ML19122A333

May 7, 2019 Open Phase Condition Public Meeting Handout: Open Phase Condition Initiative, May 2019, Revision 3 Draft

ML19122A333
Person / Time
Site:	Nuclear Energy Institute
Issue date:	05/02/2019
From:	Nuclear Energy Institute
To:	NRC/NRR/DE/EEOB
Perkins L
References
Download: ML19122A333 (9)

Text

Open Phase Condition Initiative May 2019, Revision 3 DRAFT Goal An open phase condition will not prevent functioning of important-to-safety structures, systems and components. An open phase condition is defined as one or two open phase(s), with or without a ground, which is located on the high voltage side of a transformer connecting a general design criterion (GDC) 17 off-site power circuit to the transmission system.

Objectives

• Operating nuclear power plant licensees demonstrate that important-to-safety functions remain available given an open phase condition or install plant modifications to detect and isolate from the open phase condition. If the open phase condition prevents the functioning of important-to-safety structures, systems, and components, the engineered safeguard buses should be transferred to an alternate source.

• New reactor licensees, combined license (COL) applicants and design centers for active safety features plant designs demonstrate that important-to-safety functions remain available given an open phase condition or install plant modifications to detect and isolate from the open phase condition. If the open phase condition prevents the functioning of important-to-safety structures, systems and components, the engineered safeguard buses should be transferred to an alternate source.

Criteria Notes:

• This section will only address the criteria for dealing with an adverse open phase condition. The design features (if not yet available) will be developed to meet the criteria noted below.

• Based on recent operating experience, two open phases must be considered when addressing the criteria below. Thus, the term open phase in the remainder of this document will mean one or two open phases.

• The risk associated with an OPC event is significantly reduced through the implementation of detection circuits such that the use of risk screening techniques as an alternative to enabling the automatic isolation of OPCs can be applied. See Attachment 1 for the modified information used for the risk informed evaluation method.

Detection, Alarms and General Criteria An open phase condition must be detected and alarmed in the control room unless it can be shown that the open phase condition does not prevent functioning of important-to-safety structures, systems and components. For example, some licensees believe they can show no impact due to May 2019, Revision 3 DRAFT 1

transformers that are oversized for their loading conditions. Sufficient robust calculational bases or tests must be provided to show that the open phase condition will not adversely affect important-to-safety equipment performance. Testing is preferred if this is possible without challenging on line or May 2019, Revision 3 DRAFT 2

shutdown risk profiles.

If the licensee can demonstrate that the open phase condition does not prevent the functioning of important-to-safety structures, systems and components, then detection of the open phase condition should occur within a reasonably short period of time (i.e., 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />). The licensee must document how detection and correction of the open phase condition will occur.

Detection circuits for the open phase condition, which prevents the functioning of important-to-safety structures, systems and components, must be sensitive enough to identify an open phase condition for credited loading conditions (i.e., high and low loading).

Note: It is recognized that some transformers have very low or no loading when in the standby mode. Automatic detection may not be reliable in this condition; however, automatic detection must happen as soon as loads are transferred to this standby source.

Additionally, if automatic detection is not reliable , shiftlymonitoring requirements should be established to look for evidence of an open phase.

If open phase condition actuation circuits are required, the design should minimize misoperation or spurious action that could cause separation from an operable off-site GDC 17 source. Additionally, the protective scheme should not separate the operable off-site GDC 17 source in the range of voltage unbalance normally expected in the transmission system. Licensees must demonstrate that the additional actuation circuit design does not result in lower overall plant operation reliability.

These devices must be coordinated with other protective devices in both the transmission system and the plants electrical system (e.g., fault protection, overcurrent, etc.).

Open Phase Condition detection and actuation circuits may be non-Class-1E. A non-Class-1E solution will enable timely implementation and will provide reasonable levels of reliable functionality given the low likelihood of adverse impacts from open phase events. Additionally, there is regulatory precedent in using non-Class-1E circuits in newly identified nuclear plant vulnerabilities (e.g.,

anticipated transient without scram (ATWS) circuits). New non-Class-1E circuits will not be allowed to replace existing Class-1E circuits.

The Updated Final Safety Analysis Report (UFSAR) must be reviewed to determine if updates to discuss the design features and analyses related to the effects of, and protection for, any open phase condition design vulnerability are required. This update would typically be to chapter 8.

May 2019, Revision 3 DRAFT 3

Protective Actions If an open phase condition occurs1, the following design requirements are to be satisfied:

1. With no accident condition signal present, the licensee must demonstrate that:

1.1. The open phase condition does not adversely affect the function of important-to-safety structures, systems and components; or 1.2. Technical Specification (TS) Limiting Conditions for Operation (LCOs) are maintained or the associated TS Actions are met without entry into TS LCO 3.0.3 (or the equivalent).

This provision applies to TS equipment affected by the open phase condition (i.e., not just the specifications related to the off-site power source); and 1.3. Important-to-safety equipment is not damaged by the open phase condition; and 1.4. Shutdown safety is not compromised.

Notes:

• Provision 1.1 or provisions 1.2, 1.3 and 1.4 must be maintained.

• For operating modes where power is supplied from the main generator through unit auxiliary transformers, the licensee must evaluate provisions 1.1, 1.2 and 1.3 assuming that the main generator is lost and loads must be transferred to the alternate source(s). Load transfer cases will include reactor trips without accident conditions present.

• Operator action may be credited in the evaluation of provisions 1.3 and 1.4 if existing regulations and guidelines are met for the use of manual actions in the place of automatic actions.

• Item 1.4 is intended to ensure that an open phase event will not challenge fuel cooling during hot shutdown, cold shutdown and refueling modes of operation. Power supplied to spent fuel pool cooling systems must also be considered. The limiting conditions will be those where power is supplied from a single source or an alternate source is used that does not have open phase protection (such as a main power transformer back-feed source).

• Provision 1.2 must consider situations where alternate sources are removed from service if allowed by the Technical Specifications.

• If provision 1.1 or provisions 1.2, 1.3 and 1.4 cannot be met with the existing plant 1

For plants that have evaluated their specific designs and installations and have determined that there is no single credible failure that could cause an open phase condition, a full engineering evaluation must be developed and issued to document the basis for an open phase condition as a non-credible event. The Bruce Power and Forsmark operating experience must be considered as part of this analysis.

May 2019, Revision 3 DRAFT 4

design features, modifications will be required to provide automatic features to ensure the provisions can be met.

2. With an accident condition signal present, the licensee must demonstrate:

2.1. Automatic detection and actuation will transfer loads required to mitigate postulated accidents to an alternate source and ensure that safety functions are preserved, as required by the current licensing bases.

2.2. Alternatively, a licensee may show that all design basis accident acceptance criteria are met with the open phase condition, given other plant design features. Accident assumptions must still include licensing provisions associated with single failures. Typically, licensing bases will not permit consideration of the open phase condition as the single failure since this failure is in a non-safety system.

Note:

• It is not expected that accident analyses are updated when licensees add additional detection and mitigation circuitry. Actuation times needed to maintain equipment safety functions should be short enough to provide reasonable assurance that accident mitigation functions are maintained.

Periodic tests, calibrations, setpoint verifications or inspections (as applicable) must be established for any new open phase condition protective features. The surveillance requirements must be added to the plant Technical Specifications if necessary to meet the provisions of 10CFR50.36.

Interim Actions (Operating Plants)

The Institute of Nuclear Power Operations (INPO) staff performed reviews of the industry action plans in response to the Level 2 INPO Event Report (IER) L2-12-14, Automatic Reactor Scram Resulting from a Design Vulnerability in the 4.16-kV Bus Undervoltage Protection Scheme and ensured that plant operators had identified compensatory actions needed to detect degraded off-site power sources due to open phase circuit conditions. INPO also ensured that plant operating procedures were either sufficient or actions were taken to enhance the procedures to help operators promptly diagnose and respond to open phase circuit conditions on off-site power supplies to Class-1E vital buses. The reviews were completed and satisfactory industry responses were received in the 4th Quarter 2012.

INPO Follow-up Actions (Operating Plants)

Starting in 1st Quarter 2014, the engineering evaluators will review all recommendation responses in IER L2-12-14 during the plant evaluations and verify that the recommendations are fully implemented or that there is a reasonable due date and plan to fully implement the recommendations. Evaluators will verify that the compensatory measures originally taken are still in place and being effective. Evaluators will also review progress made and the milestones developed for the long-term corrective actions to provide automatic protection from open phase circuit May 2019, Revision 3 DRAFT 5

conditions for off-site power sources supplying Class-1E vital buses. They will also ensure a review and study of the station design basis and modeling has been conducted to obtain a complete understanding of plant and equipment response following an open phase event. Also, the final station configuration will be reviewed to ensure that the probability of losing the off-site (preferred) and the on-site power source is not increased. The evaluator review and conclusion of IER recommendations will be documented in evaluation products.

Regulatory Requirements GDC 17 provides criteria for the electric design of nuclear power plants for which a construction permit application was submitted after the Commission promulgated the GDC. The PSAR, FSAR and UFSAR document the implementation of the design criteria.

GDC 17 states:

An on-site electric power system and an off-site electric power system shall be provided to permit functioning of structures, systems, and components important to safety. The safety function for each system (assuming the other system is not functioning) shall be to provide sufficient capacity and capability to assure that: (1) specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded as a result of anticipated operational occurrences, and (2) the core is cooled and containment integrity and other vital functions are maintained in the event of postulated accidents.

The on-site electric power supplies, including the batteries, and the on-site electric distribution system, shall have sufficient independence, redundancy and testability to perform their safety functions assuming a single failure.

Electric power from the transmission network to the on-site electric distribution system shall be supplied by two physically independent circuits (not necessarily on separate rights of way) designed and located so as to minimize to the extent practical the likelihood of their simultaneous failure under operating and postulated accident and environmental conditions. A switchyard common to both circuits is acceptable. Each of these circuits shall be designed to be available in sufficient time following a loss of all on- site alternating current power supplies and the other off-site electric power circuit, to assure that specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded. One of these circuits shall be designed to be available within a few seconds following a loss-of-coolant accident to assure that core cooling, containment integrity and other vital safety functions are maintained.

Provisions shall be included to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit, the loss of power from the transmission network, or the loss of power from the on-site electric power supplies.

Pre-GDC plants have their principal design criteria specified in their UFSAR.

Schedule for Operating Plants (For Plants where License Amendments (LA) are not required to install any design changes. For plants where LAs are required, the design May 2019, Revision 3 DRAFT 6

change schedule will be as directed by the LA process.)

May 15, 2013 NSIAC endorsement of the industry direction to resolve the open phase condition issue. Complete.

July 31, 2013 Draft NEI Initiative (what is required; industry criteria to address the open phase condition issue).

Complete.

Aug. 31, 2013 NSIAC approval of the NEI Initiative by a vote of 80% of CNOs. Complete.

Dec. 31, 2013 Draft NEI guidance document (how to meet industry criteria; containing industry research, developments, pilots, technology, etc. to address the open phase condition issue). Complete.

Dec. 31, 2014 Demonstration of compliance with the open phase condition criteria through analysis or identify appropriate actions required to demonstrate compliance. Complete.

March 2015 NSIAC approval of Revision 1 to the NEI Initiative. Complete.

Dec. 31, 2018 Implementation of design changes, if necessary, to comply with the open phase condition criteria.

The active actuation features of new technology designs may be installed in a monitoring mode, with adequate justification, to demonstrate reliability. During the monitoring period, further defined below, stations must implement an alarm response process for operators to take appropriate action if the system detects the presence of an OPC.

Monitoring Period If a monitoring period was deemed necessary, the period will run for at least 24 months. In order to capture industry-wide operating experience, the monitoring period for all plants will extend until December 31, 2019. Plants that have not accumulated 24 months of monitoring time by December 31, 2019, may extend the monitoring period into 2020 until they reach 24 months. This period of monitoring will ensure the collection and application, including completion of any design adjustments, of station-specific Operating Experience through one operating cycle and two seasonal periods and ensure that industry-wide Operating Experience can be evaluated and applied.

Upon completion of the monitoring period, design adjustments identified during the monitoring May 2019, Revision 3 DRAFT 7

period will have been performed and all active actuation features needed to demonstrate compliance with the open phase condition criteria will be enabled. During the monitoring period, stations must implement an alarm response process for operators to take appropriate action if the system detects the presence of an OPC.

As an alternative to enabling the automatic isolation of OPCs, the application of risk screening techniques (see Attachment 1) can be performed to determine that the risk associated with an OPC event is significantly reduced through the implementation of detection circuits. Completion of the risk analysis under the boundary conditions in Attachment 1 will have been performed by the completion of the monitoring period.

Additional Actions UFSAR Updates - Completion in conjunction with the timelines noted above and as required per the stations modification process.

Technical Specification Updates - Submitted by December 31, 2018, if required. If a TSTF Traveler is available, submitted within six months of issuance of an NRC approved TSTF Traveler.

Note 1: If Technical Specification updates are required for modification implementation, the schedule is expected to change based on NRC required review times; however, the station schedule should be maintained as closely as possible with the timelines noted above.

Note 2: If a Technical Specification Bases-only change is identified, implementation of the change by stations is expected to be completed as required per the stations modification process.

Schedule for New Reactors COL Licensees Complete design changes and plant modifications, as needed, prior to fuel load.

COL Applicants Describe design features in the FSAR, if change to certified design is required.

Design Centers Provide design features in the Design Control Document/FSAR.

May 2019, Revision 3 DRAFT 8

Open Phase Condition Initiative, May 2019, Revision 3 DRAFT Attachment 1 - Risk Informed Evaluation Method Purpose To demonstrate operator manual actions will be sufficient to mitigate the impact of an open phase condition.

Background

The previous revisions of the OPC Initiative employ a design condition based on the improbable concurrence of a DBA, which in turn drives the need to prevent loss of equipment important to mitigate such an event.1 Consequently, the automatic trip function design requirement was a direct result of applying this design condition. The risk associated with an OPC event is significantly reduced through the implementation of detection circuits such that the use of risk screening techniques as an alternative to enabling the automatic isolation of OPCs can be applied.

A probabilistic method of implementation of OPC solutions has been developed using the OPC Initiative framework. The risk evaluation of operator response to an OPC is predicated on use of the method outlined in NEI 19-02. The evaluation of a manual response to an OPC relies on the already conservative open phase detection circuit design which employed deterministic criteria combined with a probabilistic approach that characterizes the likelihood of the potential impact on plant equipment across a wide spectrum of potential plant conditions. Applying risk methods to support the application of manual actions to respond to an OPC provides nuclear plant operators an opportunity to more broadly consider the potential impacts of an OPC on equipment and plant configurations prior to taking actions that isolate or transfer loads.

Boundary Conditions Validate equipment recovery provisions to support the risk evaluation.

An OPC must be detected and alarmed in the control room.

Detection circuits for OPCs must be sensitive enough to identify an OPC for credited loading conditions (i.e., high and low loading).

For stations where transformers have very low or no loading when in the standby mode, automatic detection may not be reliable in this condition. The OPC solution must ensure automatic detection happens as soon as loads are transferred to this standby source. For this configuration, manual detection requirements must be documented in the risk evaluation and procedurally established to monitor for an OPC on a shiftly basis.

Written response procedures that allow operators to diagnose and take manual action to mitigate an open phase condition must be provided. Operator response should minimize action that could result in separation from an operable off-site GDC 17 source.

Licensees must demonstrate that the additional detection circuit design does not result in lower overall plant operation reliability.

1 ML13052A711 - NRC Bulletin 2012-01, Design Vulnerability in Electric Power System: Summary Report.

May 2019, Revision 3 DRAFT 9