ML032110040

Tech Spec Pages for License Amendment 277 Regarding Emergency Diesel Generator Testing Requirements

ML032110040
Person / Time
Site:	Millstone
Issue date:	07/25/2003
From:	NRC/NRR/DLPM
To:
References
TAC MB6112
Download: ML032110040 (24)

Text

INDEX ADMINISTRATIVE CONTROLS SECTION PAGE 6.9 REPORTING REQUIREMENTS 6.9.1 ROUTINE REPORTS ............................ 6-16 STARTUP REPORTS ............................ 6-16 ANNUAL REPORTS ............................ 6-17 ANNUAL RADIOLOGICAL REPORT ............................ 6-18 MONTHLY OPERATING REPORT ............................ 6-18 CORE OPERATING LIMITS REPORT ............................ 6-18 6.9.2 SPECIAL REPORTS ............................ 6-19 6.10 DELETED 6.11 RADIATION PROTECTION PROGRAM . 6-20 6.12 HIGH RADIATION AREA . 6-20 6.13 SYSTEMS INTEGRITY . 6-23 6.14 IODINE MONITORING . 6-23 6.15 RADIOLOGICAL EFFLUENT MONITORING AND OFFS1TE DOSE CALCULATION MANUAL (REMODCM) . 6-24 6.16 RADIOACTIVE WASTE TREATMENT . 6-24 6.17 SECONDARY WATER CHEMISTRY . 6-25 6.18 DELETED 6.19 CONTAINMENT LEAKAGE RATE TESTING PROGRAM . 6-26 6.20 RADIACTIVE EFFULENT CONTROLS PROGRAM . 6-26 6.21 RADIOLOGICAL ENVIRONMENTAL MONITORING PROGRAM . 6-28 6.22 REACTOR COOLANT PUMP FLYWHEEL INSPECTION PROGRAM . 6-28 6.23 TECHNICAL SPECIFICATION (TS) BASES CONTROL PROGRAM . 6-28 6.24 DIELEL FUEL OIL TEST PROGRAM . 6-29 Amendment No. 79,336,63,66,403, MILLSTONE - UNIT 2 XVII 404, 4414,44, 4-53,463,469, 39, 250,62, 264,20, 27, 977

ELECTRICAL POWER SYSTEMS ACTION (Continued)

Inoperable Equipment Required Action

e. Two diesel e. 1 Perfonn Surveillance Requirement 4.8.1.1.1 for the generators offsite circuits within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and at least once per 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> thereafter.

AND e.2 Restore one of the inoperable diesel generators to OPERABLE status within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> or be in HOT STANDBY within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

AND e.3 Following restoration of one diesel generator restore remaining inoperable diesel generator to OPERABLE status following the time requirements of Action Statement b above based on the initial loss of the remaining inoperable diesel generator.

SURVEILLANCE REQUIREMENTS 4.8.1. 1.1 Verify correct breaker alignment and indicated power available for each required offsite circuit at least once per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

I MILLSTONE - UNIT 2 3/4 8-2a Amendment No. 131, A3-, 277

ELECTRICAL POWER SYSTEMS SURVEILLANCE REQUIREMENTS (Continued) 4.8.1.1.2 Each required diesel generator shall be demonstrated OPERABLE:*

a. At least once per 31 days by: I

1. Verifying the fuel level in the fuel oil supply tank, 2.

NOTES

1. A modified diesel generator start involving idling and gradual acceleration to synchronous speed may be used as recommended by the manufacturer. When modified start procedures are not used, the requirements of SR 4.8.1.1.2.d.1 must be met.

2. Performance of SR 4.8.1.1.2.d satisfies this Surveillance Requirement.

Verifying the diesel generator starts from standby conditions and achieves steady state voltage Ž 3740 V and < 4580 V, and Frequency Ž 58.8 Hz and

< 61.2 Hz.

3.

NOTES

1. Diesel generator loading may include gradual loading as recommended by the manufacturer.

2. Momentary transients outside the load range do not invalidate this test.

3. This test shall be conducted on only one diesel generator at a time.

4. This test shall be preceded by and immediately follow without shutdown a successful performance of SR 4.8.1.1.2.a.2, or SRs 4.8.1.1.2.d.1 and 4.8.1.1.2.d.2.

5. Performance of SR 4.8.1.1.2.d satisfies this Surveillance Requirement.

Verifying the diesel generator is synchronized and loaded, and operates for

> 60 minutes at a load > 2475 kW and < 2750 kW.

• All diesel starts may be preceded by an engine prelube period.

MILLSTONE - UNIT 2 3/4 8-3 Amendment No. 474, -3, 277

ELECTRICAL POWER SYSTEMS SURVEILLANCE REQUIREMENTS (Continued)

b. The diesel fuel oil supply shall be checked by:

1. Checking for and removing accumulated water from each fuel oil storage tank at least once per 92 days.

2. Verifying fuel oil properties of new and stored fuel oil are tested in accordance with, and maintained within the limits of, the Diesel Fuel Oil Testing Program in accordance with the Diesel Fuel Oil Testing Program.

c. At least once per 18 months by:

I. Deleted 2.

NOTE This surveillance shall not normally be performed in MODE 1, 2, 3, or 4. However, portions of the surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

Verifying that the automatic time delay sequencer is OPERABLE with the following settings:

Sequence Time After Closing of Diesel Generator Step Output Breaker (Seconds)

Minimum Maximum I (T 1) 1.5 2.2 2 (T 2 ) TI + 5.5 8.4 3 (T 3 ) T2+5.5 14.6 4 (T 4 ) T3+5.5 20.8 MILLSTONE - UNIT 2 3/4 8-3a Amendment No. 4-34, 2, 259, 2.77

ELECTRICAL POWER SYSTEMS SURVEILLANCE REQUIREMENTS (Continued) 3.

NOTE If performed with the diesel generator synchronized with offsite power, this surveillance shall be performed at a power factor

< 0.9 lagging. However, if grid conditions do not permit, the power factor limit is not required to be met. Under this condition the power factor shall be maintained as close to the limit as practicable.

Verifying the diesel generator capability to reject a load greater than or equal to its associated single largest post-accident load and:

a) Following load rejection, the frequency is < 63 Hz, b) Within 2.2 seconds following load rejection, the voltage is

> 3740 V and < 4580 V, and c) Within 2.2 seconds following load rejection, the frequency is

>58.8Hz and <61.2Hz.

4.

NOTE If performed with the diesel generator synchronized with offsite power, this surveillance shall be performed at a power factor

< 0.83 lagging. However, if grid conditions do not permit, the power factor limit is not required to be met. Under this condition the power factor shall be maintained as close to the limit as practicable.

Verifying the diesel generator does not trip following a load rejection of 2 2475 kW and < 2750 kW.

MILLSTONE - UNIT 2 314 8-3b Amendment No. 277

ELECTRICAL POWER SYSTEMS SURVEILLANCE REQUIREMENTS (Continued) 5.

NOTE This surveillance shall not normally be performed in MODE 1, 2, 3, or 4. However, portions of the surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

Verifying on an actual or simulated loss of offsite power in conjunction with an actual or simulated Engineered Safety Feature actuation signal:

a) De-energization of emergency buses, b) Load shedding from emergency buses, c) Diesel generator auto-starts from standby condition, and:

1. energizes permanently connected loads in < 15 seconds,

2. energizes auto-connected loads through the load sequencer,

3. achieves steady state voltage Ž 3740 V and < 4580 V,

4. achieves steady state frequency 2 58.8 Hz and < 61.2 Hz and,

5. energizes permanently connected and auto-connected loads for 2 5 minutes.

6.

NOTE This surveillance shall not normally be performed in MODE 1, 2, 3 or 4. However, this surveillance may be performed to reestablish OPERABILITY provided an assessment determines that safety of the plant is maintained or enhanced.

Verifying diesel generator automatic trips are bypassed on an actual or simulated loss of offsite power in conjunction with an actual or simulated Engineered Safety Feature actuation signal except:

a) Engine overspeed, b) Generator differential current, c) Voltage restraint overcurrent, and d) Low lube oil pressure (switches to 2 out of 3 logic).

MILLSTONE - UNIT 2 314 8-3c Amendment No. 277

ELECTRICAL POWER SYSTEMS SURVEILLANCE REQUIREMENTS (Continued) 7.

NOTES

1. This surveillance shall not normally be performed in MODE 1, 2, 3, or 4. However, portions of the surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

2. The start of the diesel generator from a standby condition is not required if this surveillance is performed in conjunction with SR 4.8.1.1.2.c.5.

Verifying on an actual or simulated loss of offsite power signal:

a) De-energization of emergency buses, b) Load shedding from emergency buses, c) Diesel generator auto-starts from standby condition and:

1. energizes permanently connected loads in

• 15 seconds,

2. energizes auto-connected loads through the load sequencer,

3. achieves steady state voltage 2Ž3740 V and < 4580 V,

4. achieves steady state frequency 2 58.8 Hz and

• 61.2 Hz and,

5. energizes permanently connected and auto-connected loads for Ž 5 minutes.

MILLSTONE - UNIT 2 3/4 8-3d Amendment No. 277

ELECTRICAL POWER SYSTEMS SURVEILLANCE REQUIREMENTS (Continued)

8. Verifying on an actual or simulated Engineered Safety Feature actuation signal the diesel generator auto-starts from a standby condition and:

a) Achieves > 90% of rated speed and Ž 97% of rated voltage in < 15 seconds, b) Achieves steady state voltage Ž 3740 V and < 4580 V, c) Achieves steady state frequency Ž 58.8 Hz and c 61.2 Hz, d) Operates for Ž 5 minutes, e) Permanently connected loads remain energized from the offsite power system, and f) Auto-connected loads remain energized from the offsite power system as appropriate for plant conditions.

9.

NOTE This surveillance shall be performed within 5 minutes of shutting down the diesel generator after the diesel generator has operated 21 hour2.430556e-4 days <br />0.00583 hours <br />3.472222e-5 weeks <br />7.9905e-6 months <br /> loaded 2 2475 kW and < 2750 kW. Momentary transients outside the load range do not invalidate this test.

Verifying the diesel generator starts and:

a) Accelerates to 2 90% of rated speed and Ž97% of rated voltage in

• 15 seconds, and b) Achieves steady state voltage Ž3740 V and < 4580 V, and frequency 2 58.8 Hz and

• 61.2 Hz.

MILLSTONE - UNIT 2 3/4 8-3e Amendment No. 277

ELECTRICAL POWER SYSTEMS SURVEILLANCE REQUIREMENT (Continued)

d. At least once per 184 days by:

I. Verifying the diesel starts from standby conditions and accelerates to >

90% of rated speed and to 2 97% of rated voltage within 15 seconds after the start signal.

2. Verifying the generator achieves steady state voltage Ž 3740 V and

< 4580 V, and frequency Ž 58.8 Hz and < 61.2 Hz.

3.

NOTES

1. Diesel generator loading may include gradual loading as recommended by the manufacturer.

2. Momentary transients outside the load range do not invalidate this test.

3. This test shall be conducted on only one diesel generator at a time.

4. This test shall be preceded by and immediately follow without shutdown a successful performance of SRs 4.8.1.1.2.d. 1 and 4.8.1.1.2.d.2, or SR 4.8.1.1.2.a.2.

Verifying the diesel generator is synchronized and loaded, and operates for 2 60 minutes at a load 2 2475 kW and < 2750 kW.

MILLSTONE - UNIT 2 314 8-4 Amendment No. 2I-3, 277

ELECTRICAL POWER SYSTEMS SHUTDOWN LIMITING CONDITION FOR OPERATION 3.8.1.2 As a minimum, the following A.C. electrical power sources shall be OPERABLE:

a. One circuit between the offsite transmission network and the onsite Class IE distribution system, and

b. One diesel generator with a fuel oil supply tank containing a minimum of 12,000 gallons of fuel.

APPLICABILITY: MODES 5 and 6.

ACTION:

With less than the above minimum required A.C. electrical power sources OPERABLE, suspend all operations involving CORE ALTERATIONS or positive reactivity changes or movement of irradiated fuel assemblies.

SURVEILLANCE REQUIREMENTS 4.8.1.2 The above required A.C. electrical power sources shall be demonstrated OPERABLE per Surveillance Requirements 4.8.1.1.1 and 4.8.1.1.2, except for testing pursuant to Surveillance Requirements 4.8.1.1.2.a.3, 4.8.1.1.2.c.2, 4.8.1.1.2.c.5, 4.8.1.1.2.c.6, 4.8.1.1.2.c.7, and 4.8.1.1.2.d.3.

MILLSTONE - UNIT 2 3/4 8-5 Amendment No. 497, 23I, 277

3/4.8 ELECTRICAL POWER SYSTEMS BASES The 14 day allowed outage time for one inoperable Millstone Unit No. 2 diesel generator will allow performance of extended diesel generator maintenance and repair activities (e.g., diesel inspections) while the plant is operating. To minimize plant risk when using this extended allowed outage time the following additional requirements must be met:

1. The extended diesel generator maintenance outage shall not be scheduled when adverse or inclement weather conditions and/or unstable grid conditions are predicted or present.

2. The availability of the Millstone Unit No. 3 SBO DG shall be verified by test performance within the previous 30 days prior to allowing a Millstone Unit No. 2 diesel generator to be inoperable for greater than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

3. All activity in the switchyard shall be closely monitored and controlled. No elective maintenance within the switchyard that could challenge offsite power availability shall be scheduled.

In addition, the plant configuration shall be controlled during the diesel generator maintenance and repair activities to minimize plant risk consistent with a Configuration Risk Management Program, as required by 10 CFR 50.65(a)(4).

Diesel Generator Testing An engine prelube period is allowed prior to engine start for all diesel generator testing.

This will minimize wear on moving parts that do not get lubricated when the engine is not running.

When specified in the surveillance tests, the diesel generators must be started from a standby condition. Standby condition for a diesel generator means the diesel engine coolant and oil are being circulated and temperature is being maintained consistent with manufacturer recommendations.

SR 4.8.1.1.2.a.2 This surveillance helps to ensure the availability of the standby electrical power supply to mitigate design basis accidents and transients and to maintain the unit in a safe shutdown condition. It verifies the ability of the diesel generator to start from a standby condition and achieve steady state voltage and frequency conditions. The time for voltage and speed (frequency) to stabilize is periodically monitored and the trend evaluated to identify degradation of governor or voltage regulator performance when testing in accordance with the requirements of the surveillance.

MILLSTONE - UNIT 2 B 3/4 8-lc Amendment No 4+8, 4-2, 23+, 248, B 3/4

~ 8-Ic ~ ~ ~ ~ 2" 277

3/4.8 ELECTRICAL POWER SYSTEMS BASES This surveillance is modified by two notes. Note I allows the use of a modified start based on recommendations of the manufacturer to reduce stress and wear on diesel engines.

When using a modified start, the starting speed of the diesel generators is limited, warmup is limited to this lower speed, and the diesel generators are gradually accelerated to synchronous speed prior to loading. If a modified start is not used, the 15 second start requirement of SR 4.8.1.1 .2.d applies. Note 2 states that SR 4.8.1.1 .2.d, a more rigorous test, may be performed in lieu of 4.8.1.1.2.a.

During performance of SR 4.8.1.1 .2.a.2, the diesel generator shall be started by using one of the following signals:

1. Manual;

2. Simulated loss of offsite power in conjunction with a safety injection actuation signal;

3. Simulated safety injection actuation signal alone; or

4. Simulated loss of power alone.

The 31 day frequency for SR 4.8.1.1.2.a.2 is consistent with standard industry guidelines.

SR 4.8.1.1.2.a.3 This surveillance verifies that the diesel generators are capable of synchronizing with the offsite electrical system and accepting loads greater than or equal to the equivalent of the maximum expected accident loads. A minimum run time of 60 minutes is required to stabilize engine temperatures, while minimizing the time that the diesel generator is connected to the offsite source. Although no power factor requirements are established by this surveillance, the diesel generator is normally operated at a power factor between 0.8 lagging and 1.0. The 0.8 value is the design rating of the machine, while 1.0 is an operational limitation.

This surveillance is modified by five Notes. Note 1 indicates that diesel engine runs for this surveillance may include gradual loading, as recommended by the manufacturer, so that mechanical stress and wear on the diesel engine are minimized. Note 2 states that momentary transients because of changing bus loads do not invalidate this test. Similarly, momentary power factor transients above the limit will not invalidate the test. Note 3 indicates that this surveillance should be conducted on only one diesel generator at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations. Note 4 stipulates a prerequisite requirement for performance of this surveillance. A successful diesel generator start must precede this test to credit satisfactory performance. Note 5 states that SR 4.8.1.1.2.d, a more rigorous test, may be performed in lieu of 4.8.1.1 .2.a.

The 31 day frequency for SR 4.8.1.1 .2.a.3 is consistent with standard industry guidelines.

MILLSTONE - UNIT 2 Amendment No. 277 ID i1- 0 sL I

3/4.8 ELECTRICAL POWER SYSTEMS BASES SR 4.8.1.1.2.b.I Microbiological fouling is a major cause of fuel oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Removal of water from the three fuel storage tanks once every 92 days eliminates the necessary environment for bacterial survival. This is the most effective means of controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during EDG operation. Water may come from any of several sources, including condensation, rain water, contaminated fuel oil, and from breakdown of the fuel oil by bacteria.

Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. This surveillance is for preventative maintenance. The presence of water does not necessarily represent failure of this surveillance provided the accumulated water is removed during performance of the surveillance.

SR 4.8.1.1.2.b.2 This surveillance requires testing of the new and stored fuel oil in accordance with the Diesel Fuel Oil Testing Program, as defined in Section 6 of the Technical Specifications.

The tests listed below are a means of determining whether new fuel oil is of the appropriate grade and has not been contaminated with substances that would have an immediate, detrimental impact on diesel engine combustion. If results from these tests are within acceptable limits, the fuel oil may be added to the storage tanks without concern for contaminating the entire volume of fuel oil in the storage tanks. These tests are to be conducted prior to adding the new fuel to the storage tank(s), but in no case is the time between receipt of new fuel and conducting the tests to exceed 31 days. The tests, limits, and applicable ASTM Standards are as follows (more restrictive State of Connecticut and/or equipment limits may apply):

a. Sample the new fuel oil in accordance with ASTM D4057,

b. Verify in accordance with the tests specified in ASTM D975-81 that the sample has an absolute specific gravity at 60/60 0 F of 2 0.83 and

• 0.89, or an API gravity at 60'F of Ž 270 and

• 390, a kinematic viscosity at 40'C of 2 1.9 centistokes and <

4.1 centistokes (alternatively, Saybolt viscosity, SUS at 100lF of 2 32.6 but

• 40.1) and a flash point 2 125 0 F, and

c. Verify that the new fuel oil has water and sediment

• 0.05% when tested in accordance with ASTM D1796-83.

MILLSTONE - UNIT 2 Amendment No. 277 B 3/4 8-I e

3/4.8 ELECTRICAL POWER SYSTEMS BASES Failure to meet any of the above limits is cause for rejecting the new fuel oil, but does not represent a failure to meet the LCO concern since the fuel oil is not added to the storage tanks.

Within 31 days following the initial new fuel oil sample, the fuel oil is analyzed to establish that the other properties specified in Table 1 of ASTM D975-8 1 are met for new fuel oil when tested in accordance with ASTM D975-81, except that the analysis for sulfur may be performed in accordance with ASTM D1552 or ASTM D2622. The 31 day period is acceptable because the fuel oil properties of interest, even if they were not within stated limits, would not have an immediate effect on DG operation.

This surveillance ensures the availability of high quality fuel oil for the diesel generators.

Fuel oil degradation during long term storage shows up as an increase in particulate, due mostly to oxidation. The presence of particulate does not mean the fuel oil will not bum properly in a diesel engine. The particulate can cause fouling of filters and fuel oil injection equipment, however, which can cause engine failure. Particulate concentrations should be determined in accordance with ASTM D2276-78, Method A, every 92 days. This method involves a gravimetric determination of total particulate concentration in the fuel oil and has a limit of 10 mg/I. It is acceptable to obtain a field sample for subsequent laboratory testing in lieu of field testing.

The frequency of this test takes into consideration fuel oil degradation trends that indicate that particulate concentration is unlikely to change significantly between surveillance intervals.

SR 4.8.l.1.2.c.2 Under accident and loss of offsite power conditions, loads are sequentially connected to the bus by the automatic load sequencer. The sequencing logic controls the permissive and starting signals to motor breakers to prevent overloading of the diesel generators due to high motor starting currents. The load sequence time interval tolerances ensure that sufficient time exists for the diesel generator to restore frequency and voltage prior to applying the next load and that safety analysis assumptions regarding Engineered Safety Features (ESF) equipment time delays are not violated.

The 18 month frequency is based on engineering judgment, taking into consideration unit conditions required to perform the surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the surveillance when performed at the 18 month frequency. Therefore, the frequency is acceptable from a reliability standpoint.

MILLSTONE - UNIT 2 Amendment No. 277 B 3/4 8-If

3/4.8 ELECTRICAL POWER SYSTEMS BASES This surveillance is modified by a Note. The reason for the Note is that performing the surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally performing the surveillance in MODE 1, 2, 3, or 4 is further amplified to allow the surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed surveillance, a successful surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and start up to determine that plant safety is maintained or enhanced when the surveillance is performed in MODE 1, 2, 3, or 4. Risk insights or deterministic methods may be used for this assessment.

SR 4.8.1.3.2.c.3 Each diesel generator is provided with an engine overspeed trip to prevent damage to the engine. Recovery from the transient caused by the loss of a large load could cause diesel engine overspeed, which, if excessive, might result in a trip of the engine. This surveillance demonstrates the diesel generator load response characteristics and capability to reject the largest single load without exceeding a predetermined frequency limit. The single largest load for each diesel generator is identified in the FSAR (Tables 8.3-2 and 8.3-3).

This surveillance may be accomplished by either:

a. Tripping the diesel generator output breaker with the diesel generator carrying greater than or equal to its associated single largest post-accident load while paralleled to offsite power or while solely supplying the bus; or

b. Tripping the equivalent of the single largest post-accident load with the diesel generator solely supplying the bus.

The time, voltage, and frequency tolerances specified in this surveillance are based on the response during load sequence intervals. The 2.2 seconds specified is equal to 40% of the 5.5 second load sequence interval associated with sequencing of the largest load (Safety Guide 9).

The voltage and frequency specified are consistent with the design range of the equipment powered by the diesel generator. SR 4.8.1.1.2.c.3.a corresponds to the maximum frequency excursion, while SR 4.8.1.1.2.c.3.b and SR 4.8.l.1.2.c.3.c are steady state voltage and frequency values to which the system must recover following load rejection.

MILLSTONE - UNIT 2 Amendment No. 277 B3/48-Ig

3/4.8 ELECTRICAL POWER SYSTEMS BASES The 18 month frequency is based on engineering judgment, taking into consideration unit conditions required to perform the surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the surveillance when performed at the 18 month frequency. Therefore, the frequency is acceptable from a reliability standpoint.

This surveillance is modified by a Note to ensure that the diesel generator is tested under load conditions that are as close to design basis conditions as practical. When synchronized with offsite power, testing should be performed at a power factor of < 0.9 lagging. This power factor is representative of the inductive loading a diesel generator would see based on the motor rating of the single largest load. It is within the adjustment capability of the Control Room Operator based on the use of reactive load indication to establish the desired power factor. Under certain conditions, however, the note allows the surveillance to be conducted at a power factor other than

< 0.9. These conditions occur when grid voltage is high, and the additional field excitation needed to get the power factor to < 0.9 results in voltages on the emergency buses that are too high. Under these conditions, the power factor should be maintained as close as practicable to 0.9 while still maintaining acceptable voltage limits on the emergency buses. In other circumstances, the grid voltage may be such that the diesel generator excitation levels needed to obtain a power factor of 0.9 may not cause unacceptable voltages on the emergency buses, but the excitation levels are in excess of those recommended for the diesel generator. In such cases, the power factor shall be maintained as close as practicable to 0.9 lagging without exceeding the diesel generator excitation limits.

SR 4.8.1.1.2.c.4 This surveillance demonstrates the diesel generator capability to reject a rated load without overspeed tripping. A diesel generator rated load rejection may occur because of a system fault or inadvertent breaker tripping. This surveillance ensures proper engine generator load response under the simulated test conditions. This test simulates the loss of the total connected load that the diesel generator experiences following a rated load rejection and verifies that the diesel generator will not trip upon loss of the load. While the diesel generator is not expected to experience this transient during an event, this response ensures that the diesel generator is not degraded for future application, including reconnection to the bus if the trip initiator can be corrected or isolated.

This surveillance is performed by tripping the diesel generator output breaker with the diesel generator carrying the required load while paralleled to offsite power.

The 18 month frequency is based on engineering judgment, taking into consideration unit conditions required to perform the surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the surveillance when performed at the 18 month frequency. Therefore, the frequency is acceptable from a reliability standpoint.

MILLSTONE - UNIT 2 Amendment No. 277 B 314 8-lh

3/4.8 ELECTRICAL POWER SYSTEMS BASES This surveillance is modified by a Note to ensure that the diesel generator is tested under load conditions that are as close to design basis conditions as practical. When synchronized with offsite power, testing should be performed at a power factor of < 0.83 lagging. This power factor is representative of the inductive loading a diesel generator would see under design basis accident conditions. Under certain conditions, however, the note allows the surveillance to be conducted at a power factor other than

• 0.83. These conditions occur when grid voltage is high, and the additional field excitation needed to get the power factor to *0.83 results in voltages on the emergency buses that are too high. Under these conditions, the power factor should be maintained as close as practicable to 0.83 while still maintaining acceptable voltage limits on the emergency buses. In other circumstances, the grid voltage may be such that the diesel generator excitation levels needed to obtain a power factor of 0.83 may not cause unacceptable voltages on the emergency buses, but the excitation levels are in excess of those recommended for the diesel generator. In such cases, the power factor shall be maintained as close as practicable to 0.83 lagging without exceeding the diesel generator excitation limits.

SR 4.8.l.1.2.c.5 In the event of a design basis accident coincident with a loss of offsite power, the diesel generators are required to supply the necessary power to ESF systems so that the fuel, RCS, and containment design limits are not exceeded. This surveillance demonstrates the diesel generator operation during a loss of offsite power actuation test signal in conjunction with an ESF actuation signal, including shedding of the nonessential loads and energization of the emergency buses and respective loads from the diesel generator. It further demonstrates the capability of the diesel generator to automatically achieve the required voltage and speed (frequency) within the specified time. The diesel generator auto-start time of 15 seconds is derived from requirements of the accident analysis to respond to a design basis large break LOCA. The surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability has been achieved. The requirement to verify the connection of permanent and auto-connected loads is intended to satisfactorily show the relationship of these loads to the diesel generator loading logic. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the diesel generator system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The 18 month frequency is based on engineering judgment, taking into consideration unit conditions required to perform the surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the surveillance when performed at the 18 month frequency. Therefore, the frequency is acceptable from a reliability standpoint.

MILLSTONE - UNIT 2 Amendment No. 277 13 i/4 1-11i

3/4.8 ELECTRICAL POWER SYSTEMS BASES For the purpose of this testing, the diesel generators must be started from a standby condition. Standby condition for a diesel generator means the diesel engine coolant and oil are being circulated and temperature is being maintained consistent with manufacturer recommendations.

This surveillance is modified by a Note. The reason for the Note is that performing the surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally performing the surveillance in MODE 1 2, 3, or 4 is further amplified to allow portions of the surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial surveillance, a successful partial surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and start up to determine that plant safety is maintained or enhanced when portions of the surveillance are performed in MODE 1, 2, 3, or 4. Risk insights or deterministic methods may be used for the assessment.

SR 4.8I.1.2.c.6 This surveillance demonstrates that diesel generator noncritical protective functions (e.g.,

high jacket water temperature) are bypassed on a loss of voltage signal concurrent with an ESF actuation test signal. During this time, the critical protective functions (engine overspeed, generator differential current, low lube oil pressure [2 out of 3 logic], and voltage restraint overcurrent) remain available to trip the diesel generator and/or output breaker to avert substantial damage to the diesel generator unit. An EDG Emergency Start Signal (Loss of Power signal or SIAS) bypasses the EDG mechanical trips in the EDG control circuit, except engine overspeed, and switches the low lube oil trip to a 2 of 3 coincidence. The loss of power to the emergency bus, based on supply breaker position (A302, A304, and A505 for Bus 24C; A410, A41 1, and A505 for Bus 24D), bypasses the EDG electrical trips in the breaker control circuit except generator differential current and voltage restraint over current. The noncritical trips are bypassed during design basis accidents and provide an alarm on an abnormal engine condition. This alarm provides the operator with sufficient time to react appropriately. The diesel generator availability to mitigate the design basis accident is more critical than protecting the engine against minor problems that are not immediately detrimental to emergency operation of the diesel generator.

The 18 month frequency is based on engineering judgment, taking into consideration unit conditions required to perform the surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the surveillance when performed at the 18 month frequency. Therefore, the frequency is acceptable from a reliability standpoint.

MILLSTONE - UNIT 2 Amendment No. 277 B 3/4 8-lj

3/4.8 ELECTRICAL POWER SYSTEMS BASES This surveillance is modified by a Note. The reason for the Note is that performing the surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally performing the surveillance in MODE 1, 2, 3, or 4 is further amplified to allow portions of the surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial surveillance, a successful partial surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the surveillance are performed in MODE 1, 2, 3, or 4. Risk insights or deterministic methods may be used for the assessment.

SR 4.8.1.1.2.c.7 This surveillance demonstrates the as designed operation of the standby power sources during loss of the offsite source. This test verifies all actions encountered from the loss of offsite power, including shedding of the nonessential loads and energization of the emergency buses and respective loads from the diesel generator. It further demonstrates the capability of the diesel generator to automatically achieve the required voltage and speed (frequency) within the specified time. The diesel generator auto-start time of 15 seconds is derived from requirements of the accident analysis to respond to a design basis large break LOCA. The surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability has been achieved. The requirement to verify the connection and power supply of permanent and auto-connected loads is intended to satisfactorily show the relationship of these loads to the diesel generator loading logic. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the diesel generator system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The 18 month frequency is based on engineering judgment, taking into consideration unit conditions required to perform the surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the surveillance when performed at the 18 month frequency. Therefore, the frequency is acceptable from a reliability standpoint.

MILLSTONE - UNIT 2 Amendment No. 277 1 3/4 h-1k

3/4.8 ELECTRICAL POWER SYSTEMS BASES This surveillance is modified by two Notes. The reason for Note I is that performing the surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally performing the surveillance in MODE 1, 2, 3, or 4 is further amplified to allow portions of the surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial surveillance, a successful partial surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and start up to determine that plant safety is maintained or enhanced when portions of the surveillance are performed in MODE 1,2, 3, or 4. Risk insights or deterministic methods may be used for the assessment.

Surveillance Note 2 specifies that the start of the diesel generator from a standby condition is not required if this surveillance is performed in conjunction with SR 4.8.1.1 .2.c.5. Since this test is normally performed in conjunction with SR 4.8.1.1.2.c.5, the proposed note will exclude the requirement to start from a standby condition to minimize the time to perform this test. This will reduce shutdown risk since plant restoration, and subsequent equipment availability will occur sooner. In addition, it is not necessary to test the ability of the EDG to auto start from a standby condition for this test since that ability will have already been verified by SR 4.8.1.1.2.c.5, which will have just been performed if the note's exclusion is to be utilized. If this test is to be performed by itself, the EDG is required to start from a standby condition.

SR 4.8.1.1.2.c.8 This surveillance demonstrates that the diesel generator automatically starts and achieves the required voltage and speed (frequency) within the specified time (15 seconds) from the design basis actuation signal (Safety Injection Actuation Signal) and operates for 2 5 minutes. The 5 minute period provides sufficient time to demonstrate stability. Since the specified actuation signal (ESF signal without loss of offsite power) will not cause the emergency bus loads to be shed, and will not cause the diesel generator to load, the surveillance ensures that permanently connected loads and autoconnected loads remain energized from the offsite electrical power system (Unit 2 RSST or NSST, or Unit 3 RSST or NSST). In certain circumstances, many of these loads cannot actually be connected without undue hardship or potential for undesired operation. It is not necessary to verify all autoconnected loads remain connected. A representative sample is acceptable.

MILLSTONE - UNIT 2 Amendment No. 277 b it/4 a-II

3/4.8 ELECTRICAL POWER SYSTEMS BASES The 18 month frequency is based on engineering judgment, taking into consideration unit conditions required to perform the surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the surveillance when performed at the 18 month frequency. Therefore, the frequency is acceptable from a reliability standpoint.

For the purpose of this testing, the diesel generators must be started from a standby condition. Standby condition for a diesel generator means the diesel engine coolant and oil are being circulated and temperature is being maintained consistent with manufacturer recommendations.

SR 4.8.1.1.2.c.9 This surveillance demonstrates that the diesel engine can restart from a hot condition, such as subsequent to shutdown from a normal surveillance, and achieve the required voltage and speed within 15 seconds. The 15 second time is derived from the requirements of the accident analysis to respond to a design basis large break LOCA.

The 18 month frequency is based on engineering judgment, taking into consideration unit conditions required to perform the surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the surveillance when performed at the 18 month frequency. Therefore, the frequency is acceptable from a reliability standpoint.

This surveillance is modified by a Note. The Note ensures that the test is performed with the diesel sufficiently hot. The load band is provided to avoid routine overloading of the diesel generator. Routine overloads may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain diesel generator OPERABILITY The requirement that the diesel has operated for at least 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> at rated load conditions prior to performance of this surveillance is based on manufacturer recommendations for achieving hot conditions. Momentary transients due to changing bus loads do not invalidate this test.

SRs 4.8.1.1 .2.d. 1 and 4.8.1.1 .2.d.2 SR 4.3.1.1 .2.d.1 verifies that, at a 184 day frequency, the diesel generator starts from standby conditions and achieves required voltage and speed (frequency) within 15 seconds. The 15 second start requirement supports the assumptions of the design basis LOCA analysis in the FSAR. Diesel generator voltage and speed will continue to increase to rated values, and then should stabilize. SR 4.8.1.1.2.d.2 verifies the ability of the diesel generator to achieve steady state voltage and frequency conditions. The time for voltage and speed (frequency) to stabilize is periodically monitored and the trend evaluated to identify degradation of governor or voltage regulator performance when besting in accordance with the requirements of this surveillance.

MILLSTONE - UNIT 2 Amendment No. 277 Li 3/4 S-i m

3/4.8 ELECTRICAL POWER SYSTEMS BASES The 184 day frequency for this surveillance is a reduction in cold testing consistent with Generic Letter 84-15. This frequency provides adequate assurance of diesel generator OPERABILITY, while minimizing degradation resulting from testing. In addition, SR 4.8.1.1.2.d may be performed in lieu of 4.8.1.1 .2.a.

For the purpose of this testing, the diesel generators must be started from a standby condition. Standby condition for a diesel generator means the diesel engine coolant and oil are being circulated and temperature is being maintained consistent with manufacturer recommendations.

During performance of SR 4.8.1.1 .2.d. 1, the diesel generators shall be started by using one of the following signals:

1. Manual;

2. Simulated loss of offsite power in conjunction with a safety injection actuation signal;

3. Simulated safety injection actuation signal alone; or

4. Simulated loss of power alone.

SR 4.8.1.1.2.d.3 This surveillance verifies that the diesel generators are capable of synchronizing with the offsite electrical system and accepting loads greater than or equal to the equivalent of the maximum expected accident loads. A minimum run time of 60 minutes is required to stabilize engine temperatures, while minimizing the time that the diesel generator is connected to the offsite source. Although no power factor requirements are established by this surveillance, the diesel generator is normally operated at a power factor between 0.8 lagging and 1.0. The 0.8 value is the design rating of the machine, while 1.0 is an operational limitation.

The 184 day frequency for this surveillance is a reduction in cold testing consistent with Generic Letter 84-15. This frequency provides adequate assurance of diesel generator OPERABILITY, while minimizing degradation resulting from testing.

This SR is modified by four Notes. Note 1 indicates that diesel engine runs for this surveillance may include gradual loading, as recommended by the manufacturer, so that mechanical stress and wear on the diesel engine are minimized. Note 2 states that momentary transients because of changing bus loads do not invalidate this test. Similarly, momentary power factor transients above the limit will not invalidate the test. Note 3 indicates that this surveillance should be conducted on only one diesel generator at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations. Note 4 stipulates a prerequisite requirement for performance of this surveillance. A successful diesel generator start must precede this test to credit satisfactory performance.

MILLSTONE - UNIT 2 Amendment No. 277 B 3/4 X- in

3/4.8 ELECITRICAL POWER SYSTEMS BASES The OPERABILITY of the minimum specified A.C. and D.C. power sources and associated distribution systems during shutdown and refueling ensures that 1) the facility can be maintained in the shutdown or refueling condition for extended time periods and 2) sufficient instrumentation and control capability is available for monitoring and maintaining the facility status. If the required power sources or distribution systems are not OPERABLE in MODES 5 and 6, operations involving CORE ALTERATIONS, positive reactivity changes, or movement of irradiated fuel assemblies are required to be suspended. The required action to suspend positive reactivity additions does not preclude actions to maintain or increase reactor vessel inventory provided the boron concentration of the makeup water source is greater than or equal to the boron concentration for the required SHUTDOWN MARGIN. In addition, suspension of these activities does not preclude completion of actions to establish a safe conservative plant condition.

The non-safety grade 125V D.C. Turbine Battery is required for accident mitigation for a main steam line break within containment with a coincident loss of a vital D.C. bus. The Turbine Battery provides the alternate source of power for Inverters 1 & 2 respectively via non-safety grade Inverters 5 & 6. For the loss of a D.C. event with a coincident steam line break within containment, the feedwater regulating valves are required to close to ensure containment design pressure is not exceeded.

MILLSTONE - UNIT 2 B 314 8-lo Amendment No. 488,492,234-, 24&, .

26A, 277

ADMINISTRATIVE CONTROLS 6.24 Diesel Fuel Oil Test Program A diesel fuel oil testing program to implement required testing of both new fuel oil and stored fuel oil shall be established. The program shall include sampling and testing requirements, and acceptance criteria, all in accordance with applicable ASTM Standards. The purpose of the program is to establish the following:

a. Acceptability of new fuel oil for use prior to addition to storage tanks by determining that the fuel oil has:

1. An API gravity or an absolute specific gravity within limits,

2. A flash point and kinematic viscosity within limits for ASTM 2D fuel oil, and

3. Water and sediment < 0.05%.

b. Within 31 days following addition of the new fuel oil to storage tanks, verify that the properties of the new fuel oil, other than those addressed in a., above, are within limits for ASTM 2D fuel oil, and

c. Total particulate concentration of the fuel oil is < 10 mg/l when tested every 92 days in accordance with ASTM D-2276-78, Method A.

The provisions of Surveillance Requirements 4.0.2 and 4.0.3 are applicable to the Diesel Fuel Oil Test Program test frequencies.

MILLSTONE - UNIT 2 6-29 Amendment No. 277