Information Notice No. 91-29, Supplement 1: Deficiencies Identified During Electrical Distribution System Functional Inspections
UNITED STATES NUCLEAR REGULATORY COMMISSION OFFICE OF NUCLEAR REACTOR REGULATION WASHINGTON, D.C. 20555 September 14, 1992 NRC INFORMATION NOTICE 91-29, SUPPLEMENT 1: DEFICIENCIES IDENTIFIED DURING ELECTRICAL DISTRIBUTION SYSTEM FUNCTIONAL INSPECTIONS Addressees All holders of operating licenses or construction permits for nuclear power reactors. Purpose The U.S. Nuclear Regulatory Commission (NRC) is issuing this information notice supplement to provide additional information on deficiencies found by the NRC during electrical distribution system functional inspections (EDSFIs) at nuclear plants. It is expected that recipients will review the information for applicability to their facilities and consider actions, as appropriate, to avoid similar problems. However, suggestions contained in this information notice are not NRC requirements; therefore, no specific action or written response is required. Description of Circumstances During multidiscipline inspections such as safety system functional inspections (SSFIs) or safety system outage modification inspections (SSOMIs), the NRC identified a number of deficiencies related to the electrical distribution system (EDS). As a result of these deficiencies, the NRC developed the EDSFI to specifically evaluate the EDS. Since 1989, the NRC has performed over 50 EDSFIs, and found design weaknesses in the following generic areas: 1. Undervoltage relay setpoints for degraded grid conditions (this issue was also addressed in Information Notice 91-29). 2. Interrupting capacity of fault protection devices (see Generic Letter (GL) 88-15, "Electric Power Systems - Inadequate Control Over Design Processes") 3. Improper coordination of fault protection devices (see GL 88-15) 4. Analysis of emergency diesel generator (EDG) capacity to power safety- related loads during postulated accidents (see GL 88-15) 5. EDG mechanical interfaces 9209080117. IN 91-29, Supplement 1 September 14, 1992 Page 2 of 6 Discussion Inadequate Undervoltage Relay Setpoints for Degraded Grid Conditions Grid voltage can become degraded as a result of (1) grid perturbations such as electrical instabilities, lightning, hurricanes, high winds, snow and ice storms, and tornadoes, (2) high load demand, and (3) loss of one or more power generating units. Plant technical specifications include two levels of undervoltage protection to ensure that accident mitigating loads at all voltage levels will perform their safety functions on demand during an accident. The first level of undervoltage protection (loss of voltage) is implemented by setting the undervoltage relays to trip quickly for a loss of offsite voltage. The second level of undervoltage protection (degraded voltage) is implemented by setting the undervoltage relays to alarm and trip for a sustained degraded voltage condition. At the Edwin I. Hatch Nuclear Plant, four Westinghouse time delay relays were used to protect against failures of Class 1E accident mitigating equipment during degraded grid voltage conditions. During a sustained degraded grid voltage condition, two of these relays sent signals to alarms and the other two transferred the buses to an alternate power source. The setting of the undervoltage protection relays was such that the relays would perform their functions at 3675 Vac. However, if the 4160 Vac bus voltage were degraded and remained between a voltage band of 3786 Vac to 3676 Vac the loads would not be transferred to the EDGs. The inspection found that, in this intermediate voltage condition, some of the Class 1E loads at the 600 Vac and 208 Vac levels may not receive sufficient voltage to perform their safety functions. At the Dresden Nuclear Power Station, the trip setting of the second level undervoltage protection relay for the 4 kV busses was between 3708 and 3784 Vac. Responding to the results of the EDSFI, the Commonwealth Edison Company (the licensee) performed calculations which determined that the voltage requirements at the 4 kV bus to start and run the EDG 480 Vac cooling water pumps under "worst-case" motor loads were 3960 Vac and 3850 Vac, respectively. Thus, the trip setting was inadequate and the safety functions may not have been performed. The licensee found similar problems with the performance of loads of voltage less than 480 Vac (such as the 120 Vac motor starters) for degraded voltage conditions. Inadequate Interrupting Capacity of Fault Protection Devices Failure of protective devices, including breakers and fuses, to function properly could result in a loss of power to a safety bus and/or extensive damage to associated equipment should a short circuit condition occur. Fault current calculations ensure that the fault protection devices are properly selected to clear a fault under the maximum calculated short circuit current. . IN 91-29, Supplement 1 September 14, 1992 Page 3 of 6 At the Quad Cities Station, numerous breakers were used in applications where the fault current exceeded the breaker interrupting capability. Several 250 Vdc breakers had potential fault currents of up to 180 percent of their maximum breaker interrupting current ratings, and various 4 kV breakers were susceptible to fault currents up to 109 percent of their maximum interrupting rating. At Indian Point Station, Unit 3, the calculated fault current for the 125 Vdc power panels was approximately 16,600 amps, with an additional 2,000 amps available from the battery chargers. The molded case circuit breakers protecting these panels were manufactured before 1976 and could not be certified by the manufacturer (Westinghouse) for fault currents higher than 10,000 amps. This deficiency was partly caused by a recent replacement of two batteries and their associated chargers with equipment having a higher short circuit contribution. Improper Coordination of Fault Protection Devices Protective devices are improperly coordinated when a supply (feeder) breaker or fuse protecting a bus opens because of a fault in a branch circuit, thereby causing a loss of power to the bus and all branch circuits fed by the bus. For circuits to be coordinated properly, the branch circuit breakers or fuses must isolate local faults without tripping the feeder breaker or blowing the fuse to the bus. At the William B. McGuire Nuclear Station, Units 1 and 2, each of the four batteries supply one distribution center, which supplies one dc panelboard for each unit. The 125 Vdc circuit breakers at McGuire were improperly coordinated. During a fault condition, a branch circuit breaker could cause the 400 amp main feeder circuit breaker to open, thereby separating the battery and charger from the 125 Vdc distribution center. This would result in a loss of 125 Vdc and vital 120 Vac power for the instrumentation and control of one train for both Units 1 and 2. During charger maintenance, the Duke Power company (the licensee) cross-connected the distribution centers with tie breakers such that a fault condition could have caused power to be lost for two trains of vital instrumentation and control as a result of improper coordination. At Hatch Units 1 and 2, five EDG output breakers feeding essential 4160 Vac buses were improperly coordinated with their corresponding downstream load breakers. If the diesel was energizing the essential 4160 Vac buses during emergency conditions, a postulated fault on a branch circuit (such as a high impedance fault, a sluggish motor start with an extended locked rotor current, or a continuous locked rotor condition) could cause the EDG output circuit breaker to trip before the downstream branch feeder circuit breaker tripped causing a loss of the diesel rather than the branch circuit. . IN 91-29, Supplement 1 September 14, 1992 Page 4 of 6 At Dresden, design documents were inadequate to verify proper coordination. In addition, available design documents indicated that the 480 Vac circuits were improperly coordinated at several locations. For example, a fault on the nonsafety equipment could disable an entire 480 Vac safety division. Inadequate Analysis of EDG Capacity to Power Safety-Related Loads During Postulated Accidents The EDGs are designed with sufficient capacity to (1) start and carry assigned loads during steady-state and dynamic (transient) conditions, and (2) account for the load requirements of equipment utilized for the emergency operating procedures (EOPs). EDGs shared by two units at a site are designed with sufficient capacity to start and carry all emergency loads required to mitigate a loss-of-coolant accident (LOCA) in one unit and the safe shutdown loads in the other unit. At the Point Beach Nuclear Plant, Units 1 and 2, the steady-state loading calculation for the shared EDGs was not conservative because it assumed that a containment fan for the nonfaulted unit was not operating during the injection and recirculation phases of a postulated LOCA in the faulted unit. However, the FSAR indicated that one containment fan would be manually started in the nonfaulted unit and EOPs for the nonfaulted unit did not preclude starting the fan. Adding the fan load onto the EDG during the recirculation phase would have increased the EDG loading to 101 percent of its 200 hour rating. This marginal situation for steady-state loading was aggravated by the fact that the licensee had not analyzed EDG loading under transient conditions. At the River Bend Station the EDG loading calculation was based upon loads simulated in the manufacturer's shop test, but did not reconcile differences between actual loads and those simulated in the shop tests. For example, test motors were running unloaded during the shop test, which was less severe than for postulated accident load conditions. Deficiencies in Emergency Diesel Generator Mechanical Interfaces The staff found deficiencies involving EDG mechanical systems interfaces, such as air start systems, fuel oil storage, and heating, ventilation and cooling (HVAC). Air Start Systems Each EDG generally has two redundant air start systems consisting of air compressors, air dryers, air receivers, devices to crank the engine, piping and controls. Design criteria and licensing commitments require that the air receivers have adequate capacity to provide EDG starting air for a specified minimum number of starts (usually five starts). The air receiver capacity and the pressure switch setpoints for the low pressure alarm are based upon a requirement to meet the minimum number of EDG starts without the air receivers being recharged. . IN 91-29, Supplement 1 September 14, 1992 Page 5 of 6 At the Three Mile Island Nuclear Station, Unit 1, the Haddam Neck Plant, River Bend, the Fort Calhoun Station, and some other facilities, the air receiver low pressure alarm setpoint or the technical specification limit for low air pressure was set below the level required for the specified number of EDG starts. At the San Onofre Nuclear Generating Station, test results indicated that the EDG could be started five times at an initial air receiver pressure of 195 psig. However, the air compressor was set to actuate at an air receiver pressure of 182 psig and the air receiver low pressure alarm was set at 165 psig which could have allowed the air receiver pressure to drop to these levels. Fuel Oil Storage The technical specifications generally require the quantity of diesel fuel stored on site for each EDG to be sufficient for the EDG to supply essential electrical loads for 7 days. At the Indian Point Station, Unit 3, the Duane Arnold Energy Center, the Zion Nuclear Plant, Point Beach Nuclear Plant, and some other facilities, the staff found insufficient fuel oil storage capacities because of one or more of the following reasons: � Incorrect EDG electrical load assumed during fuel consumption tests � Lack of data on actual fuel consumption rate � Failure to consider parallel consumption of fuel by other equipment � Limitations on the usable volume in the storage tank because of the physical configuration of the tank or the suction piping, or inadequate net positive suction head of the fuel oil transfer pumps The staff also found cases of lack of seismic qualification of the original or modified fuel oil system. EDG Room Heating, Ventilation and Cooling The diesel building HVAC is designed to operate during diesel operation and maintain room temperature between design specification limits. The EDG room temperature limit is based upon the limits on the operating temperature for electrical components within the EDG rooms, the lube oil and jacket cooling water temperature, and combustion air inlet temperature. At the Donald C. Cook Plant, St. Lucie, the Trojan Nuclear Plant, the Diablo Canyon Nuclear Power Plant, McGuire, H. B. Robinson Plant, Arkansas Nuclear One, and some other facilities, the staff found one or more of the following deficiencies in the EDG room HVAC: � EDG room temperature was not being monitored, and there were no alarms to alert the operator to high room temperature. � EDG power output could be limited because of high combustion air inlet temperatures. . IN 91-29, Supplement 1 September 14, 1992 Page 6 of 6 � EDG lube oil and jacket water temperatures exceeded the specified limits. � EDG room temperatures for normal operation (with the EDGs not operating) exceeded the operating temperature limits for electrical components in the control panels within the EDG rooms. � The ducting for the room ventilation system and the engine air intake were not designed to withstand the differential pressure caused by tornadoes. This information notice requires no specific action or written response. If you have any questions about the information in this notice, please contact the technical contact listed below, or the appropriate Office of Nuclear Reactor Regulation (NRR) project manager. ORIGINAL SIGNED BY Charles E. Rossi, Director Division of Operational Events Assessment Office of Nuclear Reactor Regulation Technical contact: Anil S. Gautam, NRR (301) 504-2988 Attachment: List of Recently Issued NRC Information Notices .
Page Last Reviewed/Updated Tuesday, March 09, 2021
Page Last Reviewed/Updated Tuesday, March 09, 2021