Text

Request for Licensing Action to Modify Technical Specification 3.8.1, AC Sources - Operating, to Remove Mode Restrictions on Certain Division 3 Surveillance Requirements
	ML12188A001
Person / Time
Site:	Perry
Issue date:	07/03/2012
From:	Kaminskas V; FirstEnergy Nuclear Operating Co
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	L-12-261
	Download: ML12188A001 (76)
	v • d • e

FENOC~ Perry Nuclear Power Plant 10 Center Road FirstEnergyNuclear OperatingCompany Perry, Ohio 44081 Vito A. Kaminskas 440-280-5382 Vice President Fax: 440-280-8029 July 3, 2012 L-12-261 10 CFR 50.90 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555-0001

SUBJECT:

Perry Nuclear Power Plant Docket No. 50-440, License No. NPF-58 Request for Licensinq Action to Modify Technical Specification 3.8.1, "AC Sources -

Operatinq," to Remove MODE Restrictions on Certain Division 3 Surveillance Requirements Pursuant to 10 CFR 50.90, FirstEnergy Nuclear Operating Company (FENOC) is requesting an amendment to the Perry Nuclear Power Plant (PNPP) Technical Specification (TS) 3.8.1, "AC Sources - Operating." The proposed amendment would modify nine surveillance requirements (SRs) by excluding Division 3 from the current MODE restrictions, thus allowing performance in any MODE of plant operation. It would also delete expired TS 3.8.1 provisions regarding use of the delayed access circuit.

An evaluation of the proposed amendment is provided as an enclosure. In order to use the amendment prior to the next refueling outage, which is scheduled to start March 18, 2013, Nuclear Regulatory Commission (NRC) staff approval is requested by March 1, 2013.

Implementation of the amendment by FENOC is planned within 30 days of its approval.

There are no regulatory commitments contained in this submittal. If there are any questions or if additional information is required, please contact Mr. Phil H. Lashley, Supervisor -

Fleet Licensing, at (330) 315-6808.

I declare under penalty of perjury that the foregoing is true and correct. Executed on July 3.*, 2012.

Sincerely, Vito A. Kaminskas

Enclosure:

Evaluation of Proposed Request for Licensing Action cc: NRC Region III Administrator NRC Resident Inspector NRC Project Manager Executive Director, Ohio Emergency Management Agency, State of Ohio (NRC Liaison)

Utility Radiological Safety Board

EVALUATION OF PROPOSED REQUEST FOR LICENSING ACTION Page 1 of 22

Subject:

Request for Licensing Action to Modify Technical Specification 3.8.1, "AC Sources - Operating," to Remove MODE Restrictions on Certain Division 3 Surveillance Requirements 1.0

SUMMARY

DESCRIPTION 2.0 DETAILED DESCRIPTION

3.0 TECHNICAL EVALUATION

3.1 General Basis 3.2 Transient Analysis 3.3 Administrative Controls for Online Maintenance 3.4 Online Risk Management 3.5 Online Testing versus Outage Testing 3.6 Discussions for Individual Surveillance Requirements 3.7 Probabilistic Risk Assessment (PRA) 3.8 Surveillance Testing Historical Results 3.9 Removal of Provisions for Delayed Access Circuit

4.0 REGULATORY EVALUATION

4.1 No Significant Hazards Consideration Analysis 4.2 Applicable Regulatory Requirements/Criteria 4.3 Precedent 4.4 Conclusions

5.0 ENVIRONMENTAL CONSIDERATION

Attachments:

1. PROPOSED TECHNICAL SPECIFICATION CHANGES (MARK-UP)

2. PROPOSED TECHNICAL SPECIFICATION CHANGES (RETYPED)

3. PROPOSED TECHNICAL SPECIFICATION BASES CHANGES (MARK-UP)

(PROVIDED FOR INFORMATION PURPOSES ONLY)

4. HISTORICAL RESULTS OF DIVISION 3 AC SOURCES SURVEILLANCE TESTING

Page 2 of 22 1.0

SUMMARY

DESCRIPTION This evaluation supports a FirstEnergy Nuclear Operating Company (FENOC) request to modify Perry Nuclear Power Plant (PNPP) Technical Specification (TS) 3.8.1, "AC Sources - Operating,"

by revising certain Division 3 surveillance requirements (SRs). The Division 3 alternating current (AC) sources are separate sources of onsite and offsite power dedicated to supporting the high pressure core spray (HPCS) system. The TS currently prohibits performing the tests required by SR 3.8.1.8, SR 3.8.1.9, SR 3.8.1.10 and SR 3.8.1.12 in MODE 1 or 2; and, prohibits performing the tests required by SR 3.8.1.11, SR 3.8.1.13, SR 3.8.1.16, SR 3.8.1.17 and SR 3.8.1.19 in MODE 1, 2, or 3. The proposed license amendment would remove these MODE restrictions and allow these nine SRs to be performed in any operating MODE for the Division 3 AC sources only.

As discussed in the TS Bases for each of the SRs, the MODE restrictions for performance of the SRs online were put into place because it was believed they could:

1. Perturb the electrical distribution system,

2. Challenge plant safety systems, and/or

3. Remove a required offsite circuit from service.

Sections 3.1 through 3.5 of this evaluation provide detailed discussions of these assumptions for performance of the Division 3 SRs online. This evaluation concluded that performance of these Division 3 SRs online is acceptable due to the fact the Division 3 AC sources present no credible challenge that would result in a perturbation of the electrical distribution system during performance of these SRs online. Additionally, the Division 3 safety system, HPCS, is declared inoperable during portions of SRs 3.8.1.11, 3.8.1.16, and 3.8.1.19, and the other two electrical divisions (Divisions 1 and 2) and their safety systems remain unchallenged during the performance of these nine Division 3 SRs. By design, the brief removal of the required offsite circuit for the performance of SRs 3.8.1.11, 3.8.1.16, and 3.8.1.19 only impacts Division 3 AC sources. As discussed in the Note to the Applicability requirements for TS 3.8.1, if the HPCS system is not OPERABLE, the Division 3 AC sources are not required to be OPERABLE. Individual discussions on the acceptability of online performance for each of the SRs listed above can be found in Section 3.6.

In summary, the proposed amendment will provide greater flexibility in scheduling by allowing certain Division 3 surveillance tests to be performed during non-outage periods. Having a fully tested and available Division 3 emergency diesel generator (DG) for the duration of a refueling outage will reduce the number of system re-alignments and associated operator workload during the outage. Additionally, performing these Division 3 activities online increases the Division 3 DG and HPCS system availability during refueling outages and allows the Division 3 surveillance testing to be conducted when both Division 1 and 2 AC sources are required to be OPERABLE.

The proposed amendment also includes the removal of temporary TS 3.8.1 provisions related to the delayed access circuit, which were recently added in Amendment 160. As currently stated in TS 3.8.1, the delayed access circuit was able to be used in place of the circuit associated with the Unit 1 startup transformer, but only through December 12, 2011. The proposed changes to remove the MODE restrictions associated with the Division 3 SRs do not rely upon removal of the expired provisions. Removal of the TS 3.8.1 delayed access circuit provisions is included herein as a matter of processing convenience. only.

The proposed TS changes are provided in Attachment 1; retyped TS pages incorporating the proposed changes are provided in Attachment 2; proposed changes to the TS Bases are provided in Attachment 3; and surveillance testing historical results are provided in Attachment 4.

Page 3 of 22 2.0 DETAILED DESCRIPTION The proposed amendment includes the following revisions to TS 3.8.1:

SR 3.8.1.8 Revise the Note to remove the restriction that prohibits performance of this SR in MODE 1 or 2, for Division 3 only. This SR verifies manual transfer of unit power supply from the normal offsite circuit to the alternate offsite circuit.

SR 3.8.1.9 Revise Note 1 to remove the restriction that prohibits performance of this SR in MODE 1 or 2, for Division 3 only. This SR verifies the DG rejects a load greater than or equal to its associated single largest post-accident load. Following load rejection, engine speed is maintained less than nominal plus 75 percent of the difference between nominal speed and the overspeed trip setpoint, or 15 percent above nominal, whichever is less.

SR 3.8.1.10 Revise the Note to. remove the restriction that prohibits performance of this SR in MODE 1 or 2, for Division 3 only. This SR verifies the DG (operating at a power factor < 0.9) does not trip and voltage is maintained < 5000 volts (V) during and following a load rejection of a load > 2600 kilowatts (kW).,

SR 3.8.1.11 Revise Note 2 to remove the restriction that prohibits performance of this SR in MODE 1, 2, or 3, for Division 3 only. This SR verifies that upon an actual or simulated loss of offsite power (LOOP) signal, the emergency bus is de-energized, and the diesel generator automatically starts from the standby condition and energizes permanently connected loads in < 13 seconds, achieves and maintains the required voltage and frequency, and supplies permanently connected loads for a 5 minutes.

SR 3.8.1.12 Revise Note 2 to remove the restriction that prohibits performance of this SR in MODE 1 or 2, for Division 3 only. This SR verifies that upon an actual or simulated emergency core cooling system (ECCS) initiation signal, the diesel generator automatically starts from the standby condition and achieves the required voltage and frequency in < 13 seconds, and operates for > 5 minutes.

SR 3.8.1.13 Revise the Note to remove the restriction that prohibits performance of this SR in MODE 1, 2, or 3, for Division 3 only. This SR verifies the DG's automatic trips are bypassed on an actual or simulated ECCS initiation signal, except for the engine overspeed and generator differential current trips.

SR 3.8.1.16 Revise the Note to remove the restriction that-prohibits performance of this SR in MODE 1, 2, or 3, for Division 3 only. This SR verifies that upon a simulated restoration of offsite power, the diesel generator can be synchronized with an offsite power source while loaded with emergency loads, transfers loads to offsite power, and the diesel generator returns to ready-to-load operation.

SR 3.8.1.17 Revise the Note to remove the restriction that prohibits performance of this SR in MODE 1, 2, or 3, for Division 3 only. This SR verifies that with the diesel generator operating in test mode and connected to its bus, an actual or simulated ECCS initiation signal overrides the test mode by returning the diesel generator to ready-to-load operation and automatically energizing the emergency loads from offsite power.

Page 4 of 22 SR 3.8.1.19 Revise Note 2 to remove the restriction that prohibits performance of this SR in MODE 1, 2, or 3, for Division 3 only. This SR verifies that upon an actual or simulated LOOP signal in conjunction with an actual or simulated ECCS initiation signal, the emergency bus is de-energized, the diesel generator automatically starts from the standby condition and energizes permanently connected and auto-connected loads in < 13 seconds, achieves and maintains the required voltage and frequency, and supplies permanently connected and auto-connected loads for > 5 minutes.

3.0 TECHNICAL EVALUATION

3.1 General Basis The three 4160 volt emergency buses are depicted on PNPP's updated safety analysis report (USAR) Figure 8.3-1. The Division 3 power system, which includes the Division 3 diesel generator, is self-contained, except for connections to the system actuation signal sources and either the preferred or alternate preferred sources of offsite power. Divisional protection and separation criteria for the 4160 volt emergency buses are described in USAR sections 8.1 and 8.3, and the Bases for TS 3.3.8.1, "Loss of Power (LOP) Instrumentation." As discussed in the Bases, offsite power is the preferred source of power for the three divisional buses. The LOP instrumentation monitors the 4160 volt emergency buses, and if the LOP monitors determine that insufficient power is available, the three divisional buses are disconnected from the offsite power source and independently connected to their respective onsite diesel generator power sources.

As described below, the loads in Division 3 are relatively small in comparison to the offsite power grid and have been shown to not perturb the offsite grid when connected or tripped off.

Historically, Division 3 testing while connected to the offsite grid has not adversely affected the other electrical divisions, which are also connected to the offsite grid when the plant is online. As described in USAR section 8.3, the loads supplied by this power system are only those loads associated with Division 3 of the emergency core cooling system (ECCS). The HPCS power system loads consist of the HPCS pump motor and associated auxiliaries, motor operated valves, emergency service water pump, ventilation equipment, and miscellaneous diesel engine auxiliary loads. Therefore, during the performance of the nine Division 3 surveillance tests contained in this proposed amendment, only Division 3 equipment can be directly affected.

Although the TS Bases, as currently written, state that the reason for the SR Notes imposing MODE restrictions is to preclude the potential for perturbations of the electrical distribution system during plant operation and challenge to plant safety systems, reconsideration of these Bases specifically for Division 3 has determined the assumptions are not warranted. This conclusion is based on:

(1) the PNPP AC power system design and associated protection features; (2) plant experience with the performance of testing (historical results) required in accordance with the affected SRs; (3) administrative controls that minimize plant risks during performance of the affected testing; and (4) the low probability of a significant voltage perturbation during such testing.

As required by individual SRs, PNPP declares the Division 3 DG inoperable during portions of the surveillance testing. As a result, the Division 3 DG and its associated loads are unavailable for responding to a design basis accident during short portions of the testing. The effect on safety of performing these Division 3 SRs during plant operation is not significantly different than the effect on safety associated with the online performance of other DG surveillances that do not contain MODE restrictions. For example, the 24-hour DG run in SR 3.8.1.14 is performed by paralleling

Page 5 of 22 the Division 3 DG with offsite power, similar to the SR 3.8.1.2 and SR 3.8.1.3 monthly runs of the DG, all of which may be conducted with the plant online.

Additionally, performance of the testing online as proposed will not impact the reactor core isolation cooling (RCIC) system. This system, discussed in TS 3.5.3, "RCIC System," provides a high pressure injection function similar to the HPCS system. The RCIC system consists of a steam driven turbine pump unit, piping and valves to provide steam to the turbine, as well as piping and valves to transfer water from its suction sources into the core via the reactor head spray nozzle.

Since the RCIC steam turbine drives the RCIC pump, and none of the RCIC support equipment is powered from Division 3 AC sources, the RCIC system will not be impacted by online testing of the Division 3 AC sources.

Finally, testing in the proposed manner does not significantly interfere with normal plant operation.

3.2 Transient Analysis This portion of the evaluation examines degraded voltage issues, loss of offsite power events, divisional cross-tie capabilities, and responses to loss of coolant accidents.

Degraded Voltage By procedure, control room operators maintain cognizance of the operational configuration of equipment in the transmission yard to ensure the availability and reliability of the plant's offsite power sources. Additionally, the operators periodically monitor control room indications and communicate with regional grid control centers regarding grid status, discussing degraded grid or degraded voltage conditions, if present. As actual grid conditions warrant, or if requested by the grid control center, testing would either be postponed or terminated.

With the Division 3 DG running and paralleled with the grid, if grid voltage started to degrade and somehow went unnoticed, the DG's voltage regulator would increase field current in an effort to raise terminal voltage, until the regulator reached its limit. This DG voltage regulator limit is set such that the DG would continue to operate normally with the voltage regulator at its maximum output. The frequency would remain within limits and there would be no significant change in the loading on the diesel. If grid voltage continued to degrade, protective relaying would initiate' separation of the main generator and the Division 3 emergency bus from the degraded grid. This condition would have no adverse impact on the Division 3 DG or its associated loads.

Since the conditions 'necessary for PNPP to enter into a degraded voltage condition on the 4160 volt emergency buses in any operational configuration would be severe, and outside of their specified operating band, all TS 3.8.1 AC source testing would be terminated.

Based on the administrative controls for the availability and quality of offsite power sources and the design of the PNPP onsite and offsite power systems, there is no additional adverse condition introduced by testing in the proposed manner.

Loss of Offsite Power (LOOP)

A significant overload of the Division 3 DG could result if operating in parallel with an offsite source that experiences a loss of power. Several variables must be considered when analyzing scenarios with the Division 3 DG operating in parallel with an offsite source should a LOOP occur. Multiple line-ups, initial loading, and the number of potential LOOP scenarios make it difficult to analyze for each discrete possibility. However, there are only two potential outcomes of these various scenarios, as discussed below:

(1) The diesel is loaded within its capability, and (2) The diesel is loaded beyond its capability.

Page 6 of 22 First, if the Division 3 DG is loaded within its capability, it will continue to operate normally with no adverse consequences.

Secondly, significant overloading beyond the Division 3 DG capability would begin to stall the DG.

At this point, multiple protective relay actuation sequences would begin. When loaded beyond capability, the DG would begin to stall within seconds. DG frequency would decay first followed by voltage, and a protective relay would actuate and isolate the Division 3 DG from the offsite source.

Although the Division 3 DG is designed to withstand a full load rejection without an overspeed, it is conservative to assume an overspeed lockout would occur. No damage is expected to occur to the Division 3 DG in this scenario.

Both of the above potential outcomes resulting from a LOOP concurrent with the Division 3 DG paralleled to an offsite source are recoverable with no damage to the DG. These scenarios are not unique to the testing that is the subject of this request for licensing action, and they have been previously analyzed and found to be acceptable. The acceptability of operating with the Division 3 DG in parallel with the grid when the plant is online is illustrated by the other TS SRs that are not prohibited from online performance and already run the diesel in sync with the grid. For example, SR 3.8.1.3 demonstrates that the diesel generator is capable of operating for > 60 minutes at a load > 2600 kW, which is performed by synchronizing to and loading the Division 3 diesel generator from the grid.

The overload conditions described above would not occur if a, concurrent loss of coolant accident (LOCA) signal is present. LOCA control logic automatically trips the DG output breaker when the DG is paralleled with an offsite source. The LOCA scenario is further discussed below.

In summary, while there is a potential for an overspeed lockout to occur if the DG were to experience an extreme overload condition during online testing, there is no potential to damage the Division 3 DG in any overload condition that might occur during DG testing. As described above, none of the outcomes associated with a LOOP are new outcomes that are introduced by testing in the proposed manner or made more likely by performing the Division 3 testing online.

Response During an Actual Loss of Offsite Power (LOOP) Event On August 14, 2003, PNPP experienced an actual LOOP event. As required, all three emergency diesels, including the Division 3 diesel, started and supplied their respective emergency electrical buses. The diesels ran, as necessary, throughout the event until restoration of offsite power.

Follow-up reviews of the plant's response to the actual LOOP event revealed the diesels performed as required by design. To date, no other LOOP events have occurred at PNPP.

Divisional Crosstie Capabilities By design, there are no permanently installed Division 3 to Division 1 or Division 3 to Division 2 electrical crossties. Each division is electrically and physically separated to prevent a failure on any single division from directly affecting any of the remaining divisions.

In an emergency, Division 3 can temporarily provide 480 volt power to select 480 volt buses of either Division 1 or Division 2 using locally enabled crossties. For these temporary crosstie circuits, divisional separation is maintained by employing normally open, fused disconnect switches at both ends of each circuit. The fuses are not stored in the circuits. These crossties are only used when directed by emergency operating procedures, following a loss of power to either the Division 1 or Division 2 buses. The temporary electrical crosstie is made to provide 480 volt power to key plant components, like containment isolation valves. The crossties to Division 1 or Division 2 are physically removed upon restoration of offsite power or when the buses can be supplied by the associated divisional DG, thus restoring divisional separation.

Page 7 of 22 Loss of Coolant Accident (LOCA)

Upon receipt of a LOCA signal while the Division 3 DG is operating in parallel with an offsite source, the diesel output breaker [EH1301] will trip open, leaving the emergency [EH13] bus powered solely from the offsite source. The Division 3 DG will remain in a ready-to-load condition.

System response to the receipt of a LOCA signal will not be changed as a result of the proposed testing in any operating MODE, except as noted within Section 3.1 above, and the individual surveillance requirements discussions in Section 3.6 below.

3.3 Administrative Controls for Online Maintenance The PNPP TS impose requirements and restrictions on the amount of equipment allowed out of service at any given time. Specifically, TS 3.8.1, "AC Sources-Operating," requires identification of inoperable required features that are redundant to required features supported by the inoperable diesel generator. This required action is applicable throughout the entire period of diesel inoperability. Inoperable ECCS or RCIC components, or DGs on the redundant division, would cause entry into other more stringent required actions, thus providing further incentive not to perform testing on Division 3 AC sources with redundant equipment inoperable. Additionally, the program required by TS Section 5.5.10, "Safety Function Determination Program (SFDP)," ensures that a loss of safety function is detected and appropriate actions taken. The PNPP approach'to performing online maintenance is also based upon a protected division concept. This means that without special considerations, work is only allowed on one division at.a time. Access to areas of the plant containing protected equipment are restricted, and the areas appropriately posted. These administrative controls provide assurance that work is performed on only one division at a time.

PNPP procedures also contain precautions to minimize risk associated with surveillance testing, maintenance activities, and degraded grid conditions when paralleling a DG with offsite power. For example, during testing, only one DG at a time is paralleled with offsite power. This configuration provides for sufficient independence of the onsite power sources from offsite power while still enabling testing that demonstrates DG operability. In this configuration and with the administrative controls for AC sources in place, it is only possible for one DG to be affected by an unstable offsite power system.

In summary, even if a Division 3 power source were adversely impacted while testing in the, proposed manner, the impact will be limited to Division 3 AC sources. Plant safe shutdown capability will continue to be ensured by protected Division 1 and 2 AC sources.

3.4 Online Risk Manaqement PNPP procedures provide requirements to conduct risk assessment for all maintenance activities by implementing the requirements of 10 CFR 50.65, "Requirements for monitoring the effectiveness of maintenance at nuclear power plants," Section (a)(4). As required, a probabilistic risk assessment (PRA) risk evaluation may use a tool or method that considers quantitative insights from the PRA to quantify the potential risk implications of planned or emergent work activities. This tool warns planning, scheduling and operations personnel that plant risk goals are being approached or would be exceeded if work was released for performance. These administrative controls minimize the potential to allow work on redundant equipment or components. The risk evaluation tool is a comprehensive modeling of important PNPP equipment and allows the site to evaluate the adverse effects of other maintenance activities and its impact on DG maintenance.

PNPP procedures currently require an evaluation of the unique plant configurations introduced by performing SR 3.8.1.8, SR 3.8.1.9, SR 3.8.1.10, SR 3.8.1.11, SR 3.8.1.12, SR 3.8.1.13, SR 3.8.1.16, SR 3.8.1.17 and SR 3.8.1.19 online. The PNPP probabilistic risk analysis model is

Page 8 of 22 used to evaluate the impact of these configurations prior to the performance of online maintenance (including surveillance testing) in accordance with 10 CFR 50.65(a)(4).

3.5 Online Testing versus Outage Testing Per the Note in the Applicability of TS 3.8.1, Division 3 AC sources are not required to be OPERABLE when the HPCS system is inoperable. TS 3.5.1, ECCS - Operating, provides a 14 day completion time for the HPCS system, when the RCIC system is OPERABLE. This 14 day allowance also permits maintenance and testing of Division 3 AC sources, when the RCIC system is OPERABLE. The actual time needed to perform these SRs is approximately 90 hours0.00104 days 0.025 hours 1.488095e-4 weeks 3.4245e-5 months . Thus, the existing TS provide ample time for the online performance of the nine SRs in this proposed amendment. A comparison of the TS 3.5.1 operating (online) versus TS 3.5.2 shutdown requirements for ECCS, and the corresponding TS 3.8.1 operating (online) and TS 3.8.2 shutdown requirements for AC sources, indicates that the TS requirements are more restrictive during MODE 1, 2, or 3 than the requirements during MODE 4 or 5. In other words, the online specifications require more equipment to be available for event response. Thus, due to the redundancy and diversity of the ECCS, adequate accident mitigation equipment will be available if an event occurs while performing the subject surveillance testing during MODE 1, 2, or 3.

The HPCS system is a stand-alone system with a dedicated DG and electrically separated distribution system. As discussed in PNPP USAR Sections 6.3.1.1.3 and 8.3.1.4, this system is both physically and electrically separated from the other two safety-related divisions. All controls, wiring, and other components are separated to prevent common cause failures and cross-divisional damage due to external events such as fires, pipe ruptures and falling objects. The Division 3 DG supplies power to the HPCS pump motor and associated support equipment and auxiliaries. The Division 1 and Division 2 safety systems remain isolated from the power sources undergoing testing. Also, due to the minimal size of the loads associated with the HPCS system there is no credible potential for this testing to create a perturbation on the grid. Completed Division 3 test results have shown that bus voltage parameters stay within prescribed limits during and after such testing. Therefore, there is minimal opportunity for the performance of these SRs to have any impact on other safety-related plant equipment.

The HPCS system has a full flow suction line and a return line to both the suppression pool and the condensate storage tank (CST), and an automatically actuated minimum flow line to the suppression pool. These features allow testing of the system online without discharging into the reactor vessel, while providing protection of the pump from overheating. The HPCS system configuration is such that testing can be performed without impacting other divisional safety systems or the RCIC system. Additionally, as described in USAR Section 6.3.4.2.1, "HPCS Testing", the HPCS system can be tested at full flow with CST water during normal plant operation.

If an initiation signal occurs while testing the HPCS system, the system automatically returns from the test mode to the operating mode.

The proposed license amendment does not alter any of the TS-required DG surveillance test frequencies; thus, the total number of tests and associated transients would be unchanged by performing this testing online versus during shutdowns.

According to USAR Table 8.3-1, the maximum total Division 3 DG load for a simultaneous LOCA and LOOP is 2617.3 kW, with the largest load being the 2397 kW HPCS pump (approximately 91.6 percent of the total Division 3 DG load). Energizing or de-energizing a load of this size as part of DG surveillance testing online or during shutdown conditions creates minimal potential to cause a significant electrical distribution system perturbation. In fact, HPCS pump starts and stops are routinely performed online to satisfy quarterly inservice testing requirements without disturbing plant operations. In summary, starting and stopping the HPCS pump online is a routine evolution;

Page 9 of 22 therefore, there is no potential to create an electrical distribution system perturbation introduced by testing the HPCS system in the proposed manner.

The online performance of the subject SRs for the Division 3 DG will have little effect on managing the equipment unavailability goals described in 10 CFR 50.65(a)(3). The maintenance rule unavailability performance criterion for the Division 3 DG is set at 544.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for a 36-month rolling period. Based on this criterion, PNPP has established an administrative goal of 408.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months (75 percent of the criterion) of unavailability for the 36-month period. In summary, the use of a portion of the 408.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months to perform this online testing does not challenge achievement of the established performance criteria for the Division 3 DG.

3.6 Discussions for Individual Surveillance Requirements SR 3.8.1.8 For Division 3, SR 3.8.1.8 verifies manual transfer of unit power supply from the normal offsite circuit to the alternate offsite circuit.

This SR currently contains a Note that prohibits performance of this SR in MODE 1 or 2. The TS Bases state that the reason for this Note is that during operation with the reactor critical, performance of this SR could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, plant safety systems.

With the bus energized from the preferred offsite circuit, surveillance performance demonstrates that the bus is capable of manual transfer of unit power supply from the normal offsite circuit to the alternate offsite circuit. This surveillance places the alternate supply breaker in the test position and secures its cell switch contacts in place, and installs a jumper at the normal supply breaker to simulate an open condition. The synchronization selector switch is then aligned to the alternate supply bus. The manual transfer from the normal offsite circuit to the alternate offsite circuit is completed by closing the alternate supply breaker.. After visual confirmation is obtained via breaker position indicating lights, the synchronization selector switch is turned off, and the!

previously installed jumper is removed from the normal supply breaker.

This manual operation demonstrates the operability of the alternate circuit and has minimal impact on normal plant operation or the Division 3 diesel generator. The power system loading during this test is within the rating of all transformers, switchgear, and breakers, which thus are unaffected by the performance of this test.

The Division 3 electrical loads do not approach the electrical load rating of either the Division 3 normal or alternate electrical distribution system; therefore there is no impact to the electrical distribution system, and no credible mechanism for challenging continued steady state operation when performing this SR for Division 3. In addition, buses are manually transferred on a periodic basis during monthly testing of the DG.

Lastly, the HPCS system is a stand-alone system with a dedicated Division 3 DG electrical distribution system. The Division 3 DG supplies power to the HPCS pump motor and associated support equipment and auxiliaries. The Division 1 and Division 2 safety systems remain electrically isolated from the power sources undergoing testing. Performing SR 3.8.1.8 for Division 3, whether shutdown or online, affects only Division 3 equipment. Thus, due to the minimal size of the loads associated with the HPCS system and the manual transfer, there is no potential for this testing to create a perturbation on the grid.

Therefore, the reasons for the MODE restrictions stated in the TS Bases for SR 3.8.1.8 are not considered to be valid for the Division 3 testing.

Page 10 of 22 SR 3.8.1.9 For Division 3, SR 3.8.1.9 verifies the DG rejects a load greater than or equal to its associated single largest post-accident load. Following load rejection, engine speed is maintained less than nominal plus 75 percent of the difference between nominal speed and the overspeed trip setpoint, or 15 percent above nominal, whichever is less.

This SR currently contains two Notes. The first Note prohibits performance of this SR in MODE 1 or 2. Per the TS Bases, the reason for this Note is that during operation with the reactor critical, performance of this SR could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, plant safety systems. The second Note states that if synchronized to offsite power, testing shall be performed using a power factor less than or equal to 0.9. The second Note remains unaffected by the proposed license amendment.

After starting the Division 3 DG and paralleling it locally to the Division 3 emergency bus, it is loaded to a load greater than the single largest post-accident load associated with Division 3.

The Division 3 DG output breaker is then opened separating the Division 3 DG from its associated emergency bus and allowing the offsite circuit to continue to supply the bus. This evolution has minimal impact on plant loads. The power system loading during such testing is within the rating of all transformers, switchgear, and breakers, both before and after the load rejection, and as further explained below, performance of the load rejection SRs does not cause any significant perturbations to the electrical distribution systems as the Division 3 DG is separated from the bus.

During operation at PNPP, the emergency buses are connected to either the normal or alternate offsite circuit. This is the same configuration maintained during plant shutdown when the load reject testing has been conducted. The probability for a grid disturbance to occur during the timeframe of a test performed per SR 3.8.1.9 is low, and the occurrence of a grid disturbance is considered independent of the testing. In addition, the degraded voltage and loss of voltage instrumentation required by TS 3.3.8.1, "Loss of Power (LOP) Instrumentation," would be available to respond to such a grid disturbance.

Historical bus voltage data from performing this SR for Division 3 DG has shown that the voltage during the transient remains within the required voltage range for plant loads. Thus, the voltage transient experienced by loads on the affected bus is minimal.

Therefore, the reasons for the MODE restrictions stated in the TS Bases for SR 3.8.1.8 are not considered to be valid for the Division 3 testing.

SR 3.8.1.10 For Division 3, SR 3.8.1.10 verifies the diesel generator (operating at a power factor < 0.9) does not trip and voltage is maintained 5 5000 volts (V) during and following a load rejection of a load > 2600 kilowatts (kW).

This SR currently contains a Note that prohibits performance of this SR in MODE 1 or 2. Per the TS Bases, the reason for this Note is that during operation with the reactor critical, performance of this SR could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, plant safety systems.

After starting the Division 3 DG and paralleling it locally to the Division 3 emergency bus, it is loaded to 2600 kW and 1300 kilovars (kVars) with a 0.9 power factor. The Division 3 DG output breaker is opened separating the Division 3 DG from its associated emergency bus allowing the offsite circuit to continue to supply the bus. This evolution has little impact on plant loads. The power system loading during such testing is within the rating of all transformers, switchgear, and

Page 11 of 22 breakers, both before and after the load rejection. Performance of the load rejection SRs does not cause any significant perturbations to the electrical distribution systems as the Division 3 DG is separated from the bus, as further explained below.

During operation at PNPP, the emergency buses are tied to either the normal or alternate offsite circuit. This is the same configuration maintained during plant shutdown when the load reject testing has been conducted. The probability for a grid disturbance to occur during the timeframe of a test performed per SR 3.8.1.10 is low, and the occurrence of a grid disturbance is independent of the testing. Regardless, protective relaying for the diesel generator would be available to protect the diesel generator while it is connected to the grid. In addition, the protection instrumentation (required to be OPERABLE per TS 3.3.8.1, "Loss of Power (LOP) Instrumentation") for sustained grid low-voltage conditions would be available to respond to such a condition.

Historical bus voltage data from performing this SR for Division 3 DG has shown that the voltage during the transient remains within the required voltage range for plant loads. Thus, the voltage transient experienced by loads on the affected bus is minimal.

Therefore, the reasons for the MODE restrictions stated in the TS Bases for SR 3.8.1 .10 are not considered to be valid for the Division 3 testing.

SR 3.8.1.11 For Division 3, SR 3.8.1.11 verifies that upon an actual or simulated loss of offsite power (LOOP) signal, the emergency bus is de-energized, and the diesel generator automatically starts from the standby condition and energizes permanently connected loads in < 13 seconds, achieves and maintains the required voltage and frequency, and supplies permanently connected loads*-

for > 5 minutes.

This SR currently contains a Note that prohibits performance of this SR in MODE 1, 2, or 3. The TS Bases state the reason for this Note is that performing this SR would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge plant safety systems.

With the Division 3 emergency bus energized from the normal (or alternate) offsite circuit, a LOOP is simulated by removing the control power fuses ahead of the undervoltage relays, causing the Division 3 emergency switchgear to de-energize, thereby isolating the Division 3 electrical subsystem from the other two safety-related electrical subsystems. The Division 3 DG starts, re-energizes. its associated emergency bus, and runs for at least 5 minutes.

First, although the offsite source of power to the Division 3 emergency bus is disconnected when performing this SR for Division 3, the period of time that this condition. exists is small and deemed acceptable since the HPCS system is already inoperable for performance .of the test (since the HPCS pump actually pumps water during this test, the flow path is aligned back to the condensate storage tank rather than to the reactor vessel, making the HPCS system inoperable). As discussed in the Note to the Applicability requirements of TS 3.8.1, the Division 3 AC electrical power system is not required to be OPERABLE when the HPCS system is inoperable.

Secondly, due to the relatively small size of the loads associated with the HPCS system and the Division 1 and Division 2 safety systems remaining isolated from the power sources undergoing testing, there is minimal potential when performing this SR for Division 3 to create an offsite power supply perturbation that could affect the Division 1 and 2 safety systems when the Division 3 emergency bus is de-energized.

Lastly, the Division 3 power system is an electrically separated distribution system with a dedicated diesel generator. Therefore, there is minimal opportunity for this SR to have an impact on other safety-related plant equipment or normal plant operation. The simulated LOOP signal is generated

Page 12 of 22 at the Division 3 switchgear and does not affect the Division 1 and 2 electrical divisions or their associated loads.

Therefore, the reasons for the MODE restrictions stated in the TS Bases for SR 3.8.1.11 are not considered to be valid for the Division 3 testing.

SR 3.8.1.12 For Division 3, SR 3.8.1.12 verifies that upon an actual or simulated emergency core cooling system (ECCS) initiation signal, the diesel generator automatically starts from the standby condition and achieves the required voltage and frequency in < 13 seconds, and operates for > 5 minutes.

This SR currently contains a Note that prohibits performance of this SR in MODE 1 or 2. The TS Bases state the reason for this Note is that performing this surveillance could cause perturbations to the electrical distribution system that could challenge continued steady state operation and, as a result, plant safety systems.

This test is performed by inserting an ECCS initiation signal into the Division 3 control logic by closing a temporary test switch installed on the Division 3 auxiliary relay panel. With the ECCS initiation signal present, the Division 3 DG starts and runs unloaded with the generator output breaker open for > 5 minutes while acceptable performance parameters (voltage and frequency) are verified.

First, since this test is conducted with the Division 3 DG unloaded and isolated from its emergency bus, there is no impact to the electrical distribution system, and no mechanism for challenging continued steady state operation. Lastly, the Division 3 power system is an electrically separated distribution system with a dedicated DG. Therefore, there is minimal opportunity for the performance.of this SR for the Division 3 DG to have any impact on other safety-related plant equipment or normal plant operation. When performing this SR for Division 3, the simulated ECCS initiation signal is generated only in the Division 3 logic and does not affect the Division 1 and 2 safety-related electrical divisions or their associated loads.

Therefore, the reasons for the MODE restrictions stated in the TS Bases for SR 3.8.1.12 are not considered to be valid for the Division 3 testing.

SR 3.8.1.13 For Division 3, SR 3.8.1.13 verifies the diesel generator's automatic trips are bypassed on an actual or simulated ECCS initiation signal, except for the engine overspeed and generator differential current trips, as described in USAR Section 8.3.1.1.3.3.

This SR currently contains a Note that prohibits performance in MODE 11 2 or 3. The TS Bases state the reason for this Note is that performing the surveillance could cause perturbations to the electrical distribution system that could challenge continued steady state operation and, as a result, plant safety systems.

Portions of this SR are performed with the Division 3 DG output breaker open in the test position, separating the Division 3 DG from its associated emergency bus and allowing the offsite circuit to continue to supply the bus. The associated output breaker cell switch contacts are secured in place to simulate the breaker in a connected position. The Division 3 DG is started remotely.

Simulated paralleling of the running Division 3 DG to its associated emergency bus is performed by using the synchronization selector switch and the closure of the Division 3 DG output breaker.

While the Division 3 DG output breaker is closed and isolated from its associated emergency bus, it is confirmed that the reverse power and instantaneous overcurrent trips are bypassed and that

Page 13 of 22 both an engine overspeed and a generator differential current condition will trip the Division 3 DG (are not bypassed) on a simulated ECCS initiation signal. Installed jumper and signal simulation required to perform this SR are completed at the relay level in the DG control circuitry such that only the associated DG is affected during this SR. The remainder of the testing for this SR is completed with the output breaker reconnected, but tripped open. With a Division 3 LOCA signal inserted, it is confirmed that the jacket water temperature high and lube oil pressure low trips are bypassed (the DG does not trip).

Thus, performance of testing required per SR 3.8.1.13 to verify that non-emergency automatic trips are bypassed and that emergency automatic trips will trip the Division 3 DG in an emergency, while at power, is justified on the basis that:

(1) this SR is not performed with the Division 3 DG paralleled to offsite power, and (2) unavailability of the Division 3 DG during the conduct of this test is minimal.

First, since this test is conducted with the Division 3 DG unloaded and isolated from its emergency bus when performing this SR for Division 3, there is no impact to the electrical distribution system, and no mechanism exists for challenging continued steady state operation.

Lastly, the Division 3 power system is an electrically separated distribution system with a dedicated diesel generator. Therefore, there is minimal opportunity during the performance of this SR for the Division 3 DG to have any impact on other safety-related plant equipment or normal plant operation. When performing this SR for Division 3, whether shutdown or online, the simulated ECCS initiation signal is generated only in the Division 3 logic and does not affect the other two safety-related electrical divisions or their associated loads.

Therefore, the reasons for the MODE restrictions stated in the TS Bases for SR 3.8.1.13 are not considered to be valid for the Division 3 testing.

SR 3.8.1.16 - -

For Division 3, SR 3.8.1.16 verifies that upon a simulated restoration of offsite power, the diesel generator can be synchronized with an offsite power source while loaded with emergency loads, transfers loads to offsite, power, and the diesel generator returns to ready-to-load operation.

This SR currently contains a Note-that prohibits performance of this SR in MODE 1, 2, or 3. The TS Bases state the reason for this Note is that performing the surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge plant safety systems.

This Division 3 SR is performed following completion of the LOOP test of SR 3.8.1 .11. After the Division 3 DG has started and re-energized its emergency bus, the DG is run for at least 5 minutes with the HPCS and emergency service water (ESW) pumps running. HPCS is aligned in the test mode with the HPCS pump suction from the condensate storage tank (CST), and pump discharge through the test return line back to the CST. Thus, actual discharge of water into the reactor vessel by the HPCS system is prevented during this test. The Division 3 emergency bus is then paralleled to offsite power and the bus loads are transferred to the offsite power source. After the DG output breaker is opened, the DG is verified to return to ready-to-load operation.

First, one of the offsite sources of power to the Division 3 emergency bus is disconnected at the beginning of this test when performing this SR for Division 3; however, the period of time that this condition exists is small and is deemed acceptable since the HPCS system is already declared inoperable for performance of the test (since it is aligned to return flow to the CST). Therefore, the Division 3 AC sources are not required to be OPERABLE as discussed in the Note associated with the Applicability requirements of TS 3.8.1.

Page 14 of 22 Secondly, completed test results performed during shutdown conditions have shown that the required bus voltage parameters remain within expected limits and no anomalous actions regarding load transfer sequences occur. Conducting this test for Division 3 online is not expected to be more challenging to plant safety systems than performance during shutdown conditions.

Additionally, as discussed in Section 3.5, due to the relatively small size of the loads associated with the HPCS system there is minimal potential for creating an offsite power supply perturbation when shifting the load between the Division 3 DG and the offsite power source.

Lastly, the HPCS system is a stand-alone system with a dedicated DG and electrically separated distribution system. The HPCS system has a full flow suction line and a return line to both the suppression pool and the condensate storage tank, and an automatically actuated minimum flow line to the suppression pool. These features allow testing of the system online without discharging into the reactor vessel, while providing protection of the pump from overheating. Additionally, system configuration is such that HPCS system testing can be performed without impacting other divisional safety systems or the RCIC system. Energizing or de-energizing loads of this size as part of surveillance testing online or during shutdown conditions creates minimal potential to cause an electrical distribution system perturbation. HPCS pump starts and stops are periodically performed online to satisfy quarterly inservice testing requirements without disturbing plant operations. As such, there is minimal opportunity for the performance of this SR for the Division 3 DG to have an impact on other safety-related plant equipment or normal plant operations.

Therefore, the reasons for the MODE restrictions stated in the TS Bases forSR 3.8.1.16 are not considered to be valid for the Division 3 testing.

SR 3.8.1.17 For Division 3, SR 3.8.1.17 verifies that with the DG operating in test mode and connected to its bus, an actual or simulated ECCS initiation signal overrides the test mode by returning the DG to ready-to-load operation and automatically energizing the emergency loads from offsite power.

This SR currently contains a Note that prohibits performance of this SR in MODE 1, 2 or 3. The TS Bases state the reason for this Note is that performing the surveillance would remove-a, required offsite circuit from service, perturb the electrical distribution system and challenge safety systems.

The performance of the test mode override test ensures that the availability of the Division 3 DG under accident conditions is unaffected when the DG is in test mode.. This test is performed with the DG paralleled with the offsite source and by simulating an ECCS signal to the DG start circuitry causing the DG output breaker to open, and the DG returning to a ready-to-load condition. Similar to the tests performed for SRs 3.8.1.9 and 3.8.1.10, opening the DG output breaker separates the DG from its associated emergency bus and allows the offsite circuit to continue to supply the bus.

Performance of this test does not cause any significant perturbations to the electrical distribution systems as the DG is separated from the bus. In addition, similar to testing performed for SRs 3.8.1.9 and 3.8.1.10, the power system loading for this test is within the rating of the affected transformers, switchgear, and breakers, both before and after the load rejection.

As noted in the TS Bases for this SR, the intent of SR 3.8.1.17.b is to show that the emergency loading is not affected by DG operation in the test mode. Performance of testing required pursuant to this SR does not involve separating the bus from offsite power, so performance of this surveillance would not "remove an offsite circuit from service, perturb the electrical distribution system, and challenge safety systems," as currently stated in the TS Bases for this SR.

Therefore, the reasons for the MODE restrictions stated in the TS Bases for SR 3.8.1.17 are not considered to be valid for the Division 3 testing.

Page 15 of 22 SR 3.8.1.19 For Division 3, SR 3.8.1.19 verifies that upon an actual or simulated LOOP signal in conjunction with an actual or simulated ECCS initiation signal, the emergency bus is de-energized, the diesel generator automatically starts from the standby condition and energizes permanently connected and auto-connected loads in < 13 seconds, achieves and maintains the required voltage and frequency, and supplies permanently connected and auto-connected loads for > 5 minutes.

This SR currently contains a Note that prohibits performance of this SR in MODE 1, 2, or 3. The TS Bases state the reason for the Note is that performing the surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge plant safety systems.

For Division 3, this test is performed with Division 3 emergency bus aligned to either the preferred or alternate preferred offsite circuit. A LOOP signal is simulated by tripping open either the preferred source breaker or alternate preferred source breaker carrying load to the Division 3 emergency bus (simulating bus undervoltage) while simultaneously inserting an ECCS initiation signal into the Division 3 control logic by arming and depressing the HPCS manual initiation pushbutton. The Division 3 DG starts, re-energizes its associated emergency bus, and powers the HPCS pump and other permanently connected loads. For this test, the HPCS pump suction is from the suppression pool, and pump discharge is through the minimum flow line back to the suppression pool. The HPCS system discharge pathway to the reactor vessel is isolated.

Actual discharge of water into the reactor vessel by the HPCS system is prevented during the current performance of this test during shutdown conditions in order to preclude undesirable effects on reactorvessel water level. Discharge into the reactor vessel would likewise be prevented when performing this test online to preclude undesirable effects on reactor vessel water level and core reactivity. The current method of preventing HPCS system discharge into the reactor vessel is by shutting HPCS manual isolation valve [1 E22-F036]. However, since the manual isolation valve is in the Drywell and inaccessible during operation at power, the prevention of HPCS system discharge into the reactor vessel could be accomplished by other means such as verifying that the motor-operated injection valve is closed and de-energized by placing its breaker for the valve motor in the OFF position. Following the test, restoration of all safety related functions, including restoration of the HPCS system to OPERABLE status, are independently verified.

Although the offsite source of power to the Division 3 emergency bus is disconnected when performing this SR for Division 3, the period of time that this condition exists is small and deemed acceptable. The HPCS system is already inoperable for performance of the test; therefore, the Division 3 AC sources are not required to be OPERABLE as discussed in the Note associated with the Applicability requirements for TS 3.8.1.

Due to the relatively small size of the loads associated with the HPCS system (2397 kW), there is minimal potential for this testing to create an offsite power supply perturbation when the Division 3 electrical bus, is de-energized.

As previously discussed, the HPCS system is a stand-alone system with a dedicated DG and electrically separated distribution system. The HPCS system has a full flow suction line and a return line to both the suppression pool and the condensate storage tank, and an automatically actuated minimum flow line to the suppression pool. These features allow testing of the system online without discharging into the reactor vessel, while providing protection of the pump from overheating. Additionally, system configuration is such that HPCS system testing can be performed without impacting other divisional safety systems or the RCIC system. Energizing or de-energizing loads of this size as part of surveillance testing online or during shutdown conditions creates minimal potential to cause an electrical distribution system perturbation. In fact, HPCS

Page 16 of 22 pump starts and stops are routinely performed online to satisfy quarterly inservice testing requirements, without disturbing plant operations. The simulated LOOP and ECCS initiation signals associated with this SR for Division 3 affect only Division 3 and do not affect the other two safety-related electrical divisions.

Based on the above discussion and plant experience related to performing this test, conducting this test online for the Division 3 DG would be no more challenging than conducting the test while shutdown; therefore, the reasons for the MODE restrictions stated in the TS Bases for SR 3.8.1.19 are not considered to be valid for the Division 3 testing.

3.7. Probabilistic Risk Assessment (PRA)

Assessment of Unavailability Regulatory Guide (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 2, May 2001, was used to assess the acceptability of the proposed amendment. Based on the guidance within RG 1.174, Section 2.4, an increase or change in core damage frequency (CDF) less than 1 E-6 per reactor year is considered to be very small. Additionally, an increase or change in large early release frequency (LERF) less than 1 E-7 per reactor year is also considered very small.

As discussed, FENOC has determined that performing the Division 3 surveillance testing online would not affect the offsite electrical distribution capabilities of the plant or any other function related to accident mitigation; the only potential impact to the plant would be from a small increase in unavailability of Division 3 resulting from the testing activity itself. From a probabilistic risk assessment (PRA) perspective, Division 3 capabilities were conservatively modeled as unavailable to respond in any mitigative capacity during performance of the surveillances that are the subject of this request for licensing action, when they are performed online. In the PRA model, the increase in average CDF was calculated based on a 72-hour (3-day) unavailability period per year, which bounds the expected duration of 90 hours0.00104 days 0.025 hours 1.488095e-4 weeks 3.4245e-5 months per operating cycle (2 years) for this testing.

The baseline CDF for PNPP is 4.29E-6 per reactor year. Adjusting the Division 3 [high pressure core spray system, Division 3 diesel generator, and Division 3 emergency service water system (ESW)] capabilities to unavailable in the baseline model provides a corresponding CDF of 1.22E-5 per reactor year. Factoring in the allowed 3-day per year increased unavailability results in:

CDFnew= CDFo * (T0/365) + CDF 1 * (T11365)

= 4.29E-6/year * (362/365) + 1.22E-5 * (3/365)

= 4.26E-6/year + 1.OE-7/year

= 4.36E-6/yr Where CDFo = baseline CDF CDF 1 = CDF when HPCS, Division 3 DG, and Division 3 ESW are unavailable To = Time when CDFo is appropriate T, = Time when the increased CDF, is appropriate and Change in CDF = 4.36E-6/year - 4.29E-6/year

= 7E-8/year This increase in CDF is less than the 1E-6/year threshold considered to be a "very small change" in CDF by RG 1.174, Section 2.4. Since LERF is typically an order of magnitude below CDF, it would

Page 17 of 22 also be expected to be below the 1 E-7/year threshold considered to be a "very small change" in CDF by RG 1.174, Section 2.4. As such, the change is considered acceptable.

A sensitivity analysis was also performed to increase the Division 3 unavailable period from three days to seven days. This analysis produced an increase in CDF of 1.5E-7/year, an increase which remains below the RG 1.174 acceptance threshold.

Comparison of the results of this PRA assessment with other assessments on the same topic [the NRC staff approved similar Grand Gulf and River Bend requests as listed in Section 4.3, below]

revealed similar conclusions relative to overall significance of performing the surveillances online.

The above assessment is provided to quantify the potential impact of this online testing; however, because the total amount of time the HPCS system and its DG support system can be unavailable is limited by the PNPP Maintenance Rule Program, the allowance to perform this testing online will not significantly increase the total number of unavailable hours, as discussed in Section 3.5.

PRA Quality - ASME PRA.Standard Evaluation An independent peer review of PNPP's PRA model was performed in 1997 under the auspices of the BWR Owner's Group (BWROG) PSA Peer Review Certification process. Multiple internal self assessments, including a 2008 self-assessment utilizing an independent contractor (Scientech),

have also been performed. During the 2008 review, ASME RA-Sb-2005, "Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications," December 2005, was used as the standard for the review.

Following a February 2011 update to PNPP's average-maintenance model that included the incorporation of the 2008 review findings, the model is judged to meet Capability Category 11for all supporting requirements regarding Level 1 internal events only, and is also judged to be compliant with Regulatory Guide 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 1, January 2007, with the exception of internal flooding. Additionally, the latest model update met the supporting requirements of the PRA Standard, ASME/ANS RA-Sa-2009, "Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications," February 2009, for Level 1 internal events, minus internal flooding, and large early release frequency.,

Following the 1997 PSA Peer Review Certification Process, the PRA model used in this assessment incorporated changes to address issues identified during the 2008 review, and to meet current requirements of the PRA Standard. The changes did not utilize any new methodologies, so they do not meet the criteria for a PRA model upgrade as defined. in the PRA Standard.. Therefore, these changes are considered PRA model updates, which do not require a peer review.

The model used in this assessment does not address LERF, internal flood, fire, seismic, or external events.

3.8 Surveillance Testing Historical Results As presented in the historical results table provided as Attachment 4, Division 3 AC sources surveillance testing has been completed satisfactorily with only two noted occurrences requiring test reperformance (failure of undervoltage relaying, grid voltage out of range high). In those instances, the issues were entered into the corrective action program, promptly corrected, and the testing completed satisfactorily. There were no documented instances of electrical perturbations occurring either during or after the testing, or created by the surveillance testing itself.

3.9 Removal of Provision for Delayed Access Circuit**

The proposed amendment also includes the removal of temporary TS 3.8.1 provisions related to the delayed access circuit, which were added in Amendment 160. As stated in TS 3.8.1, the

Page 18 of 22 delayed access circuit may be used in place of the circuit associated with the Unit 1 startup transformer until December 12, 2011. The temporary provisions, added in October 2011, have expired and are no longer applicable. Removal of the provisions does not affect the proposed removal of MODE restrictions associated with certain Division 3 surveillance requirements. As a result, a technical evaluation regarding the removal of the expired provisions is not required.

4.0 REGULATORY EVALUATION

The proposed amendment would modify Technical Specification (TS) 3.8.1, "AC Sources -

Operating," to remove MODE restrictions on certain Perry Nuclear Power Plant Division 3.AC sources surveillance requirements. The proposed amendment affects the following surveillance

.requirements (SRs): 3.8.1.8, 3.8.1.9, 3.8.1.10, 3.8.1.11, 3.8.1.12, 3.8.1.13, 3.8.1.16, 3.8.1.17 and 3.8.1.19. Currently, certain TS surveillance requirements restrict performance of the tests in MODE 1 and 2 or 3. With the proposed changes, certain Division 3 AC sources surveillance testing would be allowed in any MODE of operation. Removing the MODE restrictions is predicated on:

e AC power system design and associated protection features 0 Administrative controls in place during testing

Historically satisfactory test results

Low probability of a significant electrical perturbation during testing

Effect on plant operation and safety is not significantly different than when performing other Division 3 surveillance tests that do not have similar MODE restrictions The proposed amendment also removes temporary TS 3.8.1 provisions related to the delayed access circuit. As stated in TS 3.8.1, the delayed access circuit was permitted to be used in place of the circuit associated with the Unit 1 startup transformer until December 12, 2011 and is no longer applicable.

The proposed amendment does not involve a design modification or physical change to the plant, and does not change methods of plant operation or maintenance of equipment important to safety.

4.1 No Siqnificant Hazards Consideration Analysis FirstEnergy Nuclear Operating Company (FENOC) has evaluated whether or not a significant hazards consideration is involved with the proposed amendment by focusing on the three standards set forth in 10 CFR 50.92, Issuance of amendment," as discussed below:

1. Does the proposed amendment involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No This amendment request proposes to remove MODE restrictions on certain Division 3 AC sources surveillance tests, allowing testing in any MODE of operation. The Division 3 AC sources, including the diesel generator (DG) and its associated emergency loads are accident mitigating features, not accident initiators. This proposed amendment does not change the design function of the Division 3 AC sources, including the DG or any of its required loads, and does not change the way the systems and plant are operated or maintained. This proposed amendment does not impact any plant systems that are accident initiators and does not adversely impact any accident mitigating systems.

The proposed amendment does not affect the operability requirements for the AC sources, as verification of such operability will continue to be performed as required. Continued verification of

Page 19 of 22 operability supports the capability of the Division 3 AC sources to perform their required design functions of providing emergency power to high pressure core spray (HPCS) system equipment, consistent with the plant safety analyses. Limiting testing to only one AC source at a time also ensures that design basis requirements are met. Should a fault occur while testing the Division 3 AC sources, there would be no significant impact on any accident consequences since Division 1 and 2 AC sources and their respective emergency loads would be available to provide the safety functions necessary to shut down the unit and maintain it in a safe shutdown condition.

Removing the MODE restrictions associated with certain Division 3 surveillance requirements, thus allowing testing to occur in any MODE of operation, will not significantly increase the probability of an accident previously evaluated because the Division 3 DG and its emergency loads are accident mitigation features, not accident initiators.

Removing the MODE restrictions associated with certain Division 3 surveillance requirements, thus allowing testing to occur in any MODE of operation, will not change any of the dose analyses associated with the USAR Chapter 15 accidents because accident mitigation functions and requirements remain unchanged.

This amendment request also proposes to remove temporary TS 3.8.1 provisions related to use of the delayed access circuit. Effective October 17, 2011, the temporary provisions supported plant startup and normal operation until the Unit 1 startup transformer was returned to service. The provisions expired on December 12, 2011, after the Unit 1 startup transformer was returnedto service. Removing the provisions will not increase the probability of an accident previously evaluated since the provisions are no longer required or applicable. Removing the provisions will not change any of the dose analyses associated with the USAR Chapter 15 accidents because accident mitigation functions and requirements remain unchanged as a result of the removal.

Removing the expired provisions does not affect or alter any other aspect of this amendment request.

Therefore, the proposed amendment does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed amendment create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No This amendment request proposes to remove the MODE restrictions associated with certain Division 3 AC sources surveillance requirements. This proposed amendment does not change the design function of the Division 3 AC sources or any required loads, and does not change the way the systems and plant are operated or maintained. This proposed amendment does not impact any plant systems that are accident initiators and does not adversely impact any accident mitigating systems. Performance of these surveillances tests in any operating MODE will continue to verify operability of the Division 3 AC sources.

This amendment request also proposes to remove temporary TS 3.8.1 provisions related to the use of the delayed access circuit. Effective October 17, 2011, the temporary provisions supported plant startup and normal operation until the Unit 1 startup transformer was returned to service. The provisions expired on December 12, 2011, after the Unit 1 startup transformer was returned to service. Removing the provisions will not increase the probability of an accident previously evaluated since the provisions are no longer required or applicable. Removing the expired provisions does not affect or alter any other aspect of this amendment request.

Therefore, the proposed amendment does not create the possibility of a new or different kind of accident from any accident previously evaluated.

Page 20 of 22

3. Does the proposed amendment involve a significant reduction in a margin of safety?

Response: No.

This amendment request proposes to remove the MODE restrictions associated with certain Division 3 diesel generator surveillance requirements. Margin of safety is related to the ability of the fission product barriers (fuel cladding, reactor coolant system, and primary containment) to perform their design functions during and following postulated accidents. This proposed amendment does not involve or affect fuel cladding, the reactor coolant system, or the primary containment. Performing Division 3 surveillance testing online increases the Division 3 DG and HPCS system availability during refueling outages and allows the testing to be conducted when both Division 1 and 2 systems are required to be OPERABLE, not significantly different than when performing other Division 3 surveillance tests that do not have similar MODE restrictions.

This amendment request also proposes to remove temporary TS 3.8.1 provisions related to the use of the delayed access circuit. Effective October 17, 2011, the temporary provisions supported plant startup and normal operation until the Unit 1 startup transformer was returned to service. The provisions expired on December 12, 2011, after the Unit 1 startup transformer was returned to service. The provisions are no longer required or applicable. When they were effective, the provisions did not involve or affect fuel cladding, the reactor coolant system, or the primary containment. Removing the provisions does not involve or affect fuel cladding, the reactor coolant system, or the primary containment. The proposed amendment does not involve a physical change to the plant, methods of plant operation, or maintenance of equipment important to safety.

Therefore, the proposed amendment does not involve a significant reduction in a margin of safety.

Based on the above, FENOC concludes that the proposed amendment does not involve a significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and, accordingly, a finding of "no significant hazards consideration" is justified.

4.2 Applicable Regulatory Requirements/Criteria The proposed amendment has been evaluated against general design criteria (GDC), the standard review plan (SRP), and branch technical position (BTP) documents to determine whether applicable regulations and requirements would continue to be met. Specifically:

GDC 17, Electrical Power Systems

GDC 18, Inspection and Testing of Electrical Power Systems

SRP 8.1, Electric Power- Introduction

SRP 8.3.1, AC Power Systems (Onsite)

BTP 7-17, Guidance on Self-Test and Surveillance Test Provisions

BTP PSB-2, Criteria for Alarms and Indications Associated With Diesel-Generator Unit Bypassed and Inoperable Status FENOC has determined that the proposed amendment maintains conformance with the criterion and requirements described in the above cited documents and in PNPP's updated safety analysis report (USAR).

4.3 Precedent The Nuclear Regulatory Commission has issued similar license amendments that remove the operating mode restrictions associated with performing Division 3 AC sources surveillance testing.

Comparing the precedent (cited below) to FENOC's submittal revealed the following differences:

Page 21 of 22

" Clinton Power Station submitted two separate amendment requests to modify nine total surveillance requirements (SRs); specifically: five SRs in 2000, four SRs in 2010.

" Nine Mile Point Nuclear Station, Unit 2, submitted one amendment request in 2001 to modify eight total surveillance requirements (Nine Mile Point Nuclear Station, Unit 2, does not have an SR similar to PNPP's SR 3.8.1.8).

Columbia Generating Station submitted two separate amendment requests to modify eight total surveillance requirements; specifically: four SRs in 2001, four SRs in 2006 (Columbia Generating Station did not request a change to SR 3.8.1.8).

River Bend Station submitted one amendment request in 2003 to modify nine total surveillance requirements.

Grand Gulf Nuclear Station submitted two separate amendment requests to modify eight total surveillance requirements; specifically: four SRs in 2001, four SRs in 2002 (Grand Gulf Nuclear Station did not request a change to SR 3.8.1.8).

The noted differences are not substantive in nature; the differences are primarily how many SR modifications were requested at a time and when they were requested. Format, content, and bases for removing the MODE restrictions for Division 3 AC sources within FENOC's submittal is similar to that within the 2010 Clinton Power Station and other utility submittals.

Nuclear Regulatory Commission letter to Exelon Generation Company, LLC,

Subject:

Clinton Power Station, Unit No. 1 - Issuance of Amendment No. 197 re: Request for the Removal of Operating Mode Restrictions for Performing High Pressure Core Spray Emergency Diesel Generator Surveillance Testing (TAC No. ME4949), October 17, 2011.

Nuclear Regulatory Commission letter to Nine Mile Point Nuclear Station, LLC,

Subject:

Nine Mile Point Nuclear Station, Unit No. 2 - Issuance of Amendment Regarding Removal of Operating Mode Restrictions for Performing High Pressure Core Spray Emergency Diesel Generator Surveillance Testing (TAC No. ME1042), March 18, 2010.

Nuclear Regulatory Commission letter to Energy Northwest,

Subject:

Columbia Generating Station - Issuance of Amendment re: Removal of Operating Mode Restrictions for Performing Emergency Diesel Generator Surveillance Testing (TAC No. MD2113), March 23, 2007.

Nuclear Regulatory Commission letter to Entergy Operations, Inc.,

Subject:

River Bend Station, Unit 1 - Issuance of Amendment re: Removal of Operating Mode Restrictions for Performing Emergency Diesel Generator Testing (TAC No. MB5093), March 14, 2003.

Nuclear Regulatory Commission letter to Entergy Operations, Inc.,

Subject:

Grand Gulf Nuclear Station, Issuance-of Amendment re: Removal of Operating Mode Restrictions for Performing Emergency Diesel Generator Testing (TAC No. MB3487), September 5, 2002.

Nuclear Regulatory Commission letter to Entergy Operations, Inc.,

Subject:

Grand Gulf Nuclear Station, Issuance of Amendment re: Removal of Operating Mode Restrictions for Performing High Pressure Core Spray Emergency Diesel Generator Testing (TAC No. MB4261),

September 10, 2002.

Nuclear Regulatory Commission letter to Energy Northwest,

Subject:

Columbia Generating Station - Issuance of Amendment re: Technical Specification Change to Remove Operating Mode Restrictions for Performing Emergency Diesel Generator Surveillance Testing (TAC No. MB1 259),

May 18, 2001.

Nuclear Regulatory Commission letter to Clinton Power Station,

Subject:

Clinton Power Station, Unit No. 1 - Issuance of Amendment (TAC No. MA9269), October 2, 2000.

Page 22 of 22 4.4 Conclusions In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

5.0 ENVIRONMENTAL CONSIDERATION

A review has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement. However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or a significant increase in the amounts of any effluent that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

Attachment 1 PROPOSED TECHNICAL SPECIFICATION CHANGES (MARK-UP)

(15 Pages Follow)

AC Sources-Operating 3.8.1 REMOVE

ADMINISTRATIVE CHANGE*

3.8 ELECTRICAL POWER SYSTEMS Provision for delayed access circuit expired on December 12, 2011.

3.8.1 AC Sources-Operating LCO 3.8.1 The following AC electrical po r sources shall be OPERABLE:

a. Two qualified circuits be een the offsite transmission network and the onsite Cl ss 1E AC Electric Power Distribution System; and

b. Three diesel generators s).*

Until December 12, 2011, a delayed AcceSS circuit may% be usedin place, -ofth crcit associated wi"h!th te UnitI 1 APPLICABILITY: MODES 1, 2, and 3.

-NOTE --------------------

Division 3 AC electrical power sources are-not required to be OPERABLE when High Pressure Core Spray System is inoperable.

ACTIONS NOTE- --------------------------

S-------------------

LCO 3.0.4.b is'not applicable to DGs.

CONDITION REQUIRED ACTION COMPLETION TIME A. One required offsite A.1 Perform SR 3.8.1.1 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months circuit inoperable. for.OPERABLE required offsite circuit. AND Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter AND (continued)

PERRY - UNIT 1 3.8-1 Amendment No.

AC Sources-Operating 3.8.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. (continued) A.2 Restore required 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months offsite circuit to OPERABLE status. AND 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months from discovery of two divisions REMOVE with no offsite

ADMINISTRATIVE. CHANGE* power Provision for delayed access circuit expired on December 12, 2011. AND 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months from disi cver

that onl*

.nd.may..e ued .n n18GP 9f the.

assocpiated Unit 1 AND

17. days from discovery of failure to meet LCO B. One required DG B.1 Perform SR 3.8.1'.1 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months inoperable, for OPERABLE required offsite circuit(s). AND Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter AND B.2 Declare required 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from feature(s), supported discovery of by the inoperable DG, Condition B inoperable when the concurrent with redundant requi red inoperability.

feature(s) are of redundant inoperable. required feature(s)

AND (continued)

PERRY - UNIT 1 3.8-2 Amendment No.

NO CHANGE to this page; page provided for context only. AC Sources--Operating 3.8.1 ACTIK?

CONDITION REQUIRED ACTION COMPLETION TIME B.3.1 Determine OPERABLE 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months B. (continued) DG(s) are not inoperable due to common cause failure.

OR B.3.2 Perform SR 3.8.1.2 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for OPERABLE DG(s).

B.4 Restore required DG 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months from to OPERABLE' status. discovery of an inoperable Division:3 DG AND 14 days 17 days from discovery of failure to meet LCO C. Two required offs-ite CA Declare required 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months from ci rcui ts. i norperabl e. Tfeature(s) inoperable .:dlscovery of:

when the redundant Condition C.

required feature(s) concurrent with are inoperable. i noperabi li.ty of redundant' requi red feature(s)

AND C.2 Restore one required 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months offsite circuit to OPERABLE status..

(continued)

PEFRY - LNIT 1 3.8-3 PEJ~YLHIT13.8-3Amndwti No99

NO CHANGE to this page; page provided for context only.

AC Sources-Operating 3.8.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME D. One required offsite ----------- NOTE---------

circuit inoperable. Enter applicable Conditions and Required Actions of LCO 3.8.7, "Distribution Systems-Operating," when any One required DG required division is de-inoperable. energized as a result of Condition D.

D.1 Restore required 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months offsite circuit to OPERABLE status.

D.2 Restore required DG 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to OPERABLE status.

E. Two required DGs E.A Restore one required 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months inoperable. D6 to OPERABLE status.

24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months if Division 3 DG is inoperable F. Required Action and F.! Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time of Condition A,

., C, D, or E rot met.

F.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months G. Three or more required G.1 Enter LCO 3.0.3. Imediately AC sources inoperable.

PERRY - UNIT I 3.8-4 Amendment No. 69

NO CHANGE to this page; page provided for context only.

AC Sources-Operating 3.8.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.1.1 Verify correct breaker alignment and 7 days indicated power availability for each required offsite circuit.

SR 3.8.1.2 --------------- NOTES --------------------

1. Performance of SR 3.8.1.7 satisfies this SR.

2. All DG starts may be preceded by an engine prelube period and followed by a warmup period prior to loading.

3.' A modified DG start involving idling and gradual acceleration to synchronous speed may be used for this SR as recommended by the manufacturer.

Verify each DG starts from standby 31 days conditions and achieves:

Steady state voltage > 3900 V and

4400 V I and frequency Ž58.8 Hz and : 61.2 Hz.

(continued)

PERRY - UNIT 1 3.8-5 Amendment No. 142

NO CHANGE to this page; page provided for context only.

AC Sources -Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued) I.

SURVEILLANCE FREQUENCY I.

SR 3.8.1.3 ------------------- NOTES -------------------

1. DG loadings may include gradual loading as recommended by the manufacturer.

2. Momentary transients outside the load range do not invalidate this test.

3. This Surveillance shall be conducted on only one DG at a time.

4. This SR shall be preceded by. and immediately follow. without shutdown.

a successful performance of SR 3.8.1.2 or SR 3.8.1.7.,

Verify each DG operates for a 60 minutes at 131 days a load z 5600 kWand . 7000 kW for I

Division 1 and 2 DGs. and z .2600 kW for Division 3 DG.

SR 3.8.1.4 Verify each day tank contains z 316 gal of 31 days fuel oil for Divisions 1 and 2 and 2 279 gal for Division 3.

SR 3.8.1.5 Check for and remove accumulated water from 31 days each day tank..

SR 3.8.1.6 Verify the fuel oil transfer system 31 days operates to automatically transfer fuel oil from the storage tank to the day tank.

(continued)

PERRY - UNIT I 3.8-6 Amendment No. 92,

AC Sources-Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.7 ---------------- NOTE---------------

All DG starts may be preceded by an engine prelube period.

Verify each DG starts from standby 184 days conditions and achieves:

a. In 10 seconds for Division 1 and 2.

and

13 seconds for. Division 3.

voltage Ž 3900 V and. frequency 2 58.8 Hz: and

b. Steady state voltage'Ž 3900 V and

. 4400 V and frequency Ž 58.8 Hz and

61.2 Hz.

SR 3.8.1.8 -------------NOTE----.--------------

This MODE Surveillance I1or 2= (no al"al shall not to be Diiso performed 3.

in However, credit maye'taen Tor unplanne events that satisfy this SR.

Verify manual transfer of unit power supply 24 months from the normal.offsite circuit to the alternate offsite circuit.

(continued)

PERRY - UNIT 1 3.8-7 Amendment No.

AC Sources-Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.9 ----------------- NOTES --------------

1. This Surveillance shall not be performed in MODE 1 or 2 (not aetlicable credit may tobe Division taken tor 3un--nowever, unplanned I events that satisfy this SR.

2. If performed with DG synchronized with offsite power, it shall be performed at a power factor < 0.9.

Verify-each DG rejects a load greater than *24 months or equal to its associated single largest post-accident load. Following load rejection, engine speed is maintained less than nominal plus 7 of the difference between nominal speed and the overspeed trip setpoint, or 15% above nomi~nal.

whichever is less.

4.

SR 3.8.1.10 ----------------- NOTE ---------------

This Surveillance shall not be performed in.

MODE I or 2 (not aDoicable to' ivision 3).-

However. credit may be taken for unplanned

.II events that satisfy this SR.

Verify each DG operating at a power factor 24 months

0.9 does not trip and voltage is maintained : 4784 V for Division 1 and 2 DGs and

5000 V for Division 3 DG during.

and following a load rejection of a load

5600 kW for Division 1 and 2 DGs and

2600 kW for Division 3 DG.

(continued)

PERRY - UNIT 1 3.8-8 Amendment No.

AC Sources-Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.11 ---------------- NOTES -------------------

1. All DG starts may be preceded by an engine prelube period.

2. This Surveillance shall not be performed in MODE 1. 2. or 3 (not alicable to Division 3). However, credit may be taken for unplanned events that satisfy this SR.

Verify on an actual or simulated loss of 24 months offsite power signal:

a. De-energization of emergency buses;

b. Load shedding from emergency buses for Divisions 1 and 2: and

c. DG auto-starts from standby condition and:

1. energizes permanently connected loads in 10seconds for Division 1 and 2 DGs and

13 seconds for Division 3.

2. energizes auto-connected loads for Divisions 1 and 2.

3. maintains steady state'voltage

3900 V and - 4400 V.

4. maintains steady state frequency 58.8 Hz and < 61.2 Hz, and

5. supplies permanently connected and auto-connected loads for 5 minutes.

(continued)

PERRY - UNIT 1 3.8-9 Amendment No.

AC Sources-Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR. 3.8.1.12 ---------------- NOTES-------------------

1. All DG starts may be preceded by an engine prelube period.

2. This Surveillance shall not be performed in MODE 1 or 2 (not applicable to Division 3T. However, credit may be taken for unplanned events that satisfy this SR.

Verify on an actual or simulated. Emergency 24 months Core Cooling System (ECCS) initiation signal each DG auto-starts from standby condition and:

a. In

10 seconds for Division land 2.,

and

13 seconds for Division 3, after auto-start and'during tests, achieves voltage Ž 3900 V and frequency 58.8 Hz; and

b. Achieves steady state voltage Ž 3900 V and _ 4400 V and frequency

58.8 Hz and - 61.2 Hz; and

c. Operates forŽ 5 mi:nutes.

SR 3.8.1.13 -------------- NOTE ----------------------

This Surveillance shall not be performed in MODE 1, 2, or 3 (not applica le to Qivision 31, However, credit may-be taken for unplanned events that satisfy this SR.

Verify each DG's automatic trips are 24 months bypassed on an actual or simulated ECCS initiation signal except:

a. Engine overspeed: and.

b. Generator differential current (continued)

PERRY - UNIT 1 3.8-10 Amendment No.

NO CHANGE to this page; page provided for context only. AC Sources-Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.14 ------------------- NOTES -.-.-.-.--------

7-.

1. Momentary transients outside the load and power factor ranges do not inva idate this test.

2. Credit may be taken for unplanned events that satisfy this SR.

Verify each DG operating at a power factor 24 months I 0.9 operates for k 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months s:

a. For k 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months loaded 2 6800 kW and

, 7000 kW for Division I and 2 DGs.

and k 2860 kW for Division 3 DG; and

b. For the remaining hours of the test loaded k 5600 kW and g 7000 kW for Division 1 and 2 DGs. and Ž 2600 kW for Division.3 DG.

(continued)

PERRY - UNIT 1 3.8-11 Amendment No. 115

AC Sources-Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY-4 SR 3.8.1..15 ---------------

-- NOTES -------------------

1. This Surveillance shall be performed within 5 minutes of shutting down the DG after the DG has operated Ž 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months loaded Ž 5600 kW and - 7000 kW.for Division I and 2 DGs, and Ž 2600 kW for Division 3 DG.

Momentary transients outside of the load range do not invalidate this test.

2. All DG starts may be preceded by an engine prelube period.

Verify each DG starts and achieves: 24 months

a. In

10 seconds for Division 1 and 2.

and - 13 seconds for Division 3.

voltage Ž 3900 V and frequency

> 58.8 Hz; and

b. Steady state voltage :3900 V and r 4400 V and frequency Ž 58.8 Hz and

< 61.2 Hz.

-4 SR 3.8.1.16 ------------------- NOTE --------------------

This Surveillance shall not be performed in.

MODE 1. 2. or3 (not applicable to Division 3). However, credit may be taken I.

for unplanned events that satisfy this SR.

Verify each DG: 24 months

a. Synchronizes with offsite power source while loaded with emergency loads upon a simulated restoration of offsite power;

b. Transfers loads to offsite power source; and

c. Returns to ready-to-load operation.

I ________________________

(continued)

PERRY - UNIT 1 3.8-12 Ainendment No.

AC Sources-Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.17 ---------------- NOTE -------------

This Surveillance shall not be performed in MODE 1, 2. or 3 (not applicable to Division 31. However, credit may be taken for unplanned events that satisfy this SR.

Verify, with a DG operating in test mode 24 months and connected to its bus, an actual or simulated ECCS initiation signal overrides the test mode by:

a. Returning DG to ready-to-load operation; and

b. Automatically energizing the emergency loads from offsite power.

SR 3.8.1.18 ---------- -------- NOTE ---------------- 7 This Surveillance shall not be performed in MODE 1, 2, or 3. However, credit may be taken for unplanned events that satisfy this SR.

Verify for Division 1 and 2 DGs, the 24 months sequence time is within +/- 10% of design for each load sequence timer.

(continued)

PERRY - UNIT 1 3.8-13 Amendment No.

AC Sources -Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY v

SR 3.8.1.19 ------------------- NOTES--------------

1. All DG starts may be preceded by an engine prelube period.

2. This Surveillance shall not be performed in MODE 1. 2. or 3.(not applicable t6 Division 3). However. I credit may be taken for unplanned events that satisfy this SR.

Verify, on an actual or simulated loss of 24 months offsite power signal in conjunction with an actual or simulated ECCS initiation signal:

a. De-energization of emergency buses;

b. Load shedding from emergency buses for Divisions 1 and 2; and

c. DG auto-starts from standby condition and:

1. energizes permanently connected loads in ,10 seconds for Divisions 1 and,2 and g 13 seconds for Divisi-on 3.

2. energizes auto-connected emergency loads (for-Division 3. verify energizati-on in g 13 seconds).

3. achieves steady-state voltage 3900 V and

4400 V.

4. achieves steady state frequency

58.8 Hz and

61.2 Hz, and

5. supplies permanently connected and auto-connected emergency loads for

Ž 5 minutes.

(continued)

PERRY - UNIT 1 3.8-14 Amendment No.

NO CHANGE to this page; page provided for context only.

AC Sources-Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.20 ------------------- NOTE----.: ---------------

All DG starts may be preceded by an engine prelube period.

Verify, when started simultaneously from 10 years standby condition, each DG achieves:

a. In

10 seconds for Division 1 and 2, and : 13 seconds for Division 3. voltage

> 3900 V and frequency ; 58.8 Hz: and

b. Steady state voltage Ž 3900 V and

< 4400 V and frequency Ž 58.8 Hz and

61.2 Hz.

PERRY - UNIT 1 3.8-15 Amendment No. 142

Attachment 2 PROPOSED TECHNICAL SPECIFICATION CHANGES (RETYPED)

(9 Pages Follow)

AC Sources-Operating 3.8.1 I RETYPED; FOR INFORMATION ONLY I 3.8 ELECTRICAL POWER SYSTEMS 3.8.1 AC Sources-Operating LCO 3.8.1 The following AC electrical power sources shall be OPERABLE:

a. Two qualified circuits between the offsite transmission network and the onsite.Class 1E AC Electric Power Distribution System; and

b. Three diesel generators (DGs).

APPLICABILITY: MODES 1. 2. and 3.

--- NOTE ---------------------

Division 3 AC electrical power sources are not required to be OPERABLE when High Pressure Core Spray System is inoperable.

ACTIONS

NOTE -------------- ----------- -----

LCO 3.0.4.b is not applicable to DGs.

CONDITION REQUIRED ACTION COMPLETION TIME A. One required offsite A.1 Perform SR 3.8.1.1 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months circuit inoperable, for OPERABLE required offsite circuit. AND Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter AND (continued)

PERRY - UNIT 1 3.8-1 Amendment No.

AC Sources-Operating 3.8.1 I RETYPED; FOR INFORMATION ONLY I ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. (continued) A.2 Restore required 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months offsite circuit to OPERABLE status. AND.

24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months from discovery of two divisions with no offsite power AND 17 days from discovery of failure to meet LCO B. One required DG B.1 Perform SR 3.8.1.1 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months inoperable, for OPERABLE required offs.ite circuit(s). AND Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter AND B.2 Declare required 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from feature(s), supported discovery of by the inoperable DG. Condition B inoperable when the concurrent with redundant required inoperability feature(s) are of redundant inoperable, required feature(s)

AND (continued)

PERRY - UNIT 1 3.8-2 Amendment No.

AC Sources-Operating 3.8.1 I RETYPED; FOR INFORMATION ONLY I SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.7 ------------------- NOTE-All DG starts may be preceded by an engine prelube period.

Verify each DG starts from standby 184 days conditions and achieves:

a. In

10 seconds for Division 1 and 2.

and

13 seconds for Division 3.

voltage Ž 3900 V and frequency

Ž 58.8 Hz; and

b. Steady state voltage Ž 3900 V and

4400 V and frequency Ž 58.8 Hz and e 61.2 Hz.

SR 3.8.1.8 NOTE ------------

This Surveillance shall not be performed in MODE 1 or 2 (not applicable to Division 3). I However. credit may be taken for unplanned events that satisfy this SR.

Verify manual transfer of unit power supply 24 months

,from the normal offsite circuit to the alternate offsite circuit.

(continued)

PERRY - UNIT 1 3.8-7 Amendment No.

AC Sources-Operating 3.8.1 I RETYPED; FOR INFORMATION ONLY I SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.9 ----------------- NOTES- -------------

1. This Surveillance shall not be performed in MODE 1 or 2 (not applicable to Division 3). However.

credit may be taken for unplanned events that satisfy this*SR.

2. If performed with DG synchronized with offsite power, it shall be performed at a power factor

0.9.

Verify each DG rejects a load greater than 24 months or equal to its associated single largest post-accident load. Following load rejection,. engine speed is maintained less than.nominal plus 75% of the difference between nominal speed and the overspeed trip setpoint, or 15% above nominal.

whichever is less.

SR 3.8.1.10 ----------------- NOTE- --------------

This Surveillance shall not be performed in MODE 1.or 2 (not applicable to Division 3 DG). However, credit may be taken for unplanned events that satisfy this SR. I Verify each DG operating at a power factor 24 months

,.0.9 does not trip and voltage is maintained

4784 V for Divi.si:on 1 and 2 DGs and : 5000 V for Division 3 DG during and following a load rejection of a load

Ž 5600 kW for Division 1 and 2 DGs and 2600 kW for Division 3 DG.

(continued)

PERRY - UNIT 1 3.8-8 Amendment No.

AC Sources-Operating 3.8.1 I RETYPED; FOR INFORMATION ONLY I SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY 4.

SR 3.8.1.11 ------------------- NOTES---------------

1. All DG starts may be preceded by an engine prelube period.

2. This Surveillance shall not be

.performed in MODE 1.. 2. or 3 (not applicable to Division 3). However, I' credit may be taken for unplanned events that satisfy this SR.

Verify on an actual or simulated loss of 24 months offsite power signal:

a. De-energization of emergency buses;

b. Load shedding from emergency buses for Divisions 1 and 2; and

c. DG auto-starts from standby Condition and:

1. energizes permanently connected loads in

10 seconds for Division 1 and 2 DGs and 13 seconds for Division 3.

2. energizes auto-connected loads'for Divisions 1 and 2, 3.- maintains steady state voltage

Ž3900 V and

4400 V,

4. maintains steady state frequency

Ž 58.8 Hz and

61.2 Hz, and

5. supplies permanently connected and auto-connected loads for

Ž 5 minutes.

.(continued)

PERRY - UNIT 1 3.8-9 Amendment No.

AC Sources-Operating 3.8.1 I RETYPED; FOR INFORMATION ONLY I SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY 4.

SR 3.8.1.12 ---------------

NOTES--------------

1. All DG starts may be preceded by an engine prelube period.

2.. This Surveillance shall not be performed in MODE 1 or 2 (not applicable to Division 3). However.

credit may be taken for unplanned events that satisfy this SR.

Verify on an actual or simulated Emergency 24 months Core Cooling System (ECCS) initiation signal each DG auto-starts from standby condition and:

a. In g 10 seconds for Division 1 and 2.

and

13 seconds for Division 3. after auto-start and during tests, achieves voltage Ž 3900 V and frequency

. 58.8. Hz: and

b. Achieves steady state voltage Ž 3900 V and

4400 V and frequency Ž 58.8 Hz and

61.2 Hz: and

c. Operates for > 5-minutes.

4 SR 3.8.1.13 -------------- NOTE ---------------

This Surveillance shall not be performed-in MODE 1, 2. or 3 (not applicable to Division 3). However, credit may be taken I for unplanned events that satisfy this SR.

Verify each DG's automatic trips are 24 months bypassed on an actual or simulated ECCS initiation signal except:

a. Engine overspeed; and

b. Generator differential current (continued)

PERRY - UNIT 1 3.8-10 Amendment No.

AC Sources-Operating 3.8.1 I RETYPED; FOR INFORMATION ONLY I SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.15 -------------- NOTES -------------

1. This Surveillance shall be performed within 5 minutes of shutting down the DG after the DG has operated ; I hour loaded Ž 5600 kW and

7000 kW for Division 1 and 2 OGs. and > 2600 kW for Division 3 DG.

Momentary transients outside of the load range do not invalidate this test.

2. All DG starts may be preceded by an engine prelube period.

Verify each DG starts and achieves: 24 months

a. In < 10 seconds for Division 1 and 2.

and

13 seconds for Division 3.

voltage Ž 3900 V and frequency

58. 8 Hz: and b.. Steady state voltage Ž 3900 V and 4400 V and frequency Ž 58.8 Hz and 61.2 Hz.

SR, 3.8.1.16 ----------------- NOTE---------------

This Surveillance shall not be performed in MODE 1. 2. or 3 (not applicable to Division 3). However, credit may be taken 11 for unplanned events that satisfy this SR.

Verify each DG: 24 months

a. Synchronizes with offsite power source while loaded with emergency loads upon a simulated restoration of offsite power:

b. Transfers loads to offsite power source: and

c. Returns to ready-to-load operation.

.(continued)

PERRY - UNIT 1 3.8-12 Amendment No.

AC Sources-Operating S 3.8.1 I RETYPED; FOR INFORMATION ONLY I SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.17 ------------------- NOTE -------------

This Surveillance shall not be performed in MODE 1, 2, or 3 (not applicable to Division 3). However, credit may be taken for unplanned events that satisfy this SR.

I Verify, with a DG operating in test mode 24 months and connected to its bus, an actual or simulated ECCS initiation signal overrides the test mode by:

a. Returning DO to ready-to-load operation: and

b. Automatically energizing the emergency loads from offsite power.

SR 3.8.1.18 --------------- NOTE ---------------

This Surveillance shall not be performed in MODE 1,. 2. or 3. However. credit may be taken for unplanned events that satisfy this SR.

Verify for Division 1 and 2 DGs, the 24 months sequence time is within +/- 10% of design for each load sequence timer.

-I (continued)

PERRY - UNIT 1 3.8-13 Amendment No.

AC Sources-Operating RETYPED; FOR INFORMATION ONLY 3.8.1 SURVEILLANCE REQUIREMENTS (continued) 1*

SURVEILLANCE FREQUENCY SR 3.8.1.19 -------------------NOTES -------------

1. All DG starts may be preceded by an engine prelube period.

2. This Surveillance shall not be performed in MODE 1, 2., or 3 (not applicable to Division 3). However, I credit may be taken for unplanned events that satisfy this SR.

Verify, on an actual or simulated loss of 24 months offsite power signal in conjunction with an actual or simulated ECCS initiation signal:

a. De-energization of emergency buses;

b. Load'shedding from emergency buses for Divisions 1 and 2: and

c. DG auto-starts from standby condition and:

1. energizes permanently connected loads in

10 seconds for Divisions 1 and 2 and

13 seconds for Division 3.

2. energizes auto-connected emergency loads (for Division 3. verify.

energization in

13 seconds),

3. achieves steady state voltage 3900 V and

4400 V.

4. achieves steady state frequency 58.8 Hz and

61.2 Hz, and

5. supplies permanently connected and auto-connected emergency loads for

Ž 5 minutes.

(continued)

PERRY - UNIT 1 3.8-14 Amendment No.

Attachment 3 PROPOSED TECHNICAL SPECIFICATION BASES CHANGES (PROVIDED FOR INFORMATION)

(Only pages related to modifying the TS 3.8.1 surveillance requirements are provided)

(23 Pages Follow)

AC Sources-Operating INFORMATION ONLY BASES NO CHANGE to this SR SURVEILLANCE I SR 3.8.1.6 (continued)I REQUIREMENTS S I standby power sources. This Surveillance provides assurance that each fuel oil transfer pump is OPERABLE, the fuel oil piping system is intact, the fuel delivery piping is not obstructed, and the controls and control systems for automatic fuel transfer systems are OPERABLE.

The design of the fuel transfer systems is such that pumps operate automatically in order to maintain an adequate volume of fuel oil in the day tanks during or following DG testing. Therefore, a 31 day Frequency is specified to correspond to the maximum interval for DG testing.

3.8.AGEto1h.7S

_S See SR.3.8.1.2. RSTSRafected bythe FIjT

_ Fproposed changes.

Transfer of each 4.16 kV ESF bus power supply from the normal offsite circuit to the alternate offsite circuit

-demonstrates the OPERABILITY ,of the alternate circuit. The 24 month Frequency of the Surveillance is based on engineering judgment taking into consideration the plant conditions required to perform the Surveillance. and is intended to be consistent with expected fuel cycle lengths.

The-24 month Frequency is..based on operating experience, and is consistent with a typical industry refueling cycle.

This SR has been modified by a Note. This Note is not aD1cable toDivision 3. The reason tor the Note is that (luring operation with the reactor critical, performance of this SR could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, plant safety systems.

Credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:

1) Maintenance; and

2) Post maintenance testing that requires performance of

-this Surveillance in order to restore the component to OPERABLE. provided the maintenance was required, or performed in conjunction with maintenance required to reestablish OPERABILITY (e.g. post work testing following corrective maintenance, corrective (continued)

IFIRST PAGE of TS BASES included herein PERRY - UNIT 1 B 3.8-18 Revision No. 4

- INFORMATION ONLY **A Included for context only. AC Sources-peratingB3.8.

BASES SURVEILLANCE SR 3.8.1.8 (continued)

REQUIREMENTS modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns). Performance of this Surveillance is allowed provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance: as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when the Surveillance is performed in MODE 1 or 2.

Risk insights or deterministic methods may be used for this assessment..,

.(continued)

PERRY - UNIT 1 B 3.8-18a Revision No. 4

AC Sources-Operating B 3.8.1 I INFORMATION ONLY II I

BASES SURVEILLANCE .SR 3.8.1.9 REQUIREMENTS (continued) Each DG is provided with an engine overspeed trip to prevent damage to the engine. Recovery from the transient caused by the loss of a large load could cause diesel engine overspeed, which, if excessive, might result in a trip of the engine. This Surveillance demonstrates the DG -load response characteristics and capability to reject.the largest single load while maintaining a specified margin to the overspeed trip. The referenced Ioad for the Division 1 DG is the 1400 kW low pressure core spray pump: for the Divisi.on 2 DG. the 729 kW residual heat removal (RHR) pump:

and for the Division 3 DG the 2400 kW HPCS pump. This surveillance may be.accomplished by: 1) tripping the DG output breaker with the associated si.ngle largest load while aralleled to offsite power, or-while solely supplying the us. or 2) tripping its associated single largest load with the DG solely supplying the bus. As required by IEEE-308 (Ref. 13). the load rejection.testis acceptablie if the increase in diesel speed does not exceed 75% of the.

difference between synchronous speed and the. overspeed trip setpoint, or 15% above synchronous speed, whichever is lower.

This SR has been modified by two Notes. Note 1 is not ap licable to Division 3 The reason for.Note I is that

.duin operation with the reactor critical, performance of this could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, plant.

safety systems. Credit.may be taken for unplanned events that.sati-sfy this SR.. Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and

2) Post maintenancetesting that requires performance of thi-s Surveillance in order to restore the component to OPERABLE, provided the maintenance was required.or performed in conjunction with maintenance required to reestablish OPERABILITY (e.g. post work testing following corrective maintenance, corrective (continued)

PERRY - UNIT 1 B 3.8-19 Revision No. 4

B 3.8.1 Included for context only.

- INFORMATION ONLY ** AC Sources-Operating BASES SURVEILLANCE SR 3.8.1.9 (continued)

REQUIREMENTS modificati-on, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns). Performance of this Surveillance Is allowed provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced

-when the Surveillance is performed in.MODE I or 2.

Risk insights or deterministic methods may be used for this assessment.

(continued)

PERRY - UNIT 1 B 3.8-19a Revision No. 4

AC Sources-Operating B 3.8.

INFORMATION ONLY BASES SURVEILLANCE SR 3.8.1.9 (continued)

REQUIREMENTS In order-to ensure that the DG is tested under load conditions that are as close to design basis conditions as possible, Note 2 requires that, if synchronized to offsite ower. testing be performed using a power factor

0.9.

his power factor is chosen to be representative of the actual design basis inductive loading that the DG could experience. The 24 month Frequency takes into consideration unit conditions required to perform the surveillance, and is consistent with the intent of Regulatory Guide 1.108 (Ref. 9) Section C.2.a.

SR 3.8.1.10 This Surveillance demonstrates the DG capability to reject a full load. i.e., maximum-expected accident load, without overspeed tripping or exceeding the-predetermined voltage limits. The DG full load rejection may occur becauseof a system fault or inadvertent breaker tripping. This Surveillance ensures proper engine generator load response under the simulated test conditions. This test simulates the loss of total connected load that the DG experiences following a full load rejection and verifies that the DG

.does not trip upon loss of the load. These acceptance criteria provide DG damage protection. While the DG is not expected to experience this transient during an event and continue to be available, this response ensures that the DG is not degraded for future application, including reconnection to the bus if the trip initiator can be corrected or isolated.

In order to ensure that the DG is tested under load conditions that are as close to design basis conditions as possible, testing must be performed using a power factor r .9. This power factor is chosen to be representative of the actual design basis inductive loading that the DG would experience.

The 24 month Frequency takes into consideration unit conditions required to perform the surveillance, and is consistent with the intent of Regulatory Guide 1.108 (Ref. 9) to perform this test at refueling intervals.

This SR has been modified by twei Notes. his Note -isnot annlicable to Division 3 no tate tha*-momenay trnsen uetocangn buod ont invalidateP this tes-.The reason for f Note-2 is that during operation with the reactor critical, performance of this SR could cause perturbation to the electrical distribution (continued)

PERRY - UNIT 1 B 3.8-20 Revision No. 3

- INFORMATION ONLY ** AC Sources-Operating Included for context only. B 3.8.1 BASES SURVEILLANCE SR 3.8.1.10 (continued)

REQUIREMENTS systems that could challenge continued steady state operation and, as a result, plant safety systems. Credit may be taken for unplanned events that satisfy this SR.

Examples of unplanned events may include:

1) Unexpected oprational events which cause the equipment toperform the function specified by this Surveillance, for which adequate documentation'of the required performance is available: and

2) Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE,. provided the maintenance was required, or performed.in conjunction with maintenance required to reestablish OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns).

Performance of this Surveillance is allowed provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance:,as well as the

-operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plantisafety is maintained or enhanced when the Surveillance is performed in MODE 1 or 2. Risk insights or'deterministic methods. may be used for this assessment.

SR 3.8.1;11 As required by Regulatory Guide 1.108 (Ref. 9),

paragraph 2.a.(1), this Surveillance demonstrates the as designed operation of the standby power sources during-loss of the offsite source.. This test verifies all actions encountered from the loss of offsite power, including shedding of the Division 1 and 2 nonessential loads and energization of the emergency buses and .respective loads from the DG. It further demonstrates the capability of the DG to automatically achieve the required voltage and frequency within the specified time.

(continued)

PERRY - UNIT I B 3.8-21 Revision No. 4

'**INFORMATION ONLY ** AC Sources-Operating I B 3.8.1 Included for context only. I BASES SURVEILLANCE SR 3.8.1.11 (continued)

REQUIREMENTS The DG auto-start times are derived from requirements of the accident analysis to respond to a design basis large break LOCA. The Surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability has been achieved.

The requirement to verify the connection and energization of permanent and auto-connected loads through the load sequence (individual load timers) is intended to satisfactorily show the relationship of these loads to the DG loading logic. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation. For instance. ECCS injection valves are not desired to be stroked open. systems are not (continued)

PERRY - UNIT 1 B 3.8-21a Revision No. 4

AC Sources-Operating B 3.8.1 INFORMATION ONLY BASES SURVEILLANCE SR 3.8.1.11 (continued)

REQUIREMENTS capable of being operated at full flow. or RHR subsystems performing a decay heat removal function are not desired to be realigned to the ECCS mode of operation. In lieu of actual demonstration of the connection and energization of these loads, testing that adequately shows the capability of the DG system to perform these functions is acceptable..

This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The 24 month Frequency takes into consideration unit conditions required to perform the surveillance, and is consistent with the intent of Regulatory-Guide 1.108 (Ref. 9) paragraph C.2.a to perform this test at refueling intervals.

This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is.with the engine coolant and oil being continuously circulated and temperature maintained consistent with manufacturer recommendations for Division 1 and 2 DGs. For the Division 3 DG, standby conditions mean that the lube oil is heated by the jacket water and continuously circulated through a portion of the system as recommended by the vendor. Engine jacket water is heated by an immersion heater and circulates through the system by natural circulation. Note2 is no+aDglical *o Division 3. The reason for Note 2is that performingthe Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge plant safety systems. Credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available: and

2) Post maintenance testing that requires performance of portions of this Surveillance in order to restore the component to OPERABLE. provided the maintenance was required. or performed in conjunction with maintenance required to reestablish OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance (continued)

PERRY - UNIT 1 B 3.8-22 Revision No. 4

Included for context only. B 3.8.1

- INFORMATION ONLY ** AC Sources-Operating BASES SURVEILLANCE SR 3.8.1.11 (continued)

REQUIREMENTS testing, and other unanticipated OPERABILITY concerns). Performance of portions of this Surveillance is allowed provided an assessment determines plant safety is maintained or enhanced.

'This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1 or 2.

Risk insights or deterministic methods may be used for this assessment.

(continued)

PERRY - UNIT 1 B 3.8-22a Revision No. 4

AC Sources -Operating B 3.8.1 INFORMATION ONLY BASES SURVEILLANCE SR 3.8.1.12 REQUIREMENTS (continued) This Surveillance demonstrates that the DG- automatically starts and achieves the required voltage and frequency within the specified time (10 seconds for Divisions 1 and 2 and 13 seconds for Division 3) from the design basis actuation signal (LOCA signal) and operates for Ž 5 minutes. The 5 minute period provides sufficient time to demonstrate stability.

The Frequency of 24 months takes into consideration plant conditions required to perform the Surveillance and is intended to be consistent with the expected fuel cycle lengths. The 24,month Frequency is based on operating experience, and is consistent with a typical industry refueling cycle.

This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is.with the engine coolant and oil being continuously circulated and temperature maintained consistent with manufacturer recommendations for Division 1 and 2 DGs. For the Division 3 DG, standby conditions mean that the lube oil is heated by the jacket water and continuously circulated through a portion of the system as recommended by the vendor. Engine jacket water is heated by an immersion heater and circulates through the system by natural circulation. N"2n bp bleAto pivision3. The reason tN Z th during operation-with the rtor critical, performance of this SR could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, plant safety systems. Credit may be taken for unplanned events that satisfy this SR. Examples of unplanned.:events may.include:

1) Unexpected operational events which cause the equipment to perform.the function specified by this Surveillance, for which adequate documentation of the required performance is available: and

2) Post maintenance testing that requires performance of portions of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to reestablish OPERABILITY (e.-g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance (continued)

PERRY - UNIT 1 B 3.8-23 Revision No. 4

B 3.8.1 Included for context only.

- INFORMATION ONLY ** AC Sources-Operating BASES SURVEILLANCE SR 3.8.1.12 (continued)

REQUIREMENTS testing, and other unanticipated OPERABILITY concerns). Performance of.portions of this Surveillance is allowed provided an assessment determines plant safety is maintained or enhanced.

This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance: as well as the operator'procedures available to cope with-these outcomes. These shall be measured against the avoided risk of a plant shutdown. and startup to determine that plant safety is maintained or enhanced when portions of the. Surveillance are performed in MODE 1.or 2.

Risk insights or deterministic methods may be used for this assessment.

(continued)

PERRY - UNIT 1 B 3.8-23a Revision No. 4

AC Sources-Operating B 3.8.1 I INFORMATION ONLY I BASES SURVEILLANCE SR 3.8.1.13 REQUIREMENTS (continued) This Surveillance demonstrates that DG non-critical protective functions (e.g., high jacket water temperature) are bypassed on an ECCS initiation test signal and critical protective functions trip the DG to avert substantial damage to the DG unit. The non-critical trips are bypassed during DBAs and provide alarms on abnormal engine conditions.

These alarms provide the operator with necessary information to react appropriately. The DG availability to mitigate the DBA is more critical than protecting the engine against minor problems that are not immediately detrimental to emergency operation of the DG.

The 24 month Frequency is based on engineering judgment.

taking into consideration-plant conditions required-to perform the. Surveillance, and is intended to be consistent with expected fuel cycle lengths. The 24 month Frequency is based on operating experience, and is consistent with a typical industry refueling cycle.

The SR is modified toDivision 3.,The byreason a Note.

for This Note isis that the Note noaDDlicable performing the Surveil.]ance removes a required DG from service. Credit I

may be taken for unplanned events that satisfy this SR.

Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available: and

3) Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to reestablish OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns).

Performance of this Surveillance is allowed provided an assessment determines plant safety ismaintained or enhanced. This assessment shall, as a minimum.

consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together (continued)

PERRY - UNIT 1 B 3.8-24 Revision No. 4

- IL ** AC Sources-Operating INFORMATION ONLY B 3.8.1 Included for context only.

BASES SURVEILLANCE SR 3.8.1.13 (continued)

REQUIREMENTS or operated independently for the Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when the Surveillance is performed in MODE 1 or 2.

Risk insights or deterministic methods may be used for this assessment.

SSR 3.8.14 NOCHANGEtothis Regulatory Guide 1.108 (Ref. 9). paragraph 2.a.(3). requires demonstration once per 18 months that the DGs can start and run continuously at full load capability for an interval of not less than 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months s-22 hours of which is at a load, equivalent to the continuous rating of the DG, and 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months (continued)

PERRY - UNIT 1 B 3.8-24a Revision No. 4

I**INFORMATION ONLY ** AC Sources-Operating SR 3.8.

Bthis Included for context only.

BASES SURVEILLANCE SR 3.8.1.14 (continued)I REQUIREMENTS of which is at a load equivalent to 110% of the continuous duty rating of the DG. An exception to the loading requirements is made for Division 1 and 2 DGs since the load carrying capability testing of the Transamerica Delaval Inc.

(TDI) diese] generators (Division 1 and 2) has been limited.

Division 1 and 2 DGs are operated for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months at a load

?reater than or equal to the maximum expected post accident oad; the first 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months of which is at the continuous rating of the DG. The DG starts for this Surveillance can be performed either from standby or hot conditions. The provisions for prelube and warmup, discussed in SR 3.8.1.2.

and for gradual loading, discussed in SR 3.8.1.3, are applicable to this SR.

In order to ensure that the DG is tested under load conditions that are as close to design conditions as possible. testing must be performed using a power factor

0.9. This power factor is chosen to be representative of the actual design basis inductive loading that the DG could experience. Limits on the frequency and voltage during the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months run are unnecessary because this test is performed with the DG connected in parallel to offsite power, and the power factor which is to be maintained is specified.

The 24 month Frequency takes into consideration unit conditions required to perform the surveillance, and is consistent with the intent of Regulatory Guide 1.108 (Ref. 9) paragraph C.2.a to perform this test at refueling intervals.

This.Surveillance is modified by two Notes. Note 1 states that momentary transients due to changing bus loads do not invalidate this test. The load band for the Division 1 and 2 DGs is provided to avoid routine overloading of these DGs.

While this Surveillance allows operation of the Division 1 and 2 DGs in the band of 5600 kW to 7000 kW. a range of 5600 kW to 5800 kW will normally be used in order to minimize wear on the DGs. This is the load range referred to in Note 1. Routine overloading may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY.

.Similarly, momentary power factor transients above the limit do not invalidate the test.

(continued)

PERRY - UNIT 1 B 3.8-25 Revision No. 3

- INFORMATION ONLY ** AC Sources-Operating B 3.8.1 Included for context only.

/- NO CHANEtthsS BASES SURVEILLANCE SR 3.8.1.14 (continued)

REQUIREMENTS The reason for Note 2 is that credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and 2). Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE. provided the maintenance was required. or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

.1 SR 3.8.1.1514 NO CHANGE to this SR This Surveillance demonstrates that the diesel. engine can restart from a hot condition, such as subsequent to shutdown from normal Surveillances, and achieve the required voltage and frequency within 10 seconds for Divisions 1 and 2 and 13 seconds for.Division 3. The times are derived from the requirements of the accident analysis to respond to a design basis large break LOCA.

The 24 month Frequency takes into consideration unit conditions required to-perform the surveillance, and is consistent with the intent of Regulatory Guide 1.108

(Ref. 9) paragraph C.2.a.

This SR has been modified by two Notes. Note 1 ensures that the test is performed with the diesel sufficiently hot. The requirement that the diesel has operated for at least 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months at full load conditions prior to performance of this Surveillance is based on manufacturer recommendations for achieving hot conditions. The load band for the Division 1 and 2 DGs is provided to avoid routine overloading of these DGs. While this Surveillance allows operation of the Division 1 and 2 DGs in the band of 5600 kW to 7000 kW, a range of 5600 kW to 5800 kW will normally be used in order to minimize wear on the DGs. This isthe load range (continued)

PERRY - UNIT 1 B 3.8-26 Revision No. 3

AC Sources-Operating I

INFORMATION ONLY BASES SURVEILLANCE SR 3.8.1.15 (continued)

REQUIREMENTS referred to in Note 1. Routine overloads may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY.

Momentary transients due to changing bus loads do not invalidate this test. Note 2 allows all DG starts to be preceded by an engine prelube period to minimize wear and tear on the diesel during testing.

SR 3.8.1.16 As required by Regulatory Guide 1.108 (Ref. 9),

paragraph 2.a.(6). this Surveillance ensures that the manual synchronization and load transfer from the DG to each required offsite power can be made and that the DG can be returned to ready-to-load status when offsite power is restored. It also ensures that the undervoltage logic is reset to allow the DG to reload if a subsequent loss of offsite power occurs. The DG is considered to be in ready-to-load status when the DG is at rated speed and voltage, the output breaker is open and can receive an auto-close signal on bus undervoltage. Portions of the synchronization circuit are associated with the DG and portions with each offsite circuit. If a failure in the synchronization requirement of the Surveillance occurs.

depending on the specific affected portion of the synchronization circuit, either the DG or an associated offsite circuit is declared inoperable.

The 24 month Frequency takes into consideration unit conditions required to perform the surveillance, and is consistent with the intent of Regulatory Guide1.108 (Ref. 9) paragraph C.2.a to perform this test at'refueli.ng intervals.

This SR is modified by a Note. This Note Jis Anoa icabl.e tDivision 3The reason for theNote is that perTormin I Surveil-lance would remove a required offsite circuit from service, perturb the electrical distribution system.

and challenge safety systems. Credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and (continued)

PERRY - UNIT 1 B 3.8-27 Revision No. 3

AC Sources-Operating I*INFORMATION ONLY ** B 3.8.1 Included for context only.

BASES SURVEILLANCE REQU IREMENTS SR 3.8.1.16 (continued)

2) Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to reestablish OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing. and other unanticipated OPERABILITY concerns). Performance of this Surveillance is allowed provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance: as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk ofa plant shutdown and startup to determine that plant safety is maintained or-enhanced when the Surveillance is performed in.MODE 1 or 2 Risk insights or deterministic methods may be used for this assessment.

SR 3.8.1.17 Demonstration of the test mode override ensures that the DG availability under accident conditions is not compromised as the result of testing. Interlocks to the LOCA sensing circuits cause the DG to automatically reset to ready-to-load operation if an ECCS initiation signal is received during operation in the test mode. Ready-to-load operation is defined as the DG running at rated speed and voltage with the DG output breaker open. These provisions for automatic switchover are required by IEEE-30B (Ref. 13),

paragraph 6.2.6(2).

The requirement to automatically energize the emergency loads with offsite power is essential y identical to that of SR 3.8.1.12. The intent in the requirement associated with SR 3.8.1.17.b is to show that the emergency loading is not affected by the DG operation in test mode.. In lieu of actual demonstration of connection and energization of loads, testing that adequately shows the capability of the emergency loads to perform these functions is acceptable.

(continued)

PERRY - UNIT 1 B 3.8-28 Revision No. 4

AC Sources-Operating B 3.8.1 INFORMATION ONLY BASES SURVEILLANCE SR 3.8.1.17 (continued)

REQUIREMENTS This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading, sequence is verified.

The 24 month Frequency takes into consideration unit con.ditions required to perform the surveillance., and i.s consistent-with the intent of Regulatory Guide 1.108 (Ref. 9) paragraph C.2.a to perform this test at refueling intervals.

This SR has been modified by a Note. This Note is not aDDlicable to Division.3. The reason for the Note is.that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. Credit may be taken.

for unplanned events that satisfy this SR. Examples .of unplanned events may include:

(continued)

PERRY - UNIT 1 B 3.8-28a R Revision No. 4

AC Sources-Operating j**INFORMATION ONLY ** B 3.8.1 Included for context only.

BASES SURVEILLANCE REQU IREMENTS SR 3.8.1.17 (continued)

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available: and

2) Post maintenance testing that requires performance of portions of this Survei lance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to reestablish OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification. deficient or incomplete surveillance testing. and other unanticipated OPERABILITY concerns). Performance of portions of this Surveillance is allowed provided an assessment determines plant safety is maintained orenhanced.

This assessment-shall, as a minimum. consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated.

independently for the partial Surveillance; as well as the operator procedures available to-cope with these outcomes.. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1 or 2.

Risk insights or deterministic methods may be used for this assessment NO CHANGE to this SIR SR 3.8.1.18C1 Under accident conditions, loads are sequentially connected to the bus by the time delay relays. The time delay relays control the permissive and starting signals to motor breakers to prevent overloading of the bus power supply due to high motor starting currents. The 10% load sequence time tolerance ensures that sufficient time exists for the bus power supply to restore frequency and voltage prior to applying the next load and that safety analysis assumptions regarding ESF equipment time delays are not violated.

Reference 2 provides a summary of the automatic loading of ESF buses.

(continued)

PERRY - UNIT 1 B 3.8-29 Revision No. 4

- IL** AC Sources-Operating INFORMATION ONLY B 3.8.1 Included for context only.

BASES INO CHANGE to this SR SURVEILLANCE I SR 3.8.1.18 (continued)

REQUIREMENTS The 24month Frequency takes into consideration unit conditions required to perform the surveillance, and is consistent with the intent of Regulatory Guide 1.108 (Ref. 9) paragraph C.2.a to perform this test at refueling intervals.

This SR is modified by a Note. The reason for the Note is that performing the Surveillance during these MODES would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge plant safety systems. Credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:

(continued)

PERRY - UNIT 1 B 3.8-29a Revision No. 4

AC Sources-Operating I** INFORMATION ONLY ** B 3.8.1 Included for context only. I BASES / -NO CHANGE to this SR SURVEILLANCE SR 3.8.1.18 (continued)

REQUIREMENTS

1. Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and

2. Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required. or performed in conjunction with maintenance required to reestablish OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns). Performance of this Surveillance is allowed provided an assessment.determines plant safety is maintained or enhanced. This assessment shall, as a minimum., consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when the Surveillance is performed in MODE 1 or 2.

Risk insights or deterministic methods may be used for this assessment. LAST SR affected by the SR 3.8.1.19 proposed changes.

In the event of a DBA coincident with a loss of offsite ower,.the-DGs are required to supply the necessary power to SF systems so that the fuel., RCS, and containment design limits are not exceeded.

This Surveillance demonstrates the DG operation, as discussed in the Bases for SR 3.8.1.11, during a loss of offsite power actuation test signal in conjunction with an ECCS initiation signal. In lieu of actual demonstration of connection and energization of loads, testing that adequately shows the capability of the DG system to perform these functions is acceptable. This testing may include any series of.sequential, overlapping, or total steps so that (continued)

PERRY - UNIT 1 B 3.8-30 Revision No. 4

AC Sources -Operating

INFORMATION ONLY ** B 3.8.1 Included for context only.

BASES SURVEILLANCE SR 3.8.1.19 (continued)

REQUIREMENTS the entire connection and loading sequence is verified. The verification for assuring that the auto-connected emergency loads are energized has a timing requirement associated with Division 3. Thus verification for Division 1 or 2 is simply a check that the auto-connected loads are energized, whereas the verification for Division 3 includes a check that the auto-connected loads are energized in 5 13 seconds.

The Frequency of 24 months takes into consideration plant conditions required to perform the Surveillance and is intended to be consistent with an expected fuel cycle length of 24 months.

This SR is modified by two Notes. The reason for Note 1 is to minimize wear and-tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions,. that is, witt i the engine coolant and oil being continuously circulated ancItemperature maintained (continued)

PERRY - UNIT 1 B 3.8-30a Revision No. 4

AC Sources-Operatinf B 3.8.1 INFORMATION ONLY BASES SURVEILLANCE REQUIREMENTS SR 3.8.1.19 (continued) consistent with manufacturer recommendations for Division 1 and 2 DGs. For the Division 3 DG. standby conditions mean that the lube oil is heated by the jacket water and continuously circulated through a portion of the system as recommended by the vendor. Engine jacket water is heated by an immersion heater and circulates through the system by natural circulation.. Note 2 is not aDplicable to Division 3. The reason for Note 2 is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge plant safety systems. Credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available: and

2) Post maintenance testing that requires performance of portions of this Surveillance-in order to restore the component to OPERABLE, provided the maintenance was required, or, performed in conjunction with maintenance required to reestablish OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns). Performance of portions of this Surveillance is allowed provided an assessment determines plant safety is.maintained or enhanced.

This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1 or 2.

Risk insights or deterministic methods may be used for this-assessment.

ILAST PAGE included of TS BASES herein.

PERRY .- UNIT 1 B 3.8-31 Revision No. 4

ATTACHMENT 4 HISTORICAL RESULTS OF DIVISION 3 AC SOURCES SURVEILLANCE TESTING Page 1 of 3 Surveillance Requirement (SR) 3.8.1.8 This SR verifies manual transfer of unit power supply from the normal offsite circuit to the alternate offsite circuit.

DATE PERFORMED RESULTS 5/4/2011 SAT 4/7/2009 SAT 5/4/2007 SAT 5/4/2007 UNSAT*

4/21/2005 SAT 5/13/2003 SAT

UNSAT due to failure of undervoltage relaying; issue entered into FENOC's corrective action program, undervoltage relaying was reworked, and SR was re-performed SAT.

Surveillance Requirement (SR) 3.8.1.9 This SR verifies the diesel generator rejects a load greater than or equal to its associated single largest post-accident load. Following load rejection, engine speed is maintained less than nominal plus 75 percent of the difference between nominal speed

nd the. nv*.r.*nP~r trin .*.tnnint nr 1F n*.rnrnt *hnv* nnmin~l whir~h*.v*r i.* I d.......... ...... r ..... 15 percent above no.......... ......... .......

DATE PERFORMED RESULTS 5/1/2011 SAT 4/1/2009 SAT 5/6/2007 SAT 4/20/2005 SAT 5/5/2003 SAT Surveillance Requirement (SR) 3.8.1.10 This SR verifies the diesel generator (operating at a power factor < 0.9) does not trip and voltage is maintained < 5000 volts (V) during and following a load rejection of a load > 2600 kilowatts (kW).

DATE PERFORMED RESULTS 5/1/2011 SAT 4/1/2009 SAT 5/6/2007 SAT 4/20/2005 SAT 5/5/2003 SAT Page 2 of 3 Surveillance Requirement (SR) 3.8.1.11 This SR verifies that upon an actual or simulated loss of offsite power (LOOP) signal, the emergency bus is de-energized, and the diesel generator automatically starts from the standby condition and energizes permanently connected loads in < 13 seconds, achieves and maintains the required voltage and frequency, and supplies permanently connected loads for > 5 minutes.

DATE PERFORMED RESULTS 5/4/2011 SAT 4/7/2009 SAT 5/4/2007 SAT 5/4/2007 UNSAT*

4/21/2005 SAT 5/13/2003 SAT'

UNSAT due to failure of undervoltage relaying; issue entered into FENOC's corrective action program, undervoltage relaying was reworked, and SR was re-performed SAT.

Surveillance Requirement (SR) 3.8.1.12 This SR verifies that upon an actual or simulated emergency core cooling system (ECCS) initiation signal, the diesel generator automatically starts from the standby condition and achieves the required voltage and frequency in < 13 seconds, and -

operates for > 5 minutes.

DATE PERFORMED RESULTS 5/1/2011 SAT 4/1/2009 SAT 5/6/2007 SAT 4/20/2005 SAT 5/5/2003 SAT Surveillance Requirement (SR) 3.8.1.13 This SR verifies that upon an actual or simulated ECCS initiation signal, the diesel generator's automatic trips are bypassed, except for the engine overspeed and generator differential current trips.

DATE PERFORMED RESULTS

.5/1/2011 SAT 4/1/2009 SAT 5/6/2007 SAT 4/20/2005 SAT 5/5/2003 SAT Page 3 of 3 Surveillance Requirement (SR) 3.8.1.16 This SR verifies that upon a simulated restoration of offsite power, the diesel generator can be synchronized with an offsite power source while loaded with emergency loads, transfers loads to offsite power, and the diesel generator returns to ready-to-load operation.

DATE PERFORMED RESULTS 5/4/2011 SAT 4/7/2009 SAT 5/4/2007 SAT 5/4/2007 UNSAT*

4/21/2005 SAT 5/13/2003 SAT

UNSAT due to failure of undervoltage relaying; issue entered into FENOC's corrective action program, undervoltage relaying was reworked, and SR was re-performed SAT.

Surveillance Requirement (SR) 3.8.1.17 This SR verifies that with the diesel generator operating in test mode and connected to its bus, an actual or simulated ECCS initiation signal overrides the test mode by returning the diesel generator to ready-to-load operation and automatically energizing the emeraencv loads from offsite D)ower.

DATE PERFORMED RESULTS 5/3/2011 .SAT 5/1/2011 UNSAT*

4/1/2009 SAT 5/6/2007 SAT 4/20/2005 SAT 5/5/2003 SAT

UNSAT due to grid voltage out of acceptable range (high); issue entered into FENOC's corrective -action program, and SR was re-performed SAT.

Surveillance Requirement (SR) 3.8.1.19 This SR verifies that upon an actual or simulated LOOP signal in conjunction with an actual or simulated ECCS initiation signal, the emergency bus is de-energized, the diesel generator automatically starts from the standby condition and energizes permanently connected and auto-connected loads in < 13 seconds, achieves and maintains the required voltage and frequency, and supplies permanently connected and

uto-connected loads for >_5 minute*

DATE PERFORMED RESULTS 5/4/2011 SAT 4/7/2009 SAT 5/5/2007 SAT 4/22/2005 SAT 5/14/2003 SAT

v t e Letter Sequence Request
TAC:ME9006, (Open)
Initiation Request Acceptance... Administration Questions 11 December 2012 7 February 2013 Answers 7 January 2013 8 March 2013 Results Approval... Other:
MONTHYEAR2013-01-07 [Table View]

L-12-261, Request for Licensing Action to Modify Technical Specification 3.8.1, AC Sources - Operating, to Remove Mode Restrictions on Certain Division 3 Surveillance Requirements

Text

SUBJECT:

Enclosure:

Subject:

SUMMARY

3.0 TECHNICAL EVALUATION

4.0 REGULATORY EVALUATION

5.0 ENVIRONMENTAL CONSIDERATION

SUMMARY

3.0 TECHNICAL EVALUATION

4.0 REGULATORY EVALUATION

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

5.0 ENVIRONMENTAL CONSIDERATION

Navigation menu

L-12-261, Request for Licensing Action to Modify Technical Specification 3.8.1, AC Sources - Operating, to Remove Mode Restrictions on Certain Division 3 Surveillance Requirements

Text

SUBJECT:

Enclosure:

Subject:

SUMMARY

3.0 TECHNICAL EVALUATION

4.0 REGULATORY EVALUATION

5.0 ENVIRONMENTAL CONSIDERATION

SUMMARY

3.0 TECHNICAL EVALUATION

4.0 REGULATORY EVALUATION

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

5.0 ENVIRONMENTAL CONSIDERATION

Navigation menu

Search