. the motor-driven emergency feedwater pump was added to the plant's design basis auto-start load requirement for one diesel generator. A
supplemental load study was performed and, 'like the original. assunied a-power factor of 0.8. The study indicated that the design basis load requirement would exceed the diesel generator's continuous-duty rating of 2750'Kw and the 2000-
hour rating of 3000 Kw. but would not exceed the 30-minute rating.of 3300 Kw.
In November 1987. the licensee reported that recent.load studies, using actual load power factors of 0.9 versus the assumed power factQrtof 0.8 used in earlier studies. indicated a total design basis load requirement in exc'ess of the diesel generator's 30-minute rating of 3300 Kw.
In the load studies supporting the original design and the subsequent design change (i.e.. addition of a motor-driven emergency feedwater pump), the effect that load power factors have on the capacity requirements for the diesel gen- erator were not adequately considered. The resultant overloading of the diesel generator did not fully conform to GDC'17 or the guidelines of Regulatory Guide 1.9 "Selection. Design, and Qualification of Diesel-Generator Units Used as Onsite Electric Power Systems at Nuclear Power Plants."
In addition an associated concern arises from the testing of the diesel generators. The 30-minute design rating for the Crystal River diesel generators is 3300Kw. The 30-minute rating means that the diesel generators should not be operated for more than a cumulative total time of 30 minutes, when loaded to above 3000Kw up to a maximum load of 3300Kw. If the time of operation in this range exceeds 30 minutes. the diesel manufacturer requires a special maintenance inspection to verify that the diesel has not been damaged.
r__
I
3 SEP 12 1988 However, the Crystal River technical specifications required testing at least once every 18 months for 60 minutes at a load equal to or greater than 3000 Kw.
In this instance, the diesel generators were tested beyond the manufacturer's design limit. This could jeopardize their capacity and capability to reliably perform their intended safety function during a design basis event.
3. Inadequate Diesel Generator Response to Actual Loading Conditions During the original design phase for Consumer Power Company's Palisades Nuclear Plant. a load study for diesel generators was performed. This study indicated that the maximum automatically energized design basis load would not exceed the diesel generator's continuous duty rating of 2500 Kw. On this basis, the design was found acceptable.
In 1982 a 450-horsepower (HP) auxiliary feedwater pump load was added to the automatically energized design basis load of diesel generator 1-1. With this pump and other loads added since plant licensing, a load study indicated that the automatically energized design basis load was approaching the diesel gen- erator's continuous duty rating of 2500 Kw. However. this loading was within the guidelines of Regulatory Guide 1.9 and was thus considered acceptable.
Because surveillance testing of the diesel generator's capability to supply the actual design basis load under full load conditions is not practical, the licensee (as part of the load study in support of adding the auxiliary feed- water pump load). used a computer model to simulate diesel generator response under full load conditions. The computer simulation. using test data from diesel generator 1-2. indicated that the diesel generator had sufficient capability to supply its design basis load requirement. A similar computer simulation using test data from diesel generator 1-1 was not performed until September 1987. The
1987 computer simulation predicted that a voltage collapse would occur when the
450-HP auxiliary feedwater pump (which is the last large 2300 V load to be se- quenced on the bus) was started on the loaded bus supplied by diesel generator 1-1.
For the design change (i.e.. the automatic addition of an auxiliary feedwater pump load). the effect of full load conditions on diesel generator response for the specific diesel generator was not adequately considered. The resultant design was not in full conformance with the guidelines of Regulatory Guide 1.9 and the requirements of GDC-17.
4. Overloading of lE Buses Because of Interaction of Fire Suppression and Safety-related Systems On April 14. 1987 an internal TVA Condition Adverse to Quality Report (CAQR)
was prepared for the Sequoyah Nuclear Power Plant as a result of design reviews performed to ensure that adequate calculations exist to support the design basis of the plant. The CAQR addressed calculations of voltage, current. and load for the class lE electric power system. Prior to preparation of the CAQR. the effect of operation of the fire pumps on safety-related equipment had been ignored. The pumps are powered by class IE buses that automatically transfer to the emergency diesel-generators on loss of offsite power.
J
-4 - SEP 1'2 138'
During a LOCA. the fire protection heat sensors inside containment will start the fire pumps if the sensors detect temperatures greater than 212 0F. Contain- ment temperatures can be greater than 2400 F during a LOCA; therefore. starting of the fire pumps would be expected. Ionization sensors can also start the fire pumps. Starting the fire pumps concurrent with a LOCA could potentially degrade the voltage of the class IE buses and prevent safety-related equipment from performing its intended function. For these conditions, as demonstrated by testing. the emergency diesel generators would have been overloaded if a loss of offsite power occurred coincident with a LOCA.
The root cause of this problem was a design error. The design engineer realized that a fire concurrent with a LOCA was outside the design basis of the plant and that containment isolation valves for the fire suppression system will close when a LOCA is detected. Therefore. the design engineer failed to recognize the possibility of inadvertent starting of the fire pumps during a LOCA and the effect of their operation on the normal and emergency power system.
5. Inadequate Breaker Coordination New Jersey Public Service Electric and Gas (PSE&G) contracted to have the Salem Units 1 and 2 fire protection program audited. The contractor concluded that a lack of breaker coordination existed at the plant to the extent that protection of redundant equipment and other associated circuitry from common mode failures could be compromised. PSE&G evaluated the ability of the Salem units to safely shut down in the event of any internal or external hazard in the absence of full breaker coordination. It was determined that there was insufficient basis to conclude that adequate protection existed. An NRR Inspection team also deter- mined that the licensee program for the setting and the coordination of electrical protective devices was inadequate.
On September 6. 1987 a reactor trip and turbine trip occurred at the Duke Power Company's McGuire nuclear station. These trips resulted directly from a lack of proper circuit breaker coordination on the plant's onsite electrical distribution system. To facilitate component maintenance, the power supply to an auxiliary power panel board was shifted to an alternate source, a 600 V motor control center (MCC). This MCC also provides power to a compressor in the plant's instrument air system. A ground fault developed in the compressor's motor. This fault not only caused the compressor motor's feeder breaker to open but also caused the feeder breaker to the 600 V MCC to open. The inter- ruption of power to the MCC precipitated the loss of the panel board. The turbine control system closed the main turbine throttle, governor, and intercept valves causing the reactor to trip on high pressurizer pressure.
Lack of breaker coordination can create the potential for an unacceptable level of equipment loss during fault conditions. Thus, the designs of these elec- trical systems were not fully in conformance with GDC-17.
NRC Information Notice 88-45. "Problems in Protective Relay and Circuit Breaker Coordination," was issued on July 7, 1988 to highlight the safety significance of this issue.
5 ~SEP 1 2 i988
6. Inadequate Fault Current Interruption Capability During a 1987 safety system functional inspection (SSFI) at the H. B. Robinson plant, the staff determined that the licensee had not ensured that the circuit breakers in 480-V switchgear and motor control centers serving engineered safety features -circuits were properly sized to permit safe operation under short cir- cuit conditions. During the inspection, the staff found that the Westinghouse DB-50 circuit breakers have inadequate fault current interrupting capability for the duties to which they have been assigned. A computer generated fault analysis performed by the licensee showed that for a loss-of-coolant accident (LOCA) with offsite power available, the short circuit current to which the DB-50 circuit breaker could be exposed would exceed 59,600 amperes, or 19 per- cent more than the breaker's rated interrupting capability.
In addition, the preliminary results of an NRC staff SSFI held at Consolidated Edison's Indian Point Unit 2 indicated that the Class 1E circuit breakers and related equipment were inappropriately sized. An NRR staff review of the licensee's short circuit calculations for the 480-V distribution system found that for certain fault conditions, symmetrical short-circuit current would approach 48,700 amperes, which is below the maximum interrupting rating of Westinghouse-type DB-50 breakers. However, the available asymmetrical short circuit current would exceed the maximum momentary capability of the Westinghouse breaker.
Inadequate fault-current interrupting capability can create the potential for an unacceptable level of equipment loss during fault conditions. Thus, the.
electrical system designs were not fully in conformance with GDC-17.
No specific action or written response is required by this letter. If you have any questions about this matter, please contact one of the technical contacts listed below or the Regional Administrator of the appropriate regional office.
Sincerely, Dennis Crutchfield 1 9cting Associate Director for Pro ects Office of Nuclear Reactor Regulation Technical Contacts:
Carl Schulten, NRR
(301) 492-1192 John Knox, NRR
(301) 492-3285 Nick Fields, NRR
(301) 492-1173
r Enclosure LIST OF RECENTLY ISSUED GENERIC LETTERS
Generic Date of Letter No.
.
Subject Issuance Issued To
88-14 INSTRUMENT AIR SUPPLY 08/08/88 ALL HOLDERS OF
SYSTEM PROBLEMS AFFECTING OPERATING LICENSES
SAFETY-RELATED EQUIPMENT OR CONSTRUCTION
PERMITS FOR NUCLEAR
POWER REACTORS
- 88-13 OPERATOR LICENSING 08/08/88 ALL POWER REACTOR
EXAMINATIONS LICENSEES AND
APPLICANTS FOR
AN OPERATING LICENSE.
88-12 REMOVAL OF FIRE PROTECTION 08/02/88 ALL POWER REACTOR
REQUIREMENTS FROM TECHNICAL LICENSEES AND
SPECIFICATIONS APPLICANTS
88-11 NRC POSITION ON RADIATION 07/12/88 ALL LICENSEES OF
EMBRITTLEMENT OF REACTOR OPERATING REACTORS
VESSEL MATERIALS AND ITS AND HOLDERS OF
IMPACT ON PLANT OPERATIONS CONSTRUCTION PERMITS
88-10 PURCHASE OF GSA APPROVED 07/01/88 ALL POWER REACTOR
SECURITY CONTAINERS LICENSEES AND
HOLDERS OF PART 95 APPROVALS
88-09 PILOT TESTING OF FUNDAMENTALS 05/17/88 ALL LICENSEES OF ALL
EXAMINATION BOILING WATER REACTORS
AND APPLICANTS FOR A
BOILING WATER REACTOR
OPERATOR'S LICENSE
UNDER 10 CFR PART 55
88-08 MAIL SENT OR DELIVERED TO 05/03/88 ALL LICENSEES FOR POWER
THE OFFICE OF NUCLEAR REACTOR AND NON-POWER REACTORS
REGULATION AND HOLDERS OF
CONSTRUCTION PERMITS
FOR NUCLEAR POWER
REACTORS
88-07 MODIFIED ENFORCEMENT POLICY 04/07/88 ALL POWER REACTOR
RELATING TO 10 CFR 50.49, LICENSEES AND
NENVIRONMENTAL QUALIFICATION APPLICANTS
OF ELECTRICAL EQUIPMENT
IMPORTANT TO SAFETY FOR
NUCLEAR POWER PLANTS"
6. Inadequate Fault Current Interruption Capability SEP 1 2 1988 During a 1987 safety system functional inspection (SSFI) at the H. B. Robinson plant, the staff determined that the licensee had not ensured that the circuit breakers in 480-V switchgear and motor control centers serving engineered safety features circuits were properly sized to permit safe operation under short cir- cuit conditions. During the inspection, the staff found that the Westinghouse DB-50 circuit breakers have inadequate fault current interrupting capability for the duties to which they have been assigned. A computer generated fault analysis performed by the licensee showed that for a loss-of-coolant accident (LOCA) with offsite power available, the short circuit current to which the DB-50 circuit breaker could be exposed would exceed 59,600 amperes, or 19 per- cent more than the breaker's rated interrupting capability.
In addition, the preliminary results of an NRC staff SSFI held at Consolidated Edison's Indian Point Unit 2 indicated that the Class 1E circuit breakers and related equipment were inappropriately sized. An NRR staff review of the licensee's short circuit calculations for the 480-V distribution system found that for certain fault conditions, symmetrical short-circuit current would approach 48,700 amperes, which is below the maximum interrupting rating of Westinghouse-type DB-50 breakers. However, the available asymmetrical short circuit current would exceed the maximum momentary capability of the Westinghouse breaker.
Inadequate fault-current interrupting capability can create the potential for an unacceptable level of equipment loss during fault conditions. Thus, the electrical system designs were not fully in conformance with GDC-17.
No specific action or written response is required by this letter. If you have any questions about this matter, please contact one of the technical contacts listed below or the Regional Administrator of the appropriate regional office.
Sincerely, Dennis Crutchfield, Acting Associate Director for Projects Office of Nuclear Reactor Regulation Technical Contacts: t C-
Carl Schulten, NRR6 V, o. -O.
(301) 492-1192
~_e John Knox, NRRo
(301) 492-3285 n6aw4 '
Aola Nick Fields, NRROLI ,.
(301 ) 492-1173 TCa AB:NRR EAB:NRR EAB:NRR TECH:ED C:EAB:NRR C:OGCB:DOEA D
NFields:db CSchulten RLobel WLanning CHBerlingerl Ros
9/ /88 9/ /88 /88 9/ /88 9/ /88 9/ /88 g9/, /81 SAD:DEST D:DEST AtWis AThadani LShao Dfeld
9/ /88 9/ / F 9/ /88
~ J