Text

Response to a Request for Additional Information License Basis Document Change Request 2-9-02 Emergency Diesel Generator Testing Requirements
	ML030700399
Person / Time
Site:	Millstone
Issue date:	02/28/2003
From:	Price J; Dominion Nuclear Connecticut
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	B18821, TAC MB6112
	Download: ML030700399 (63)
	v • d • e

Dominion Nuclear Connecticut, Inc.

Station Dominion Millstone Power Rope Ferry Road Waterford, CT 06385 FEB 2 8 2003 Docket No. 50-336 B18821 RE: 10 CFR 50.90 U S. Nuclear Regulatory Commission Attention" Document Control Desk j, Washington, DC 20555 Millstone Power Station, Unit No. 2 Response to a Request for Additional Information License Basis Document Change Request 2-9-02 Emergency Diesel Generator Testing Requirements (TAC No. MB6112)

In a letter dated August 12, 2002ý') Dominion Nuclear Connecticut, Inc. (DNC) requested changes to the Millstone Unit No. 2 Technical Specifications. The purpose of the requested changes was to revise the surveillance requirements associated with the for Emergency Diesel Generators (EDGs). On October 18, 2002,(2) a Request Additional Information (RAI) was received via facsimile from the Nuclear Regulatory Commission which contained four (4) questions related to the aforementioned License Basis Document Change Request.

These four questions and one additional question were discussed during conference calls conducted on October 23, 2002 and December 19, 2002. Attachment 1 provides the DNC response to these questions. Attachment 2 contains a marked-up version of the original retyped pages of Technical Specifications contained in our submittal dated August 12, 2002. Attachment 3 contains the revised retyped pages. The additional information provided in this letter will not affect the conclusions of the Significant Hazards Consideration discussion in the DNC letter dated August 12, 2002.

(1) J. A Price letter to U S. Nuclear Regulatory Commission, "Millstone Nuclear Power Station, Unit No 2, License Basis Document Change Request 2-9-02, Emergency Diesel Generator Testing Requirements," dated August 12, 2002 (2) R B Ennis (NRC) Facsimile Transmission, "Issues for Discussion in Upcoming Telephone Conference Regarding Proposed Amendment to Technical Specifications Emergency Diesel Generator Testing Requirements, Millstone Power Station, Unit No 2, Docket No. 50-336," dated October 18, 2002 AooD

U.S. Nuclear Regulatory Commission B18821/Page 2 There are no regulatory commitments contained within this letter.

If you should have any questions regarding this submittal, please contact Mr. Ravi Joshi at (860) 440-2080.

Very truly yours, DOMINION NUCLEAR CONNECTICUT, INC.

J. a* Price Sit ce President - Millstone Lorrie A.Arzamarski Sworn to and subscribed before me Notary Public this

day of F-.b (j . 2003 Commission Expires February 28, 2006 Notary Public My Commission Expires *) 9*"j &.LP S-

/ "- --- .

Attachment (1) cc: H. J. Miller, Region I Administrator R. B. Ennis, NRC Senior Project Manager, Millstone Unit No. 2 Millstone Senior Resident Inspector Director Bureau of Air Management Monitoring and Radiation Division Department of Environmental Protection 79 Elm Street Hartford, CT 06106-5127

Docket No. 50-336 B18821 Attachment 1 Millstone Power Station, Unit No. 2 Response to a Request for Additional Information License Basis Document Change Request 2-9-02 Emergency Diesel Generator Testing Requirements Supplemental Information

U.S. Nuclear Regulatory Commission B18821/Attachment 1/Page 1 Response to a Request for Additional Information License Basis Document Change Request 2-9-02 Emergency Diesel Generator Testing Requirements Supplemental Information In a letter dated August 12, 2002(1) Dominion Nuclear Connecticut, Inc. (DNC) requested changes to the Millstone Unit No. 2 Technical Specifications. On October 18, 2002,(2) four (4) questions related to the aforementioned Technical Specifications Change Request were received via facsimile from the Nuclear Regulatory Commission.

These four questions and one additional question were discussed during conference calls conducted on October 23, 2002, and December 19, 2002. The questions and associated responses are presented below:

Question 1 What is the minimum EDG terminal voltage for proper operation of all design basis loads?

Response

For all safety related loads to meet their minimum required voltage, the emergency 4160 VAC buses require a minimum of 88% (3660 VAC).

The analytical limit for safety related 4160 VAC buses degraded grid relay drop out setpoint is approximately 88% (3660 VAC). This provides assurance that the required minimum voltage for the safety related loads is met.

The reset voltage setpoint for the degraded grid relays is approximately 92% (3827 VAC). This ensures the bus voltages have recovered above this value following a transient so that it is not necessary to sequence loads on the EDGs.

A calculation has been performed that supports the 88% analytical limit for the degraded grid voltage relay drop out setpoint. Calculation 98-ENG-02678-E2 verifies the adequacy of the Class 1E and select Non-Class 1 E cables supplied from the safety related 4160 VAC, 480 VAC, 120 VAC, and 125 VDC buses. This calculation assumes a bus voltage of 3628 VAC (87.2%) at the safety related 4160 VAC buses, and then (1) J A Price letter to U.S. Nuclear Regulatory Commission, "Millstone Nuclear Power Station, Unit No.

2, License Basis Document Change Request 2-9-02, Emergency Diesel Generator Testing Requirements," dated August 12, 2002.

(2) R B Ennis (NRC) Facsimile Transmission, "Issues for Discussion in Upcoming Telephone Conference Regarding Proposed Amendment to Technical Specifications Emergency Diesel Generator Testing Requirements, Millstone Power Station, Unit No 2, Docket No 50-336," dated October 18, 2002

I U.S. Nuclear Regulatory Commission B18821/Attachment 1/Page 2 verifies sufficient voltage is available for the safety related loads. This demonstrates that the degraded grid voltage setpoint of 88% is adequate for safety related loads.

The EDG voltage regulator will establish the EDG voltage at > 97% (4035 VAC) which will allow the EDG to be automatically loaded. This value is well above the degraded grid voltage relay drop out value of 88% (3660 VAC). Therefore, the voltage regulator value of 97% is adequate for the safety related loads.

Additional changes were proposed to numerous surveillance requirements (SR 4.8.1.1.2.a.2, 4.8.1.1.2.c.5, 4.8.1.1.2.c.7, 4.8.1.1.2.c.9, and 4.8.1.1.2.d.2) to verify the EDG achieves a steady state voltage between 3740 VAC and 4580 VAC, and a steady state frequency between 58.8 Hz and 61.2 Hz. The proposed voltage and frequency bands were the same as those currently contained in SR 4.8.1.1.2.c.8. License Amendment No. 171,(') issued in response to a License Amendment Request dated August 4, 1993,(4) added these voltage and frequency bands. The basis for the voltage and frequency bands contained in the August 1993 submittal, and the subsequent NRC Safety Evaluation, was consistent with the Standard Technical Specifications.

The steady state minimum voltage value of 3740 VAC (90%) is above the degraded grid voltage setpoint of 3660 VAC (88%), which has been determined to be an adequate voltage value for safety related loads. In addition, the EDG output voltage value of 3740 VAC is sufficiently above 3660 VAC to account for the minimal expected voltage drop between the EDGs and the 4160 VAC emergency buses.

Question 2 What is the worst case power factor of the largest load fed from the EDGs?

Response

Calculation PA-79-126-1027-E2 specifies that the High Pressure Safety Injection pumps (P41A/B/C) are the highest brake horsepower loads. The power factor for these pumps per the vendor data sheet is 87.5%.

The proposed change to SR 4.8.1.1.2.c.3 added a note to provide guidance with respect to the required power factor when performing the load rejection test associated with the single largest load. This note specified a power factor < 0.90 lagging. The (3) G S. Vissing (NRC) letter to Northeast Nuclear Energy Company, "Issuance of Amendment (TAC No. M87178)," Amendment No. 171, Millstone Nuclear Power Station, Unit No 2, dated February 14, 1994 (4) J. F Opeka letter to U.S Nuclear Regulatory Commission, "Millstone Nuclear Power Station, Unit No. 2, Proposed Revision to Technical Specification, Electrical Power Systems," dated August 4, 1993

U.S. Nuclear Regulatory Commission B1882 1/Attachment 1/Page 3 intent of this note is to require test performance, if grid conditions permit, at a power factor representative of the inductive loading the EDG would see under design basis accident conditions. It was only intended to be representative of the expected reactive loading, not to be based on the rated power factor of the single largest load (i.e.,

< 0.875).

The plant operators control power factor when the EDG is synchronized with offsite power by adjusting reactive load, which is indicated in the Control Room. There is no Control Room indication of EDG power factor. The Control Room operator is provided with a curve to correlate power factor to reactive load based on EDG loading (Kw).

The Control Room reactive load indicator scale is 3000 Kvars lagging to 2000 Kvars leading in 100 Kvar increments. Minimum accuracy for control of EDG reactive loading by the Control Room operator is 50 Kvars, based on the industry standard resolution of one-half the smallest division.

At the low EDG loading specified for this SR (approximately 365 Kw), a small change in reactive loading correlates to a large change in power factor. At this low Kw loading, a 1% change in power factor (0.01) correlates to a change of approximately 11 Kvar. In contrast, at the higher load value specified for SR 4.8.1.1.2.c.4 (approximately 2500 Kw) a 1% change in power factor (0.01) correlates to a change of approximately 74 Kvar.

Due to the smaller change in reactive loading for a given change in power factor at low EDG loads, it is more difficult for the Control Room operator to establish a power factor of 0.875 compared to a power factor of 0.90. In addition, at low EDG loads it is easier for a small change in reactive loading to cause the EDG to operate at a power factor beyond the design rating (0.80).

As a result, DNC believes the proposed power factor value of < 0.90 lagging is correct for the load rejection test of the single largest load. This value is representative of the rated power factor for the largest single load, it is close to the rated power factor of the single largest load, will not unduly challenge the Control Room operator based on the available Control Room indications, and will minimize the potential to operate at a power factor beyond the design of the EDG. In addition, operation of the EDG at a power factor consistent with the design basis EDG loading calculations will be checked in the proposed SR 4.8.1.1.2.c.4 as discussed in the response to Question 3.

U.S. Nuclear Regulatory Commission B118821 /Attachment 1/Page 4 The description of the Technical Specification change to SR 4.8.1.1.2.c.3 (Item 7.b, contained on page 7 of Attachment 1 of our submittal dated August 12, 2002) has been modified to incorporate the above discussion with respect to the specified power factor.

The revised description is as follows:

"A Surveillance Note will be added to specify the desired power factor if this test is performed while paralleled to the grid. The note will specify a lagging power factor. The intent is to establish load conditions as close as practical to design basis conditions. The specified power factor is representative of the actual inductive loading an EDG would see based on the motor rating of the single largest load. It is within the adjustment capability of the Control Room Operator based on the use of reactive load indication to establish the desired power factor. The note will allow test performance at a power factor other than specified, but as close as practical to the specified value. The proposed note is consistent with standard industry guidance (NUREG-1432, SR 3.8.1.9, except for adjusting the specified value based on the use of reactive load indication and associated meter accuracy to establish the desired power factor, and clarifying the limit is associated with a lagging power factor)."

The Safety Summary discussion of the Technical Specification change to SR 4.8.1.1.2.c.3 contained on Attachment 1 Page 19 has been modified to incorporate the above discussion with respect to the specified power factor. The revised description is as follows.

A surveillance note will be added to specify the desired power factor when performing the load rejection tests (SR 4.8.1.1.2.c.3 and SR 4.8.1.1.2.c.4) while paralleled to the grid. This more restrictive change will provide additional administrative control to establish load conditions representative of the motor rating for the single largest load while considering the indication available to the Control Room Operator for the small load rejection test, and representative of design basis loading conditions for the large load rejection test, while allowing test performance at a power factor other than specified, but as close as practical to the specified value. It is consistent with standard industry guidance (NUREG 1432, SR 3.8.1.9 and SR 3.8.1.10, except as previously noted).

The Bases discussion of SR 4.8.1.1.2.c.3 has been modified to incorporate the above discussion with respect to the specified power factor. Attachment 2 of this submittal contains a marked up version of the original retyped Bases page to illustrate the modification. A revised set of retyped pages is contained in Attachment 3. These revised retyped pages are a complete set to replace the retyped pages contained in of the August 2002 submittal.

U.S. Nuclear Regulatory Commission B18821/Attachment 1/Page 5 Question 3 What is the worst case EDG load and its power factor?

Response

The worst case steady state loading for the B EDG (LOCA loading) is 2679 Kw at a power factor of 84% (A EDG steady state LOCA load is 2641 Kw). This is within the continuous rating of 2750 Kw at a power factor of 80%.

The proposed change to SR 4.8.1.1.2.c.4 added a note to provide guidance with respect to the required power factor when performing the load rejection test at the EDG rated load. This note specified a power factor < 0.90 lagging. The intent of this note is to require test performance, if grid conditions permit, at a power factor representative of the inductive loading the EDG would see under design basis accident conditions. After discussions with the NRC reviewer, DNC has agreed to modify the proposed power factor to be consistent with the EDG design load calculation. The proposed value will be changed from < 0.90 lagging to < 0.83 lagging. A value of < 0.83 is consistent the worst case EDG loading, and is within the design rating of the EDG.

No change has been made to the description of the Technical Specification change to SR 4.8.1.1.2.c.4 contained on Attachment 1 Page 8.

The Safety Summary discussion of the Technical Specification change to SR 4.8.1.1.2.c.4 contained on Attachment 1 Page 19 has been modified to incorporate the above discussion with respect to the specified power factor. The revised description is as follows.

A surveillance note will be added to specify the desired power factor when performing the load rejection tests (SR 4.8.1.1.2.c.3 and SR 4.8.1.1.2.c.4) while paralleled to the grid. This more restrictive change will provide additional administrative control to establish load conditions representative of the motor rating for the single largest load while considering the indication available to the Control Room Operator for the small load rejection test, and representative of design basis loading conditions for the large load rejection test, while allowing test performance at a power factor other than specified, but as close as practical to the specified value. It is consistent with standard industry guidance (NUREG 1432, SR 3.8.1.9 and SR 3.8.1.10, except as previously noted).

The proposed SR 4.8.1.1.2.c.4 and the associated Bases discussion have been modified to incorporate the revised power factor value. Attachment 2 of this submittal contains a marked up version of the original retyped Technical Specification and Bases pages to illustrate the modification. A revised set of retyped pages is contained in

U.S. Nuclear Regulatory Commission B18821/Attachment 1/Page 6 . These revised retyped pages are a complete set to replace the retyped pages contained in Attachment 4 of the August 2002 submittal.

Question 4 What is the basis for the current EDG start voltage requirement of SR 4.8.1.1.2.a.2 (i.e.,

97% of rated voltage)?

Response

The EDG voltage regulator is set at 97% (4035 VAC), which is well above the degraded grid voltage relay drop out value of 88% (3660 VAC) and reset voltage value for the degraded grid relays of approximately 92% (3827 VAC).

The values of > 90% of rated speed and to > 97% of rated voltage are consistent with the EDG output breaker control circuitry. When these values are reached the EDG is ready to load. The relays that energize after these values have been obtained will allow the EDG output breaker to automatically close (assuming the associated emergency 4160 VAC bus is deenergized). Once the EDG output breaker closes the EDG sequencer will sequentially load the EDG.

This is functionally equivalent, with respect to the Millstone Unit No. 2 EDGs, to the NUREG-1432 requirement (SR 3.8.1.7) of:

In < [10] seconds, voltage > [3740] V and frequency > [58.8] Hz.

The EDG voltage value of > 97% of rated voltage is high enough to meet the following Safety Guide 9 requirement.

At no time during the loading sequence should voltage decrease to less than 75% of nominal. Voltage should be restored within 10% of nominal in less than 40% of each load sequence time interval.

The worst-case actual voltage dip, based on a previous performance was approximately 81% with a recovery time of 1.2 seconds (limit is 40% of 6.0 seconds or 2.4 seconds). These values are well above the Safety Guide 9 requirements.

The EDG ready to load voltage value of 97% is well above the degraded grid relay drop out and reset setpoints to provide adequate voltage during steady state conditions. The EDG ready to load voltage value of 97% is set high enough to meet Safety Guide 9 requirements such that the voltage does not drop below 75% between EDG loading steps and the voltage recovers to within 10% of nominal value in less than 40% of each load sequence time interval (2.2 seconds of the 5.5 seconds load sequence time interval). A Technical Evaluation has been performed that evaluated the actual voltage

U.S. Nuclear Regulatory Commission B18821/Attachment 1/Page 7 dips by test and the predicted voltage dips. The worst-case actual voltage dip was approximately 81% with a recovery time of approximately 1.2 seconds. The worst case predicted dip was approximately 82%.

Question 5 What is the purpose of each of the proposed EDG SRs? Include the basis for the acceptance criteria specified.

Response

SR 4.8.1.1.2.a.1 This SR verifies the quantity of fuel oil contained in the EDG fuel oil supply tanks (EDG day tanks) every 31 days. This SR provides reasonable assurance sufficient EDG fuel will be available to support EDG operation.

SR 4.8.1.1.2.a.2 This SR verifies the ability of the EDG to start every 31 days by performing a slow controlled start of the EDG following manufacturers recommendations. This provides reasonable assurance the EDG will be available if needed, but it does not check design features such as attaining 90% rated speed and 97% rated voltage within 15 seconds, the automatic start signals, or the automatic load sequence. The proposed additional requirements to verify steady state voltage and frequency conditions provide additional assurance the voltage regulator and governor control circuits are functioning properly.

SR 4.8.1.1.2.a.3 This SR verifies the ability of the EDG to be fully loaded and operate for at least one hour every 31 days by performing a slow controlled loading of the EDG following manufacturers recommendations. This provides reasonable assurance the EDG will be available if needed, but it does not check design features such the automatic start signals, or the automatic load sequence.

SR 4.8.1.1.2.b.1 This SR checks for and removes accumulated water from the EDG fuel oil supply tanks (EDG day tanks) every 92 days. This SR provides reasonable assurance excessive water will not accumulate in the EDG fuel oil supply tanks.

U.S. Nuclear Regulatory Commission B18821/Attachment 1/Page 8 SR 4.8.1.1.2.b.2 This SR verifies the fuel oil properties of new and stored fuel oil in accordance with the Fuel Oil Test Program. This SR provides reasonable assurance the quality of the EDG fuel will be adequate to support EDG operation.

SR 4.8.1.1.2.c.1 - DELETED SR 4.8.1.1.2.c.2 This SR verifies the timing of the EDG loading sequence to ensure the EDG sequencers will properly load the EDG in response to a design basis accident with a loss of offsite power. This SR, which is performed every 18 months, provides reasonable assurance the EDGs will function properly to support accident mitigation.

SR 4.8.1.1.2.c 3 This SR verifies the ability of the EDG to withstand the loss of the single largest load without exceeding a specified frequency limit and then subsequently restore EDG voltage and frequency to a specified band within the allowed time interval. This SR does not verify EDG accident mitigation functions. It does verify the ability of the EDG to continue operation following an equipment malfunction (e.g., pump or breaker failure). This SR is performed every 18 months.

SR 4.8.1.1.2.c.4 This SR verifies the ability of the EDG to withstand complete load rejection without tripping. This SR does not verify EDG accident mitigation functions. It does verify the ability of the EDG to continue operation following an equipment malfunction (e.g., EDG output breaker failure). This SR is performed every 18 months.

SR 4.8.1.1.2.c.5 This SR verifies EDG response following a design basis accident in conjunction with a loss of offsite power. This SR verifies proper load shedding of emergency bus loads, closure of the EDG output breaker (i.e., EDG attains > 90% of rated speed and > 97%

of rated voltage within 15 seconds), subsequent load sequencing of the emergency bus loads, and continued operation for at least 5 minutes. The proposed additional requirements to verify steady state voltage and frequency conditions provide additional assurance the voltage regulator and governor control circuits are functioning properly.

This SR is performed every 18 months.

U.S. Nuclear Regulatory Commission B 18821/Attachment 1/Page 9 SR 4.8.1.1.2.c.6 This SR verifies that numerous EDG protective trips are bypassed when the EDG is started following a design basis accident in conjunction with a loss of offsite power.

This eliminates EDG shutdowns for minor equipment malfunctions when the EDG is the sole source of power. This SR does not verify EDG accident mitigation functions. This SR is performed every 18 months.

SR 4.8.1.1.2.c.7 This SR verifies EDG response following a loss of offsite power without a concurrent design basis accident. This SR verifies proper load shedding of emergency bus loads, closure of the EDG output breaker (i.e., EDG attains > 90% of rated speed and > 97%

of rated voltage within 15 seconds), subsequent load sequencing of the emergency bus loads, and continued operation for at least 5 minutes. The proposed additional requirements to verify steady state voltage and frequency conditions provide additional assurance the voltage regulator and governor control circuits are functioning properly.

This SR is performed every 18 months.

SR 4.8.1.1.2.c.8 This SR verifies EDG response following a design basis accident without a concurrent loss of offsite power. This SR verifies proper fast start operation of the EDG (i.e., EDG attains > 90% of rated speed and > 97% of rated voltage within 15 seconds), the emergency buses remain energized from normal sources, and continued operation of the EDG for at least 5 minutes. The additional (current) requirements to verify steady state voltage and frequency conditions provide additional assurance the voltage regulator and governor control circuits are functioning properly. This SR is performed every 18 months.

SR 4.8.1.1.2.c.9 This SR verifies the ability of the EDG to fast start (i.e., EDG attains > 90% of rated speed and > 97% of rated voltage within 15 seconds) from a hot condition. This ensures the EDG will be available for accident mitigation immediately (within 5 minutes) after shutdown. The proposed additional requirements to verify steady state voltage and frequency conditions provide additional assurance the voltage regulator and governor control circuits are functioning properly. This SR is performed every 18 months.

U.S. Nuclear Regulatory Commission B18821/Attachment 1/Page 10 SR 4.8.1.1.2.d (1,2, and 3)

This SR verifies the ability of the EDG to fast start (i.e., EDG attains > 90% of rated speed and > 97% of rated voltage within 15 seconds) every 184 days. This provides assurance the EDG will start within the assumed accident analysis time frame, but it does not check other design features such as the automatic start signals, or the automatic load sequence. It also verifies the ability of the EDG to be fully loaded and operate for at least one hour by performing a slow controlled loading of the EDG following manufacturers recommendations. The proposed additional requirements to verify steady state voltage and frequency conditions provide additional assurance the voltage regulator and governor control circuits are functioning properly.

Docket No. 50-336 B18821 Attachment 2 Millstone Power Station, Unit No. 2 Response to a Request for Additional Information License Basis Document Change Request 2-9-02 Emergency Diesel Generator Testing Requirements Mark-uD of Oriainal Retvyed Paaes

INDEX ADMINISTRATIVE CONTROLS SECTION PAGE 6.9 REPORTING REQUIREMENTS 6.9.1 ROUTINE REPORTS ..... ....... ........................ .. 6-16 STARTUP REPORTS .............. ....................... ... 6-16 ANNUAL REPORTS ............. ........................ ... 6-17 ANNUAL RADIOLOGICAL REPORTS ..... ....... .................. 6-18 MONTHLY OPERATING REPORT ......... ................. ... 6-18 CORE OPERATING LIMITS REPORT .... ......... ................. 6-18 6.9.2 SPECIAL REPORTS .............. ....................... .. 6-19 6.10 DELETED 6.11 RADIATION PROTECTION PROGRAM ..... ....... .................. 6-22 6.12 HIGH RADIATION AREA ............. ...................... ... 6-22 6.13 SYSTEMS INTEGRITY ...... ..... ........................ .. 6-23 6.14 IODINE MONITORING ................ ...................... 6-23 6.15 RADIOLOGICAL EFFLUENT MONITORING AND OFFSITE DOSE CALCULATION MANUAL (REMODCM) ....... ................. .. 6-24 6.16 RADIOACTIVE WASTE TREATMENT ......... .................. ... 6-24 6.17 SECONDARY WATER CHEMISTRY ........... ........... ........ .. 6-25 6.18 DELETED 6.19 CONTAINMENT LEAKAGE RATE TESTING PROGRAM .... ............ ... 6-26 6.20 RADIOACTIVE EFFLUENT CONTROLS PROGRAM .... ............. .... 6-26 6.21 RADIOLOGICAL ENVIRONMENTAL MONITORING PROGRAM ............. ... 6-27 6.22 REACTOR COOLANT PUMP FLYWHEEL INSPECTION PROGRAM ........... ... 6-28 6.24 DIESEL FUEL OIL TEST PROGRAM ..... ... .................. ... 6-29 MILLSTONE - UNIT 2 XVII Amendment No. 7Y, 79, fi, fJf, 7I9 0867 Jxi, 777, 799, 17~,

"ELECTRICAL POWER SYSTEMS ACTION (Continued)

Inoperable Equipment Required Action

/' t

e. Two diesel e.1 Perform Surveillance Requirement 4.8.1.1.1 generators for the offsite circuits within I hour and at least once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter.

AND e.2 Restore one of the inoperable diesel generators to OPERABLE status within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months or be in HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

AND e.3 Following restoration of one diesel generator restore remaining inoperable diesel generator to OPERABLE status following the time requirements of Action Statement b above based on the initial loss of the remaining inoperable diesel generator.

SURVEILLANCE REQUIREMENTS 4.8.1.1.1 Verify correct breaker alignment and indicated power available for each required offsite circuit at least once per 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

I MILLSTONE 0868

- UNIT 2 3/4 8-2a Amendment No. 777, W7,

ELECTRICAL POWER SYSTEMS 1SURVEILLANCE REQUIREMENTS (Continued) 4.8.1.1.2 Each required diesel generator shall be demonstrated OPERABLE:*

a. At least once per 31 days by: I

1. Verifying the fuel level in the fuel oil supply tank,

2. NOTES

1. A modified diesel generator start involving idling and gradual acceleration to synchronous speed may be used as recommended by the manufacturer. When modified start procedures are not used, the requirements of SR 4.8.1.1.2.d.1 must be met.

2. Performance of SR 4.8.1.1.2.d satisfies this Surveillance Requirement.

Verifying the diesel generator starts from standby conditions and achieves steady state voltage > 3740 V and < 4580 V, and frequency Ž 58.8 Hz and < 61.2 Hz.

3. NOTES

1. Diesel generator loading may include gradual loading as recommended by the manufacturer.

2. Momentary transients outside the load range do not invalidate this test.

3. This test shall be conducted on only one diesel generator at a time.

4. This test shall be preceded by and immediately follow without shutdown a successful performance of SR 4.8.1.1.2.a.2, or SRs 4.8.1.1.2.d.1 and 4.8.1.1.2.d.2.

5. Performance of SR 4.8.1.1.2.d satisfies this Surveillance Requirement.

Verifying the diesel generator is synchronized and loaded, and operates for > 60 minutes at a load > 2475 kW and < 2750 kW.

All diesel starts may be preceded by an engine prelube period.

MILLSTONE 0868

- UNIT 2 3/4 8-3 Amendment No. 777, 77,

ELECTRICAL POWER SYSTEMS SURVEILLANCE REQUIREMENTS (Continued)

b. The diesel fuel oil supply shall be checked by:

1. Checking for and removing accumulated water from each fuel oil storage tank at least once per 92 days.

2. Verifying fuel oil properties of new and stored fuel oil are tested in accordance with, and maintained within the limits of, the Diesel Fuel Oil Testing Program in accordance with the Diesel Fuel Oil Testing Program.

c. At least once per 18 months by:

1. Deleted

2. [ NOTE This surveillance shall not normally be performed in MODE 1, 2, 3, or 4. However, portions of the surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

Verifying that the automatic time delay sequencer is OPERABLE with the following settings:

Sequence Time After Closing of Diesel Generator Step Output Breaker (Seconds)

Minimum Maximum 1 (Tj) 1.5 2.2 2 (T 2 ) T, + 5.5 8.4 3 (T3) T2 + 5.5 14.6 4 (T') T3 ÷ 5.5 20.8 MILLSTONE 0868

- UNIT 2 3/4 8-3a Amendment No. 177, 71, ? ,

ELECTRICAL POWER SYSTEMS 1ýSURVEILLANCE REQUIREMENTS (Continued)

3. NOTE If performed with the diesel generator synchronized with offsite power, this surveillance shall be performed at a power factor < 0.9 lagging. However, if grid conditions do not permit, the power factor limit is not required to be met. Under this condition the power factor shall be maintained as close to the limit as practicable.

Verifying the diesel generator capability to reject a load greater than or equal to its associated single largest post-accident load and:

a. Following load rejection, the frequency is < 63 Hz,

b. Within 2.2 seconds following load rejection, the voltage is > 3740 V and < 4580 V, and

c. Within 2.2 seconds following load rejection, the frequency is > 58.8 Hz and < 61.2 Hz.

4. 0.83 NOTE If performed withithe diesel generator synchronized with offsite power, this surveillance shall be performed at a power factor < .4lagging. However, if grid conditions do not permit, the power factor limit is not required to be met. Under this condition the power factor shall be maintained as close to the limit as practicable.

Veriyfing the diesel generator does not trip following a load rejection of > 2475 kW and < 2750 kW.

MILLSTONE - UNIT 2 3/4 8-3b Amendment No.

0868

Im ELECTRICAL POWER SYSTEMS SURVEILLANCE REQUIREMENTS (Continued)

5. NOTE This surveillance shall not normally be performed in MODE 1, 2, 3, or 4. However, portions of the surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

Verifying on an actual or simulated loss of offsite power in conjunction with an actual or simulated Engineered Safety Feature actuation signal:

a. De-energization of emergency buses,

b. Load shedding from emergency buses,

c. Diesel generator auto-starts from standby condition, and:

1. energizes permanently connected loads in < 15 seconds,

2. energizes auto-connected loads through the load sequencer,

3. achieves steady state voltage > 3740 V and < 4580 V,

4. achieves steady state frequency > 58.8 Hz and

< 61.2 Hz and,

5. energizes permanently connected and auto-connected loads for > 5 minutes.

6. NOTE This surveillance shall not normally be performed in MODE 1, 2, 3, or 4. However, this surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

Verifying diesel generator automatic trips are bypassed on an actual or simulated loss of offsite power in conjunction with an actual or simulated Engineered Safety Feature actuation signal except:

a. Engine overspeed,

b. Generator differential current,

c. Voltage restraint overcurrent, and

d. Low lube oil pressure (switches to 2 out of 3 logic).

MILLSTONE - UNIT 2 3/4 8-3c Amendment No.

0868

ELECTRICAL POWER SYSTEMS SURVEILLANCE REQUIREMENTS (Continued)

7. NOTES

1. This surveillance shall not normally be performed in MODE 1, 2, 3, or 4. However, portions of the surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

2. The start of the diesel generator from a standby condition is not required if this surveillance is performed in conjunction with SR 4.8.1.1.2.c.5.

Verifying on an actual or simulated loss of offsite power signal:

a. De-energization of emergency buses,

b. Load shedding from emergency buses,

c. Diesel generator auto-starts from standby condition and:

1. energizes permanently connected loads in

< 15 seconds,

2. energizes auto-connected loads through the load sequencer,

3. achieves steady state voltage > 3740 V and < 4580 V,

4. achieves steady state frequency Ž 58.8 Hz and

< 61.2 Hz and,

5. energizes permanently connected and auto-connected loads for > 5 minutes.

MILLSTONE - UNIT 2 3/4 8-3d 0868 Amendment No.

ELECTRICAL POWER SYSTEMS SURVEILLANCE REQUIREMENTS (Continued)

!4

8. Verifying on an actual or simulated Engineered Safety Feature actuation signal the diesel generator auto-starts from a standby condition and:

a. Achieves > 90% of rated speed and > 97% of rated voltage in S15 seconds,

b. Achieves steady state voltage > 3740 V and < 4580 V,

c. Achieves steady state frequency t 58.8 Hz and < 61.2 Hz,

d. Operates for > 5 minutes,

e. Permanently connected loads remain energized from the offsite power system, and

f. Auto-connected loads remain energized from the offsite power system as appropriate for plant conditions.

9. NOTE This surveillance shall be performed within 5 minutes of shutting down the diesel generator after the diesel generator has operated > 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months loaded > 2475 kW and

< 2750 kW. Momentary transients outside the load range do not invalidate this test.

Verifying the diesel generator starts and:

a. Accelerates to > 90% of rated speed and > 97% of rated voltage in < 15 seconds, and

b. Achieves steady state voltage > 3740 V and < 4580 V, and frequency k 58.8 Hz and < 61.2 Hz.

MILLSTONE - UNIT 2 3/4 8-3e Amendment No.

0868

ELECTRICAL POWER SYSTEMS SSURVEILLANCE REQUIREMENT (Continued)

d. At least once per 184 days by:

1. Verifying the diesel starts from standby conditions and accelerates to > 90% of rated speed and to > 97% of rated voltage within 15 seconds after the start signal.

2. Verifying the diesel generator achieves steady state voltage

> 3740 V and < 4580 V, and frequency > 58.8 Hz and < 61.2 Hz.

3. 1 NOTES

1. Diesel generator loading may include gradual loading as recommended by the manufacturer.

2. Momentary transients outside the load range do not invalidate this test.

3. This test shall be conducted on only one diesel generator at a time.

4. This test shall be preceded by and immediately follow without shutdown a successful performance of SRs 4.8.1.1.2.d.1 and 4.8.1.1.2.d.2, or SR 4.8.1.1.2.a.2.

Verifying the diesel generator is synchronized and loaded, and operates for > 60 minutes at a load > 2475 kW and < 2750 kW.

MILLSTONE - UNIT 2 3/4 8-4 Amendment No. 71, 0868

ELECTRICAL POWER SYSTEMS SHUTDOWN LIMITING CONDITION FOR OPERATION 3.8.1.2 As a minimum, the following A.C. electrical power sources shall be OPERABLE:

a. One circuit between the offsite transmission network and the onsite Class IE distribution system, and

b. One diesel generator with a fuel oil supply tank containing a minimum of 12,000 gallons of fuel.

APPLICABILITY: MODES 5 and 6.

ACTION:

With less than the above minimum required A.C. electrical power sources OPERABLE, suspend all operations involving CORE ALTERATIONS or positive reactivity changes or movement of irradiated fuel assemblies.

SURVEILLANCE REQUIREMENTS 4.8.1.2 The above required A.C. electrical power sources shall be demonstrated OPERABLE per Surveillance Requirements 4.8.1.1.1 and 4.8.1.1.2, except for testing pursuant to Surveillance Requirements 4.8.1.1.2.a.3, 4.8.1.1.2.c.2, 4.8.1.1.2.c.5, 4.8.1.1.2.c.6, 4.8.1.1.2.c.7, and 4.8.1.1.2.d.3. I MILLSTONE - UNIT 2 3/4 8-5 Amendment No. 797, 771, 0868

3/4.8 ELECTRICAL POWER SYSTEMS BASES The 14 day allowed outage time for one inoperable Millstone Unit No. 2 diesel generator will allow performance of extended diesel generator maintenance and repair activities (e.g., diesel i6spections) while the plant is operating. To minimize plant risk when using this extended allowed outage time the following additional requirements must be met:

1. The extended diesel generator maintenance outage shall not be scheduled when adverse or inclement weather conditions and/or unstable grid conditions are predicted or present.

2. The availability of the Millstone Unit No. 3 SBO DG shall be verified by test performance within the previous 30 days prior to allowing a Millstone Unit No. 2 diesel generator to be inoperable for greater than 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

3. All activity in the switchyard shall be closely monitored and controlled. No elective maintenance within the switchyard that could challenge offsite power availability shall be scheduled.

In addition, the plant configuration shall be controlled during the diesel generator maintenance and repair activities to minimize plant risk consistent with a Configuration Risk Management Program, as required by 10 CFR 50.65(a)(4).

Diesel Generator Testing An engine prelube period is allowed prior to engine start for all diesel generator testing. This will minimize wear on moving parts that do not get lubricated when the engine is not running.

When specified in the surveillance tests, the diesel generators must be started from a standby condition. Standby condition for a diesel generator means the diesel engine coolant and oil are being circulated and temperature is being maintained consistent with manufacturer recommendations.

SR 4.8.1.1.2.a.2 This surveillance helps to ensure the availability of the standby electrical power supply to mitigate design basis accidents and transients and to maintain the unit in a safe shutdown condition. It verifies the ability of the diesel generator to start from a standby condition and achieve steady state voltage and frequency conditions. The time for voltage and speed (frequency) to stabilize is periodically monitored and the trend evaluated to identify degradation of governor or voltage regulator performance when testing in accordance with the requirements of this surveillance.

MILLSTONE - UNIT 2 B 3/4 8-ic Amendment No. Xg, Xg, 771, 0869 7 47,

3/4.8 ELECTRICAL POWER SYSTEMS BASES This surveillance is modified by two notes. Note I allows the use of a modified start based on recommendations of the mafiufacturer to reduce stress and wear on diesel engines. When using a modified start, the starting speed of the diesel generators is limited, warmup is limited to this lower speed, and the diesel generators are gradually accelerated to synchronous speed prior to loading. If a modified start is not used, the 15 second start requirement of SR 4.8.1.1.2.d applies. Note 2 states that SR 4.8.1.1.2.d, a more rigorous test, may be performed in lieu of 4.8.1.1.2.a.

During performance of SR 4.8.1.1.2.a.2, the diesel generator shall be started by using one of the following signals:

1. Manual;

2. Simulated loss of offsite power in conjunction with a safety injection actuation signal;

3. Simulated safety injection actuation signal alone; or

4. Simulated loss of power alone.

The 31 day frequency for SR 4.8.1.1.2.a.2 is consistent with standard industry guidelines.

SR 4.8.1.1.2.a.3 This surveillance verifies that the diesel generators are capable of synchronizing with the offsite electrical system and accepting loads greater than or equal to the equivalent of the maximum expected accident loads. A minimum run time of 60 minutes is required to stabilize engine temperatures, while minimizing the time that the diesel generator is connected to the offsite source. Although no power factor requirements are established by this surveillance, the diesel generator is normally operated at a power factor between 0.8 lagging and 1.0. The 0.8 value is the design rating of the machine, while 1.0 is an operational limitation.

This surveillance is modified by five Notes. Note 1 indicates that diesel engine runs for this surveillance may include gradual loading, as recommended by the manufacturer, so that mechanical stress and wear on the diesel engine are minimized. Note 2 states that momentary transients because of changing bus loads do not invalidate this test-. Similarly, momentary power factor transients above the limit will not invalidate the test. Note 3 indicates that this surveillance should be conducted on only one diesel generator at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations. Note 4 stipulates a prerequisite requirement for performance of this surveillance. A successful diesel generator start must precede this test to credit satisfactory performance. Note 5 states that SR 4.8.1.1.2.d, a more rigorous test, may be performed in lieu of 4.8.1.1.2.a.

The 31 day frequency for SR 4.8.1.1.2.a.3 is consistent with standard industry guidelines.

MILLSTONE 0869

- UNIT 2 B 3/4 8-1d Amendment No.

I-3/4.8 ELECTRICAL POWER SYSTEMS BASES SR 4.8.1.1.2.b.1 Microbiological fouling is a major cause of fuel oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Removal of water from the three fuel storage tanks once every 92 days eliminates the necessary environment for bacterial survival. This is the most effective means of controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during EDG operation. Water may come from any of several sources, including condensation, rain water, contaminated fuel oil, and from breakdown of the fuel oil by bacteria. Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. This surveillance is for preventative maintenance. The presence of water does not necessarily represent failure of this surveillance provided the accumulated water is removed during performance of the surveillance.

SR 4.8.1.1.2.b.2 This surveillance requires testing of the new and stored fuel oil in accordance with the Diesel Fuel Oil Testing Program, as defined in Section 6 of the Technical Specifications.

The tests listed below are a means of determining whether new fuel oil is of the appropriate grade and has not been contaminated with substances that would have an immediate, detrimental impact on diesel engine combustion. If results from these tests are within acceptable limits, the fuel oil may be added to the storage tanks without concern for contaminating the entire volume of fuel oil in the storage tanks. These tests are to be conducted prior to adding the new fuel to the storage tank(s), but in no case is the time between receipt of new fuel and conducting the tests to exceed 31 days. The tests, limits, and applicable ASTM Standards are as follows (more restrictive State of Connecticut and/or equipment limits may apply):

a. Sample the new fuel oil in accordance with ASTM D4057,

b. Verify in accordance with the tests specified in ASTM D975-81 that the sample has an absolute specific gravity at 60/60°F of > 0.83 and

< 0.89, or an API gravity at 60°F of > 270 and < 390, a kinematic viscosity at 40°C of > 1.9 centistokes and < 4.1 centistokes (alternatively, Saybolt viscosity, SUS at 100°F of > 32.6 but 0

< 40.1) and a flash point > 125 F, and

c. Verify that the new fuel oil has water and sediment < 0.05% when tested in accordance with ASTM D1796-83.

MILLSTONE - UNIT 2 B 3/4 8-le Amendment No.

0869

U 3/4.8 ELECTRICAL POWER SYSTEMS

,* BASES Failure to meet any of the above limits is cause for rejecting the new fuel oil, but does not represent a failure to meet the LCO concern since the fuel oil is not added to the storage tanks. Within 31 days following the initial new fuel oil sample, the fuel oil is analyzed to establish that the other properties specified in Table 1 of ASTM D975-81 are met for new fuel oil when tested in accordance with ASTM D975-81, except that the analysis for sulfur may be performed in accordance with ASTM D1552 or ASTM D2622. The 31 day period is acceptable because the fuel oil properties of interest, even if they were not within stated limits, would not have an immediate effect on DG operation.

This surveillance ensures the availability of high quality fuel oil for the diesel generators. Fuel oil degradation during long term storage shows up as an increase in particulate, due mostly to oxidation. The presence of particulate does not mean the fuel oil will not burn properly in a diesel engine. The particulate can cause fouling of filters and fuel oil injection equipment, however, which can cause engine failure. Particulate concentrations should be determined in accordance with ASTM D2276-78, Method A, every 92 days. This method involves a gravimetric determination of total particulate concentration in the fuel oil and has a limit of 10 mg/l. It is acceptable to obtain a field sample for subsequent laboratory testing in lieu of field testing.

The frequency of this test takes into consideration fuel oil degradation trends that indicate that particulate concentration is unlikely to change significantly between surveillance intervals.

SR 4.8.1.1.2.c.2 Under accident and loss of offsite power conditions, loads are sequentially connected to the bus by the automatic load sequencer. The sequencing logic controls the permissive and starting signals to motor breakers to prevent overloading of the diesel generators due to high motor starting currents. The load sequence time interval tolerances ensure that sufficient time exists for the diesel generator to restore frequency and voltage prior to applying the next load and that safety analysis assumptions regarding Engineered Safety Features (ESF) equipment time delays are not violated.

The 18 month frequency is based on engineering judgment, taking into consideration unit conditions required to perform the surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the surveillance when performed at the 18 month frequency. Therefore, the frequency is acceptable from a reliability standpoint.

MILLSTONE - UNIT 2 B 3/4 8-If Amendment No.

0869

3/4.8 ELECTRICAL POWER SYSTEMS BASES This surveillance is modified by a Note. The reason for the Note is that performing the surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally performing the surveillance in MODE 1, 2, 3, or 4 is further amplified to allow the surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced.

This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed surveillance, a successful surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when the surveillance is performed in MODE 1, 2, 3, or 4. Risk insights or deterministic methods may be used for this assessment.

SR 4.8.1.1.2.c.3 Each diesel generator is provided with an engine overspeed trip to prevent damage to the engine. Recovery from the transient caused by the loss of a large load could cause diesel engine overspeed, which, if excessive, might result in a trip of the engine. This surveillance demonstrates the diesel generator load response characteristics and capability to reject the largest single load without exceeding a predetermined frequency limit. The single largest load for each diesel generator is identified in the FSAR (Tables 8.3-2 and 8.3-3).

This surveillance may be accomplished by either:

a. Tripping the diesel generator output breaker with the diesel generator carrying greater than or equal to its associated single largest post-accident load while paralleled to offsite power or while solely supplying the bus; or

b. Tripping the equivalent of the single largest post-accident load with the diesel generator solely supplying the bus.

The time, voltage, and frequency tolerances specified in this surveillance are based on the response during load sequence intervals. The 2.2 seconds specified is equal to 40% of the 5.5 second load sequence interval associated with sequencing of the largest load (Safety Guide 9). The voltage and frequency specified are consistent with the design range of the equipment powered by the diesel generator. SR 4.8.1.1.2.c.3.a corresponds to the maximum frequency excursion, while SR 4.8.1.1.2.c.3.b and SR 4.8.1.1.2.c.3.c are steady state voltage and frequency values to which the system must recover following load rejection.

MILLSTONE - UNIT 2 B 3/4 8-Ig Amendment No.

0869

3/4.8 ELECTRICAL POWER SYSTEMS &51 J oA , ,*oA- r-//nL 0o/tAr V`/^

BASES iC7ad10 11-.-o A 1 The 18 month frequency is based on engineering judgment, taking into consideration unit conditions required to perforMn the surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the surveillance when performed at the 18 month frequency. Therefore, the frequency is acceptable

rom a reliability standpoint.

>This surveillance is modified by a Note to ensure that the diesel generator is

',,tested under load conditions that are as close to design basis conditions as f -*-ss444--. When synchronized with offsite power, testing should be performed at a power factor of < 0.9 lagging. This power factor is representative of the -aete-& inductive loading a diesel generator would see accident conditions. Under certain conditions, however, the note allows the surveillance to be conducted at a power factor other than < 0.9. These conditions occur when grid voltage is high, and the additional field excitation needed to get the power factor to < 0.9 results in voltages on the emergency buses that are too high. Under these conditions, the power factor should be maintained as close as practicable to 0.9 while still maintaining acceptable voltage limits on the emergency buses. In other circumstances, the grid voltage may be such that the diesel generator excitation levels needed to obtain a power factor of 0.9 may not cause unacceptable voltages on the emergency buses, but the excitation levels are in excess of those recommended for the diesel generator. In such cases, the power factor shall be maintained as close as practicable to O.S lagging without exceeding the diesel generator excitation limits.

SR 4.8.1.1.2.c.4 This surveillance demonstrates the diesel generator capability to reject a rated load without overspeed tripping. A diesel generator rated load rejection may occur because of a system fault or inadvertent breaker tripping.

This surveillance ensures proper engine generator load response under the simulated test conditions. This test simulates the loss of the total connected load that the diesel generator experiences following a rated load rejection and verifies that the diesel generator will not trip upon loss of the load. While the diesel generator is not expected to experience this transient during an event, this response ensures that the diesel generator is not degraded for future application, including reconnection to the bus if the trip initiator can be corrected or isolated.

This surveillance is performed by tripping the diesel generator output breaker with the diesel generator carrying the required load while paralleled to offsite power.

The 18 month frequency is based on engineering judgment, taking into consideration unit conditions required to perform the surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the surveillance when performed at the 18 month frequency. Therefore, the frequency is acceptable from a reliability standpoint.

MILLSTONE - UNIT 2 B 3/4 8-1h Amendment No.

0869

3/4.8 ELECTRICAL POWER SYSTEMS BASES f .CThis surveillance is modified by a Note to ensure that the diesel generator is tested under load conditions that are as close to design basis conditions as

-pxo.s-ie. When synchronized with offsite power, testing should be performed at a power factor of <--9 lagging. This power factor is representative of thee -aetta+ inductive loading a diesel generator would see under design basis accident conditions. Under certain conditions, however, the note allows the surveillance to be conducted at a power factor other than < hese conditions occur when grid voltage is high, and the additional field excitation needed to get the power factor to <-G--9results in voltages on the emergency buses that are too high. Under these conditionste power factor should be maintained as close as practicable to -O-9-* whie_ still maintaining acceptable voltage limits on the emergency buses. In other circumstances, the grid voltage may be such that the diesel generator excitation levels needed to obtain a power factor of -O-*-9 may not cause unacceptable voltages on the emergency buses, but the excitation levels are in excess of those recommended for the diesel generator. In such eases, the power factor shall be maintained as close as practicable to lagging without exceeding the diesel generator excitation limits. " .{3 SR 4.8.1.1.2.c.5 In the event of a design basis accident coincident with a loss of offsite power, the diesel generators are required to supply the necessary power to ESF systems so that the fuel, RCS, and containment design limits are not exceeded.

This surveillance demonstrates the diesel generator operation during a loss of offsite power actuation test signal in conjunction with an ESF actuation signal, including shedding of the nonessential loads and energization of the emergency buses and respective loads from the diesel generator. It further demonstrates the capability of the diesel generator to automatically achieve the required voltage and speed (frequency) within the specified time. The diesel generator auto-start time of 15 seconds is derived from requirements of the accident analysis to respond to a design basis large break LOCA. The surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability has been achieved. The requirement to verify the connection of permanent and auto connected loads is intended to satisfactorily show the relationship of these loads to the diesel generator loading logic. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the diesel generator system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The 18 month frequency is based on engineering judgment, taking into consideration unit conditions required to perform the surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the surveillance when MTIII.TNF - IINTT 9 B 3/4 8-1i -Amendment No.

0869

3/4.8 ELECTRICAL POWER SYSTEMS BASES performed at the 18 month frequency. Therefore, the frequency is acceptable from a reliability standpoint.

For the purpose of this testing, the diesel generators must be started from a standby condition. Standby condition for a diesel generator means the diesel engine coolant and oil are being circulated and temperature is being maintained consistent with manufacturer recommendations.

This surveillance is modified by a Note. The reason for the Note is that performing the surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally performing the surveillance in MODE 1, 2, 3, or 4 is further amplified to allow portions of the surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial surveillance, a successful partial surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the surveillance are performed in MODE 1, 2, 3, or 4. Risk insights or deterministic methods may be used for the assessment.

SR 4.8.1.1.2.c.6 This surveillance demonstrates that diesel generator noncritical protective functions (e.g., high jacket water temperature) are bypassed on a loss of voltage signal concurrent with an ESF actuation test signal. During this time, the critical protective functions (engine overspeed, generator differential current, low lube oil pressure [2 out of 3 logic], and voltage restraint overcurrent) remain available to trip the diesel generator and/or output breaker to avert substantial damage to the diesel generator unit. An EDG Emergency Start Signal (Loss of Power signal or SIAS) bypasses the EDG mechanical trips in the EDG control circuit, except engine overspeed, and switches the low lube oil trip to a 2 of 3 coincidence. The loss of power to the emergency bus, based on supply breaker position (A302, A304, and A505 for Bus 24C; A410, A411, and A505 for Bus 24D), bypasses the EDG electrical trips in the breaker control circuit except generator differential current and voltage restraint overcurrent. The noncritical trips are bypassed during design basis accidents and provide an alarm on an abnormal engine condition.

This alarm provides the operator with sufficient time to react appropriately.

The diesel generator availability to mitigate the design basis accident is more critical than protecting the engine against minor problems that are not immediately detrimental to emergency operation of the diesel generator.

MILLSTONE - UNIT 2 B 3/4 8-1i Amendment No.

0869

3/4.8 ELECTRICAL POWER SYSTEMS BASES The 18 month frequency is based on engineering judgment, taking into consideration unit conditions required to perform the surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the surveillance when performed at the 18 month frequency. Therefore, the frequency is acceptable from a reliability standpoint.

This surveillance is modified by a Note. The reason for the Note is that performing the surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally performing the surveillance in MODE 1, 2, 3, or 4 is further amplified to allow portions of the surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial surveillance, a successful partial surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the surveillance are performed in MODE 1, 2, 3, or 4. Risk insights or deterministic methods may be used for the assessment.

SR 4.8.1.1.2.c.7 This surveillance demonstrates the as designed operation of the standby power sources during loss of the offsite source. This test verifies all actions encountered from the loss of offsite power, including shedding of the nonessential loads and energization of the emergency buses and respective loads from the diesel generator. It further demonstrates the capability of the diesel generator to automatically achieve the required voltage and speed (frequency) within the specified time. The diesel generator auto-start time of 15 seconds is derived from requirements of the accident analysis to respond to a design basis large break LOCA. The surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability has been achieved. The requirement to verify the connection and power supply of permanent and auto-connected loads is intended to satisfactorily show the relationship of these loads to the diesel generator loading logic. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the diesel generator system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The 18 month frequency is based on engineering judgment, taking into consideration unit conditions required to perform the surveillance, and is MILLSTONE - UNIT 2 B 3/4 8-1k Amendment No.

0869

3/4.8 ELECTRICAL POWER SYSTEMS BASES intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the surveillance when performed at the 18 month frequency. Therefore, the frequency is acceptable from a reliability standpoint.

This surveillance is modified by two Notes. The reason for Note 1 is that performing the surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally performing the surveillance in MODE 1, 2, 3, or 4 is further amplified to allow portions of the surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum,' consider the potential outcomes and transients associated with a failed partial surveillance, a successful partial surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the surveillance are performed in MODE 1, 2, 3, or 4. Risk insights or deterministic methods may be used for the assessment.

Surveillance Note 2 specifies that the start of the diesel generator from a standby condition is not required if this surveillance is performed in conjunction with SR 4.8.1.1.2.c.5. Since this test is normally performed in conjunction with SR 4.8.1.1.2.c.5, the proposed note will exclude the requirement to start from a standby condition to minimize the time to perform this test. This will reduce shutdown risk since plant restoration, and subsequent equipment availability will occur sooner. In addition, it is not necessary to test the ability of the EDG to auto start from a standby condition for this test since that ability will have already been verified by SR 4.8.1.1.2.c.5, which will have just been performed if the note's exclusion is to be utilized. If this test is to be performed by itself, the EDG is required to start from a standby condition.

SR 4.8.1.1.2.c.8 This surveillance demonstrates that the diesel generator automatically starts and achieves the required voltage and speed (frequency) within the specified time (15 seconds) from the design basis actuation signal (Safety Injection Actuation Signal) and operates for _> 5 minutes. The 5 minute period provides sufficient time to demonstrate stability. Since the specified actuation signal (ESF signal without loss of offsite power) will not cause the emergency bus loads to be shed, and will not cause the diesel generator to load, the surveillance ensures that permanently connected loads and autoconnected loads remain energized from the offsite electrical power system (Unit 2 RSST or NSST, or Unit 3 RSST or NSST). In certain circumstances, many of these loads cannot actually be connected without undue hardship or potential for undesired MIIITnNF - UNIT 2 B 3/4 8-11 Amendment No.

F -- 4 ....

0869

3/4.8 ELECTRICAL POWER SYSTEMS BASES operation. It is not necessary to verify all autoconnected loads remain connected. A representative sample is acceptable.

The 18 month frequency is based on engineering judgment, taking into consideration unit conditions required to perform the surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the surveillance when performed at the 18 month frequency. Therefore, the frequency is acceptable from a reliability standpoint.

For the purpose of this testing, the diesel generators must be started from a standby condition. Standby condition for a diesel generator means the diesel engine coolant and oil are being circulated and temperature is being maintained consistent with manufacturer recommendations.

SR 4.8.1.1.2.c.9 This surveillance demonstrates that the diesel engine can restart from a hot condition, such as subsequent to shutdown from a normal surveillance, and achieve the required voltage and speed within 15 seconds. The 15 second time is derived from the requirements of the accident analysis to respond to a design basis large break LOCA.

The 18 month frequency is based on engineering judgment, taking into consideration unit conditions required to perform the surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the surveillance when performed at the 18 month frequency. Therefore, the frequency is acceptable from a reliability standpoint.

This surveillance is modified by a Note. The Note ensures that the test is performed with the diesel sufficiently hot. The load band is provided to avoid routine overloading of the diesel generator. Routine overloads may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain diesel generator OPERABILITY. The requirement that the diesel has operated for at least I hour at rated load conditions prior to performance of this surveillance is based on manufacturer recommendations for achieving hot conditions. Momentary transients due to changing bus loads do not invalidate this test.

MILLSTONE - UNIT 2 B 3/4 8-i1m Amendment No.

0869

3/4.8 ELECTRICAL POWER SYSTEMS BASES SRs 4.8.1.1.2.d.1 and 4.8.1.1.2.d.2 SR 4.8.1.1.2.d.1 verifies that, at a 184 day frequency, the diesel generator starts from standby conditions and achieves required voltage and speed (frequency) within 15 seconds. The 15 second start requirement supports the assumptions of the design basis LOCA analysis in the FSAR. Diesel generator voltage and speed will continue to increase to rated values, and then should stabilize. SR 4.8.1.1.2.d.2 verifies the ability of the diesel generator to achieve steady state voltage and frequency conditions. The time for voltage and speed (frequency) to stabilize is periodically monitored and the trend evaluated to identify degradation of governor or voltage regulator performance when testing in accordance with the requirements of this surveillance.

The 184 day frequency for this surveillance is a reduction in cold testing consistent with Generic Letter 84-15. This frequency provides adequate assurance of diesel generator OPERABILITY, while minimizing degradation resulting from testing. In addition, SR 4.8.1.1.2.d may be performed in lieu of 4.8.1.1.2.a.

For the purpose of this testing, the diesel generators must be started from a standby condition. Standby condition for a diesel generator means the diesel engine coolant and oil are being circulated and temperature is being maintained consistent with manufacturer recommendations.

During performance of SR 4.8.1.1.2.d.1, the diesel generators shall be started by using one of the following signals:

1. Manual;

2. Simulated loss of offsite power in conjunction with a safety injection actuation signal;

3. Simulated safety injection actuation signal alone; or

4. Simulated loss of power alone.

SR 4.8.1.1.2.d.3 This surveillance verifies that the diesel generators are capable of synchronizing with the offsite electrical system and accepting loads greater than or equal to the equivalent of the maximum expected accident loads. A minimum run time of 60 minutes is required to stabilize engine temperatures, while minimizing the time that the diesel generator is connected to the offsite source. Although no power factor requirements are established by this surveillance, the diesel generator is normally operated at a power factor between 0.8 lagging and 1.0. The 0.8 value is the design rating of the machine, while 1.0 is an operational limitation.

The 184 day frequency for this surveillance is a reduction in cold testing consistent with Generic Letter 84-15. This frequency provides adequate assurance of diesel generator OPERABILITY, while minimizing degradation resulting from testing.

MTIt-TfnNF - IINIT 2 B 3/4 8-in Amendment No.

w -- / .. ...

0869

3/4.8 ELECTRICAL POWER SYSTEMS BASES This SR is modified by four Notes. Note I indicates that diesel engine runs for this surveillance may include gradual loadfing, as recommended by the manufacturer, so that mechanical stress and wear on the diesel engine are minimized. Note 2 states that momentary transients because of changing bus loads do not invalidate this test. Similarly, momentary power factor transients above the limit will not invalidate the test. Note 3 indicates that this surveillance should be conducted on only one diesel generator at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations. Note 4 stipulates a-prerequisite requirement for performance of this surveillance. A successful diesel generator start must precede this test to credit satisfactory performance.

The OPERABILITY of the minimum specified A.C.and D.C. power sources and associated distribution systems during shutdown and refueling ensures that

1) the facility can be maintained in the shutdown or refueling condition for extended time periods and 2) sufficient instrumentation and control capability is available for monitoring and maintaining the facility status.

If the required power sources or distribution systems are not OPERABLE in MODES 5 and 6, operations involving CORE ALTERATIONS, positive reactivity changes, or movement of irradiated fuel assemblies are required to be suspended. The required action to suspend positive reactivity additions does not preclude actions to maintain or increase reactor vessel inventory provided the boron concentration of the makeup water source is greater than or equal to the boron concentration for the required SHUTDOWN MARGIN. In addition, suspension of these activities does not preclude completion of actions to establish a safe conservative plant condition.

The non-safety grade 125V D.C. Turbine Battery is required for accident mitigation for a main steam line break within containment with a coincident loss of a vital D.C. bus. The Turbine Battery provides the alternate source of power for Inverters I & 2 respectively via non-safety grade Inverters 5 &

6. For the loss of a D.C. event with a coincident steam line break within containment, the feedwater regulating valves are required to close to ensure containment design pressure is not exceeded.

MILLSTONE - UNIT 2 B 3/4 8-1o Amendment No. 7*, 7*, *J, 0869 79 ,

1.1 ADMINISTRATIVE CONTROLS 6.24 Diesel Fuel Oil Test Proqram

.0 A diesel fuel oil testing program to implement required testing of both new fuel oil and stored fuel oil shall be established. The program shall include sampling and testing requirements, and acceptance criteria, all in accordance with applicable ASTM Standards. The purpose of the program is to establish the following:

a. Acceptability of new fuel oil for use prior to addition to storage tanks by determining that the fuel oil has:

1. An API gravity or an absolute specific gravity within limits,

2. A flash point and kinematic viscosity within limits for ASTM 2D fuel oil, and

3. Water and sediment < 0.05%.

b. Within 31 days following addition of the new fuel oil to storage tanks, verify that the properities of the new fuel oil, other than those addressed in a., above, are within limits for ASTM 2D fuel oil, and

c. Total particulate concentration of the fuel oil is < 10 mg/l when tested every 92 days in accordance with ASTM D-2276-78, Method A.

The provisions of Surveillance Requirements 4.0.2 and 4.0.3 are applicable to the Diesel Fuel Oil Test Program test frequencies.

MILLSTONE - UNIT 2 6-29 Amendment No.

0870

Docket No. 50-336 B18821 Attachment 3 Millstone Power Station, Unit No. 2 Response to a Request for Additional Information License Basis Document Change Request 2-9-02 Emergency Diesel Generator Testing Requirements Revised Set of Retyped Pages

INDEX ADMINISTRATIVE CONTROLS SECTION PAGE 6.9 REPORTING REQUIREMENTS 6.9.1 ROUTINE REPORTS .............. ........................ .. 6-16 STARTUP REPORTS ... ................. ............. ... 6-16 ANNUAL REPORTS ............... ........................ .. 6-17 ANNUAL RADIOLOGICAL REPORTS ............ .................. 6-18 MONTHLY OPERATING REPORT ........... ................... ... 6-18 CORE OPERATING LIMITS REPORT ......... ................. ... 6-18 6.9.2 SPECIAL REPORTS ................ ....................... ... 6-19 6.10 DELETED 6.11 RADIATION PROTECTION PROGRAM ............ .................. 6-22 6.12 HIGH RADIATION AREA ................ ...................... 6-22 6.13 SYSTEMS INTEGRITY ........... ........................ .. 6-23 6.14 IODINE MONITORING ........... ........................ .. 6-23 6.15 RADIOLOGICAL EFFLUENT MONITORING AND OFFSITE DOSE CALCULATION MANUAL (REMODCM) ....... ................. .. 6-24 6.16 RADIOACTIVE WASTE TREATMENT ............. .................. 6-24 6.17 SECONDARY WATER CHEMISTRY ........... ................... ... 6-25 6.18 DELETED 6.19 CONTAINMENT LEAKAGE RATE TESTING PROGRAM ..... ............ ... 6-26 6.20 RADIOACTIVE EFFLUENT CONTROLS PROGRAM ..... .............. ... 6-26 6.21 RADIOLOGICAL ENVIRONMENTAL MONITORING PROGRAM .... .......... .. 6-27 6.22 REACTOR COOLANT PUMP FLYWHEEL INSPECTION PROGRAM ... ........ .. 6-28 6.24 DIESEL FUEL OIL TEST PROGRAM ............ .................. 6-29 MILLSTONE - UNIT 2 XVII Amendment No. 79, 7, 9, 9, J9, 0867 lo 79, M, X777,

ELECTRICAL POWER SYSTEMS ACTION (Continued)

Inoperable Equipment Required Action

e. Two diesel e.1 Perform Surveillance Requirement 4.8.1.1.1 generators for the offsite oircuits within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and at least once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter.

AND e.2 Restore one of the inoperable diesel generators to OPERABLE status within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months or be in HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

AND e.3 Following restoration of one diesel generator restore remaining inoperable diesel generator to OPERABLE status following the time requirements of Action Statement b above based on the initial loss of the remaining inoperable diesel generator.

SURVEILLANCE REQUIREMENTS 4.8.1.1.1 Verify correct breaker alignment and indicated power available for each required offsite circuit at least once per 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

I MILLSTONE 0868

- UNIT 2 3/4 8-2a Amendment No. 777, 777,

ELECTRICAL POWER SYSTEMS 1I SURVEILLANCE REQUIREMENTS (Continued) 4.8.1.1.2 Each required diesel generator shall bedemonstrated OPERABLE:*

a. At least once per 31 days by: I

1. Verifying the fuel level in the fuel oil supply tank,

2. NOTES

1. A modified diesel generator start involving idling and gradual acceleration to synchronous speed may be used as recommended by the manufacturer. When modified start procedures are not used, the requirements of SR 4.8.1.1.2.d.1 must be met.

2. Performance of SR 4.8.1.1.2.d satisfies this Surveillance Requirement.

Verifying the diesel generator starts from standby conditions and achieves steady state voltage > 3740 V and < 4580 V, and frequency Ž 58.8 Hz and < 61.2 Hz.

3. NOTES

1. Diesel generator loading may include gradual loading as recommended by the manufacturer.

2. Momentary transients outside the load range do not invalidate this test.

3. This test shall be conducted on only one diesel generator at a time.

4. This test shall be preceded by and immediately follow without shutdown a successful performance of SR 4.8.1.1.2.a.2, or SRs 4.8.1.1.2.d.1 and 4.8.1.1.2.d.2.

5. Performance of SR 4.8.1.1.2.d satisfies this Surveillance Requirement.

Verifying the diesel generator is synchronized and loaded, and operates for > 60 minutes at a load > 2475 kW and < 2750 kW.

All diesel starts may be preceded by an engine prelube period.

MILLSTONE 0868

- UNIT 2 3/4 8-3 Amendment No. 777, 77,

f ELECTRICAL POWER SYSTEMS II SURVEILLANCE REQUIREMENTS (Continued) 1-1

b. The diesel fuel oil supply shall be checked by:

1. Checking for and removing accumulated water from each fuel oil storage tank at least once per 92 days.

2. Verifying fuel oil properties of new and stored fuel oil are tested in accordance with, and maintained within the limits of, the Diesel Fuel Oil Testing Program in accordance with the Diesel Fuel Oil Testing Program.

c. At least once per 18 months by:

1. Deleted

2. 1 NOTF This surveillance shall not normally be performed in MODE 1, 2, 3, or 4. However, portions of the surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

Verifying that the automatic time delay sequencer is OPERABLE with the following settings:

Sequence Time After Closing of Diesel Generator Step Output Breaker (Seconds)

Minimum Maximum 1 (Tj) 1.5 2.2 2 (T2) T, + 5.5 8.4 3 (T 3 ) T2 + 5.5 14.6 4 (TJ) T3 + 5.5 20.8 MILLSTONE 0868

- UNIT 2 3/4 8-3a Amendment No. 771, 771, M,

ELECTRICAL POWER SYSTEMS SURVEILLANCE REQUIREMENTS (Continued)

3. NOTE If performed with the diesel generator synchronized with offsite power, this surveillance shall be performed at a power factor < 0.9 lagging. However, if grid conditions do not permit, the power factor limit is not required to be met. Under this condition the power factor shall be maintained as close to the limit as practicable.

Verifying the diesel generator capability to reject a load greater than or equal to its associated single largest post accident load and:

a. Following load rejection, the frequency is < 63 Hz,

b. Within 2.2 seconds following load rejection, the voltage is > 3740 V and < 4580 V, and

c. Within 2.2 seconds following load rejection, the frequency is > 58.8 Hz and < 61.2 Hz.

4. NOTE If performed with the diesel generator synchronized with offsite power, this surveillance shall be performed at a power factor < 0.83 lagging. However, if grid conditions do not permit, the power factor limit is not required to be met. Under this condition the power factor shall be maintained as close to the limit as practicable.

Veriyfing the diesel generator does not trip following a load rejection of > 2475 kW and < 2750 kW.

MILLSTONE - UNIT 2 3/4 8-3b Amendment No.

0868

ELECTRICAL POWER SYSTEMS SURVEILLANCE REQUIREMENTS (Continued)

5. NOTE This surveillance shall not normally be performed in MODE 1, 2, 3, or 4. However, portions of the surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

Verifying on an actual or simulated loss of offsite power in conjunction with an actual or simulated Engineered Safety Feature actuation signal:

a. De-energization of emergency buses,

b. Load shedding from emergency buses,

c. Diesel generator auto-starts from standby condition, and:

1. energizes permanently connected loads in < 15 seconds,

2. energizes auto-connected loads through the load sequencer,

3. achieves steady state voltage > 3740 V and < 4580 V,

4. achieves steady state frequency > 58.8 Hz and

< 61.2 Hz and,

5. energizes permanently connected and auto-connected loads for > 5 minutes.

6. NOTE This surveillance shall not normally be performed in MODE 1, 2, 3, or 4. However, this surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

Verifying diesel generator automatic trips are bypassed on an actual or simulated loss of offsite power in conjunction with an actual or simulated Engineered Safety Feature actuation signal except:

a. Engine overspeed,

b. Generator differential current,

c. Voltage restraint overcurrent, and

d. Low lube oil pressure (switches to 2 out of 3 logic).

MILLSTONE - UNIT 2 3/4 8-3c Amendment No.

0868

ELECTRICAL POWER SYSTEMS SURVEILLANCE REQUIREMENTS (Continued)

7. NOTES I. This surveillance shall not normally be performed in MODE I, 2, 3, or 4. However, portions of the surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

2. The start of the diesel generator from a standby condition is not required if this surveillance is performed in conjunction with SR 4.8.1.1.2.c.5.

Verifying on an actual or simulated loss of offsite power signal:

a. De-energization of emergency buses,

b. Load shedding from emergency buses,

c. Diesel generator auto-starts from standby condition and:

1. energizes permanently connected loads in

< 15 seconds,

2. energizes auLo-connected loads through the load sequencer,

3. achieves steady state voltage > 3740 V and < 4580 V,

4. achieves steady state frequency > 58.8 Hz and

< 61.2 Hz and,

5. energizes permanently connected and auto-connected loads for > 5 minutes.

MILLSTONE - UNIT 2 0868 3/4 8-3d Amendment No.

ELECTRICAL POWER SYSTEMS SURVEILLANCE REQUIREMENTS (Continued)

.0

8. Verifying on an actual or simulated Engineered Safety Feature actuation signal the diesel generator auto-starts from a standby condition and:

a. Achieves > 90% of rated speed and > 97% of rated voltage in

< 15 seconds,

b. Achieves steady state voltage > 3740 V and < 4580 V,

c. Achieves steady state frequency > 58.8 Hz and < 61.2 Hz,

d. Operates for > 5 minutes,

e. Permanently connected loads remain energized from the offsite power system, and

f. Auto-connected loads remain energized from the offsite power system as appropriate for plant conditions.

9. NOTE This surveillance shall be performed within 5 minutes of shutting down the diesel generator after the diesel generator has operated > 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months loaded > 2475 kW and

< 2750 kW. Momentary transients outside the load range do not invalidate this test.

Verifying the diesel generator starts and:

a. Accelerates to > 90% of rated speed and > 97% of rated voltage in < 15 seconds, and

b. Achieves steady state voltage > 3740 V and < 4580 V, and frequency > 58.8 Hz and < 61.2 Hz.

MILLSTONE - UNIT 2 3/4 8-3e Amendment No.

0868

ELECTRICAL POWER SYSTEMS SSURVEILLANCE REQUIREMENT (Continued)

d. At least once per 184 days by:

1. Verifying the diesel starts from standby conditions and accelerates to > 90% of rated speed and to > 97% of rated voltage within 15 seconds after the start signal.

2. Verifying the diesel generator achieves steady state voltage

> 3740 V and < 4580 V, and frequency > 58.8 Hz and < 61.2 Hz.

3. 1 NOTES I

1. Diesel generator loading may include gradual loading as recommended by the manufacturer.

2. Momentary transients outside the load range do not invalidate this test.

3. This test shall be conducted on only one diesel generator at a time.

4. This test shall be preceded by and immediately follow without shutdown a successful performance of SRs 4.8.1.1.2.d.1 and 4.8.1.1.2.d.2, or SR 4.8.1.1.2.a.2.

Verifying the diesel generator is synchronized and loaded, and operates for > 60 minutes at a load > 2475 kW and < 2750 kW.

MILLSTONE - UNIT 2 3/4 8-4 Amendment No. 771, 0868

ELECTRICAL POWER SYSTEMS SHUTDOWN LIMITING CONDITION FOR OPERATION 3.8.1.2 As a minimum, the following A.C. electrical power sources shall be OPERABLE:

a. One circuit between the offsite transmission network and the onsite Class IE distribution system, and

b. One diesel generator with a fuel oil supply tank containing a minimum of 12,000 gallons of fuel.

APPLICABILITY: MODES 5 and 6.

ACTION:

With less than the above minimum required A.C. electrical power sources OPERABLE, suspend all operations involving CORE ALTERATIONS or positive reactivity changes or movement of irradiated fuel assemblies.

SURVEILLANCE REQUIREMENTS 4.8.1.2 The above required A.C. electrical power sources shall be demonstrated OPERABLE per Surveillance Requirements 4.8.1.1.1 and 4.8.1.1.2, except for testing pursuant to Surveillance Requirements 4.8.1.1.2.a.3, 4.8.1.1.2.c.2, 4.8.1.1.2.c.5, 4.8.1.1.2.c.6, 4.8.1.1.2.c.7, and 4.8.1.1.2.d.3.

MILLSTONE 0868

- UNIT 2 3/4 8-5 Amendment No. 797, 777,

3/4.8 ELECTRICAL POWER SYSTEMS BASES The 14 day allowed outage time for one inoperable Millstone Unit No. 2 diesel generator will allow performance of extended diesel generator maintenance and repair activities (e.g., diesel inspections) while the plant is operating. To minimize plant risk when using this extended allowed outage time the following additional requirements must be met:

1. The extended diesel generator maintenance outage shall not be scheduled when adverse or inclement weather conditions and/or unstable grid conditions are predicted or present.

2. The availability of the Millstone Unit No. 3 SBO DG shall be verified by test performance within the previous 30 days prior to allowing a Millstone Unit No. 2 diesel generator to be inoperable for greater than 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

3. All activity in the switchyard shall be closely monitored and controlled. No elective maintenance within the switchyard that could challenge offsite power availability shall be scheduled.

In addition, the plant configuration shall be controlled during the diesel generator maintenance and repair activities to minimize plant risk consistent with a Configuration Risk Management Program, as required by 10 CFR 50.65(a) (4).

Diesel Generator Testing An engine prelube period is allowed prior to engine start for all diesel generator testing. This will minimize wear on moving parts that do not get lubricated when the engine is not running.

When specified in the surveillance tests, the diesel generators must be started from a standby condition. Standby condition for a diesel generator means the diesel engine coolant and oil are being circulated and temperature is being maintained consistent with manufacturer recommendations.

SR 4.8.1.1.2.a.2 This surveillance helps to ensure the availability of the standby electrical power supply to mitigate design basis accidents and transients and to maintain the unit in a safe shutdown condition. It verifies the ability of the diesel generator to start from a standby condition and achieve steady state voltage and frequency conditions. The time for voltage and speed (frequency) to stabilize is periodically monitored and the trend evaluated to identify degradation of governor or voltage regulator performance when testing in accordance with the requirements of this surveillance.

MILLSTONE - UNIT 2 B 3/4 8-1c Amendment No. Igg, Xg?, 77, 0869 0 79,

AO -3 3/4.8 ELECTRICAL POWER SYSTEMS BASES This surveillance is modified by two notes. Note I allows the use of a modified start based on recommendations of the manufacturer to reduce stress and wear on diesel engines. When using a modified start, the starting speed of the diesel generators is limited, warmup is limited to this lower speed, and the diesel generators are gradually accelerated to synchronous speed prior to loading. If a modified start is not used, the 15 second start requirement of SR 4.8.1.1.2.d applies. Note 2 states that SR 4.8.1.1.2.d, a more rigorous test, may be performed in lieu of 4.8.1.1.2.a.

During performance of SR 4.8.1.1.2.a.2, the diesel generator shall be started by using one of the following signals:

1. Manual;

2. Simulated loss of offsite power in conjunction with a safety injection actuation signal;

3. Simulated safety injection actuation signal alone; or

4. Simulated loss of power alone.

The 31 day frequency for SR 4.8.1.1.2.a.2 is consistent with standard industry guidelines.

SR 4.8.1.1.2.a.3 This surveillance verifies that the diesel generators are capable of synchronizing with the offsite electrical system and accepting loads greater than or equal to the equivalent of the maximum expected accident loads. A minimum run time of 60 minutes is required to stabilize engine temperatures, while minimizing the time that the diesel generator is connected to the offsite source. Although no power factor requirements are established by this surveillance, the diesel generator is normally operated at a power factor between 0.8 lagging and 1.0. The 0.8 value is the design rating of the machine, while 1.0 is an operational limitation.

This surveillance is modified by five Notes. Note 1 indicates that diesel engine runs for this surveillance may include gradual loading, as recommended by the manufacturer, so that mechanical stress and wear on the diesel engine are minimized. Note 2 states that momentary transients because of changing bus loads do not invalidate this test. Similarly, momentary power factor transients above the limit will not invalidate the test. Note 3 indicates that this surveillance should be conducted on only one diesel generator at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations. Note 4 stipulates a prerequisite requirement for performance of this surveillance. A successful diesel generator start must precede this test to credit satisfactory performance. Note 5 states that SR 4.8.1.1.2.d, a more rigorous test, may be performed in lieu of 4.8.1.1.2.a.

The 31 day frequency for SR 4.8.1.1.2.a.3 is consistent with standard industry guidelines.

MILLSTONE - UNIT 2 B 3/4 8-1d Amendment No.

0869

3/4.8 ELECTRICAL POWER SYSTEMS BASES SR 4.8.1.1.2.b.1 Microbiological fouling is a major cause of fuel oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Removal of water from the three fuel storage tanks once every 92 days eliminates the necessary environment for bacterial survival. This is the most effective means of controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during EDG operation. Water may come from any of several sources, including condensation, rain water, contaminated fuel oil, and from breakdown of the fuel oil by bacteria. Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. This surveillance is for preventative maintenance. The presence of water does not necessarily represent failure of this surveillance provided the accumulated water is removed during performance of the surveillance.

SR 4.8.1.1.2.b.2 This surveillance requires testing of the new and stored fuel oil in accordance with the Diesel Fuel Oil Testing Program, as defined in Section 6 of the Technical Specifications.

The tests listed below are a means of determining whether new fuel oil is of the appropriate grade and has not been contaminated with substances that would have an immediate, detrimental impact on diesel engine combustion. If results from these tests are within acceptable limits, the fuel oil may be added to the storage tanks without concern for contaminating the entire volume of fuel oil in the storage tanks. These tests are to be conducted prior to adding the new fuel to the storage tank(s), but in no case is the time between receipt of new fuel and conducting the tests to exceed 31 days. The tests, limits, and applicable ASTM Standards are as follows (more restrictive State of Connecticut and/or equipment limits may apply):

a. Sample the new fuel oil in accordance with ASTM D4057,

b. Verify in accordance with the tests specified in ASTM D975-81 that the sample has an absolute specific gravity at 60/60°F of > 0.83 and

< 0.89, or an API gravity at 60°F of > 27* and < 390, a kinematic viscosity at 40°C of > 1.9 centistokes and < 4.1 centistokes (alternatively, Saybolt viscosity, SUS at 100°F of > 32.6 but

< 40.1) and a flash point > 125°F, and

c. Verify that the new fuel oil has water and sediment < 0.05% when tested in accordance with ASTM D1796-83.

MTII1lTnNF - IINTT 9 B 3/4 8-le Amendment No.

0869

3/4.8 ELECTRICAL POWER SYSTEMS BASES Failure to meet any of the above limits is cause for rejecting the new fuel oil, but does not represent a failure to meet the LCO concern since the fuel oil is not added to the storage tanks. Within 31 days following the initial new fuel oil sample, the fuel oil is analyzed to establish that the other properties specified in Table 1 of ASTM D975-81 are met for new fuel oil when tested in accordance with ASTM D975-81, except that the analysis for sulfur may be performed in accordance with ASTM D1552 or ASTM D2622. The 31 day period is acceptable because the fuel oil properties of interest, even if they were not within stated limits, would not have an immediate effect on DG operation.

This surveillance ensures the availability of high quality fuel oil for the diesel generators. Fuel oil degradation during long term storage shows up as an increase in particulate, due mostly to oxidation. The presence of particulate does not mean the fuel oil will not burn properly in a diesel engine. The particulate can cause fouling of filters and fuel oil injection equipment, however, which can cause engine failure. Particulate concentrations should be determined in accordance with ASTM D2276-78, -Method A, every 92 days. This method involves a gravimetric determination of total particulate concentration in the fuel oil and has a limit of 10 mg/l. It is acceptable to obtain a field sample for subsequent laboratory testing in lieu of field testing.

The frequency of this test takes into consideration fuel oil degradation trends that indicate that particulate concentration is unlikely to change significantly between surveillance intervals.

SR 4.8.1.1.2.c.2 Under accident and loss of offsite power conditions, loads are sequentially connected to the bus by the automatic load sequencer. The sequencing logic controls the permissive and starting signals to motor breakers to prevent overloading of the diesel generators due to high motor starting currents. The load sequence time interval tolerances ensure that sufficient time exists for the diesel generator to restore frequency and voltage prior to applying the next load and that safety analysis assumptions regarding Engineered Safety Features (ESF) equipment time delays are not violated.

The 18 month frequency is based on engineering judgment, taking into consideration unit conditions required to perform the surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the surveillance when performed at the 18 month frequency. Therefore, the frequency is acceptable from a reliability standpoint.

MILLSTONE - UNIT 2 B 3/4 8-1f Amendment No.

0869

C-3/4.8 ELECTRICAL POWER SYSTEMS BASES This surveillance is modified by a Note. The reason for the Note is that performing the surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally performing the surveillance in MODE 1, 2, 3, or 4 is further amplified to allow the surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced.

This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed surveillance, a successful surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when the surveillance is performed in MODE 1, 2, 3, or 4. Risk insights or deterministic methods may be used for this assessment.

SR 4.8.1.1.2.c.3 Each diesel generator is provided with an engine overspeed trip to prevent damage to the engine. Recovery from the transient caused by the loss of a large load could cause diesel engine overspeed, which, if excessive, might result in a trip of the engine. This surveillance demonstrates the diesel generator load response characteristics and capability to reject the largest single load without exceeding a predetermined frequency limit. The single largest load for each diesel generator is identified in the FSAR (Tables 8.3-2 and 8.3-3).

This surveillance may be accomplished by either:

a. Tripping the diesel generator output breaker with the diesel generator carrying greater than or equal to its associated single largest post-accident load while paralleled to offsite power or while solely supplying the bus; or

b. Tripping the equivalent of the single largest post-accident load with the diesel generator solely supplying the bus.

The time, voltage, and frequency tolerances specified in this surveillance are based on the response during load sequence intervals. The 2.2 seconds specified is equal to 40% of the 5.5 second load sequence interval associated with sequencing of the largest load (Safety Guide 9). The voltage and frequency specified are consistent with the design range of the equipment powered by the diesel generator. SR 4.8.1.l.2.c.3.a corresponds to the maximum frequency excursion, while SR 4.8.l.1.2.c.3.b and SR 4.8.1.1.2.c.3.c are steady state voltage and frequency values to which the system must recover following load rejection.

MILLSTONE - UNIT 2 B 3/4 8-Ig Amendment No.

0869

3/4.8 ELECTRICAL POWER SYSTEMS BASES The 18 month frequency is based on engineering judgment, taking into consideration unit conditions required to perform the surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the surveillance when performed at the 18 month frequency. Therefore, the frequency is acceptable from a reliability standpoint.

This surveillance is modified by a Note to ensure that the diesel generator is tested under load conditions that are as close to design basis conditions as practical. When synchronized with offsite power, testing should be performed at a power factor of < 0.9 lagging. This power factor is representative of the inductive loading a diesel generator would see based on the motor rating of the single largest load. It is within the adjustment capability of the Control Room Operator based on the use of reactive load indication to establish the desired power factor. Under certain conditions, however, the note allows the surveillance to be conducted at a power factor other than '<

0.9. These conditions occur when grid voltage is high, and the additional field excitation needed to get the power factor to < 0.9 results in voltages on the emergency buses that are too high. Under these conditions, the power factor should be maintained as close as practicable to 0.9 while still maintaining acceptable voltage limits on the emergency buses. In other circumstances, the grid voltage may be such that the diesel generator excitation levels needed to obtain a power factor of 0.9 may not cause unacceptable voltages on the emergency buses, but the excitation levels are in excess of those recommended for the diesel generator. In such cases, the power factor shall be maintained as close as practicable to 0.9 lagging without exceeding the diesel generator excitation limits.

SR 4.8.1.1.2.c.4 This surveillance demonstrates the diesel generator capability to reject a rated load without overspeed tripping. A diesel generator rated load rejection may occur because of a system fault or inadvertent breaker tripping.

This surveillance ensures proper engine generator load response under the simulated test conditions. This test simulates the loss of the total connected load that the diesel generator experiences following a rated load rejection and verifies that the diesel generator will not trip upon loss of the load. While the diesel generator is not expected to experience this transient during an event, this response ensures that the diesel generator is not degraded for future application, including reconnection to the bus if the trip initiator can be corrected or isolated.

This surveillance is performed by tripping the diesel generator output breaker with the diesel generator carrying the required load while paralleled to offsite power.

The 18 month frequency is based on engineering judgment, taking into consideration unit conditions required to perform the surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the surveillance when MILLSTONE - UNIT 2 B 3/4 8-1h Amendment No.

0869

3/4.8 ELECTRICAL POWER SYSTEMS BASES performed at the 18 month frequency. Therefore, the frequency is acceptable from a reliability standpoint.

This surveillance is modified by a Note to ensure that the diesel generator is tested under load conditions that are as close to design basis conditions as practical. When synchronized with offsite power, testing should be performed at a power factor of < 0.83 lagging. This power factor is representative of the inductive loading a diesel generator would see under design basis accident conditions. Under certain conditions, however, the note allows the surveillance to be conducted at a power factor other than < 0.83. These conditions occur when grid voltage is high, and the additional field excitation needed to get the power factor to < 0.83 results in voltages on the emergency buses that are too high. Under these conditions, the power factor should be maintained as close as practicable to 0.83 while still maintaining acceptable voltage limits on the emergency buses. In other circumstances, the grid voltage may be such that the diesel generator excitation levels needed to obtain a power factor of 0.83 may not cause unacceptable voltages on the emergency buses, but the excitation levels are in excess of those recommended for the diesel generator. In such cases, the power factor shall be maintained as close as practicable to 0.83 lagging without exceeding the diesel generator excitation limits.

SR 4.8.1.1.2.c.5 In the event of a design basis accident coincident with a loss of offsite power, the diesel generators are required to supply the necessary power to ESF systems so that the fuel, RCS, and containment design limits are not exceeded.

This surveillance demonstrates the diesel generator operation during a loss of offsite power actuation test signal in conjunction with an ESF actuation signal, including shedding of the nonessential loads and energization of the emergency buses and respective loads from the diesel generator. It further demonstrates the capability of the diesel generator to automatically achieve the required voltage and speed (frequency) within the specified time. The diesel generator auto-start time of 15 seconds is derived from requirements of the accident analysis to respond to a design basis large break LOCA. The surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed 'and stability has been achieved. The requirement to verify the connection of permanent and auto connected loads is intended to satisfactorily show the relationship of these loads to the diesel generator loading logic. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the diesel generator system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The 18 month frequency is based on engineering judgment, taking into consideration unit conditions required to perform the surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown-that these components usually pass the surveillance when MILLSTONE - UNIT 2 B 3/4 8-1i Amendment No.

0869

3/4.8 ELECTRICAL POWER SYSTEMS BASES performed at the 18 month frequency. Therefore, the frequency is acceptable from a reliability standpoint.

For the purpose of this testing, the diesel generators must be started from a standby condition. Standby condition for a diesel generator means the diesel engine coolant and oil are being circulated and temperature is being maintained consistent with manufacturer recommendations.

This surveillance is modified by a Note. The reason for the Note is that performing the surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally performing the surveillance in MODE 1, 2, 3, or 4 is further amplified to allow portions of the surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial surveillance, a successful partial surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the surveillance are performed in MODE 1, 2, 3, or 4. Risk insights or deterministic methods may be used for the assessment.

SR 4.8.1.1.2.c.6 This surveillance demonstrates that diesel generator noncritical protective functions (e.g., high jacket water temperature) are bypassed on a loss of voltage signal concurrent with an ESF actuation test signal. During this time, the critical protective functions (engine overspeed, generator differential current, low lube oil pressure [2 out of 3 logic], and voltage restraint overcurrent) remain available to trip the diesel generator and/or output breaker to avert substantial damage to the diesel generator unit. An EDG Emergency Start Signal (Loss of Power signal or SIAS) bypasses the EDG mechanical trips in the EDG control circuit, except engine overspeed, and switches the low lube oil trip to a 2 of 3 coincidence. The loss of power to the emergency bus, based on supply breaker position (A302, A304, and A505 for Bus 24C; A410, A411, and A505 for Bus 24D), bypasses the EDG electrical trips in the breaker control circuit except generator differential current and voltage restraint overcurrent. The noncritical trips are bypassed during design basis accidents and provide an alarm on an abnormal engine condition.

This alarm provides the operator with sufficient time to react appropriately.

The diesel generator availability to mitigate the design basis accident is more critical than protecting the engine against minor problems that are not immediately detrimental to emergency operation of the diesel generator.

MILLSTONE - UNIT 2 B 3/4 8-1i Amendment No.

0869

3/4.8 ELECTRICAL POWER SYSTEMS BASES The 18 month frequency is based on engineering judgment, taking into consideration unit conditions required to perform the surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the surveillance when performed at the 18 month frequency. Therefore, the frequency is acceptable from a reliability standpoint.

This surveillance is modified by a Note. The reason for the Note is that performing the surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally performing the surveillance in MODE 1, 2, 3, or 4 is further amplified to allow portions of the surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial surveillance, a successful partial surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the surveillance are performed in MODE 1, 2, 3, or 4. Risk insights or deterministic methods may be used for the assessment.

SR 4.8.1.1.2.c.7 This surveillance demonstrates the as designed operation of the standby power sources during loss of the offsite source. This test verifies all actions encountered from the loss of offsite power, including shedding of the nonessential loads and energization of the emergency buses and respective loads from the diesel generator. It further demonstrates the capability of the diesel generator to automatically achieve the required voltage and speed (frequency) within the specified time. The diesel generator auto-start time of 15 seconds is derived from requirements of the accident analysis to respond to a design basis large break LOCA. The surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability has been achieved. The requirement to verify the connection and power supply of permanent and auto-connected loads is intended to satisfactorily show the relationship of these loads to the diesel generator loading logic. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the diesel generator system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The 18 month frequency is based on engineering judgment, taking into consideration unit conditions required to perform the surveillance, and is MILLSTONE - UNIT 2 B 3/4 8-1k Amendment No.

0869

3/4.8 ELECTRICAL POWER SYSTEMS BASES intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the surveillance when performed at the 18 month frequency. Therefore, the frequency is acceptable from a reliability standpoint.

This surveillance is modified by two Notes. The reason for Note I is that performing the surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally performing the surveillance in MODE 1, 2, 3, or 4 is further amplified to allow portions of the surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial surveillance, a successful partial surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the surveillance are performed in MODE 1, 2, 3, or 4. Risk insights or deterministic methods may be used for the assessment.

Surveillance Note 2 specifies that the start of the diesel generator from a standby condition is not required if this surveillance is performed in conjunction with SR 4.8.1.1.2.c.5. Since this test is normally performed in conjunction with SR 4.8.1.1.2.c.5, the proposed note will exclude the requirement to start from a standby condition to minimize the time to perform this test. This will reduce shutdown risk since plant restoration, and subsequent equipment availability will occur sooner. In addition, it is not necessary to test the ability of the EDG to auto start from a standby condition for this test since that ability will have already been verified by SR 4.8.1.1.2.c.5, which will have just been performed if the note's exclusion is to be utilized. If this test is to be performed by itself, the EDG is required to start from a standby condition.

SR 4.8.1.1.2.c.8 This surveillance demonstrates that the diesel generator automatically starts and achieves the required voltage and speed (frequency) within the specified time (15 seconds) from the design basis actuation signal (Safety Injection Actuation Signal) and operates for > 5 minutes. The 5 minute period provides sufficient time to demonstrate stability. Since the specified actuation signal (ESF signal without loss of offsite power) will not cause the emergency bus loads to be shed, and will not cause the diesel generator to load, the surveillance ensures that permanently connected loads and autoconnected loads remain energized from the offsite electrical power system (Unit 2 RSST or NSST, or Unit 3 RSST or NSST). In certain circumstances, many of these loads cannot actually be connected without undue hardship or potential for undesired MILLSTONE - UNIT 2 B 3/4 8-11 Amendment No.

0869

So , .

3/4.8 ELECTRICAL POWER SYSTEMS BASES operation. It is not necessary to verify all autoconnected loads remain connected. A representative sample is acceptable.

The 18 month frequency is based on engineering judgment, taking into consideration unit conditions required to perform the surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the surveillance when performed at the 18 month frequency. Therefore, the frequency is acceptable from a reliability standpoint.

For the purpose of this testing, the diesel generators must be started from a standby condition. Standby condition for a diesel generator means the diesel engine coolant and oil are being circulated and temperature is being maintained consistent with manufacturer recommendations.

SR 4.8.1.1.2.c.9 This surveillance demonstrates that the diesel engine can restart from a hot condition, such as subsequent to shutdown from a normal surveillance, and achieve the required voltage and speed within 15 seconds. The 15 second time is derived from the requirements of the accident analysis to respond to a design basis large break LOCA.

The 18 month frequency is based on engineering judgment, taking into consideration unit conditions required to perform the surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the surveillance when performed at the 18 month frequency. Therefore, the frequency is acceptable from a reliability standpoint.

This surveillance is modified by a Note. The Note ensures that the test is performed with the diesel sufficiently hot. The load band is provided to avoid routine overloading of the diesel generator. Routine overloads may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain diesel generator OPERABILITY. The requirement that the diesel has operated for at least I hour at rated load conditions prior to performance of this surveillance is based on manufacturer recommendations for achieving hot conditions. Momentary transients due to changing bus loads do not invalidate this test.

MILLSTONE - UNIT 2 B 3/4 8-1m Amendment No.

0869

3/4ý8 ELECTRICAL POWER SYSTEMS BASES SRs 4.8.1.1.2.d.1 and 4.8.1.1.2.d.2 SR 4.8.1.1.2.d.1 verifies that, at a 184 day frequency, the diesel generator starts from standby conditions and achieves required voltage and speed (frequency) within 15 seconds. The 15 second start requirement supports the assumptions of the design basis LOCA analysis in the FSAR. Diesel generator voltage and speed will continue to increase to rated values, and then should stabilize. SR 4.8.1.1.2.d.2 verifies the ability of the diesel generator to achieve steady state voltage and frequency conditions. The time for voltage and speed (frequency) to stabilize is periodically monitored and the trend evaluated to identify degradation of governor or voltage regulator performance when testing in accordance with the requirements of this surveillance.

The 184 day frequency for this surveillance is a reduction in cold testing consistent with Generic Letter 84-15. This frequency provides adequate assurance of diesel generator OPERABILITY, while minimizing degradation resulting from testing. In addition, SR 4.8.1.1.2.d may be performed in lieu of 4.8.1.1.2.a.

For the purpose of this testing, the diesel generators must be started from a standby condition. Standby condition for a diesel generator means the diesel engine coolant and oil are being circulated and temperature is being maintained consistent with manufacturer recommendations.

During performance of SR 4.8.1.1.2.d.1, the diesel generators shall be started by using one of the following signals:

1. Manual;

2. Simulated loss of offsite power in conjunction with a safety injection actuation signal;

3. Simulated safety injection actuation signal alone; or

4. Simulated loss of power alone.

SR 4.8.1.1.2.d.3 This surveillance verifies that the diesel generators are capable of synchronizing with the offsite electrical system and accepting loads greater than or equal to the equivalent of the maximum expected accident loads. A minimum run time of 60 minutes is required to stabilize engine temperatures, while minimizing the time that the diesel generator is connected to the offsite source. Although no power factor requirements are established by this surveillance, the diesel generator is normally operated at a power factor between 0.8 lagging and 1.0. The 0.8 value is the design rating of the machine, while 1.0 is an operational limitation.

The 184 day frequency for this surveillance is a reduction in cold testing consistent with Generic Letter 84-15. This frequency provides adequate assurance of diesel generator OPERABILITY, while minimizing degradation resulting from testing.

MILLSTONE - UNIT 2 B 3/4 8-1n Amendment No.

0869

3/4ý8 ELECTRICAL POWER SYSTEMS BASES This SR is modified by four Notes. Note 1 indicates that diesel engine runs For this surveillance may include gradual loading, as recommended by the manufacturer, so that mechanical stress and wear on the diesel engine are minimized. Note 2 states that momentary transients because of changing bus loads do not invalidate this test. Similarly, momentary power factor transients above the limit will not invalidate the test. Note 3 indicates that this surveillance should be conducted on only one diesel generator at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations. Note 4 stipulates a prerequisite requirement for performance of this surveillance. A successful diesel generator start must precede this test to credit satisfactory performance.

The OPERABILITY of the minimum specified A.C.and D.C. power sources and associated distribution systems during shutdown and refueling ensures that

1) the facility can be maintained in the shutdown or refueling condition for extended time periods and 2) sufficient instrumentation and control capability is available for monitoring and maintaining the facility status.

If the required power sources or distribution systems are not OPERABLE in MODES 5 and 6, operations involving CORE ALTERATIONS, positive reactivity changes, or movement of irradiated fuel assemblies are required to be suspended. The required action to suspend positive reactivity additions does not preclude actions to maintain or increase reactor vessel inventory provided the boron concentration of the makeup water source is greater than or equal to the boron concentration for the required SHUTDOWN MARGIN. In addition, suspension of these activities does not preclude completion of actions to establish a safe conservative plant condition.

The non-safety grade 125V D.C. Turbine Battery is required for accident mitigation for a main steam line break within containment with a coincident loss of a vital D.C. bus. The Turbine Battery provides the alternate source of power for Inverters I & 2 respectively via non-safety grade Inverters 5 &

6. For the loss of a D.C. event with a coincident steam line break within containment, the feedwater regulating valves are required to close to ensure containment design pressure is not exceeded.

MILLSTONE - UNIT 2 B 3/4 8-1o Amendment No. IFF, JY, 771, 0B69 79 ~79,

ADMINISTRATIVE CONTROLS 6.24 Diesel Fuel Oil Test Program A diesel fuel oil testing program to implement required testing of both new fuel oil and stored fuel oil shall be established. The program shall include sampling and testing requirements, and acceptance criteria, all in accordance with applicable ASTM Standards. [he purpose of the program is to establish the following:

a. Acceptability of new fuel oil for use prior to addition to storage tanks by determining that the fuel oil has:

1. An API gravity or an absolute specific gravity within limits,

2. A flash point and kinematic viscosity within limits for ASTM 2D fuel oil, and

3. Water and sediment < 0.05%.

b. Within 31 days following addition of the new fuel oil to storage tanks, verify that the properities of the new fuel oil, other than those addressed in a., above, are within limits for ASTM 2D fuel oil, and

c. Total particulate concentration of the fuel oil is < 10 mg/l when tested every 92 days in accordance with ASTM D-2276-78, Method A.

The provisions of Surveillance Requirements 4.0.2 and 4.0.3 are applicable to the Diesel Fuel Oil Test Program test frequencies.

MILLSTONE - UNIT 2 6-29 Amendment No.

0870

v t e Letter Sequence Response to RAI
TAC:MB6112, (Approved, Closed)
Initiation Acceptance... Administration Questions Answers 28 February 2003 Results Approval, Approval Other: ML022940218
MONTHYEAR2003-02-28 [Table View]

ML030700399

Text

Response

Response

Response

Response

Response

Navigation menu

Search