Protecting People and the EnvironmentUNITED STATES NUCLEAR REGULATORY COMMISSION
UNITED STATES
NUCLEAR REGULATORY COMMISSION
OFFICE OF NUCLEAR REACTOR REGULATION
WASHINGTON, D.C. 20555
September 14, 1992
NRC INFORMATION NOTICE 91-29, SUPPLEMENT 1: DEFICIENCIES IDENTIFIED DURING
ELECTRICAL DISTRIBUTION SYSTEM
FUNCTIONAL INSPECTIONS
Addressees
All holders of operating licenses or construction permits for nuclear power
reactors.
Purpose
The U.S. Nuclear Regulatory Commission (NRC) is issuing this information
notice supplement to provide additional information on deficiencies found by
the NRC during electrical distribution system functional inspections (EDSFIs)
at nuclear plants. It is expected that recipients will review the information
for applicability to their facilities and consider actions, as appropriate, to
avoid similar problems. However, suggestions contained in this information
notice are not NRC requirements; therefore, no specific action or written
response is required.
Description of Circumstances
During multidiscipline inspections such as safety system functional
inspections (SSFIs) or safety system outage modification inspections (SSOMIs),
the NRC identified a number of deficiencies related to the electrical
distribution system (EDS). As a result of these deficiencies, the NRC
developed the EDSFI to specifically evaluate the EDS. Since 1989, the NRC has
performed over 50 EDSFIs, and found design weaknesses in the following generic
areas:
1. Undervoltage relay setpoints for degraded grid conditions (this issue
was also addressed in Information Notice 91-29).
2. Interrupting capacity of fault protection devices (see Generic Letter
(GL) 88-15, "Electric Power Systems - Inadequate Control Over Design
Processes")
3. Improper coordination of fault protection devices (see GL 88-15)
4. Analysis of emergency diesel generator (EDG) capacity to power safety-
related loads during postulated accidents (see GL 88-15)
5. EDG mechanical interfaces
9209080117.
IN 91-29, Supplement 1
September 14, 1992
Page 2 of 6
Discussion
Inadequate Undervoltage Relay Setpoints for Degraded Grid Conditions
Grid voltage can become degraded as a result of (1) grid perturbations such as
electrical instabilities, lightning, hurricanes, high winds, snow and ice
storms, and tornadoes, (2) high load demand, and (3) loss of one or more power
generating units.
Plant technical specifications include two levels of undervoltage protection
to ensure that accident mitigating loads at all voltage levels will perform
their safety functions on demand during an accident. The first level of
undervoltage protection (loss of voltage) is implemented by setting the
undervoltage relays to trip quickly for a loss of offsite voltage. The second
level of undervoltage protection (degraded voltage) is implemented by setting
the undervoltage relays to alarm and trip for a sustained degraded voltage
condition.
At the Edwin I. Hatch Nuclear Plant, four Westinghouse time delay relays were
used to protect against failures of Class 1E accident mitigating equipment
during degraded grid voltage conditions. During a sustained degraded grid
voltage condition, two of these relays sent signals to alarms and the other
two transferred the buses to an alternate power source. The setting of the
undervoltage protection relays was such that the relays would perform their
functions at 3675 Vac. However, if the 4160 Vac bus voltage were degraded and
remained between a voltage band of 3786 Vac to 3676 Vac the loads would not be
transferred to the EDGs. The inspection found that, in this intermediate
voltage condition, some of the Class 1E loads at the 600 Vac and 208 Vac
levels may not receive sufficient voltage to perform their safety functions.
At the Dresden Nuclear Power Station, the trip setting of the second level
undervoltage protection relay for the 4 kV busses was between 3708 and 3784
Vac. Responding to the results of the EDSFI, the Commonwealth Edison Company
(the licensee) performed calculations which determined that the voltage
requirements at the 4 kV bus to start and run the EDG 480 Vac cooling water
pumps under "worst-case" motor loads were 3960 Vac and 3850 Vac, respectively.
Thus, the trip setting was inadequate and the safety functions may not have
been performed. The licensee found similar problems with the performance of
loads of voltage less than 480 Vac (such as the 120 Vac motor starters) for
degraded voltage conditions.
Inadequate Interrupting Capacity of Fault Protection Devices
Failure of protective devices, including breakers and fuses, to function
properly could result in a loss of power to a safety bus and/or extensive
damage to associated equipment should a short circuit condition occur. Fault
current calculations ensure that the fault protection devices are properly
selected to clear a fault under the maximum calculated short circuit current.
.
IN 91-29, Supplement 1
September 14, 1992
Page 3 of 6
At the Quad Cities Station, numerous breakers were used in applications where
the fault current exceeded the breaker interrupting capability. Several 250
Vdc breakers had potential fault currents of up to 180 percent of their
maximum breaker interrupting current ratings, and various 4 kV breakers were
susceptible to fault currents up to 109 percent of their maximum interrupting
rating.
At Indian Point Station, Unit 3, the calculated fault current for the 125 Vdc
power panels was approximately 16,600 amps, with an additional 2,000 amps
available from the battery chargers. The molded case circuit breakers
protecting these panels were manufactured before 1976 and could not be
certified by the manufacturer (Westinghouse) for fault currents higher than
10,000 amps. This deficiency was partly caused by a recent replacement of two
batteries and their associated chargers with equipment having a higher short
circuit contribution.
Improper Coordination of Fault Protection Devices
Protective devices are improperly coordinated when a supply (feeder) breaker
or fuse protecting a bus opens because of a fault in a branch circuit, thereby
causing a loss of power to the bus and all branch circuits fed by the bus.
For circuits to be coordinated properly, the branch circuit breakers or fuses
must isolate local faults without tripping the feeder breaker or blowing the
fuse to the bus.
At the William B. McGuire Nuclear Station, Units 1 and 2, each of the four
batteries supply one distribution center, which supplies one dc panelboard for
each unit. The 125 Vdc circuit breakers at McGuire were improperly
coordinated. During a fault condition, a branch circuit breaker could cause
the 400 amp main feeder circuit breaker to open, thereby separating the
battery and charger from the 125 Vdc distribution center. This would result
in a loss of 125 Vdc and vital 120 Vac power for the instrumentation and
control of one train for both Units 1 and 2. During charger maintenance, the
Duke Power company (the licensee) cross-connected the distribution centers
with tie breakers such that a fault condition could have caused power to be
lost for two trains of vital instrumentation and control as a result of
improper coordination.
At Hatch Units 1 and 2, five EDG output breakers feeding essential 4160 Vac
buses were improperly coordinated with their corresponding downstream load
breakers. If the diesel was energizing the essential 4160 Vac buses during
emergency conditions, a postulated fault on a branch circuit (such as a high
impedance fault, a sluggish motor start with an extended locked rotor current,
or a continuous locked rotor condition) could cause the EDG output circuit
breaker to trip before the downstream branch feeder circuit breaker tripped
causing a loss of the diesel rather than the branch circuit.
.
IN 91-29, Supplement 1
September 14, 1992
Page 4 of 6
At Dresden, design documents were inadequate to verify proper coordination.
In addition, available design documents indicated that the 480 Vac circuits
were improperly coordinated at several locations. For example, a fault on the
nonsafety equipment could disable an entire 480 Vac safety division.
Inadequate Analysis of EDG Capacity to Power Safety-Related Loads During
Postulated Accidents
The EDGs are designed with sufficient capacity to (1) start and carry assigned
loads during steady-state and dynamic (transient) conditions, and (2) account
for the load requirements of equipment utilized for the emergency operating
procedures (EOPs). EDGs shared by two units at a site are designed with
sufficient capacity to start and carry all emergency loads required to
mitigate a loss-of-coolant accident (LOCA) in one unit and the safe shutdown
loads in the other unit.
At the Point Beach Nuclear Plant, Units 1 and 2, the steady-state loading
calculation for the shared EDGs was not conservative because it assumed that a
containment fan for the nonfaulted unit was not operating during the injection
and recirculation phases of a postulated LOCA in the faulted unit. However,
the FSAR indicated that one containment fan would be manually started in the
nonfaulted unit and EOPs for the nonfaulted unit did not preclude starting the
fan. Adding the fan load onto the EDG during the recirculation phase would
have increased the EDG loading to 101 percent of its 200 hour rating. This
marginal situation for steady-state loading was aggravated by the fact that
the licensee had not analyzed EDG loading under transient conditions.
At the River Bend Station the EDG loading calculation was based upon loads
simulated in the manufacturer's shop test, but did not reconcile differences
between actual loads and those simulated in the shop tests. For example, test
motors were running unloaded during the shop test, which was less severe than
for postulated accident load conditions.
Deficiencies in Emergency Diesel Generator Mechanical Interfaces
The staff found deficiencies involving EDG mechanical systems interfaces, such
as air start systems, fuel oil storage, and heating, ventilation and cooling
(HVAC).
Air Start Systems
Each EDG generally has two redundant air start systems consisting of air
compressors, air dryers, air receivers, devices to crank the engine, piping
and controls. Design criteria and licensing commitments require that the air
receivers have adequate capacity to provide EDG starting air for a specified
minimum number of starts (usually five starts). The air receiver capacity and
the pressure switch setpoints for the low pressure alarm are based upon a
requirement to meet the minimum number of EDG starts without the air receivers
being recharged.
.
IN 91-29, Supplement 1
September 14, 1992
Page 5 of 6
At the Three Mile Island Nuclear Station, Unit 1, the Haddam Neck Plant, River
Bend, the Fort Calhoun Station, and some other facilities, the air receiver
low pressure alarm setpoint or the technical specification limit for low air
pressure was set below the level required for the specified number of EDG
starts. At the San Onofre Nuclear Generating Station, test results indicated
that the EDG could be started five times at an initial air receiver pressure
of 195 psig. However, the air compressor was set to actuate at an air
receiver pressure of 182 psig and the air receiver low pressure alarm was set
at 165 psig which could have allowed the air receiver pressure to drop to
these levels.
Fuel Oil Storage
The technical specifications generally require the quantity of diesel fuel
stored on site for each EDG to be sufficient for the EDG to supply essential
electrical loads for 7 days. At the Indian Point Station, Unit 3, the Duane
Arnold Energy Center, the Zion Nuclear Plant, Point Beach Nuclear Plant, and
some other facilities, the staff found insufficient fuel oil storage
capacities because of one or more of the following reasons:
ù Incorrect EDG electrical load assumed during fuel consumption tests
ù Lack of data on actual fuel consumption rate
ù Failure to consider parallel consumption of fuel by other equipment
ù Limitations on the usable volume in the storage tank because of the
physical configuration of the tank or the suction piping, or inadequate
net positive suction head of the fuel oil transfer pumps
The staff also found cases of lack of seismic qualification of the original or
modified fuel oil system.
EDG Room Heating, Ventilation and Cooling
The diesel building HVAC is designed to operate during diesel operation and
maintain room temperature between design specification limits. The EDG room
temperature limit is based upon the limits on the operating temperature for
electrical components within the EDG rooms, the lube oil and jacket cooling
water temperature, and combustion air inlet temperature.
At the Donald C. Cook Plant, St. Lucie, the Trojan Nuclear Plant, the Diablo
Canyon Nuclear Power Plant, McGuire, H. B. Robinson Plant, Arkansas Nuclear
One, and some other facilities, the staff found one or more of the following
deficiencies in the EDG room HVAC:
ù EDG room temperature was not being monitored, and there were no alarms to
alert the operator to high room temperature.
ù EDG power output could be limited because of high combustion air inlet
temperatures.
.
IN 91-29, Supplement 1
September 14, 1992
Page 6 of 6
ù EDG lube oil and jacket water temperatures exceeded the specified limits.
ù EDG room temperatures for normal operation (with the EDGs not operating)
exceeded the operating temperature limits for electrical components in
the control panels within the EDG rooms.
ù The ducting for the room ventilation system and the engine air intake
were not designed to withstand the differential pressure caused by
tornadoes.
This information notice requires no specific action or written response. If
you have any questions about the information in this notice, please contact
the technical contact listed below, or the appropriate Office of Nuclear
Reactor Regulation (NRR) project manager.
ORIGINAL SIGNED BY
Charles E. Rossi, Director
Division of Operational Events Assessment
Office of Nuclear Reactor Regulation
Technical contact: Anil S. Gautam, NRR
(301) 504-2988
Attachment: List of Recently Issued NRC Information Notices
.
