ULNRC-05926, 90-Day Response to NRC Bulletin 2012-01, Design Vulnerability in Electric Power System

90-Day Response to NRC Bulletin 2012-01, Design Vulnerability in Electric Power System

ML12298A514
Person / Time
Site:	Callaway
Issue date:	10/24/2012
From:	Neterer D Ameren Missouri, Union Electric Co
To:	Office of Nuclear Reactor Regulation, Document Control Desk
References
ULNRC-05926, BL-12-001
Download: ML12298A514 (12)

Text

~'t-.

WAmeren Callaway Plant MISSOURI October 24, 20 I2 ULNRC-05926 U.S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555-000I I 0 CFR 50.54(t)

Ladies and Gentlemen:

DOCKET NUMBER 50-483 CALLAWAY PLANT UNIT 1 UNION ELECTRIC CO.

FACILITY OPERATING LICENSE NPF-30 90-DAY RESPONSE TO NRC BULLETIN 2012-01, "DESIGN VULNERABILITY IN ELECTRIC POWER SYSTEM" The Nuclear Regulatory Commission (NRC) issued Bulletin 20I2-0I, "Design Vulnerability in Electric Power System," dated July 27, 20I2, in order to request each licensee to provide information about their facilities' electric power system designs and to require a comprehensive verification of their compliance with the regulatory requirements of General Design Criterion I7 in Appendix A to I 0 CFR Part 50 and the design criteria for protection systems under I 0 CFR 50.55a(h)(2) and/or I 0 CFR 50.55a(h)(3). Addressees are required to provide a written response to the NRC in accordance with I 0 CFR 50.54(t) within 90 days of the date of the Bulletin. The information requested in response to the Bulletin is hereby provided in the enclosure to this letter.

This letter does not contain commitments. Please contact Scott Maglio, Regulatory Affairs Manager at 573-676-8719 for any questions you may have regarding this issue.

I declare under penalty of peijury that the foregoing is true and correct.

Sincerely,

~

Executed on: /P ~~-.2~/..1.

David W. Neterer Plant Director DRB/nls

Enclosure:

Response to NRC Bulletin 2012-0I for Callaway Plant PO Box 620 Fulton, MD 65251 AmerenMissouri.com

ULNRC-05926 October 25, 20I2 Page 2 cc: Mr. Elmo E. Collins Regional Administrator U.S. Nuclear Regulatory Commission Region IV I600 East Lamar Boulevard Arlington, TX 760 1I-45II Senior Resident Inspector Callaway Resident Office U.S. Nuclear Regulatory Commission 820 I NRC Road Steedman, MO 65077 Mr. Fred Lyon Project Manager, Callaway Plant Office ofNuclear Reactor Regulation U.S. Nuclear Regulatory Commission Mail Stop 0-88 I Washington, DC 20555-2738

ULNRC-05926 October 25, 2012 Page 3 Index and send hardcopy to QA File A160.0761 Hardcopy:

Certrec Corporation 4150 International Plaza Suite 820 Fort Worth, TX 76109 (Certrec receives ALL attachments as long as they are non-safeguards and may be publicly disclosed.)

Electronic distribution for the following can be made via Responses and Reports ULNRC Distribution:

A. C. Heflin F. M. Diya C. 0. Reasoner III D. W. Neterer L. H. Graessle L. H. Kanuckel S. A. Maglio T. B. Elwood M.D. Haag R. Holmes-Bobo NSRB Secretary Mr. Bill Muilenburg (WCNOC)

Mr. Tim Hope (Luminant Power)

Mr. Ron Barnes (APS)

Mr. Tom Baldwin (PG&E)

Mr. Mike Murray (STPNOC)

Ms. Linda Conklin (SCE)

Mr. John O'Neill (Pillsbury Winthrop Shaw Pittman LLP)

Enclosure to ULNRC-05926 Response to NRC Bulletin 2012-01 for Callaway Plant Attachment 1- Bulletin Response Overview:

• System Description - Items 2, l.d, 2.a, 2.c

• System Protection- 1, l.a, 2.b, 2.d

• Consequences- l.b, l.c, 2.e

• Attachment 2 -Simplified One-Line Diagram

• Attachment 3 -Tables o Table 1- ESF Buses Continuously Powered From Offsite Power Source(s) o Table 2- ESF Buses Normally Energized Major Loads o Table 3- Offsite Power Transformers o Table 4- Protective Devices

System Description

Items 2, l.d, 2.a, and 2.c request system information and will be addressed in this section:

2. Briefly describe the operating configuration of the ESF buses (Class lEfor current operating plants or non-Class lEfor passive plants) at power (normal operating condition).

See Attachment 2 for a simplified one-line diagram.

Two independent, immediate access offsite power sources are brought to the Class 1E onsite power system.

During normal plant operations, one circuit is fed from Safeguards Transformer A (XMDV22) or Safeguards Transformer B (XMDV24), and then to Engineered Safety Features (ESF) transformer XNB01 in order to supply power to associated 4.16-kV Class 1E bus NBOl. The other circuit is fed from one secondary winding of the Startup Transformer (XMR01) to ESF transformer XNB02 which supplies power to associated 4.16-kV Class 1E bus NB02.

In addition, each offsite power circuit can be manually aligned to supply power to the opposite or both 4.16-kV Class 1E buses, if required. However, this requires declaring the cross-connected power source inoperable and entering Condition A ofTS 3.8.1 such that the 72-hour Completion Time of Required Action A.3 is in effect for restoring the inoperable source to operable status.

ESF Transformers XNB01 and XNB02 are each equipped with an automatic on-load tap changer (LTC). In addition, a capacitor bank is connected to the secondary side of each ESF transformer. With both systems (load tap changers and capacitor banks) in operation, the general response to a voltage decrease is for the capacitor bank to provide a rapid voltage increase if needed, and then the LTC will step to correct the voltage back to a 4.16-kV level Page 1 of9

Enclosure to ULNRC-05926 Response to NRC Bulletin 2012-01 for Callaway Plant and thus turn the capacitor bank off. The voltage control systems function to ensure that the voltage at NB01 and NB02 is sufficient to reset the safety related degraded voltage relays and loss-of-voltage relays before time limits are exceeded. With this design, the preferred offsite power sources are retained to power the safety related electrical distribution system through a wide range of switchyard voltages.

1.d. Describe the of/site power transformer (e.g., start-up, reserve, station auxiliary) winding and grounding configurations.

See Attachment 3, Table 3 for offsite power transformer winding and grounding configurations.

2.a. Are the ESF buses powered by of/site power sources? If so, explain what major loads are connected to the buses including their ratings.

For at-power (normal operating condition) configurations, ESF buses are powered by offsite sources. See , Table 2 for ESF bus major loads energized during normal power operations, including their ratings.

For normal operating conditions, no additional non-safety loads or buses are carried by the offsite sources other than some small selected loads powered from the Class 1E buses. These non-safety loads are shed during a Safety Injection.

2.c. Confirm that the operating configuration of the ESF buses is consistent with the current licensing basis. Describe any changes in of/site power source alignment to the ESF buses from the original plant licensing.

The following at-power (normal operating condition) configurations have been confirmed to be consistent with the current licensing basis:

1. Circuit #1- One offsite circuit consists of either Safeguards Transformer A orB, as supplied from Switchyard Bus A or B, and feeds through a breaker to ESF transformer XNB01 which provides power to the NB01 ESF bus through its normal feeder breaker or to the NB02 ESF bus through its alternate feeder 1

breaker, if needed.

2. Circuit #2- Another offsite circuit consists of the Startup Transformer, as normally fed from the Switchyard, feeding through breaker PA0201 to ESF transformer XNB02 which provides power to the NB02 ESF bus through its normal feeder breaker or to the NB01 bus through its alternate feeder breaker, 1

if needed.

See Attachment 3 Table 1 for the offsite power source alignment to the ESF buses. The identified alignment is consistent with the original plant licensing basis.

An additional/backup source to the ESF buses was added in 2011. No credit is taken for this source in the plant's accident analyses, as its functional capability is not part of the plant's original licensing basis. Its use is intended for an event in which both credited off-site sources are lost and both on-site emergency diesel generators are lost.

1 As noted on page 1, alignment of an offsite source (via the associated ESF transformer) to the other4.16-kV Class 1E bus via the alternate feeder breaker does not satisfy the source operability requirements of the Limiting Condition for Operation (LCO) in TS 3.8.1. For such a condition, the cross-connected source must be declared inoperable such that Condition A ofTS 3.8.1 applies and Required Action A.3 must be entered, which requires restoring the inoperable source to operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

Page 2 of9

Enclosure to ULNRC-05926 Response to NRC Bulletin 2012-01 for Callaway Plant This source is fed from a local co-operative substation or four two-megawatt diesel generators located at the substation. The Class 1E loss-of-voltage protection and degraded voltage protection will shed this source if required. Ground fault protection similar to the credited sources exists on this source to isolate in the event of a line-to-ground fault.

System Protection Items 1, l.a, 2.b, and 2.d request information regarding electrical system protection and will be addressed in this section, as follows.

1. Given the requirements above, describe how the protection scheme for ESF buses (Class 1E for current operating plants or non-Class 1E for passive plants) is designed to detect and automatically respond to a single-phase open circuit condition or high impedance ground fault condition on a credited off-site power circuit or another power sources.

Consistent with the current licensing basis and GDC 17, existing protective circuitry will separate the ESF buses from a connected but failed offsite source due to a loss of voltage or a sustained, balanced degraded grid voltage concurrent with certain design basis accidents. The relay systems were not specifically designed to detect an open single phase of a three-phase system. Detection of a single open-phase condition is beyond the approved design and licensing basis of the plant Callaway's loss-of-voltage and degraded voltage protection consists of voltage sensors arranged in a two-out-of-four coincidence logic scheme. All line-to-line voltages are monitored, with one line-to-line voltage monitored twice as part of the two-out-of-four protection scheme. A sufficiently low voltage on one phase will cause at least two out of the four channels to operate and shed the degraded offsite power source.

From experience with high-impedance grounds associated with the off-site circuits, the effect of a high-impedance ground has been seen to produce less than a one-percent voltage drop on the ESF buses for a ground fault up to the most limiting relay setting.

1.a. The sensitivity of protective devices to detect abnormal operating conditions and the basis for the protective device setpoint(s).

Consistent with the current licensing basis and GDC 17, existing electrical protective devices are sufficiently sensitive to detect design basis conditions like a loss of voltage or a degraded voltage, but they were not designed to detect a single-phase open-circuit condition. See Attachment 3, Table 4 for a listing of undervoltage protective devices and the bases for their setpoints.

Existing electrical protective devices are also sufficiently sensitive to detect a ground fault. Ground protection devices associated with sources to the ESF buses and the bases for their setpoints are identified in Attachment 3, Table 4.

2.b. If the ESF buses are not powered by offsite power sources, explain how the surveillance tests are performed to verify that a single-phase open circuit condition or high impedance ground fault condition on an off-site power circuit is detected.

Not Applicable- the ESF buses at Callaway Energy Center are powered by offsite power sources.

2.d. Do the plant operating procedures, including off-normal operating procedures, specifically call for verification of the voltages on all three phases of the ESF buses?

Page 3 of9

Enclosure to ULNRC-05926 Response to NRC Bulletin 2012-01 for Callaway Plant All three line-to-line voltages at the ESF buses are automatically monitored by the loss-of-voltage and degraded voltage protection. Voltage metering is only available for the "A" phase to "B" phase line-to-line voltage. Thus, a manual verification is not proceduralized.

Consequences Items l.b, 1.c, and 2.e request information regarding the electrical consequences of an event and will be addressed in this section, as follows.

1.b. The differences (if any) of the consequences of a loaded (i.e., ESF bus normally aligned to of/site power transformer) or unloaded (e.g., ESF buses normally aligned to unit auxiliary transformer) power source.

Installed relays were not designed to detect single-phase open-circuit conditions. Existing loss-of-voltage and degraded voltage relays may respond depending on load and possible grounds. Degraded undervoltage logic at Callaway consists of two-out-of-four, line-to-line undervoltage logic to initiate ESF bus actuations. Callaway can detect and isolate based on a low voltage on a single phase because all three line-to-line voltages are monitored in the two-out-of-four coincidence undervoltage protection scheme. A formal analysis of normal light load and heavy load conditions has not been completed.

1.c. If the design does not detect and automatically respond to a single-phase open circuit condition or high impedance ground fault condition on a credited of/site power circuit or another power sources, describe the consequences of such an event and the plant response.

Callaway has independence between offsite source feeds to the Engineered Safety Feature (ESF) buses. ("ESF buses" and "Class 1E buses" are synonymous terms.) Callaway has one off-site source feeding one 4.16-kVCiass 1E bus and the other off-site source feeding the other 4.16-kV Class 1E bus. This operating alignment is described in Callaway's operating procedures. This operating practice and design protects Callaway against a loss of safety function from an open-circuit event.

The above-described operating alignment is enforced and required by the Technical Specifications for Callaway, as previously noted. In general, the Limiting Condition for Operation (LCO) of a Technical Specification represents the lowest functional capability or performance level of equipment required for safe operation of the facility (as noted in 10 CFR 50.36). The LCO takes into account the capability of the specified system/equipment to accommodate a single failure and still be able to perform its required function. Thus, for a system designed with two independent and redundant trains or subsystems, the TS LCO requires both trains or subsystems to be operable, as this constitutes the level of performance or functional capability assumed, for example, at the onset of a postulated accident in the applicable accident analysis, in consideration of a worst-case single failure.

Consistent with the above-described basis forTS LCO requirements, TS 3.8.1, "AC Sources- Operating," of the Callaway Technical Specifications requires both of the above-described independent offsite power sources to be operable during plant operation. This provides protection against a single failure to the extent that such a failure can only affect one train of equipment. While the various single failures typically considered in the safety analyses are postulated for safety-related components, and while the single-failure protection provided by Callaway's required configuration can accommodate such failures without loss of function, the source alignment required by TS 3.8.1 also ensures that a failure of the kind addressed by Bulletin 2012-01 can be accommodated with no resultant loss of function, due to the independence of the two offsite sources and their circuit connections.

Page 4 of9

Enclosure to ULNRC-05926 Response to NRC Bulletin 2012-01 for Callaway Plant

1. Since Callaway did not credit the ESF bus protection scheme as being capable of detecting and automatically responding to a single-phase open circuit condition, an open-phase fault was not included in the design criteria for either the loss-of-voltage protection scheme, the degraded voltage relay {DVR) scheme, or the secondary-level undervoltage protection system {SLUPS) design. Since open-phase detection was not credited in the Callaway design or licensing basis, no design basis calculations or design documents exist that previously considered this condition.

2. Without formalized engineering calculations or engineering evaluations, the electrical consequences of an open-phase event {including plant response), can only be evaluated to the extent of what has already been published by EPRI and Basler, which is a generic overview. The difficulty in applying these documents to Callaway for responding to Bulletin 2012-01 is that these are generic assessments and cannot be formally credited as a basis for an accurate response. For an accurate response, detailed plant-specific models would need to be developed {e.g., transformer magnetic circuit models, electric distribution models, and motor models, including positive, negative, and zero sequence impedances), and the models would need to be compiled and analyzed for Callaway's specific Class 1E electric distribution system. Callaway is continuing efforts would be required to formalize this analysis and ensure its accuracy.

With regard to the occurrence of a high-impedance ground, such an event has no immediate effect on plant operation. If the ground is sufficiently large to affect plant operation, protective relaying will isolate the ground automatically. The effect of a high-impedance ground has been analyzed to produce less than a one-percent voltage drop on the ESF buses for a ground fault up to the most limiting relay setting.

2.e. If a common or single offsite circuit is used to supply redundant ESF buses, explain why a failure, such as a single-phase open circuit or high impedance ground fault condition, would not adversely affect redundant ESF buses.

For normal plant operation, and as already described, Callaway does not use a common or single offsite circuit to supply both ESF buses. The Technical Specifications for Callaway require the two offsite source connections to be independent. If one offsite circuit is used to supply both redundant ESF buses, a 72-hour Action statement under TS 3.8.1 is required to be entered for the out-of-service offsite circuit. This limits the time allowed for the plant to be in an abnormal line-up.

Entry into a TS Action is typically the result of an inoperable condition for which single-failure assumptions or other assumptions of the safety analysis are not met. As continued plant operation is typically limited in such a condition, the condition is not required to be assumed as a condition in the accident analysis or analyzed in terms of the effects of additional failures. Thus, for the condition that exists when the 72-hour Required Action ofTS 3.8.1 is in effect, a coincident open-circuit failure event is not required to be postulated.

Consistent with the current licensing basis and GDC 17, protective circuitry will separate the ESF buses from a failed offsite source due to a loss of voltage or a sustained balanced degraded grid voltage concurrent with certain design basis accidents. The relay systems were not specifically designed to detect an open single phase of a three-phase system. Detection of a single open-phase condition is beyond the approved design and licensing basis of the plant. No formal calculations for this scenario have been done.

Consistent with the current station design, protective circuitry will protect from a ground-fault condition with all three phases intact.

Page 5 of9

Enclosure to ULNRC-05926 Response to NRC Bulletin 2012-01 for Callaway Plant Attachment 2 Simplified One-Line Diagram CAL-BLAND 1 CAL-LSCK 2 MTG-CAL8 MTGY-CAL 7 345 kV SWITCHYARD BUS B XMDV24 345 kV 13.8 kV

+

+

L $/(_

NC

~

NO¢ NC /(_

XMDV~

+

9 9 13.8 kV.+

345 kV + rvyv'

/

345 kV SWITCH YARD BUS A 345 kV.+

GSU 25kV 6 6

13.8 k ++

UNIT AUX XFMR MAIN NO NC NO NC A. GEN 13.8 kV 13.8 kV NON-CLASS 1 E NON-CLASS 1E PA0201 13.8 kV6 XNB02 Callaway 4.16 kV.+

--r-EDG B

Electrical NO NC NB02 Distribution 4.16 kV CLASS 1E CLASS 1E 4kV 6 4 kV 6 480VI TYP.

MOTORS TYP.

MOTORS 480~

TYP. 480V TYP. 480V CLASS 1E CLASS 1E Page 6 of9

Enclosure to ULNRC-05926 Response to NRC Bulletin 2012-01 for Callaway Plant Attachment 3 -Tables Table 1 - ESF Buses Continuously Powered From Offsite Power Source(s)

Description of ESF Bus Power Source ESF Bus Name (normal operating condition). Original licensing basis configuration (Y/N)

From the 13.8 kV ring bus powered NB01 y from XMDV22 or XMDV24 through XNB01totheESFbusNB01 From the 345 kV switchyard NB02 y connection through XMR01 X winding through XNB02 to the ESF bus NB02 Table 2 - ESF Buses Normally Energized Major Loads ESF Bus Load Voltage Level Rating (HP)

NB01 Component Cooling Water 4160V 700 Pump #1 NB01 Containment Cooler #1 480V 150 NB01 Containment Cooler #3 480V 150 NB01 Battery Charger #1 480V 64 kVA NB01 Battery Charger #3 480V 64 kVA NB01 Non 1E Air Compressor 480V 200 NB01 Class 1E A/C Unit A 480V 33.7 kW + 15 hp NB01 Control Rm A/C Unit A 480V 48.6 kW + 40 hp NB01 Hydrogen Mixing Fan #1 480V 50 NB01 Hydrogen Mixing Fan #3 480V 50 NB02 Component Cooling Water 4160V 700 Pump#2 NB02 Containment Cooler #2 480V 150 NB02 Containment Cooler #4 480V 150 NB02 Battery Charger #2 480V 64 kVA NB02 Battery Charger #4 480V 64 kVA NB02 Non 1E Air Compressor 480V 200 NB02 Class 1E A/C Unit B 480V 33.7 kW + 15 hp NB02 Control Rm A/C Unit B 480V 48.6 kW + 40 hp NB02 Hydrogen Mixing Fan #2 480V so NB02 Hydrogen Mixing Fan #4 480V 50 Page 7 of9

Enclosure to ULNRC-05926 Response to NRC Bulletin 2012-01 for Callaway Plant Table 3 - Offsite Power Transformers Transformer Winding MVASize Voltage Rating Grounding Configuration (OA/FA/FOA) (Primary/Secondary) Configuration Start-up Transformer Three winding 60/80/100 MVA 345 kV/13.8 kV High side neutral XMR01 WyeG- WyeG- WyeG solidly grounded, Shell form low side neutrals grounded thru 20-ohm resistors Safeguards Transformer A Three winding 60/80/100 MVA 345 kV/13.8 kV High side neutral XMDV22 WyeG-WyeG-WyeG solidly grounded, Shell form low side neutrals grounded thru 20-ohm resistors Safeguards Transformer B Two winding 30MVA 345 kV/13.8 kV High side neutral XMDV24 WyeG-WyeG solidly grounded, 3-leg core form low side neutral grounded thru 20-ohm resistor ESF Transformer XNB01 Two winding Load 12/16 MVA 13.8 kV/4.16 kV Low side neutral Tap Changing grounded thru Delta-WyeG 6-ohm resistor 3-leg core form ESF Transformer XNB02 Two winding Load 12/16 MVA 13.8 kV/4.16 kV Low side neutral Tap Changing grounded thru Delta-WyeG 6-ohm resistor 3-leg core form Page 8 of9

Enclosure to ULNRC-05926 Response to NRC Bulletin 2012-01 for Callaway Plant Table 4 - Protective Devices Protection Protective Device uv Setpoint Basis for Setpoint Zone Logic (Nominal)

NB01 or Loss of Voltage Relays 2of4 2905 v To actuate upon a complete loss of ESF Bus NB02 4.16 kV {69.8% of 4160V) voltage.

ESF Buses NB01 or Degraded Voltage Grid 2of4 3761 v To actuate when voltage is inadequate to support proper NB02 4.16 kV (90.4% of 4160 V) operation of Class 1E equipment on any support voltage ESF Buses level.

Start Up Ground Protection Various time- Coordinate ground fault isolation to point nearest fault Transformer 450-451G/T1 current curves XMROl 251N#2-T1 and current 251N#4-T1 values 251G/B Differential Protection 487-Tl ESF Ground Protection Various time- Coordinate ground fault isolation to point nearest fault Transformer 250G-T2 current curves XNB02 151N-T2 and current NB0109 151G/F NB0212 151G/F values Differential Protection 287-T2 Safeguards A Ground Protection Various time- Coordinate ground fault isolation to point nearest fault Transformer 51NP#1-V22 current curves XMDV22 51NS#1-V22 and current 51G-1 Differential Protection values 87 Safeguards B Ground Protection Various time- Coordinate ground fault isolation to point nearest fault Transformer 51NP#1-V24 current curves XMDV24 51NS#1-V24 51G-3 Differential and current Protection values 87 ESF Ground Protection Various time- Coordinate ground fault isolation to point nearest fault Transformer 151N-T1 current curves XNBOl NB0112 151G/F and current NB0209151G/F Differential Protection values 287-Tl Page 9 of9