ML071000266
| ML071000266 | |
| Person / Time | |
|---|---|
| Site: | Cook  |
| Issue date: | 03/30/2007 |
| From: | Jensen J Indiana Michigan Power Co |
| To: | Document Control Desk, NRC/NRR/ADRO |
| References | |
| AEP:NRC:7321 | |
| Download: ML071000266 (8) | |
Text
Indiana Michigan Power INDIANA Cook Nuclear Plant MICHIGAN One Cook Place poElR XWER0AE~corn Bridgman, MI 49106 A unit of American Electric Power March 30,2007 AEP:NRC:7321 10 CFR 50.109 Docket Nos.: 50-315 50-316 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Mail Stop O-P 1-17 Washington, DC 20555-0001 Donald C. Cook Nuclear Plant Units 1 and 2 Nuclear Regulatory Commission Approval of Degraded Voltage Protection Backfit Implementation
References:
- 1) Letter from C. Haney, U. S. Nuclear Regulatory Commission (NRC), to M. K. Nazar, Indiana Michigan Power Company (I&M), "Donald C. Cook Nuclear Plant, Units 1 and 2 - Imposition of Facility-Specific Backfit Re:
Degraded Voltage Protection System (TAC Nos. MC5735 and 5736)," dated November 9, 2005, ML050680057.
- 2) Letter from J. N. Jensen, I&M, to NRC, "Implementation of Degraded Voltage Protection Backfit," dated February 8, 2006, AEP:NRC:6321, ML060530405.
This letter requests Nuclear Regulatory Commission (NRC) approval of Indiana Michigan Power Company's (I&M's) planned degraded voltage protection system backfit implementation at Donald C. Cook Nuclear Plant (CNP) Units 1 and 2.
By Reference 1, the NRC imposed a backfit of CNP pursuant to 10 CFR 50.109. The backfit consists of modifying the design of CNP Units 1 and 2 such that automatic degraded voltage protection is not bypassed during normal operation. By Reference 2, I&M informed the NRC that it would implement the backfit. In a telephone conference on September 8, 2006, I&M provided an overview of the planned design modification and informed the NRC that it intended to implement the modification at the first outage of sufficient duration but no later than the Fall 2007 refueling outage for Unit 2 and the Spring 2008 refueling outage for Unit 1. The attachment to this letter provides a more detailed description of the manner in which the modified design will function. I&M requests approval of the planned degraded voltage backfit implementation by September 1, 2007, to support associated activities prior to the Fall 2007 Unit 2 refueling outage.
U. S. Nuclear Regulatory Commission A-EP:NRC:7321 Page 2 This letter contains no new regulatory commitments. Should you have any questions, please contact Ms. Susan D. Simpson, Regulatory Affairs Manager, at (269) 466-2428.
Sincerely, Joseph N. Jensen Site Vice President
Attachment:
Functional Description of Degraded Voltage System Backfit Modification JW/rdw c: J. L. Caldwell, NRC Region III K. D. Curry, Ft. Wayne AEP J. T. King, MPSC MDEQ - WHMD/RPMWS NRC Resident Inspector P. S. Tam, NRC Washington, DC
Attachment to AEP:NRC:7321 Functional Description of Degraded Voltage System Backfit Modification This attachment provides a functional description of a degraded voltage protection system design modification to implement a backfit imposed by the Nuclear Regulatory Commission (NRC) at the Donald C. Cook Nuclear Plant (CNP). The NRC imposed the backfit in a letter from C. Haney, NRC, to M. K. Nazar, Indiana Michigan Power Company (I&M), dated November 9, 2005 (ML050680057).
Electrical Distribution System As shown on the attached sketch, the on-site alternating current (AC) power distribution system contains four, 4160 volt (4 kV) nonsafety-related electrical buses designated IA, 1B, IC, and ID.
Each of the nonsafety-related buses feeds a downstream safety-related 4 kV bus. These safety-related buses are designated TI1A, TI 1B, TI 1C, and TIID, and are referred to as the "T" buses. Buses TI IA and TI lB and their downstream lower voltage buses comprise the "B" train, while buses TI IC and TI ID and their downstream lower voltage buses comprise the "A" train.
With the main generator on line, buses IA, iB, IC, and ID are normally fed from the Unit Auxiliary Transformers (UATs) powered by the main generator. Upon a turbine/reactor trip, buses IA, 1B, IC, and ID are automatically fast transferred from the UATs to the automatic load tap changing Reserve Auxiliary Transformers (RATs), which are fed from the preferred offsite power circuit. If there is no concurrent generator trip, the fast transfer is delayed for 30 seconds following the turbine trip. This feature assures 30 seconds of forced reactor coolant flow after a reactor trip. Buses IA, 1B, IC, and ID are also fed from the preferred offsite power circuit via the RATs when the main generator is not on line, during start-up, shutdown, and refueling operations, and occasionally, for on-line maintenance activities.
The T buses can also be fed from the alternate offsite power circuit, which is a 69 kV/4 kV transformer (fed from a 69 kV transmission line) and downstream 4 kV EP bus. Consistent with the CNP design and licensing basis, the alternate offsite circuit has the capacity to supply one train of accident loads in one unit and one train of safe shutdown loads in the opposite unit.
Connection of the alternate offsite power circuit to the T buses requires manual switch operations in the control room. The alternate offsite circuit may be aligned to a de-energized bus if the other sources required by Technical Specifications, i.e., the RATs and Emergency Diesel Generators (EDGs), are not available. There are also nonsafety-related Supplemental Diesel Generators (SDGs) that can be connected to the 4 kV EP bus to feed any of the T buses in either unit.
Current Degraded Voltalge Protection System Design The current degraded voltage protection designs for Unit I and Unit 2 are functionally equivalent, although there are minor differences. The Unit 1 design is described below.
The current degraded voltage system uses two sets of three degraded voltage relays configured in a 2-out-of-3 actuation logic. One set of three relays monitors voltage on bus Ti1A and one set monitors voltage on bus TiID. These relays actuate at a voltage setpoint specified in the
Attachment to AEP:NRC:7321 Page 2 Technical Specifications. The actuation is delayed by a nominal 9 seconds after the setpoint is reached if either a safety injection or low-low steam generator level signal is present, i.e., if there is indication of an accident. The 9 second delay assures consistency with applicable accident analyses. If neither of these signals is present, there is a nominal 2 minute time delay which precludes unnecessary actuations due to short term voltage fluctuations. The nominal 9 second value is specified in Technical Specification Surveillance Requirement 3.3.5.3. The nominal 2 minute time delay is specified in I&M controlled documents.
If buses IA, IB, IC, and ID, and the downstream T buses are being fed via the RATs, a degraded voltage condition that satisfies the applicable time delay will cause the degraded voltage relays to trip the feed breakers to the T buses. These feed breakers are breakers T1lA9, TiIBI, TIlCI, and TIIDI2 on the attached sketch. The resulting loss of voltage to the safety-related T buses will then initiate a load shed sequence, start the EDGs, and sequence loads onto the T buses in a predetermined order.
If buses 1A, IB, IC, and ID, and the downstream T buses are being fed via the UATs (i.e., the UAT feed breakers IA7, 1B7, IC6, and ID5 on the attached sketch are closed), contacts derived from the open position of the RAT feed breakers 1A5, IB5,ý IC4, and ID3 block the trip function of the degraded voltage relays thereby preventing the relays from tripping the feed breakers to the T buses. In this configuration, the degraded voltage relays will produce only an alarm in the control room. The relays will not cause the T buses to separate from the UATs in response to bus voltage conditions that meet the setpoint and time delay criteria. Therefore, the automatic degraded voltage protection is bypassed when buses IA, IB, IC, and ID, and the downstream T buses are fed via the UATs, i.e., during normal Mode I power operation. Additionally, the automatic degraded voltage protection is bypassed for 30 'seconds following a reactor trip, because the main generator remains connected to the UATs and the transmission network for 30 seconds before tripping, provided there is no signal, such as a generator fault, which would result in a generator trip.
Degraded Voltage Protection System Backfit Implementation I&M plans to perform a plant modification to implement the backfit on Unit 2 during its Fall 2007 refueling outage, and on Unit 1 during its Spring 2008 refueling outage. The plant modification will retain all protective features of the current degraded voltage protection scheme, including the current Technical Specification setpoints and time delays. The plant modification will add automatic protection from a degraded voltage condition when buses IA, 1B, IC, and ID, and the downstream T buses are fed via the UATs, including the 30 second period following a reactor/turbine trip where the UATs are still connected to buses IA, IB, IC, and ID. The changes to the degraded voltage protection components are summarized as follows:
" The RAT feed breaker IA5, IB5, 1C4, and 1D3 position function that prevents the degraded voltage relays from tripping breakers T1lA9, TIlB1, TIlCI, and TIlD12 will be removed from the breakers' control circuits.
" The degraded voltage protection logic will be modified such that a fast bus transfer from the UATs to the RATs will occur in response to sustained degraded voltage at the monitored
Attachment to AEP:NRC:7321 Page 3 T buses, T I1A and TI ID, when they are fed from the UATs. The fast bus transfer from the UATs to the RATs will be implemented in a similar manner as the existing fast bus transfer.
The bus feed breakers from the UATs and RATs will receive simultaneous trip and close signals respectively, resulting in minimal dead bus time.
The modified-system will function as follows:
- If no accident signal (safety injection or low-low steam generator level) is present and a degraded voltage occurs on the T buses, buses IA, 1B, IC, and ID and the downstream T buses will transfer from the UATs to the RATs after approximately 99 seconds. The degraded voltage condition on the T buses will concurrently initiate the 2 minute time delay.
If the degraded voltage on the T buses still exists after the nominal 2 minute delay, breakers T11A9, T11B1, TI IC1, and T11D12 will open and initiate transfer to the EDGs.
- If an accident signal (safety injection or low-low steam generator level) is present and a degraded voltage occurs on the T buses, the transfer of the bus IA, 1B, IC, and ID from the UATs to the RATs will be bypassed, resulting in a transfer of the T buses from the UATs directly to the EDGs after the nominal 9 second delay.
Operators will continue to receive an alarm on a degraded voltage condition regardless of the power supply to the T buses.
The 99 second time delay in this logic scheme will allow a reasonable amount of time for operators to respond before the transfer to the RATs. The remainder of the 2 minute delay following the transfer to the RATs will allow time for the automatic load tap changing RATs to respond. If the voltage from the RATs is not sufficient to reset the degraded voltage relays, the safety-related loads will be transferred to the next power source in the order of preference for AC power sources at CNP, the EDGs. This logic scheme will also ensure that the total amount of time that equipment is exposed to degraded voltage will not exceed the currently analyzed value of 2 minutes. Note that the above described nominal time values, except the 9 second delay specified in the Technical Specifications, are I&M controlled current or expected values subject to change in accordance with 10 CFR 50.59.
Compliance with Applicable Portions of Institute of Electrical and Electronic Engineers Standards IEEE 279-1968 and IEEE 279-1971, "Criteria for Protection Systems for Nuclear Power Generating Stations" In the November 9, 2005, letter imposing the backfit, the NRC stated that CNP is not in compliance with 10 CFR 50.55a(h)(2) because its protection systems do not comply with industry standards IEEE 279-1968 and IEEE 279-1971. This section describes how the plant modification will achieve compliance with the applicable portions of those standards.
Attachment to AEP:NRC:7321 Page 4 The function of transferring the T buses from the UATs or the RATs to the EDGs will be accomplished in accordance with the requirements of IEEE 279-1968 and IEEE 279-1971, including the requirement for use of safety-related components. The function of the fast bus transfer of the T buses from the UATs to the RATs will include the use of nonsafety-related cables to send the trip signals to the nonsafety-related UAT feed breakers 1A7, IB7, 1C6, and 1D5 and the close signals to the nonsafety-related RAT feed breakers 1A5, 1B5, IC4, and 1D3.
However, as described below, this transfer is not a protective function.
IEEE 279-1968 and IEEE 279-1971 require that protection functions be accomplished by safety-related systems. The protective function of the degraded voltage relays is to transfer the safety buses to an adequate power source when the voltage decreases below the specified setpoint and the appropriate time delay has been met. The CNP Technical Specifications establish the allowable setpoint values and a time delay of 9 seconds if there is a concurrent accident signal.
There is also an I&M controlled 2 minute time delay for cases in which there is no concurrent accident signal. The function of transferring the T buses from the UATs to the RATs is a pre-emptive function that would be accomplished prior to expiration of the 2 minute time delay, and would be bypassed entirely if a concurrent accident signal was present. The safety-related logic components will continue to monitor the T buses and will cause a subsequent transfer of the T buses to the EDGs if the degraded voltage relays are not reset. The total exposure time of equipment to degraded voltage will not exceed the currently analyzed 2 minutes. Therefore, the function of transferring the T buses from the UATs to the RATs is not a protective function as defined in IEEE 279-1968 and IEEE 279-1971.
The circuits that ensure transfer to the EDGs within 9" seconds are designed to the criteria of IEEE 279-1968 and IEEE 279-1971 and will function without reliance on any nonsafety-related components. Similarly, a transfer to the EDG will occur within the 2 minute time delay criteria if failures of the nonsafety devices occur or the preferred offsite source is not sufficient to reset the degraded voltage relays. The 2 minute timer will run concurrent with the 99 second timer, and can only be interrupted by reestablishing adequate voltage to the affected T bus. The entire channel for the 2 minute time delay, 9 second time delay, and trip logic is comprised of safety-related components. Failure of the fast bus transfer of the T buses from the UATs to the RATs due to malfunction of nonsafety-related components would not prevent a transfer of the T buses to the EDGs and fulfillment of the protective function within the currently analyzed time.
Therefore, the proposed design meets the requirements of IEEE 279-1968 and IEEE 279-1971, and the use of nonsafety-related components in the fast bus transfer of the T buses from the UATs to the RATs is not inconsistent with any standard, regulatory requirement, or the CNP licensing bases..
Alternate Offsite Circuit The November 9, 2005, NRC letter informing I&M of the backfit focused on bypassing degraded voltage protection during "normal operation." Where specific normal operation power sources are discussed in the NRC letter, the discussions address only the auxiliary source (via the UATs) and the preferred offsite source (via the RATs). The NRC stated in the letter that the existing
Attachment to AEP:NRC:7321 Page 5 design must be modified to provide automatic degraded voltage protection during normal operations when the safety buses are supplied from the UATs. The alternate offsite circuit is not specifically discussed in the NRC letter. However, the letter contains several statements indicating that the NRC considers requirements associated with automatic degraded voltage protection to apply "regardless of the power source" connected to the safety buses. Therefore, I&M has provided the following discussion as to why automatic degraded voltage protection is not appropriate for the alternate offsite circuit.
Automatic degraded voltage protection is not currently provided for the alternate offsite circuit.
Operation (Mode I and Mode 2) of a unit with power to the T buses supplied by the alternate offsite circuit would be highly abnormal. Discussions with cognizant CNP design and operations personnel have identified no previous occurrences in which the alternate offsite circuit has been connected to the onsite electrical distribution system in Modes I through 4. The alternate offsite circuit is not capable of supplying the entire auxiliary power system load of both CNP units. As noted in the section describing the electrical distribution system, the alternate offsite circuit has the capacity to supply one train of accident loads in one unit and one train of safe shutdown loads in the opposite unit. Manual switch operations in the control room are necessary to connect the alternate offsite circuit to a T bus and individual loads are added to this source as necessary. The alternate offsite circuit is 30 degrees out of phase with .the other offsite AC sources. Therefore, the.T bus would have to be de-energized prior to being connected to the alternate offsite circuit.
Due to its limited capacity, the need for manual actions to utilize it, and the need to de-energize the T bus(es) before connecting to it, the alternate offsite circuit is subordinate to the RATs and EDGs, in the. established order of automatic transfer for Technical Specification required AC power sources at CNP. Therefore, actuation of a degraded voltage protection system that automatically disconnected loads from the alternate offsite circuit would likely result in a loss of all AC power to the T buses. Rather than lose power to the T buses in response to degraded voltage from the alternate offsite circuit, I&M has established administrative controls that require shedding loads if the voltage decreases below a specified value when using the circuit. If the alternate offsite circuit becomes unavailable, the SDGs can be used to provide power.
Based on the alternate offsite circuit being subordinate to the RATs, and EDGs in the order of transfer for Technical Specification required AC power sources, the undesirable consequences of automatically disconnecting from the alternate offsite circuit, and the administrative controls to maintain adequate voltage if the alternate offsite circuit is utilized, I&M plans to maintain the current design which does not apply automatic degraded voltage protection to this circuit.
Attachment to AEP:NRC:7321 Page 6 Unit 2 Unit 2 Safety Related Safety Related Safety Related Loads Loads Loads Loads Sketch - Donald C. Cook Nuclear Plant Unit 1 AC Power Supplies (Unit 2 power supplies are identical except for component designations.)