IR 05000528/2018010
| ML18103A157 | |
| Person / Time | |
|---|---|
| Site: | Palo Verde  |
| Issue date: | 04/13/2018 |
| From: | Greg Werner NRC/RGN-IV/DRS/EB-2 |
| To: | Bement R Arizona Public Service Co |
| Werner G | |
| References | |
| IR 2018010 | |
| Download: ML18103A157 (38) | |
Text
April 13, 2018 Mr. Robert Executive Vice President Nuclear/
Chief Nuclear Officer Arizona Public Service Company P.O. Box 52034, MS 7602 Phoenix, AZ 85072-2034 SUBJECT: PALO VERDE NUCLEAR GENERATING STATION - NRC INSPECTION OF THE LICENSEES IMPLEMENTATION OF INDUSTRY INITIATIVE ASSOCIATED WITH THE OPEN PHASE CONDITION DESIGN VULNERABILITIES IN ELECTRIC POWER SYSTEMS - INSPECTION REPORT 05000528/2018010, 05000529/2018010, AND 05000530/2018010
Dear Mr. Bement:
On March 22, 2018, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at the Palo Verde Nuclear Generating Station. On March 22, 2018, the inspectors discussed the results of this inspection with Ms. M. Lacal, Senior Vice President Regulatory and Oversight, and other members of your staff. The results of this inspection are documented in the enclosed report.
The NRC inspectors did not identify any findings or violations of more than minor significance.
This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html, and at the NRC Public Document Room in accordance with 10 CFR 2.390, Public Inspections, Exemptions, Requests for Withholding.
Sincerely,
/RA James Drake Acting for/
Gregory E. Werner, Chief Engineering Branch 2 Division of Reactor Safety Docket Nos. 50-528, 50-529, and 50-530 License Nos. NPF-41, NPF-51, and NPF-74 Enclosure:
Inspection Report 05000528/2018010, 05000529/2018010, and 05000530/2018010 w/ Attachments: 1. Table 1 - Information Gathered for TI 2515/194 2. TI 2515/194 Inspection Documentation Request
U.S. NUCLEAR REGULATORY COMMISSION
Inspection Report
Docket Number(s): 05000528, 05000529, 05000530 License Number(s): NPF-41, NPF-51, NPF-74 Report Number(s): 05000528/2018010, 05000529/2018010, and 05000530/2018010 Enterprise Identifier: I-2018-010-0018 Licensee: Arizona Public Service Company Facility: Palo Verde Nuclear Generating Station Location: Tonopah, Arizona Inspection Dates: March 19, 2018, to March 22, 2018 Inspectors: S. Graves, Team Lead, Senior Reactor Inspector, Region IV B. Correll, Reactor Inspector, Region IV Accompanying K. Nguyen, Electrical Engineer, NRR/DE/EEOB Personnel: I. Kafeez, Reactor Inspector, Region III/DRS/EB3 H. Kodali, Electrical Engineer, NRR/DE/EEOB J. Quichocho, Chief, NRR/DE/EEOB Approved By: G. Werner, Branch Chief, Engineering Branch 2 Enclosure
SUMMARY
The U.S. Nuclear Regulatory Commission (NRC) continued monitoring licensees performance by conducting Temporary Instruction 2515/194, Inspection of the Licensees Implementation of Industry Initiative Associated with the Open Phase Condition Design Vulnerabilities in Electric Power Systems (NRC Bulletin 2012-01), at Palo Verde Nuclear Generating Station, in accordance with the Reactor Oversight Process. The Reactor Oversight Process is the Nuclear Regulatory Commission program for overseeing the safe operation of commercial nuclear power reactors. Refer to https://www.nrc.gov/reactors/operating/oversight.html for more information.
List of Findings and Violations None.
Additional Tracking Items None.
INSPECTION SCOPE
This inspection was conducted using Temporary Instruction 2515/194 (ADAMS Accession No. ML17137A416), dated October 31, 2017. The inspectors reviewed the licensees implementation of Nuclear Energy Institute Voluntary Industry Initiative in compliance with Commission guidance. The team discussed the licensees open phase condition system design and ongoing implementation plans with plant staff and vendor staff. The team reviewed licensee and vendor documentation, and performed system walkdowns to verify that the installed equipment was supported by the design documentation. The team verified that the licensee had completed the installation and testing of equipment (with the exception of the tripping functions), installed and tested alarming circuits both local and in the control room, and analyzed potential impacts associated with the design implementation on the current licensing basis.
OTHER ACTIVITIES
- TEMPORARY INSTRUCTIONS, INFREQUENT AND ABNORMAL Temporary Instruction 2515/194 - Inspection of the Licensees Implementation of Industry Initiative Associated with the Open Phase Condition Design Vulnerabilities in Electric Power Systems (NRC BULLETIN 2012-01)
The objective of Temporary Instruction 2515/194, is to verify that licensees have appropriately implemented the Nuclear Energy Institute Voluntary Industry Initiative including updating their licensing basis to reflect the need to protect against open phase conditions, and to gather the information necessary for Office of Nuclear Reactor Regulation staff to determine whether the licensees have adequately addressed potential open phase conditions.
Temporary Instruction 2515/194-03.01 - Voluntary Industry Initiative (Part 1)
Palo Verde Nuclear Generating Station selected the open phase detection system designed and manufactured by Power System Sentinel Technologies, LLC, as the design vendor for their open phase condition system. At the end of this inspection the power system sentinel technologies system was still in the monitoring mode of operation to facilitate continued data gathering of grid perturbations for evaluation of alarm and trip setpoints. The open phase condition equipment was installed on the startup transformers (SUTs) AE-NAN-X01, AE-NAN-X02, and AE-NAN-X03 which provide power to station busses, including the stations six engineered safety feature (ESF) busses. The licensee is scheduled to transition the power system sentinel technologies system to full implementation (tripping functions enabled) in December 2018. The licensee was preparing design modifications and associated documentation for this transition, however they were not available for review at the time of inspection.
Section 03.01 of the Temporary Instruction required the determination of whether the licensee appropriately implemented the voluntary industry initiative, dated March 16, 2015 (ADAMS Accession No. ML15075A454), by verifying the following:
a. Detection, Alarms and General Criteria 1. Either open phase conditions are detected and alarmed in the control room, or
- (a) The licensee has demonstrated that open phase conditions do not prevent the functioning of important-to-safety systems, structures, and components,
- (b) Open phase condition detection will occur within a reasonably short period of time (e.g., 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />), and
- (c) The licensee has established appropriate documentation regarding open phase condition detection and correction.
2. Either detection circuits are sensitive enough to identify an open phase condition for credited loading conditions (i.e., high and low loading), or if automatic detection may not be possible in very low or no loading conditions when offsite power transformers are in standby mode, automatic detection must happen as soon as loads are transferred to this standby source. Additionally, the licensee has established appropriate shiftly surveillance requirements to look for evidence of open phase conditions.
3. Open phase condition design/protective schemes minimize misoperation or spurious action in the range of voltage unbalance normally expected in the transmission system that could cause separation from an operable offsite power source.
Licensees have demonstrated that the actuation circuit design does not result in lower overall plant operation reliability.
4. New non-Class-1E circuits are not used to replace existing Class-1E circuits.
5. The Updated Final Safety Analysis Report (UFSAR) has been updated to discuss the design features and analyses related to the effects of, and protection for, any open phase condition design vulnerability.
b. Protective Actions 1. If the licensee determines there is no single credible failure that could cause an open phase condition, then verify that the licensee has developed and issued a full engineering evaluation to document the basis for open phase condition as a non-credited event. The Bruce Power and Forsmark operating experience must be considered as part of this analysis.
2. With open phase condition occurrence and no accident condition signal present, either an open phase condition does not adversely affect the function of important-to-safety system, structures, and components, or,
- (a) Technical Specification Limiting Condition of Operations (LCOs) are maintained or the technical specification actions are met without entry into Technical Specification Limiting Condition of Operation 3.0.3 (or equivalent),and
- (b) Important-to-safety equipment is not damaged by the open phase condition, and
- (c) Shutdown safety is not compromised.
3. With open phase condition occurrence and an accident condition signal present, automatic detection and actuation will transfer loads required to mitigate postulated accidents to an alternate source and ensure that safety functions are preserved, as required by the current licensing bases, or the licensee has shown that all design basis accident acceptance criteria are met with the open phase condition, given other plant design features. Accident assumptions must include licensing provisions associated with single failures. Typically, licensing bases will not permit consideration of the open phase condition as the single failure since this failure is in a non-safety system.
4. Periodic tests, calibrations, setpoint verifications, or inspections (as applicable)have been established for any new protective features. The surveillance requirements have been added to the plant Technical Specifications if necessary to meet the provisions of 10 CFR 50.36.
Temporary Instruction 2515/194-03.02 - Information Gathering for Voluntary Industry Initiative Assessment (Part 2)
Section 03.02 of the Temporary Instruction required information gathering as part of the initial inspections to enable the Nuclear Reactor Regulation staff to determine whether the modifications implemented by the licensee of each unique open phase condition system design for the voluntary industry initiative adequately address potential open phase conditions. The information gathered for this section is tabulated in attachment, Table 1 - Information Gathered for TI 2515/194, to this report.
INSPECTION RESULTS
Based on interviews and discussions with the licensee and the vendor, review of available design, testing, grid data trending results documentation, and walkdowns of installed equipment, the team had reasonable assurance the licensee appropriately implemented, with noted exceptions discussed below, the voluntary industry initiative.
TI 2515/194-03.01 - Voluntary Industry Initiative (Part 1)a. Detection, Alarms and General Criteria
- (1) The team determined by walkdowns and observation that open phase conditions will be detected and alarmed in the control room for each unit.
- (2) The team determined that detection circuits were sensitive enough to identify an open phase condition for all credited loading conditions.
- (3) No Class-1E circuits were replaced with non-Class 1E circuits in the design.
b. Protective Actions Criteria
- (1) The team determined the licensee identified they were susceptible to an open phase condition and were implementing design changes to mitigate the effects.
- (2) The team determined that with an open phase condition present and no accident condition signal, the power system sentinel technologies system would not adversely affect the function of important-to-safety systems, structures, and components. The licensees open phase condition design solution added a set of additional tripping inputs in parallel to the existing transformer isolation controls. This addition added a new tripping condition (open phase) to the electrical faults which result in loss of one preferred source of power to one train of ESF loads. The credited plant response would be the same regardless of the conditions that generated the isolation of the transformer.
No findings were identified, however the team identified the following exceptions to the Temporary Instruction criteria resulting from the incomplete design modifications:
c. Detection, Alarms and General Criteria Exceptions
- (1) The licensees design was operating in the monitoring mode with vendor recommended setpoints enabled, to gather data to ensure the open phase condition design and protective schemes would minimize misoperation, or spurious actions in the range of voltage unbalance normally expected in the transmission system.
Because actual demonstration of this criterion requires the system to be in operation with final trip setpoints established, the team was not able to fully verify this criterion.
After discussions with licensee and vendor staff, design document and test results reviews, and historical monitoring date reviews, the team had reasonable assurance that the actuation circuit design would not result in lower overall plant operation reliability. The team did not identify any issues of concern.
- (2) The Final Safety Analysis Report had not been updated to include information related to open phase conditions at the conclusion of the onsite inspection. The licensee provided and the team reviewed proposed changes to the licensing basis that discussed the design features and analyses related to the effects of, and protection for, any open phase condition design vulnerability. The team verified the proposed changes had been entered into the corrective action program as Condition Report CR NON 18-04437 to track the completion of the Updated Final Safety Analysis Report. The team did not identify any issues of concern.
d. Protective Actions Criteria Exceptions
- (1) The licensees open phase condition design solution used the existing isolation and power scheme for safety-related accident loads; only a new tripping condition (open phase) had been added to the electrical faults which result in loss of one preferred source of power to one train of ESF loads. A loss of voltage, including a loss of voltage caused by isolation of the preferred source due to an open phase condition, on the affected ESF bus results in the affected train loading being automatically transferred to the onsite emergency power source, if available (single failure), or manually to a different SUT. While no changes to this configuration were planned due to the inclusion of the power system sentinel technologies system, actual demonstration of this criterion requires the system to be in full operation.
Through review of available design documents and discussions with plant and vendor staff, the team had reasonable assurance that with an open phase condition present and an accident condition signal, the power system sentinel technologies system automatic detection and actuation would isolate the affected transformer.
Due to the configuration of Palo Verde Nuclear Generating Stations electrical distribution system, a loss of a SUT would only affect one train of equipment, and loads required to mitigate postulated accidents would be available on the non-affected train ensuring that safety functions are preserved as required by the current licensing bases. The team did not identify any issues of concern.
- (2) The licensee had not finalized documentation for periodic tests, calibrations, setpoint verifications, or inspection procedures for open phase condition-related components at the time of this inspection. The team held discussions with licensee and vendor staff and identified that the vendor guidance, including periodic tests, setpoint verification, and equipment maintenance and inspection would be integrated into plant procedures and processes.
The licensee had existing Condition Report CR-17-12228 which was written to establish maintenance strategies for the open phase protection equipment.
The licensee updated this condition report to develop additional strategies for the transformer neutral cables which are an integral part of the power system sentinel technologies system. The licensee created Condition Report CR-18-04542 to add additional inspection criteria to existing outside area operator log procedures for visual inspection of the transformer neutral cable, neutral bushing, and ground connection integrity. The team also held discussions about the licensees plans to include open phase condition-related components into the Maintenance Rule (10 CFR 50.65) program. The licensee generated Condition Report CR NON 18-04442 to create an enhancement action item which tracked the scoping process for inclusion into their maintenance rule program. Existing plant equipment will continue to be maintained according to the licensees current preventative maintenance program. The team did not identify any issues of concern.
EXIT MEETINGS AND DEBRIEFS
On March 22, 2018, the team presented the Temporary Instruction 2515/194 inspection results to Ms. M. Lacal, Senior Vice President Regulatory and Oversight, and other members of the licensee staff.
The inspectors verified no proprietary information was retained, however some material used by the team to document compliance was characterized as proprietary by the vendor.
DOCUMENTS REVIEWED
Inspection Procedure TI 2515/194
Condition Reports
18-04439
NON 18-04437*
18-04442*
NON 18-04542*
- Issued as a result of inspection activities.
Drawings Number Title Revision
A0-E-NAB-008 Elementary Diagram 13.8 kV Non-Class 1E Power 11
System Startup XFMR A-E-NAN-X03 Tripping
A0-E-NAB-008, Elementary Diagram 13.8 kV Non-Class 1E Power 11
Sheet 2 System Startup XFMR A-E-NAN-X03 Tripping
A0-E-NAB-009 Elementary Diagram 13.8 kV Non-Class 1E Power 10
System Startup XFMR A-E-NAN-X03 Tripping
A0-E-NAF-008, Elementary Diagram 13.8 kV Non-Class 1E Power 4
Sheet 1 of 4 System Startup XFMR A-E-NAN-X03 Tripping
A0-E-NAF-008, Control Wiring Diagram 13.8kV Non-Class 1E Power 4
Sheet 2 System Startup XFMR A-E-NAN-X03 Tripping
A0-E-NAF-008, Control Wiring Diagram 13.8kV Non-Class 1E Power 4
Sheet 4 System Startup XFMR A-E-NAN-X03 Tripping
13-E-MAA-001 Main Single Line Diagram 31
Engineering Change Title Date
Numbers
LDCR 15-F029/15- Updated Final Safety Analysis Report, Section 8.2.2 January 25,
B011 and Technical Specification Bases Section 3.8.1 and 2018
3.8.2
DCN: IEGR-DD-184 Open Phase Protection System Non-Class 1E Open March 20,
Draft Phase Protection Settings, Palo Verde Nuclear 2018
Generating Station Startup Transformers (SUTs) AE-
NAN-X01, AE-NAN-X02, and AE-NAN-X03
Engineering Study Title Revision
Number
13-ES-A060 Engineering Study for Open Phase Condition on the 0
High Side of SUT Transformer
Miscellaneous Title Revision/Date
Documents Number
NLR17R050100 NLR17R050100 Required Reading August 9,
2017
3002004432 Interim Report: Electric Power Research Institute October 2014
(EPRI) Open-Phase Detection Method
13-NA-00001 PSSTech - Critical Digital Review and Related 0
Software Quality Assurance Report documents
0002282 Service Bulletin: One Phase Protection System February 21,
Injection Source Upgrade 2017
2944 Service Bulletin: Phoenix Contact QUINT- January 23,
PS/1AC/24DC/10 - 2866763 Direct Current (DC) 2018
Power Supplies and Phoenix Contact QUINT-
PS/1AC/24DC/20 - 2866776 DC Power Supplies
NA-1635 Design Input Requirements Checklist - Install Loss of 0
Phase Detection On SUTs
Engineering Disposition for ENG-DMWO # 4411244 February 01,
2018
Presentation - Palo Verde Nuclear Generating
Station Open Phase Protection for Offsite Power
Sources
Modifications Title Revision
Number
S-15-0116 50.59 Screening for DMWO 4411244 0
DMWO 4411244 NA-1635 Open Phase Detection System 0
Procedures Number Title Revision
40AL-9RK1B Panel B01B Alarm Responses 4
40AL-9MA01 Transformer Trouble Alarm Responses 42C
Vendor Documents
Number Title Revision/Date
2015APS5714 One Phase Protection System Operating and 0.0.3
Maintenance Manual
E003-00162 PSSTech - Open Phase Detection System Factory 0
Acceptance Test Report (FAT)
Cabinet S/N 7E0668419 (AENANX01 - Channel 1)
SB 0002282 One Phase Protection System Injection Source February 21,
Upgrade 2017
SB 2944 2866763 DC Power Supplies and Phoenix Contact January 23,
2018
Table 1 - Information Gathered for TI 2515/194
A Open Phase Condition Describe Observations/Comments
Detection and Alarm
Scheme
Are all credited offsite power Yes Palo Verde Nuclear Generating Station (PVNGS)
sources specified in UFSAR No UFSAR Section 8.1 states that six offsite sources of
Chapters 8.1, 8.2, and 8.3 power provide preferred power to the three units
and plant Technical through secondary windings of three startup
Specifications considered in transformers (SUTs).
the design of open phase
condition detection and The Updated Final Safety Analysis Report,
protection schemes? Section 8.2 states that the transmission system
associated with PVNGS supplies offsite air
conditioning (AC) power at 525 kV for startup, normal
operation, and safe shutdown of Units 1, 2, and 3.
Both 525 kV transmission system, which is the
credited offsite power source, and the SUT described
in the UFSAR were considered in the design of open
phase condition detection and protection schemes.
Are Open Phase Condition Yes The Power System Sentinel Technologies open
detection scheme(s) No phase condition detection scheme monitors the SUT
installed to monitor the connections through the SUT high side wye winding
qualified offsite power paths neutral. The detection scheme does not monitor the
to the ESF buses during all offsite power paths from the low side of the SUT to
modes of operation? the ESF buses.
The impact of an open phase occurring between the
SUT and the ESF transformer is documented in
Engineering Study 13-ES-A061, Open Phase
Condition on the High side of ESF Transformer,
Revision 0. There are no modifications planned to
install separate open phase detection systems on the
low side of the SUTs.
a. What is the scope of open a. The open phase condition scope includes the
phase conditions following:
considered by the
licensee? * Phase 1 (DM 4411244 Revision 0) - Installation
of open phase detection system designed and
made by PSSTech to monitor the SUT
connections through the SUT transformer high
side wye winding neutral. The system provides
alarms in the control room.
- Phase 2 (DM 4411244 Revision 1) - activation
of the tripping logic
b. Did the licensee exclude Yes b. The Palo Verde Nuclear Generating Station open
certain open phase No phase condition detection scheme does not
conditions (e.g., high monitor the power paths from the low side of the
voltage or low voltage SUT to the ESF buses. The impact of an open
side of power phase occurring between the SUT and the ESF
transformers), operating transformer is documented in Engineering Study
and loading configurations 13-ES-A061, Revision 0, and summarized below.
in their analyses? If so,
identify the technical For the steady state operation during normal,
justifications for any shutdown, and loss-of-coolant accident (LOCA)
exclusion. modes, the open phase condition on high side of
the ESF transformer resulted in notable voltage
unbalance conditions that were detected and
isolated by existing degraded voltage relay and
loss of voltage relay scheme. Only one gap of
protection was identified for the existing degraded
voltage relay and loss of voltage relay scheme
occurring during normal operation where the
inverse time delay of the loss of voltage relay
would not trip prior to the start of the spray pond
pump motor due to exposure to damaging
overheat conditions. To address this gap, the loss
of voltage relay was modified to the fixed-voltage
and time delay characteristics. The minimum loss
of voltage relay dropout occurs at 3220V with time
delay of 2.3 seconds. The steady state normal,
shutdown, or LOCA operating conditions modeled
with consideration of maximum and minimum
switchyard voltage would now be isolated within
the 2.3 seconds time frame ensuring that no
damage or lock-out of the Class-1E loads occur.
The ESF transformers local connection between
ENANS03/ENANS04 switchgear and ESF
transformer ENBNX03/ENBNX04 has no
underhung insulator. This connection is an
overhead copper bare wire mounted from top of
ESF transformer to top of switchgear that is of a
very short distance with a pole in between for
support. The insulators mounted on top of
structure transformer, pole, or switchgear. The
insulators support a very short distance of
500 MCM (thousands of circular mils) stranded
bare copper overhead that is bolted twice on each
end. A break anywhere in the path between the
switchgear and the transformer would result in a
loose bare energy conductor failing onto a
grounded enclosure. This type of fault will
separate the affected offsite source and start the
emergency diesel generator (EDG) and transfer
the ESF loads to the EDG automatically.
Therefore, this would not be an open phase
condition. The overhead line between
ENANS06/ENANS05 and ENANS04/ENANS03 is
a double connection with two conductors/phase.
An insulator failure would have to break both
conductors that are bolted on each end. A single
conductor is sufficient to provide the capacity for
the ESF loads.
Based on the PVNGS system configuration, an
open phase condition on the high side of ESF
would affect a single train of one unit. For
example, the open phase condition on the high
side of ESF NBNX04 transformer would only affect
Unit 1 B train. The Unit 1 A train is not affected
and can be supplied from its normal offsite circuit
feed SUT AENANX03 Z winding, the Unit 1 A
train has alternate supply from AENANX01 Y
winding, and lastly the EDG for the A train. Palo
Verde Nuclear Generating Station is not
susceptible to common train open phase condition
event as such a postulated open phase condition
on Unit 1 B train and EDG failure on the A train
would still allow for two offsite circuit paths to
provide power to the Unit 1 A train. Therefore an
open phase condition would not affect both trains.
The licensee concluded that the requirement for a
separate system that monitors for open phase
condition on the plant side does not appear to be
justified. Additionally, detecting open phase
conditions on low voltage side is not part of the
industry initiative.
Are the detection schemes Yes The open phase detection system consists of an
capable to identify open No active neutral injection detection element and passive
phase conditions under all neutral overcurrent detection element. The licensee
operating electrical system indicated that combination of active and passive
configurations and plant detection elements provides 100 percent coverage for
loading conditions? grounded open phases and full range of loading
conditions.
Draft SA07.S.01.15, Open Phase Protection System
Non-Class 1E open phase detection Protection
Settings, Startup Transformers AE-NAN-X01,
AE-NAN-X02, AE-NAN-X03, dated March 20, 2018,
includes the electromagnetic transients program
simulation results for the following open phase
conditions. All simulated conditions were detected
either by active or passive detection element.
- Single Open Phase Ungrounded - SUT unloaded
- Double Open Phase Ungrounded - SUT
unloaded
- Double Open Phase with 0 ground on one
phase - SUT unloaded
- Single Open Phase with 0 ground - SUT
unloaded
- Double Open Phase with 0 ground on both
open phases - SUT unloaded
- Single Open Phase Ungrounded - SUT loaded
with 70 MVA motor load
- Double Open Phase Ungrounded - SUT loaded
with 70 MVA motor load
- Single Open Phase with 8,000 ground - SUT
unloaded
- Single Open Phase with 25,000 ground - SUT
unloaded
- Double Open Phase with 4,000 ground on both
phases- SUT unloaded
- Double Open Phase with 12,500 ground on
both phases - SUT unloaded
- Single Open Phase Ungrounded - SUT loaded
with 13 MVA motor load
- Single Open Phase Ungrounded - SUT loaded
with 20 MVA motor load
- Double Open Phase Ungrounded - SUT loaded
with 8 MVA motor load
- Double Open Phase Ungrounded - SUT loaded
with 70 MVA motor load
The above electromagnetic transients program
simulations were performed as the test cases to verify
the open phase condition detection with the open
phase detection algorithm.
a. If the licensee determined Yes a. Palo Verde Nuclear Generating Station has
that open phase condition No determined that open phase condition detection
detection and alarm and alarm scheme is needed. The PSSTech open
scheme was not needed, phase detection system will detect open phase
did the licensee provide conditions and generate alarms in Main Control
adequate calculational Room (MCR).
bases or test data?
b. Are all open phase Yes b. Engineering Study 13-ES-A060, Open Phase
conditions detected and No Condition on the High side of SUT transformer,
alarmed in the MCR with Revision 0, shows that a single open phase
the existing relays? occurring on the high side of the SUT connections
would be undetected by the existing relays. The
study concluded that there is a need for a separate
open phase detection system. To address this
condition, Modification DMWO 4411244 installed
PSSTech open phase detection system to detect
and alarm in MCR.
a. Are the detection and Yes a. The wiring of the alarm circuit is separate and
alarm circuits independent No independent of the actuation circuit.
of actuation (protection)
circuits? The MCR alarm wiring circuit ends at the PSSTech
open phase detection cabinet alarm lock-out relay
for each channel. The alarm wiring is parallel to
initiate the MCR SUT common trouble alarm
window. The alarm will also trigger a computer
point to signify that an open phase condition has
been detected.
The trip wiring uses a separate wire that is looped
between the PSSTech open phase detection
cabinet trip lock-out relay contacts and existing
transformer lock-out relays. After the trip is
enabled, tripping of the exiting transformer lock-out
relays will also illuminate an existing MCR alarm
SUT protection trip.
b. If the detection, alarm, Yes b. The detection alarm and actuation circuits are non-
and actuation circuits are No Class-1E (non-safety). The non-safety protection
non-Class 1E, was there scheme has no interface with Class-1E circuits.
any interface with Class The trip output is wired to existing SUT tripping
1E systems? circuitry, which is also non-safety. In addition, the
alarm is wired to existing transformer trouble alarm,
which is also non-safety.
When the open phase detection system detects an
open phase, it will isolate the affected SUT. This
removes power from a single safety-related train in
the unit that is connected to each secondary
winding of the affected SUT. The safety-related
train then mitigates the loss of power (LOP) per the
existing design (transferring to onsite power).
There is no direct interface between the new open
phase detection system and existing safety-related
systems.
a. Did the manufacturer Yes a. The open phase detection system consists of an
provide any No active neutral injection detection element and
information/data for the passive neutral overcurrent detection element.
capability of installed
relays to detect The open phase detection system detects by either
conditions, such as a) detecting changes in zero sequence impedance
unbalanced voltage and as measured by the change in an active injection
current, negative current (the active detection element), or b) by
sequence current, detecting unbalanced current (i.e. zero sequence
subharmonic current, or current) as measured in the transformer neutral
other parameters used to (the passive detection element). The open phase
detect open phase detection system does not measure unbalanced
condition in the offsite voltage, negative sequence current, or
power system? subharmonic currents.
b. What are the analyses b. Engineering Study 13-ES-A061, Revision 0,
and criteria used by the describes the impact of the power system
licensee to identify the unbalance due to an open phase as below.
power system unbalance
due to open phase The open phase detection conditions on the high
conditions; and loading side of the ESF transformer results in voltage
and operating unbalance that exceeds the existing bus negative
configurations considered sequence alarms setpoint, which are set at
for all loading conditions 5 percent negative sequence. The resulting line-to-
which involve plant trip line 4.16 kV ESF bus voltages for open phase
followed by bus transfer condition on high side of the ESF transformer under
condition? no load condition, and nominal (525 kV) or
maximum switchyard voltage (535.5 kV) will fall just
outside of the degraded voltage relays and loss of
voltage relays detection capabilities. Specifically,
the high side open phase condition for unloaded
ESF transformer, resulted in line-to-line voltages of
3762V (Vab), 3762V (Vbc), 0V (Vac) respectively
on the ESF bus that are above the minimum
degraded voltage relay drop out of 3690
- V.
However, the open phase condition with ESF
transformer unloaded results in the worst case for
calculated unbalance. Since the open phase
condition for unloaded ESF transformer triggers the
existing 5 percent negative sequence alarm,
operators would be dispatched to determine the
cause of the alarm. The ESF transformers are not
operated unloaded and the transformers normally
supply Class-1E loads that are energized during
normal operation including some non-1E loads that
are fed from a Class-1
- E. Therefore, there is no
potential for the open phase condition to go
undetected and not recognized for an extended
period of time.
c. If certain conditions Yes c. According to the licensee, there are no open phase
cannot be detected, did No conditions that cannot be detected with the installed
the licensee document the N/A system. There are no conditions that would result
technical basis for its in spurious actuation of the system. The open
acceptability? phase condition detection scheme is designed
based on the following thresholds.
- Active detection setting - concurrence of
5th harmonic that must go up to 8 dB and excess
preset time delay. The required condition would
preclude spurious trip actuation.
- Passive detection setting - must be greater than
the neutral current resulting from maximum
allowable system voltage unbalance and excess
preset time delay.
There are no normal/abnormal plant conditions
that would defeat the open phase condition based
on the setpoints coordinating with existing relays
and transformer relays.
d. Did the licensee perform Yes d. Functional testing is documented in the factory
functional testing to No acceptance test, site acceptance test, and
validate limitations commissioning test which reflect the plant condition
specified by the and settings including the relay settings.
manufacturer of the
relays?
a. Do open phase condition Yes a. The PSSTech open phase detection system
detection circuit design No includes the following design features to minimize
features minimize spurious detections:
spurious detections due to
voltage perturbations * Digital signal controller implements both active
observed during events and passive detection schemes. The
which are normally PSSTech active detection element is primarily
expected in the intended for the no-load/light-load condition
transmission system? where the neutral current may not be
detectable by the passive detection.
- The active detection algorithm implements a
truth table based on the injection current,
5th harmonic of the neutral current, and the
injection voltage inputs. The active detection
element requires a combination of parameters
to be true before actuating a trip. The active
injection signal level must fall below its setpoint
concurrent with the 5th harmonic signal level
rising above its setpoint and the injection
voltage level must be within its allowable
voltage level band. All three of these
conditions must be met concurrently before the
active detection element actuates.
Additionally, the active detection element is
continually monitored for normal conditions
pertaining to the active injection signal level,
5th harmonic signal level, and injection voltage
level. If the active detection element goes
abnormal, actuation is blocked until the
element returns to normal.
- Time delay is selected above the passive
detection timer for coordination.
- Passive neutral overcurrent (50N) detection is
used when there is higher load on transformer
or when the open phase has a ground.
- The passive detection is based on current
magnitude.
- The detection element is an instantaneous
overcurrent element.
- The instantaneous element is supervised by a
definite-time timing function.
- Time delay selected to coordinate with high
side and low side transformer ground fault
clearing.
According to the licensee, to date, no spurious trips
have been noted in the monitoring period.
b. Identify whether the b. The licensee considered alarm/trip settings
licensee considered coordination with other electric power system
alarm/trip settings relays including transmission system protection
coordination with other features setup to avoid false indications
electric power system or unnecessary alarms. According to
relays including Draft SA07.S.01.15, the open phase detection
transmission system system active and passive detection elements
protection features setup must coordinate with existing relaying on the
to avoid false indications primary and secondary of the SUT, as well as
or unnecessary alarms.
other open phase detection systems on adjacent
or parallel SUTs. The open phase detection
system time delay setting is used to provide
coordination with existing relaying. The setting
coordination includes:
- Passive Protection Setting
The passive detection element pickup (50N)
will coordinate with:
- Maximum neutral current resulting from
system voltage unbalance.
- Maximum neutral current resulting from
open phase condition on adjacent SUTs.
- Maximum neutral current resulting from
low-side ground fault.
The passive detection element timer (50NDT)
will coordinate with:
- Trip time for existing relaying for high-side
ground fault
- Trip time for existing relaying for low-side
ground fault
- Transformer damage curve for grounded
open phase on high side
- Existing relaying for the main transformer
- the main transformer protection will pick
up instantaneously and will clear the
faulted main transformer before the open
phase detection system operates on any
of the protected transformers.
- Motor damage - will be set to limit motor
damages based on the overcurrent trip
setting of High Pressure Safety Injection
(HPSI) pump motor setting.
- Active Protection Setting
The active detection element will coordinate
with:
- Switching configurations - Coordinated
with 50ND relay to provide 100 percent
coverage during all fault conditions.
The active detection element timer will
coordinate with:
- The passive detection element timer - will
be greater than the passive detection
element timer setting.
- Transmission Zone 2 protection
Identify how the alarm The open phase detection digital controller initiates
features provided in the both the alarm and tripping circuit signals. The alarm
MCR including setpoints are signal is routed to the MCR alarm window while the
maintained, calibrated, and tripping signal will be tied to the existing transformer
controlled. tripping circuit. The controller output will start
external hardware timers, either the open phase
detection or neutral current detection (50NDT). Once
the timeout of the open phase detection or the 50NDT
occurs, the MCR will receive an alarm.
According to PSSTech, the detection algorithm does
not require calibration unless it is determined through
monitoring period that it misoperated for undesired
conditions.
The manufacturer (National Instruments)
recommends that the NI 9229 analog input module
and NI 9263 analog output module be calibrated
periodically. These modules can be swapped out
with the transformer in service in order to facilitate
calibration; however, open phase protection will be
unavailable while the modules are being swapped.
No other controller components require periodic
calibration.
Palo Verde Nuclear Generating Station is developing
the overall calibration and maintenance strategy as
part of the phase 2 of the modification. This activity is
still in progress.
The open phase condition detection settings are
maintained and controlled by the plant configuration
management and by the relay setting sheets (RSSs).
The approved RSSs at PVNGS are used by
protective relaying group to make setpoint changes.
The final settings for the open phase detection will be
documented on the RSSs.
After the modification is closed out, changes to the
setpoint will require the PVNGS design change
process to be followed. This process used to make
changes to controlled documents such as RSSs.
Does the open phase Yes The digital control system supply power is converted
condition detection scheme No to DC inside the system cabinet. The supply power
consider subharmonics in harmonics will have no impact.
the supply power or offsite
power system? Current readings are digitally filtered to only respond
to the 60Hz current, 5th harmonic current, and the
frequency of the injected current (approx. 90Hz).
Offsite power system subharmonics have no impact
to the open phase detection system.
Are open phase condition Yes System will be scoped into the maintenance rule.
detection and alarm circuit No The licensee generated a Condition Report
components scoped into the CR-18-04442 to track the implementation.
licensees maintenance rule
program?
B Open Phase Condition Yes/No Describe Observations/Comments
Protection scheme
Record location of the Location: The sensing occurs on the neutral of the
sensing of the protection primary winding that is wye-grounded, on the SU
- T.
scheme (e.g., high voltage
or low voltage side of the
transformer, ESF bus, etc.)
Classification: Safety / Non-Safety (circle one)
a. Record the classification a. Non-Safety. The non-safety protection scheme has
of the protection scheme, no interface with Class-1E circuits. The trip output
safety or non-safety. is wired to existing SUT tripping circuitry, which is
also non-safety. In addition, the alarm is wired to
existing transformer trouble alarm, which is also
non-safety.
b. Did the licensee consider Yes b. When the open phase detection system detects an
the interface requirements No open phase, it will isolate the SUT. This removes
for non-safety with safety- power from a single safety-related train in the unit
related circuits? that is connected to each secondary winding of the
affected SUT. The safety-related train then reacts
to the LOP per the existing design (transfers to
onsite power). There is no direct interface between
the new open phase detection system and existing
safety-related systems.
Type: Digital / Non-Digital (circle one)
a. Record the type of the a. Digital
protection scheme, digital
or non-digital.
b. Are cyber security Yes b. Cyber security initial review was conducted by the
requirements specified for No licensee on the new installed cabinets. The
digital detection scheme? N/A equipment has physical protection as they are
installed in a controlled area (i.e., startup yard) and
locked. Key has to be obtained to open the
cabinet.
System has no Wi-Fi capability. System has a
keypad which is used to access the system locally.
The keypad provides three levels of access to the
digital controller. Levels 0 and 1 provide read-only
to monitor parameters while level 2 is used to
change the system monitoring setpoints, and is
restricted with a programmable 4-digit alpha
numeric code entry prior to access.
Also, accessing to level 2 will initiate system alarm
to alert any potential changes to the system
setpoints.
In addition, all open USB ports are blocked as
required per Specification 13-JN-1022, Cyber
Security Installation Specification.
Did the licensee consider Yes The PSSTech open phase detection system includes
any design features to No the following design features to prevent the system
prevent protective functional failures:
failures for open phase
condition protection system? * Redundancy:
- Two redundant open phase detection channels
are provided for each SUT.
- Redundant Primary (DC) and Backup (AC)
power sources are provided for each open
phase detection cabinet.
- Independence:
- The primary power source for each open phase
detection cabinet is from a different 125VDC
source. The DC source is provided by the
existing station non-class 1E batteries. Each
open phase detection channels 125VDC
source is independent of other channels. The
system also has a 120VAC backup source.
The AC source is from different AC power
panels that are also on different bus line-ups.
Each open phase detection channels 125VAC
source is independent of other channel.
- Within a single channel, different injection
source Current Transformers (CTs) are used for
measuring the current probes. The active
detection element uses a low current probe and
the passive detection element uses a different
high current probe. The sensors are
independent.
- The wiring of the alarm circuit is separate and
independent of the actuation circuit.
- Diversity:
- The main controller that houses the detection
algorithm is diverse between the redundant
open phase detection channels. Channel 1 has
cRIO 9068 controller, which is a non-Intel based
processor and utilizes Linux Real-Time.
Channel 2 has cRIO 9081 - Intel based
processor utilizes Windows Embedded
Standard 7 Runtime Operating System.
- DC (primary) and AC (backup) power sources
are provided for each open phase detection
cabinet.
- Monitoring, Alerting, and Self-Diagnostic:
- The main controller monitors and detects
abnormal conditions and provides alarms of
input failures. There is one condition
considered normal and one condition
considered as a valid open phase. If any input
fails high or low the system will provide an
injection abnormal alarm. The single channel
failure modes and effects analysis postulates
such failure, and shows the system would
provide abnormal alarm.
- The channel 1 and channel 2 general alarms
are wired in series and initiate the SUT common
trouble alarm window in the MCR. The alarm
will also trigger a computer point that is different
from the open phase condition computer point
to alert operator of cabinet trouble/failure.
Since the general alarms include alarms other
than those important to functionality, the
specific alarm would be identified locally at the
cabinet.
- The open phase detection system employed a
self-diagnostic feature to alert the channel
failures. Alert includes non-functional alarms
and channel general alarms. The following
alarms are functionally important.
Controller Watchdog Timeout
Injection Source Failure
Channel Injection Abnormal
Cabinet Temperature or Heating, ventilation,
and air conditioning Compressor
Malfunction Alarm
Channel Function Switch in OFF Position
Open Phase Alarm Lockout Relay Actuation
Inverter Failure Alarm
Identify the number of Modification DM 4411244 installed two redundant
channels provided per open phase detection channels per SUT to monitor
offsite power source, and if SUT connections through the SUT transformer high
there is independence side neutral. These channels are independent of
between channels and each other. Each channel has its own CTs for
sensors. sensing the neutral current.
a. What is the safety a. Power supply to each open phase detection
classification of power channel is non-safety. If the protection scheme of a
supply for the protection single channel losses power, the channel will fail in
scheme? a non-tripped state. The failed channel initiates a
non-functional alarm and a channel general alarm.
Both open phase alarm and trip lockout relays are
blocked. The failure modes and effects analysis
considered bounding conditions such as loss of
24VDC supply breaker to the main controller and
SEL-2411.
b. Was a LOP to the Yes b. Loss of power to the channel protection scheme
protection scheme No results in the following:
considered?
- Shutdown of all DC powered devices
- Channel Functional green LED extinguishes
- Channel Non-functional alarm relay
de-energizes and alerts operator
- SEL2411 alarm relay de-energizes and alerts
operator
The wiring of the non-functional alarm and
SEL-2411 alarm are wired in series and opening of
either contact would initiate the MCR SUT common
trouble alarm window. This is a potential failure of
the channel considered as shown in the PSSTech
single channel failure modes and effects analysis.
However, each of redundant open phase detection
cabinets powered is by the redundant,
independent, and diverse power sources (AC and
DC). For each SUT the primary power source for
the open phase detection cabinets are from
different 125VDC sources. Similarly, the backup
power source are from different AC power panels
that are on different bus line-ups.
Upon a loss of primary power to an open phase
detection channel, the dedicated inverter for that
channel will transfer the power to the backup power
source. The inverter sends an alarm to the MCR
for LOP or failure to transfer.
Identify if the licensee Malfunctions and failures were considered. For a
considered the failure or a malfunction of either channel, the MCR
consequences of a failure or will receive an alarm. However, both channels of the
malfunction of a channel. open phase detection system for each SUT have to
send a trip signal to make up the 2-out-of-2 tripping
logic.
- Failure:
A failure is defined as the inability of the trip signal
to function on a valid open phase. There are
numerous internal diagnostics, when a problem is
detected, an alarm signal is sent to the MCR and
the trip function is disabled. The consequence is
that the trip is disabled until the cause of the
alarm is identified and corrected. However, the
tripping logic can be changed to 1-out-of-1 logic
scheme to allow the unaffected channel to initiate
trip. Alternate compensatory measures can also
be established.
- Malfunction:
A malfunction is defined as the generation of a trip
signal with no valid open phase. When this
occurs, only one of two required trip signals would
be present. It will cause an alarm in the MCR but
will not cause the SUT to be isolated. If a valid
open phase were to occur, the remaining channel
would complete the 2-out-of-2 logic and isolate the
SU
- T.
Did the design consider the Yes Based on the plant configuration, the redundant trains
single failure criteria as No for each unit at PVNGS are on different SUTs and
outlined in the general connection to the offsite sources.
design criteria or the
principle design criteria An open phase condition on the high side of any
specified in the Updated single SUT would affect a single train of two different
Final Safety Analysis units. For example, an open phase condition on the
Report? high side of SUT AENANX02 would affect Unit 1 B
train from the Y secondary winding and Unit 3 A
train from the Z secondary winding. The unit 1 A
train is not affected and can be supplied from its
normal offsite circuit feed, SUT AENANX03Z winding,
alternate offsite circuit supply from AENANX01 Y
winding, and lastly the EDG for the A train.
Therefore, an open phase condition on high side of
any single SUT would not affect both trains
simultaneously.
In addition, each phase connected to the high voltage
side of the SUT has two conductors coupled with the
design features such as redundancy (two open phase
detection channels per SUT and multiple power
sources), independence, diversity (different controller
types), and scoping the system into the maintenance
rule will ensure availability of the open phase
detection system.
The open phase detection system is a non-safety
related system and the loss of a single SUT due to
open phase condition would not preclude the onsite
electrical power system from being able to perform its
safety function. A loss of a SUT would only affect
one train of equipment and loads required to mitigate
postulated accidents would be available on the non-
affected train ensuring that safety functions are
preserved as required by the current licensing bases.
a. Did the licensee identify Yes a. N/A for PVNGS. An open phase event is a single
the industry standards No train issue at PVNG
and criteria to verify N/A
power quality issues there is no open phase condition event that affects
caused by open phase redundant ESF buses.
conditions that affect
redundant ESF buses?
b. What industry standards b. The Electric Power Research Institute Condition
were used to develop the Report CR-03002010688 concluded that the stator
acceptance criteria for current in an induction motor never exceeds the
open phase condition trip locked-rotor current for all voltage unbalance
setpoint or analytical conditions examined. Therefore, it would be a
limit? conservative estimate to use the locked-rotor
thermal limit to determine the exposure time for
motors to unbalanced conditions. Since the
4.16 kV motors over-current relaying have been
coordinated with the safe stall times per
Class-1E protection calculations 01-EC-PB-0200,
2-EC-PB-0200, and 03-EC-PB-0200, the
overcurrent would always trip prior to motor
damage. (Based on ANSI C37.96-1988: Guide for
AC Motor Protection)
What are the analytical limits A concurrent open phase condition and safety
or criteria used for setpoints injection actuations Signal (SIAS) event is assumed
of the actuation/protection to be the worst case event. The SIAS condition
scheme to provide adequate would initiate the start of the HPSI pump motor.
protection for motors and Assuming the HPSI motor stalls due to the open
sensitive equipment? phase condition event, an overcurrent trip of
5.6 seconds for rated locked rotor and settings for
HPSI A (1MSIAP02) and 5.1 seconds based on
overcurrent setting of HPSI B (1MSIBP02) would
occur. The open phase detection system will be
installed with the tripping time of ~4.5 seconds or less
to provide for coordination with the HPSI motor. This
would provide at least a 0.5 second margin between
open phase detection system trip and HPSI motor
overcurrent trip.
The 4.5 second time delay will also provide sufficient
time to allow for transmission system clearing of
faults, and for existing transformer high side and low
side clearing.
The HPSI motor has the second fastest trip time,
relative to stall conditions. The electronically
commutated motor is the most limiting and the
overcurrent protection will trip in ~3.3 seconds under
stall conditions. However, this motor is energized
later in the sequence, at 25 seconds; the open phase
detection system would have isolated the affected
transformer well before this time. Therefore, it is not
considered in selection of the open phase detection
trip time to meet the requirement of the industry
initiative.
In addition, the PSSTech protection scheme will
detect and trip from no load to full load levels, and
varying ground fault impedance. Combination of
active and passive detection provides 100 percent
coverage for all loading levels.
The time delay ensures no equipment damage
occurs.
- The passive trip is set to 4.5 seconds.
- The active trip is set to 5 seconds.
The time delays were set to coordinate with existing
transformer high side and low side ground relaying.
What are the design The open phase detection system includes the
features provided to following design features to preclude spurious trips of
preclude spurious trips of the offsite power source:
the offsite power source
(e.g. coincidence logic)? * The active detection element requires a
combination of parameters to be true before
actuating a trip. The active injection signal level
must fall below its setpoint concurrent with the
5th harmonic signal level rising above its setpoint,
and the injection voltage level must be within its
allowable voltage level band. All three of these
conditions must be met concurrently before the
active detection element actuates. Additionally,
the active detection element is continually
monitored for normal conditions pertaining to the
active injection signal level, 5th harmonic signal
level, and injection voltage level. If the active
detection element goes abnormal, actuation is
blocked until the element returns to normal.
- The active detection element is supervised by an
external timer relay to prevent non-open phase
condition transients from initiating a trip output.
- The passive detection element only responds to
fundamental frequency (i.e. 60 Hz) current as
measured in the neutral of the transformer. The
passive detection element pickup is set to exclude
unbalanced currents associated with normal grid
imbalances.
- The passive detection element is supervised by an
external timer relay to prevent non-open phase
condition transients from initiating a trip output.
- The 2-channel system with 2-out-of-2 trip logic
where both channels have to send a trip signal to
isolate the SUT if an open phase condition is
detected.
- Loss of power to the open phase detection system
will not cause a spurious trip.
The combination of the design of the system and
requiring 2-out-of-2 trip logic will minimize spurious
trips.
a. What analyses have been a. Engineering Study 13-ES-A061, Revision 0,
performed by the licensee provides the analysis with respect to the impact of
which demonstrates that open phase condition to the function(s) of
the open phase conditions important-to-safety equipment required for safe
do not adversely affect shutdown during anticipated operational
the function(s) of occurrences, design basis events, and accidents.
important-to-safety Below is the summary of the analysis.
equipment required for
safe shutdown during The Electromagnetic Transients Program
anticipated operational simulation of steady state running conditions
occurrences, design basis during LOCA case with any postulated open phase
events, and accidents? If condition impedance resulted in ESF transformer
an analyses was not secondary voltage below loss of voltage relays,
performed, what and transferred the ESF loads to the EDG within
justification was provided? 2.3 seconds for both minimum and maximum grid
conditions. The electromagnetic transients
program simulations of double open phase
condition results in a complete collapse of the
secondary voltages and trip of loss of voltage
relays. Thus there is no vulnerability gap for
double open phase condition. The double open
phase condition is considered as a result of
operating experience from the Forsmark event.
The Electric Power Research Institute Condition
Report CR-03002010688, Induction Motor
Unbalanced Voltage, concluded that the stator
current in an induction motor never exceeds the
locked rotor current for all voltage unbalance
conditions examined. Therefore, it would be a
conservative estimate to use the locked-rotor
thermal limit to determine the exposure time for
motors to unbalanced conditions. Since the
4.16 kV motors over-current relaying have been
coordinated with the safe stall times per
Class-1E protection calculations 01-EC-PB-0200,
2-EC-PB-0200, and 03-EC-PB-0200, the
overcurrent would always trip prior to motor
damage.
If an open phase condition occurs exactly at the
same time as the SIAS, the 4.16 kV motors will
stall during initiated LOCA sequence and lock-out
on overcurrent protection. Under the existing
degraded voltage relays and loss of voltage relays
scheme the entire sequence of 4.16 kV motors
would trip and lock-out on overcurrent. Under the
modified degraded voltage relays and loss of
voltage relays scheme, the electromagnetic
transients program result showed that only the
HPSI pump motor would lock-out and trip when
considering the new degraded voltage relays and
loss of voltage relays scheme. The new degraded
voltage relays and loss of voltage relays scheme
reduced degraded voltage relay timeout delay for
SIAS conditions from maximum of 35 seconds to
8.5 seconds.
The overall risk of simultaneous occurrence of an
open phase condition and SIAS is small. The Palo
Verde Nuclear Generating Station internal
evaluation of risk from an open phase condition on
the high side of an ESF transformer was
determined negligible. The Palo Verde Nuclear
Generating Station internal risk-assessment
modeled the impact of simultaneous open phase
condition and a SIAS as unavailability of a single
class bus (PBAS03 or PBBS04), during and after
sequencing, which is conservative. The risk
incurred by a random open phase condition event
that results in an unrecoverable failure of a single
class bus is as follows:
Risk Metric Value
Delta CDF due to random open 2.5E-8/yr
phase condition
Delta LERF due to random open 4.35E-9/yr
phase condition
b. Are bus transfer schemes Yes b. An open phase condition at PVNGS is a single train
and associated time No event. If an open phase is detected, the affected
delays considered? SUT is isolated and the safety train connected to
the low voltage winding will detect a LOP and react
according to the existing design. This occurs within
the start time of the diesel, therefore the
assumptions of the accident analysis are not
affected. Bus transfer schemes do not apply. The
Class 1E busses are always connected to the SUT.
Are open phase condition Yes The open phase detection system will be scoped into
protection/actuation circuit No the maintenance rule program. The licensee initiated
components scoped, as Condition Report CR NON 18-04442 for tracking this
appropriate, into the implementation.
licensees maintenance rule
program?
C Updated Final Safety Yes Describe Observations/Comments:
Analysis Report Updates to No
Reflect the Need to Protect According to the licensee, Section 8.2.2 of the
Against Open Phase UFSAR appears to be an appropriate location to add
Conditions: Using items 1 to the open phase condition description as this section
below as examples, is intended to describe interfaces with the offsite
identify whether the licensee power grid and potential sources of outages. General
has updated the UFSAR discussion of the open phase detection system will be
(and supporting documents added to the UFSAR, Section 8.2.2. Condition
such as calculations of Report CR NON 18-04437 was generated to track the
record, design change implementation of LDCR 15-F029 in conjunction with
modifications, etc.) to Revision 1 of the modification package.
ensure plant-specific
licensing basis/requirements An open phase condition is not a new accident, so it
include discussions of the is does not need to be added to either Chapters 6 or
design features and 15 of the UFSA
analyses related to the including the failure modes and effects analysis which
effects of, and protection for, is part of the design modification package, will not be
any open phase condition included in the proposed UFSAR general description
design vulnerability. change. This is due to Regulatory Guide 1.70,
Revision 3, to which Arizona Public Service is
committed in UFSAR, Section 1.8, does not require a
description of design details.
The plant-specific analysis Palo Verde Nuclear Generating Station has verified
and documentation that by ETAP analysis that a single open phase occurring
established the resolution of on the high side of the SUTs would go undetected by
the open phase condition existing plant relaying. The resolution for the open
design vulnerability, phase conditions on the high side of the SUTs for
including the failure mode PVNGS is a design change DMWO 4411244 that
analysis performed. installed a 2 channel PSSTech open phase detection
system per SUT to detect, alarm in MCR, and isolate
the SUT upon an open phase condition is detected.
Reference: Engineering Study 13-ES-A060,
Revision 0.
The single channel failure modes and effects analysis
postulates failures and malfunctions, and shows the
open phase protection system end effects and failure
states. Reference: IEGR-AD-297, Open Phase
Protection System Single Channel System Failure
Modes and Effects Analysis.
Description of open phase The PSSTech open phase detection system consists
condition automatic of an active neutral injection detection element and
detection scheme, including passive neutral overcurrent detection element.
how offsite power system Combination of active and passive detection provides
open phase conditions are 100 percent coverage for grounded open phases and
detected from sensing to full range of loading conditions. For a single channel,
alarm devices (loss of one the alarm and tripping are based on or logic between
or two phases of the three the active detection and passive detection; i.e., 1-out-
phases of the offsite power of-2 logic. For each open phase detection system,
circuit both with and without the alarm and tripping are based on 2-out-of-2 logic.
a high-impedance ground
fault condition on the
high-voltage side of all
credited qualified offsite
power sources under all
loading and operating
configurations; and loss of
one or two phases of three
phases of switchyard
breakers that feed offsite
power circuits to
transformers without ground.
Detection circuit design See A.8
features to minimize
spurious indications for an
operable offsite power
source in the range of
voltage perturbations, such
as switching surges,
transformer inrush currents,
load or generation
variations, and lightning
strikes, normally expected in
the transmission system.
Alarm features provided in The ESF trains of a unit are aligned to different SUT
the MCR. Discuss the ESF windings. The new open phase detection system will
bus alignment during normal initiate a common SUT trouble alarm in MCR. New
plant operation and the computer points will be created that will distinguish
operating procedures in the open phase detection cabinet open phase alarm
place to address open and open phase detection system cabinet
phase conditions. If the failure/trouble alarm.
plant auxiliaries are supplied
from the main generator and The following are operating procedures that are in
the offsite power circuit to place to address open phase conditions:
the ESF bus is configured
as a standby power source, * The area rounds Procedure 40DP-9OPA9,
then open phase conditions Revision 14, has been revised to provide
should be alarmed in the instructions to verify working state of
MCR for operators to take SUT A-E-NAN-X03, Loss of Phase Detection
corrective action within a Cabinets.
reasonable time.
- The general transformer trouble alarm response
Procedure 40AL-9RK1B was revised to include the
new open phase detection cabinet alarms.
- The local alarm response Procedure 40AL-9MA01
was revised to provide guidance for operator
response to PSSTech system general alarms.
Describe the automatic The tripping logic is based on detecting changes in
protection scheme provided zero sequence impedance as measured by the
for open phase conditions change in an active injection current (the active
including applicable industry detection element), and by detecting unbalanced
standards used for current, i.e. zero sequence current, as measured in
designing the scheme. the transformer neutral (the passive detection
Design features to minimize element).
spurious actuations for an
operable offsite power The trip output is wired independently from the alarm
source in the range of circuit and is looped between the PSSTech open
voltage perturbations, such phase protection cabinet trip lock-out relay contacts
as switching surges, and SUT lock-out relays.
transformer inrush currents,
load or generation The system will be configured with 2-out-of-2
variations, and lightning tripping logic required from both open phase
strikes, normally expected in detection channel lock-out relays to trip the lock-out
the transmission system relays. Tripping of either lock-out relays will trip all
should be described. normal and alternate 13.8 kV breakers on the low
side and 525 kV breakers on the high side.
The open phase condition protection scheme has
been designed to the following standards:
- ANSI Stds C37 and C57
- IEEE C57.13
- EMI/RFI qualification EPRI 102323
- Surge withstand IEEE C62.45
- Electrostatic Discharge IEEE C63.16
- NEI 08-09, Revision 6
Brief discussion of the Bus transfer schemes do not apply. The Class 1E
licensees analyses busses are always connected to the SUT.
performed for accident
condition concurrent open
phase conditions which
demonstrate that the
actuation scheme will
transfer ESF loads required
to mitigate postulated
accidents to an alternate
source consistent with
accident analyses
assumptions to ensure that
safety functions are
preserved, as required by
the licensing bases.
D Technical Specifications Describe Observations/Comments:
Surveillance Requirements
and LCO for Equipment
Used for Open Phase
Condition Mitigation
a. Are Technical Yes a. Palo Verde Nuclear Generating Station followed
Specifications No the suggested changes described in TSTF-556-T,
Surveillance Revision 0. The Technical Specifications Task
Requirements and LCO Force (TSTF) Evaluation was performed to support
for equipment used for the changing Technical Specification 3.8.1 and
mitigation of open phase Technical Specification 3.8.2 bases to address an
condition identified and open phase condition.
implemented consistent
with the operability The licensee generated Condition Report
requirements specified in CR NON 18-04439 to track the implementation
the plant Technical of LDCR 15-B011.
Specifications?
b. If the licensee determined Yes b. The Technical Specification Bases will be revised
that Technical No for surveillance requirement 3.8.1.1 to include
Specifications are verification of continuity of 3 phases to the SUTs.
unaffected because open plant surveillance procedures, will be modified to
phase condition is being reflect the operation of the system, and credit the
addressed by system as one means of confirming that the
licensee-controlled required offsite power circuits are operable, in that
programs, is the technical there is no indication of an open phase condition
justification adequate? (SR 3.8.1.1). No license amendment is required to
implement the modification.
Impacted procedures will be updated in the
modification process.
E Provide a brief summary The licensee answered No to all eight questions in the draft
of the Open Phase 10 CFR 50.59 evaluation. The 10 CFR 50.59 evaluation
Condition plant modification concludes that no NRC review is required. The evaluation is
performed under summarized below:
CFR 50.59.
The open phase detection system will isolate a SUT that has a
valid open phase condition detected. This will result in one
safety train from two different PVNGS units to register a LOP
and transfer the affected safety train to onsite power. The
design and testing of the open phase detection system are
sufficient to produce a reliable design such that there is not
more than a minimal increase in the likelihood of a malfunction
or spurious trip. The open phase detection system is
configured in a 2-out-of-2 logic scheme to prevent against
inadvertent trips. The open phase detection system for each
SUT is independent from the others. The open phase detection
system is designed such that no failure, such as a processor
failure, loss of AC or DC power, or failure of the injection source
will cause the open phase detection system to generate a trip
signal.
In case the open phase detection system is malfunction and
generates a spurious trip, the system isolates the SUT, causing
a single safety train in two separate units to transfer to onsite
power. In other words, the open phase detection system
activates a trip when offsite power is still available and
capable. This is an undesired event, challenges the onsite
power safety system, but has no real nor significant
consequence to the plant.
The open phase detection system can also be malfunction, in
such, there is an open phase on the high voltage side of the
SUT and the open phase detection system fails to isolate the
SUT concurrent with an ESF actuation signal, the offsite power
may not be capable of powering all of the safety-related loads
(on a single safety train in a unit) required to respond to the
ESF actuation signal. For this case to impact a unit, there has
to be simultaneously an open phase, a failure or malfunction of
the open phase detection system to operate, and there has to
be a concurrent ESF actuation signal demand. The probability
of all three events occurring simultaneously is relatively small.
TI 2515/194 Inspection Documentation Request
Please provide the following documentation (Items 1 - 6) to the lead inspector prior to the onsite
inspection date, preferably no later than March 5, 2018. Whenever practical, please provide
copies electronically (IMS/CERTREC is preferred). Please provide an index of the requested
documents which includes a brief description of the document and the numerical heading
associated with the request (i.e., where it can be found in the list of documents requested).
Sam Graves, Lead Inspector
RIV/DRS/EB2
1600 E. Lamar Blvd.
Arlington, TX 76011
817-200-1102
samuel.graves@nrc.gov
1. Copies of any calculations, analyses, and/or test reports performed to support the
implementation of your open phase condition solution. If, in your implementation, open
phase conditions are not detected and alarmed in the control room please include
documentation that: a) demonstrates the open phase condition will not prevent functioning
of important-to-safety system, structures, and components; and b) detection of an open
phase condition will occur within a short period of time (e.g., 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />).
2. Copies of any modification packages, including 10 CFR 50.59 evaluations if performed,
used for or planned for the implementation of your open phase condition solution.
3. Copies of periodic maintenance, surveillance, setpoint calibration, and/or test procedures
implemented or planned, for your open phase condition solution.
4. Copies of your licensing basis changes to Updated Final Safety Analysis Report (UFSAR)
and/or Technical Specifications (TS), as applicable, which discuss the design features and
analyses related to the effects of, and protection for, any open phase condition design
vulnerability.
5. Copies of any procurement specifications and acceptance testing documents related to the
installation of your open phase condition solution.
6. Copies of any site training the team will need to accomplish to gain access to areas with, or
planned, major electrical equipment used in your open phase condition solution (i.e.
Please provide the following documentation to the team when they arrive onsite. Whenever
practical, please provide copies electronically, except for drawings. Drawings should be
provided as paper copies of sufficient size (ANSI C or D) such that all details are legible.
7. A brief presentation describing your electric power system design and typical electrical
transmission and distribution system alignments; open phase condition design schemes
installed to detect, alarm and actuate; bus transfer schemes; and maintenance and
surveillance requirements. This presentation should be a general overview of your system.
Please schedule the overview shortly after the entrance meeting.
8. Plant layout and equipment drawings for areas that identify: (a) the physical plant locations
of major electrical equipment used in your open phase condition solution; (b) the locations of
detection and indication equipment used in the open phase condition sensing circuits.
9. If open phase condition actuation circuits are required, provide documentation that
demonstrates continued coordination with the other protective devices in both the offsite
electrical system (within Palo Verde Nuclear Generating Station area of responsibility) and
the onsite electrical systems.
10. Access to locations in which open phase condition equipment is installed or planned (i.e.
switchyard, transformer yard, etc.)
11. Copies of documentation or testing that demonstrates your open phase condition solution
minimizes spurious actuation or misoperation in the range of voltage imbalance normally
expected in the transmission system that could cause undesired separation from an
operable offsite power source.
This document does not contain new or amended information collection requirements
subject to the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.). Existing
information collection requirements were approved by the Office of Management and
Budget, Control Number 31500011. The NRC may not conduct or sponsor, and a person
is not required to respond to, a request for information or an information collection
requirement unless the requesting document displays a currently valid Office of
Management and Budget control number.
This document will be made available for public inspection and copying at
http://www.nrc.gov/reading-rm/adams.html and at the NRC Public document Room in
accordance with 10 CFR 2.390, Public Inspections, Exemptions, Requests for
Withholding.
SUNSI Review Non-Sensitive Publicly Available Keyword:
By: STG Sensitive Non-Publicly Available NRC-002
OFFICE SRI:EB2 RI:EB2 C:EB2 C:PBD C:EB2
NAME SGraves BCorrell GWerner GMiller GWerner
SIGNATURE /RA/ /RA/ /RA JFD for/ /RA/ /RA JFD for/
DATE 04/07/18 04/11/18 04/11/18 04/13/18 04/13/18