Text

Memo, Request for Technical Assistance - Emergency Diesel Generator Testing (TIA 2005-009)
	ML052580444
Person / Time
Site:	Dresden
Issue date:	08/29/2005
From:	Pederson C; Division of Reactor Safety III
To:	Catherine Haney; NRC/NRR/DLPM
References
	FOIA/PA-2010-0209, TIA 2005-009
	Download: ML052580444 (66)
	v • d • e

August 29, 2005 MEMORANDUM TO: Catherine Haney, Deputy Director Division of Licensing Project Management Office of Nuclear Reactor Regulation (NRR)

FROM: Cynthia D. Pederson, Director Division of Reactor Safety

SUBJECT:

REQUEST FOR TECHNICAL ASSISTANCE - EMERGENCY DIESEL GENERATOR TESTING AT DRESDEN (TIA 2005-009)

Region IlIl requests NRR assistance to resolve the following issues associated with the licensing basis and conformance with Technical Specification SR 3.8.1.15. at the Dresden Nuclear Power Station.

1. Emergency diesel generator (EDG) surveillance testing, while potentially in compliance with licensee commitments and respective Technical Specifications (TS), does not envelope the predicted LOOP-LOCA load requirements. This concern relates to the adequacy of current TS surveillance requirements.

2. EDG surveillance procedures require testing at a power factor for only 10 minutes of the 24-hour endurance test. Region IlIl questions whether this test meets TS SR 3.8.1.15.

Background

On May 10, 2002, the NRC completed an inspection at the Dresden Nuclear Power Station (Reference 1). During this inspection, the inspectors identified that calculated design basis loads for LOOP-LOCA events exceeded the continuous rating of the emergency diesel generators. The inspectors noted that Technical Specification Sections SR 3.8.1.3, SR 3.8.1.11, and SR 3.8.1.15 used a load band of 2340 kW to 2600 kW based on 90 to 100 percent of the Units 2/3 EDG continuous ratings of 2600 kW as basis for acceptability. The inspectors opened an unresolved item to track the issue (URI 50-237/02-06-02; 50-249/02-06-02).

Attachments: 1. References

2. AC Sources - Operating cc w/att: M. Johnson, OE EJL, NRR RIDSNRRDLPMLPDIII CONTACT: Stuart Sheldon, DRS (630) 829-9727

August 29, 2005 MEMORANDUM TO: Catherine Haney, Deputy Director Division of Licensing Project Management Office of Nuclear Reactor Regulation (NRR)

FROM: Cynthia D. Pederson, Director IRA!

Division of Reactor Safety

SUBJECT:

REQUEST FOR TECHNICAL ASSISTANCE - EMERGENCY DIESEL GENERATOR TESTING AT DRESDEN (TIA 2005-009)

Region IlIl requests NRR assistance to resolve the following issues associated with the licensing basis and conformance with Technical Specification SR 3.8.1.15. at the Dresden Nuclear Power Station.

1. Emergency diesel generator (EDG) surveillance testing, while potentially in compliance with licensee commitments and respective Technical Specifications (TS), does not envelope the predicted LOOP-LOCA load requirements. This concern relates to the adequacy of current TS surveillance requirements.

2. EDG surveillance procedures require testing at a power factor for only 10 minutes of the 24-hour endurance test. Region IlIl questions whether this test meets TS SR 3.8.1.15.

Background

On May 10, 2002, the NRC completed an inspection at the Dresden Nuclear Power Station (Reference 1). During this inspection, the inspectors identified that calculated design basis loads for LOOP-LOCA events exceeded the continuous rating of the emergency diesel generators. The inspectors noted that Technical Specification Sections SR 3.8.1.3, SR 3.8.1.11, and SR 3.8.1.15 used a load band of 2340 kW to 2600 kW based on 90 to 100 percent of the Units 2/3 EDG continuous ratings of 2600 kW as basis for acceptability. The inspectors opened an unresolved item to track the issue (URI 50-237/02-06-02; 50-249/02-06-02).

Attachments: 1. References

2. AC Sources - Operating cc Watt: M. Johnson, OE EJL, NRR RIDSNRRDLPMLPDIII CONTACT: Stuart Sheldon, DRS (630) 829-9727 DOCUMENT NAME:TIA 2005-009.wpd 0 Publicly Available X Non-Publicly Available X Sensitive 0 Non-Sensitive To receive a copy of this document, Indicate In the concurrence box 'C'

Copy without attachtencl 'El

Copy with attach/enc IN'

No copy OFFICE Ril I Rill I Rill I I NAME AMStone for AMStone CPederson SSheldon:tr .

DATE 08/24/05 08/24/05 08/29/05 OFFICIAL RECORD COPY

C. Haney On August 12, 2005, the NRC completed a safety system design and performance capability biennial baseline inspection at the Dresden Nuclear Power Station (Reference 2). The emergency diesel generators were chosen as the system to be reviewed. During the inspection, the inspectors reviewed information related to the previously described unresolved item and identified additional concerns related to the level of compliance with SR 3.8.1.15 and the associated bases (Reference 3 (Attch 1, 2)). The licensee also provided several position papers which are attached for your reference (Attch 3-5).

The emergency diesel generators at Dresden are rated as shown in the following table. Also shown are the predicted post accident loads on the 2 EDG (Reference 4). The short term loads are the automatically connected loads required during core flooding (less than 10 minutes).

The long term loads are manually connected and are required to ensure containment integrity.

EDG Ratings EDG 2 Calculated Loads 10 Percent Short term Long term Continuous Overload - 2000 (less than (greater than Hr 10 minutes) 10 minutes) kVA 3250 3575 2510 3249 kW 2600 2860 2228 2851 kVAR 1950 2145 1155 1557 pf .8 .8 .88 .88 Concern 1: Question Regarding the Adequacv of Existing EDG Surveillance Requirements This concern regards the lack of a surveillance requirement which envelopes the design basis loads. The table above and chart below depict where the Dresden EDGs will operate within the 10 percent overload rating beginning at 10 minutes after a design basis event and for an extended period of time after manual loads are added onto the EDG. However, the current TS surveillance requirements, and licensee testing practices, only demonstrate the ability of the EDG to carry a load near this level for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

C. Haney EDG Loads and TS SR Load 3000 2500- -'

2000 -

1500 0 500 1000 1500 Time (min)

-. kW Loads TS SR lower bound TS SR Upper bound Dresden load calculation limits appear to have been established in 1981 based upon documents from the Systematic Evaluation Program (SEP) Topic VIII-2 which evaluated licensees against criteria from Reg Guide 1.9, Revision 2. Paragraph C.2 of Reg Guide 1.9, Revision 2 states: "At the operating license stage of review, the predicted loads should not exceed the short-time rating (as defined in Section 3.7.2 of IEEE Std 387-1977) of the diesel-generator unit." The licensee complies with this requirement.

As the licensee transitioned to the Standard Technical Specifications, the EDG surveillance requirements were taken from NUREG-1 433 Volume 1, Revision 2 which references Regulatory Guide 1.9, Revision 3. A basic premise of this guide is that design basis loads do not exceed the continuous rating of the EDG. Paragraph C.1.3 of Reg Guide 1.9, Revision 3 states: "At the operating license stage of review, the predicted loads should not exceed the continuous rating (as defined in Section 3.7.1 of IEEE Std 387-1984) of the diesel-generator unit." While the licensee asserts that they are not committed to Reg Guide 1.9, Revision 3, it is referenced in their Technical Specifications.

This creates a situation in which the licensee's surveillance requirements do not envelope the design basis accident loads. The current surveillance test procedure specifies 2730 kW -

2860 kW for two hours. This is potentially less than the design load requirement of 2851 kW for an extended period. Region IlIl questions whether this is an adequate demonstration of the EDGs capability to carry design basis loads.

C. Haney Concern 2: Question regarding the licensee's compliance with the requirements of SR 3.8.1.15 This concern regards surveillance requirement 3.8.1.15 and the EDG 24-hour endurance run.

SR 3.8.1.15 requires the licensee to:

Verify each DG operating within the power factor limit operates for >24 hours:

a. For > 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months loaded > 2730 kW and < 2860 kW; and

b. For the remaining hours of the test loaded > 2340 kW and < 2600 kW.

The TS SR Bases establish the power factor limit as < .85. Note 2 of SR 3.8.1.15 states that "If grid conditions do not permit, the power factor limit is not required to be met. Under this condition, the power factor shall be maintained as close to the limit as practicable."

The licensee developed surveillance procedure DOS 6600-12 (Reference 5) to demonstrate compliance with SR 3.8.1.15. In this surveillance test, the diesel is connected to the grid and operated for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months at a load between 2730 and 2860 kW and approximately unit power factor

(+/- 300 kVARS). The load is then lowered to between 2340 and 2600 kW for the remaining 22 hours2.546296e-4 days 0.00611 hours 3.637566e-5 weeks 8.371e-6 months of the test. Sometime during this 22-hour period, the power factor is adjusted by increasing KVARS to a band of 1550 to 1600 (.83 - .86pf) if possible, keeping the voltage on the emergency bus less that 4300 volts. This is held for only 10 minutes before returning to the

+ 300 kVAR band. During a surveillance conducted on March 22, 2005, the licensee limited load to 1100 kVARS (.91 pf) to stay within the voltage limits.

Prior to the EDG test, the licensee does not perform any evaluation as to the condition of the grid, with respect to whether or not the power factor limit can be achieved. Rather, regardless of whether the grid conditions may support testing at the power factor limit, the licensee has established a testing practice which only tests at this limit for 10 minutes.

The licensee asserts that this method has been approved by the NRC. In the licensee's transition to the standard technical specification format of NUREG-1433, they submitted a request for Technical Specification Changes dated March 3, 2000 (Reference 6), which contains the following statement in the justification for deviation from ITS 3.8.1:

"... Therefore, it is not practicable to operate the generator in droop mode at the anticipated worst case accident power factor for long periods. The inductive load will vary during the accident. VAR demand is dependent on the connected loads, starting of induction motors and system impedance. Raising the voltage regulator for an output of 1600 kVAR (equal to approximately 0.85 power factor at rated kW output), maintaining this output for a short period, then returning output to near unity power factor is more representative of system requirements."

The licensee maintains that since this amendment was approved with no exception taken to the statement above, that they are complying with their surveillance requirements. However, the surveillance procedure requiring a reactive load for only 10 minutes of the 24-hour run is not in literal compliance with the requirements and would appear to violate the intent of the surveillance requirements.

C. Haney Requested Action Evaluate the EDG surveillance requirements for Dresden Nuclear Power Station to answer the following questions:

1. Does the current endurance test at 2340 - 2600 kW for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months provide reasonable assurance that the EDGs will be able to carry 2851 kW for an extended period during a design basis accident or are the values within the technical specification surveillance requirement nonconservative?

2. Does the licensee's test approach of loading the EDG to 1550 -1600 kVAR for 10 minutes meet the supporting regulatory analysis and intent of the technical specification requirements?

Coordination This request was discussed between Ann Marie Stone (RIII/DRS/EB1), Cornelius Holden (NRR/ADPT/DLPMWPD-1), George Dick (NRRIADPT/DLPM/LPD3), Ronaldo Jenkins (NRR/ADPT/DE/EEIB), and others during a conference call held on August 18, 2005. It was agreed that NRR would accept this issue as a Task Interface Agreement and respond to this request within 100 days after receipt.

References

1. Dresden Nuclear Power Station, NRC Inspection Report 50-237/02-06(DRS);

50-249/02-06(DRS) (ADAMS Accession No. ML021780428)

2. Dresden Nuclear Power Station, NRC Inspection Report 50-237/2005009; 50-249/2005009(DRS)

3. Dresden Technical Specifications SR 3.8.1.15 and associated bases section (Attch 1, 2)

4. 9389-46-19-2; Calculation for Diesel Generator 2 Loading Under Design Bases Accident Condition; Revision 1D

5. DOS 6600-12; Diesel Generator Tests - Endurance and Margin/Full Load Rejection/ECCS/Hot Restart; Revision 30

6. Request for Technical Specifications Changes for Dresden Nuclear Power Station, Units 2 and 3, March 3, 2000 (ADAMS Accession No. ML003689460)

Attachment

EMD-ESI POSITION PAPER POWVER FACTOR LOADING DURING EMERGENCY DIESEL GENERATOR TESTING Recent regulatory guidance from the Standard Technical Specifications and Regulatory Guide 1.9, Revision 3 stipulate that the EDG should be loaded to rated power factor when paralleled to the grid for certain EDG Tests. RG 1.9, Revision 3 stipulates that this practice be performed during Single Load Rejection, Full Load Rejection, and Endurance and Margin Testing which are performed each outage. Some stations have Standard Technical Specifications that also stipulate that in addition to the previous mentioned tests, EDG loading to rated power factor should be performed for monthly Slow Load-Run Testing.

In 1994 during the performance of Full Load Rejection Test, a member of the EMD-ESI Owners Group recorded a peak voltage of approximately 4900 volts. This was above their Technical Specification Acceptance Criteria of 4784 volts. The test was then reperformed without loading the EDG to rated power factor and the results were satisfactory.

At that time, discussions with their Generator manufacturer indicated that they would not recommend operating the EDG at a voltage greater than 5000 V, even during transient loading.

The manufacturer also stated that operating the EDG during transient loading for a short period of time at a voltage higher than 5000 V would not cause immediate damage to the generator, however, it would cause degradation over time, and could be considered destructive testing. It should also be noted that this manufacturer also stated that the generators would have been designed with insulation systems to meet the normal transient voltages and that this would have been confirmed by high potential testing per IEEE 115 and NEMA MG1 Standards at a voltage of 2 times rated plus 1000 volts (approximately 9000 volts).

The EDG Power Factor or KVA Rating is based on the ability of the generator's insulation to dissipate the heat generated internally by currents, rotating parts and other sources. Testing to rated KW verifies that the engine and its controls will successfully drive the generator to its full rated load. Testing to rated power factor verifies that the generator and its exciter can successfully handle full KVAR loading of the unit.

The EMD-ESI Recommended Maintenance Program has a recommendation to perform insulation resistance measurements and obtain the Polarization Index of the generator's stator windings in accordance with the manufacturer's recommendations each outage to verify that generator insulation is in acceptable condition.

Standard Technical Specifications has acceptance criteria for the full load reject test that usually has two parts. One, the diesel engine does not trip on overspeed and secondly, the voltage is maintained below some nominal value, during and following the load rejection. This voltage limit may be different at the different stations. The bases section for this Surveillance Requirement at one EMD-ESI member station goes on to state that the objective is ensure the DG is tested under load conditions that are as close to design basis conditions as possible.

Though testing at power factor is recommended such that test conditions are representive of the actual design basis inductive loading, there are some inconsistencies when performing the full load Page 1 of3 EMD-05-04 Power Factor Position-finall

EMD-ESI POSITION PAPER POWER FACTOR LOADING DURING EMERGENCY DIESEL GENERATOR TESTING reject test. When paralleled to the grid, the voltage regulator (VR) is adjusted to bring the DG load to rated power factor. Adjustment of the VR rheostat while paralleled to the grid during EDG testing, basically serves to increase or decrease the voltage reference of the voltage regulator and correspondingly increase or decrease reactive'loading with respect to the droop setting of the voltage regulator. This differs from emergency EDG operation where the EDG operates in isochronous under actual design basis reactive loading and the voltage reference setting is at nominal voltage.

When the EDG output breaker is tripped during full load reject testing at power factor, operating in parallel with an off site network, the voltage regulator attempts to maintain voltage at this higher voltage reference setting (greater than the nominal voltage it would be operating at in isochronous mode during emergency conditions). This results in a much higher peak voltage during the voltage transient following the loss of load during testing at rated power factor than what would be encountered during design basis (emergency) conditions. Full load reject testing has shown that this peak voltage can climb very close to the generator vendor's recommended maximum transient voltage.

During previous discussions between an EMD-ESI Member and NRC EDG personnel in 1995, the NRC indicated that they agreed that there did not appear to be adequate justification for performing this testing at rated power factor, because it basically serves only to change the setpoint of voltage regulator.

It is the position of the EMD-ESI Owners Group, that the EDGs not be tested at rated power factor during Slow Load-Run, Single Load Rejection, Endurance and Margin Testing, and any other EDG testing performed when parallel to the grid, with the exception of-a short period of time to show that'the unit is capable of obtaining it's design basis reactive loading. This can be done by once every refueling cycle, loading the EDG to its power factor associated with design basis reactive loading for a brief period of time to verify that the generator and its exciter can perform their design function. The EDG should be brought from a low KVAR setting, to full design basis reactive KVAR loading and full KW load over a period of time, and left there until KVARs and KWs stabilize (expected to be approximately one to two minutes). Then KVAR loading reduced to a low KVAR setting for the remainder of the test. This testing approach will ensure that the generator and exciter can perform their design function and should also serve to minimize the risks of a full load reject at rated power factor conditions when operating in parallel with the off site network. The test can be easily performed during the Endurance and Margin test (8 or 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months run).

Though testing at power factor is recommended by the Standard Technical Specifications such that test conditions are representative of the actual design basis inductive loading, testing of the full load reject test at power factor when connected to the grid does not represent an actual EDG operating condition. Testing to rated power factor when connected to the grid results in a much higher peak voltage during this transient than what would be encountered during design basis conditions (design basis reactive loading) with a voltage reference point of nominal generator voltage, and no droop. Even though EDG reactive loading may be simulated during this test, Page 2 of 3 EMD-05-04 Power Factor Position-final 1

EMD-ESI POSITION PAPER POWER FACTOR LOADING DURING EMERGENCY DIESEL GENERATOR TESTING actual voltage response associated with testing at rated power factor would not be represented.

Therefore, it does not appear that any value can be gained by performing full load rejection testing at rated power factor.

It is recommended that during EDG testing with the EDG paralleled to the grid, the KVAR loading be kept to a reasonable level as determined by each station while at full load (except as described above). This practice should serve to ensure that voltage transients do not exceed the generator vendor's maximum voltage limit, if the EDG output breaker should trip during testing. It is also recommended that some minimum reactive load, as determined by each station be maintained to prevent the Diesel Generator from tripping on reverse power due to large load changes on the grid.

The conclusion of this position paper is that EDG testing at rated power factor should not be performed during full load rejection testing or during other tests, where the EDG is paralleled to the grid with the exception that the power factor testing associated with the design basis reactive loading will be demonstrated for a short period of time during the EDG endurance surveillance.

The basis for this position is primarily that a full load rejection at rated power factor is considered to be destructive testing, based upon the potential for the generator vendor's maximum voltage limit being exceeded during such a test.

Page 3 of 3 EMD-05-04 Power Factor Position-finall

AC Sources-Operating 3.8.1 3.8 ELECTRICAL POWER SYSTEMS 3.8.1 AC Sources-Operating LCO 3.8.1 The following AC electrical power sources shall be OPERABLE:

a. Two qualified circuits between the offsite transmission network and the onsite Class 1E AC Electrical Power Distribution System;

b. Two diesel generators (DGs);

c. One qualified circuit between the offsite transmission network and the opposite unit's Division 2 onsite Class 1E AC electrical power distribution subsystem capable of supporting the equipment required to be OPERABLE by LCO 3.6.4.3, "Standby Gas Treatment (SGT) System,"

LCO 3.7.4, "Control Room Emergency Ventilation (CREV)

System" (Unit 3 only), and LCO 3.7.5, "Control Room Emergency Ventilation Air Conditioning (AC) System" (Unit 3 only); and

d. The opposite unit's DG capable of supporting the equipment required to be OPERABLE by LCO 3.6.4.3, LCO 3.7.4 (Unit 3 only), and LCO 3.7.5 (Unit 3 only).

APPLICABILITY: MODES 1, 2, and 3.

NOTE-------------------------------------

The opposite unit's AC electrical power sources in LCO 3.8.1.c and d are not required to be OPERABLE when the associated required equipment (SGT subsystem, CREV System (Unit 3 only), and Control Room Emergency Ventilation AC System (Unit 3 only)) is inoperable.

Dresden 2 and 3 3.8. 1-1 Amendment No. 185/180

AC Sources-Operating 3.8.1 ACTIONS

NOTE-------------------------------------

LCO 3.0.4.b is not applicable to the unit and common DGs, but is applicable to I the opposite unit DG. I CONDITION I REQUIRED ACTION I COMPLETION TIME A. One required offsite A.1 Perform SR 3.8.1.1 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months circuit inoperable. for OPERABLE required offsite circuit. AND Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter AND A.2 Declare required 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months from feature(s) with no discovery of no offsite power offsite power to available inoperable one division when the redundant concurrent with required feature(s) inoperability of are inoperable. redundant required feature(s)

AND A.3 Restore required 7 days offsite circuit to OPERABLE status. AND 14 days from discovery of failure to meet LCO 3.8.1.a or b (continued)

Dresden 2 and 3 3.8.1- 2 Amendment No. 212/204

AC Sources-Operating 3.8.1 ACTIONS CONDITION I REQUIRED ACTION ICOMPLETION TIME B. One required DG B.1 Perform SR 3.8.1.1 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months inoperable. for OPERABLE required offsite circuit(s). AND Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter AND B.2 Declare required 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from feature(s), supported discovery of by the inoperable DG, Condition B inoperable when the concurrent with redundant required inoperability of feature(s) are redundant inoperable. required feature(s)

AND B.3.1 Determine OPERABLE 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months DG(s) are not inoperable due to common cause failure.

OR B.3.2 Perform SR 3.8.1.2 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for OPERABLE DG(s).

B.4 Restore required DG 7 days to OPERABLE status.

AND 14 days from discovery of failure to meet LCO 3.8.1.a or b (continued)

Dresden 2 and 3 3.8.1-3 Amendment No. 185/180

AC Sources-Operating 3.8.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME C. Two required offsite C.1 Declare required 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months from circuits inoperable. feature(s) inoperable discovery of when the redundant Condition C required feature(s) concurrent with are inoperable. inoperability of redundant required feature(s)

AND C.2 Restore one required 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months offsite circuit to OPERABLE status.

D. One required offsite ------------ NOTE------------

circuit inoperable. Enter applicable Conditions and Required Actions of AND LCO 3.8.7, "Distribution Systems-Operating," when One required DG Condition D is entered with inoperable. no AC power source to any division.

D.1 Restore required 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months offsite circuit to OPERABLE status.

OR D.2 Restore required DG 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to OPERABLE status.

E. Two required DGs E.1 Restore one required 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months inoperable. DG to OPERABLE status.

(continued)

Dresden 2 and 3 3.8. 1-4 Amendment No. 185/180

AC Sources-Operating 3.8.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME F. Required Action and F.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time of Condition A, AUN B, C, D, or E not met.

F.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months G. Three or more required G.1 Enter LCO 3.0.3. Immediately AC sources inoperable.

Dresden 2 and 3 3.8. 1-5 Amendment No. 185/180

AC Sources-Operating 3.8.1 SURVEILLANCE REQUIREMENTS

NOTES -----------------------------------

1. SR 3.8.1.1 through SR 3.8.1.20 are applicable only to the given unit's AC electrical power sources.

2. SR 3.8.1.21 is applicable to the opposite unit's AC electrical power sources.

SURVEILLANCE FREQUENCY SR 3.8.1.1 Verify correct breaker alignment and 7 days indicated power availability for each required offsite circuit.

SR 3.8.1.2 -------------------NOTES-------------------

1. All DG starts may be preceded by an engine prelube period and followed by a warmup period prior to loading.

2. A modified DG start involving idling and gradual acceleration to synchronous speed may be used for this SR as recommended by the manufacturer.

When modified start procedures are not used, the time, voltage, and frequency tolerances of SR 3.8.1.8 must be met.

3. A single test of the common DG at the specified Frequency will satisfy the Surveillance for both units.

Verify each DG starts from standby 31 days conditions and achieves steady state voltage 2 3952 V and < 4368 V and frequency 2 58.8 Hz and < 61.2 Hz.

(continued)

Dresden 2 and 3 3.8.1- 6 Amendment No. 185/180

AC Sources-Operating 3.8.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.1.3 ------------------- NOTES-------------------

1. DG loadings may include gradual loading as recommended by the manufacturer.

2. Momentary transients outside the load range do not invalidate this test.

3. This Surveillance shall be conducted on only one DG at a time.

4. This SR shall be preceded by and immediately follow, without shutdown, a successful performance of SR 3.8.1.2 or SR 3.8.1.8.

5. A single test of the common DG at the specified Frequency will satisfy the Surveillance for both units.

Verify each DG is synchronized and loaded 31 days and operates for 2 60 minutes at a load 2 2340 kW and < 2600 kW.

SR 3.8.1.4 Verify each day tank contains 2 205 gal of 31 days fuel oil and each bulk fuel storage tank contains 2 10,000 gal of fuel oil.

SR 3.8.1.5 Remove accumulated water from each day 31 days tank.

SR 3.8.1.6 Verify each fuel oil transfer pump operates 31 days to automatically transfer fuel oil from the storage tank to the day tank.

(continued)

Dresden 2 and 3 3.8.1- 7 Amendment No. 185/180

AC Sources-Operating 3.8.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.1.7 Check for and remove accumulated water from 92 days each bulk storage tank.

SR 3.8.1.8 ------------------ NOTES-------------------

1. All DG starts may be preceded by an engine prelube period.

2. A single test of the common DG at the specified Frequency will satisfy the Surveillance for both units.

Verify each DG starts from standby 184 days condition and achieves:

a. In < 13 seconds, voltage 2 3952 V and frequency 2 58.8 Hz; and

b. Steady state voltage 2 3952 V and

4368 V and frequency 2 58.8 Hz and

< 61.2 Hz.

SR 3.8.1.9 Verify manual transfer of unit power supply 24 months from the normal offsite circuit to the alternate offsite circuit.

(continued)

Dresden 2 and 3 3.8. 1-8 Amendment No. 185/180

AC Sources-Operating 3.8.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.1.10 ------------------- NOTE--------------------

A single test of the common DG at the specified Frequency will satisfy the Surveillance for both units.

Verify each DG rejects a load greater than 24 months or equal to its associated single largest post-accident load, and:

a. Following load rejection, the frequency is

66.73 Hz;

b. Within 3 seconds following load rejection, the voltage is 2 3952 V and

< 4368 V; and

c. Within 4 seconds following load rejection, the frequency is 2 58.8 Hz and < 61.2 Hz.

4-SR 3.8.1.11 ------------------ NOTES--------------------

1. A single test of the common DG at the specified Frequency will satisfy the Surveillance for both units.

2. Momentary transients outside the voltage limit do not invalidate this test.

Verify each DG does not trip and voltage is 24 months maintained < 5000 V during and following a load rejection of 2 2340 kW and < 2600 kW.

(continued)

Dresden 2 and 3 3.8.1-9 Amendment No. 185/180

AC Sources-Operating 3.8.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.1.12 NOTE--------------------

All DG starts may be preceded by an engine prelube period.

Verify on an actual or simulated loss of 24 months offsite power signal:

a. De-energization of emergency buses;

b. Load shedding from emergency buses; and

c. DG auto-starts from standby condition and:

1. energizes permanently connected loads in s 13 seconds,

2. maintains steady state voltage 2 3952 V and S 4368 V,

3. maintains steady state frequency 2 58.8 Hz and

61.2 Hz, and

4. supplies permanently connected loads for 2 5 minutes.

(continued)

Dresden 2 and 3 3.8.1 -10 Amendment No. 185/180

AC Sources-Operating 3.8.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.1.13 ------------------- NOTE--------------------

All DG starts may be preceded by an engine prelube period.

Verify on an actual or simulated Emergency 24 months Core Cooling System (ECCS) initiation signal each DG auto-starts from standby condition and:

a. In < 13 seconds after auto-start, achieves voltage 2 3952 V and frequency 2 58.8 Hz;

b. Achieves steady state voltage 2 3952 V and s 4368 V and frequency 2 58.8 Hz and < 61.2 Hz; and

c. Operates for 2 5 minutes.

SR 3.8.1.14 Verify each DG's automatic trips are 24 months bypassed on actual or simulated loss of voltage signal on the emergency bus concurrent with an actual or simulated ECCS initiation signal except:

a. Engine overspeed; and

b. Generator differential current.

(continued)

Dresden 2 and 3 3.8.1 -11 Amendment No. 185/180

AC Sources-Operating 3.8.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.1.15 ------------------- NOTES-------------------

1. Momentary transients outside the load range and power factor limit do not invalidate this test.

2. If grid conditions do not permit, the power factor limit is not required to be met. Under this condition, the power factor shall be maintained as close to the limit as practicable.

3. A single test of the common DG at the specified Frequency will satisfy the Surveillance for both units.

Verify each DG operating within the power 24 months factor limit operates for Ž 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months s:

a. For 2 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months loaded 2 2730 kW and

2860 kW; and

b. For the remaining hours of the test loaded 2 2340 kW and < 2600 kW.

(continued)

Dresden 2 and 3 3.8.1 -12 Amendment No. 185/180

AC Sources-Operating 3.8.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY 4-SR 3.8.1.16 NOTES-------------------

1. This Surveillance shall be performed within 5 minutes of shutting down the DG after the DG has operated 2 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months loaded 2 2340 kW.

Momentary transients below the load limit do not invalidate this test.

2. All DG starts may be preceded by an engine prelube period.

3. A single test of the common DG at the specified Frequency will satisfy the Surveillance for both units.

Verify each DG starts and achieves: 24 months

a. In s 13 seconds, voltage 2 3952 and frequency 2 58.8 Hz; and

b. Steady state voltage 2 3952 V and

4368 V and frequency 2 58.8 Hz and

61.2 Hz.

SR 3.8.1.17 Verify each DG: 24 months

a. Synchronizes with offsite power source while loaded with emergency loads upon a simulated restoration of offsite power;

b. Transfers loads to offsite power source; and

c. Returns to ready-to-load operation.

(continued)

Dresden 2 and 3 3.8.1 -13 Amendment No. 185/180

AC Sources-Operating 3.8.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.1.18 Verify interval between each sequenced load 24 months block is 2 90% of the design interval for each load sequence time delay relay.

SR 3.8.1.19 ------------------- NOTE------------

All DG starts may be preceded by an engine prelube period.

Verify, on an actual or simulated loss of 24 months offsite power signal in conjunction with an actual or simulated ECCS initiation signal:

a. De-energization of emergency buses;

b. Load shedding from emergency buses; and

c. DG auto-starts from standby condition and:

1. energizes permanently connected loads in s 13 seconds,

2. energizes auto-connected emergency loads including through time delay relays, where applicable,

3. maintains steady state voltage 2 3952 V and < 4368 V,

4. maintains steady state frequency 2 58.8 Hz and < 61.2 Hz, and

5. supplies permanently connected and auto-connected emergency loads for 2 5 minutes.

(continued)

Dresden 2 and 3 3.8.1- 14 Amendment No. 185/180

AC Sources-Operating 3.8.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.1.20 ------------------- NOTE--------------------

All DG starts may be preceded by an engine prelube period.

Verify, when started simultaneously from 10 years standby condition, each DG achieves, in s 13 seconds, voltage 2 3952 V and frequency 2 58.8 Hz.

SR 3.8.1.21 ------------------- NOTE--------------------

When the opposite unit is in MODE 4 or 5, or moving irradiated fuel assemblies in secondary containment, the following opposite unit SRs are not required to be performed: SR 3.8.1.3, SR 3.8.1.10 through SR 3.8.1.12, and SR 3.8.1.14 through SR 3.8.1.17.

For required opposite unit AC electrical In accordance power sources, the SRs of the opposite with applicable unit's Specification 3.8.1, except SRs SR 3.8.1.9, SR 3.8.1.13, SR 3.8.1.18, SR 3.8.1.19, and SR 3.8.1.20, are applicable.

Dresden 2 and 3 3.8.1-15 Amendment No. 185/180

AC Sources-Operating B 3.8.1 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.1 AC Sources-Operating BASES BACKGROUND The unit Class IE AC Electrical Power Distribution System AC sources consist of the offsite power sources, and the onsite standby power sources (diesel generators (DGs) 2, 3, and 2/3). As required by UFSAR, Section 3.1.2.2.8 (Ref. 1), the design of the AC electrical power system provides independence and redundancy to ensure an available source of power to the Engineered Safety Feature (ESF) systems.

The Class lE unit AC distribution system is, for the most part, divided into redundant load groups (Divisions 1 and 2), so loss of any one group does not prevent the minimum safety functions from being performed. The exception is that the opposite unit's Division 2 AC Electrical Power Distribution System powers shared Division 2 loads (i.e.,

standby gas treatment subsystem, Control Room Emergency Ventilation (CREV) System (Unit 3 only), and Control Room Emergency Ventilation Air Conditioning (AC) System (Unit 3 only)). Although shared by both units, the CREV System and Control Room Emergency Ventilation AC System are single train systems that are powered only from a single Unit 2 motor control center. Each unit's load group has connections to two physically independent offsite power sources and a single DG.

Offsite power is supplied to each of the 138 kV and 345 kV switchyards from the transmission network by six and seven transmission lines, respectively. From the 345 kV switchyards, one qualified electrically and physically separated circuit normally provides AC power, through a 345/138 kV transformer (TR86) to the reserve auxiliary transformer (RAT) 22, to 4160 V Essential Service System (ESS) bus 24-1 via ESS bus 24 to supply the Division 2 loads of Unit 2. From the 345 kV switchyard, another qualified, electrically and physically separated circuit normally provides AC power, through RAT 32, to 4160 V ESS bus 34-1 via ESS bus 34 to supply the Division 2 loads of Unit 3.

Unit auxiliary transformer (UAT) 21, which is normally supplied by the Unit 2 main generator, is normally aligned to Unit 2 to supply Division 1 4160 V ESS bus 23-1 via ESS bus 23. Finally, UAT 31, which is normally supplied by the (continued)

Dresden 2 and 3 B 3.8.1-1 Revision 14

AC Sources-Operating B 3.8.1 BASES BACKGROUND Unit 3 main generator, is normally aligned to Unit 3 to (continued) supply Division 1 4160 V ESS bus 33-1 via ESS bus 33.

When a main generator is not operating, the loads fed from the UAT are automatically transferred to the RAT on a generator trip (RAT 22 will supply 4160 V ESS bus 23-1 via 4160 V ESS bus 23 and RAT 32 will supply 4160 V ESS bus 33-1 via 4160 V ESS bus 33). The given unit's RAT is the primary (normal) offsite source to the Division 1 and 2 load groups.

The RAT of the opposite unit provides the second (alternate) qualified offsite source through bus ties provided between the corresponding ESS buses of the two units. Additionally, the UAT of either unit provides another source of offsite power to the ESS buses only when the unit is shutdown and the UAT is being backfed from the grid. Physical changes to the generator links are required to place the unit in an alignment to allow backfeed. The offsite AC electrical power sources are designed and located so as to minimize to the extent practical the likelihood of their simultaneous failure under operating and postulated accident and environmental conditions. A detailed description of the offsite power network and circuits to the onsite Class lE ESS buses is found in the UFSAR, Section 8.2 (Ref. 2).

A qualified offsite circuit consists of all breakers, transformers, switches, interrupting devices, cabling, and controls required to transmit power from the offsite transmission network to the onsite Class lE ESS bus or buses.

RATs 22 and 32 are sized to accommodate the simultaneous starting of all ESF loads on receipt of an accident signal without the need for load sequencing.

The onsite standby power source for 4160 V ESS 23-1, 24-1, 33-1, and 34-1 consists of three DGs. DGs 2 and 3 are dedicated to ESS buses 24-1 and 34-1, respectively. DG 2/3 is a shared power source and can supply either Unit 2 ESS bus 23-1 or Unit 3 ESS bus 33-1. A DG starts automatically on a loss of coolant accident (LOCA) signal (i.e., low reactor water level signal or high drywell pressure signal)

(refer to LCO 3.3.5.1, "Emergency Core Cooling System (ECCS)

Instrumentation") or on an ESS bus degraded voltage or undervoltage signal (refer to LCO 3.3.8.1, "Loss of Power (LOP) Instrumentation"). After the DG has started, it automatically ties to its respective bus after offsite power (continued)

Dresden 2 and 3 B 3.8.1-2 Revision 14

AC Sources-Operating B 3.8.1 BASES BACKGROUND is tripped as a consequence of ESS bus undervoltage or (continued) degraded voltage, independent of or coincident with a LOCA signal. The DGs also start and operate in the standby mode without tying to the ESS bus on a LOCA signal alone. In the event of a LOCA on a unit, DG 2/3 will start and supply the unit (bus 23-1 or 33-1) experiencing the accident if no offsite power is available. This is accomplished by using the accident signal to prevent the DG 2/3 output breaker from closing on the nonaccident unit. Following the trip of offsite power, buses 23-1, 24-1, 33-1, and 34-1 are automatically disconnected from their normal supply and all nonessential loads are disconnected from the ESS bus. When the DG is tied to the ESS bus, loads are then sequentially connected to their respective ESS bus, if a LOCA signal is present, by the sequence logic. The sequencing logic controls the starting signals to motor breakers to prevent overloading the DG.

In the event of a loss of offsite power, the ESF electrical loads are automatically connected to the DGs in sufficient time to provide for safe reactor shutdown and to mitigate the consequences of a Design Basis Accident (DBA) such as a LOCA.

Certain required plant loads are returned to service in a predetermined sequence in order to prevent overloading of the DGs in the process. Within 30 seconds after the initiating signal is received, all automatic and permanently connected loads needed to recover the unit or maintain it in a safe condition are returned to service.

DGs 2, 3, and 2/3 have the following ratings:

a. 2600 kW-continuous,

b. 2860 kW-2000 hours.

APPLICABLE The initial conditions of DBA and transient analyses in the SAFETY ANALYSES UFSAR, Chapter 6 (Ref. 3) and Chapter 15 (Ref. 4), assume ESF systems are OPERABLE. The AC electrical power sources are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System (RCS), and containment design limits are not exceeded. These limits are discussed in more detail in the (continued)

Dresden 2 and 3 B 3.8.1-3 Revision 0

AC Sources-Operating B 3.8.1 BASES APPLICABLE Bases for Section 3.2, Power Distribution Limits; SAFETY ANALYSES Section 3.5, Emergency Core Cooling System (ECCS) and (continued) Isolation Condenser (IC) System; and Section 3.6, Containment Systems.

The OPERABILITY of the AC electrical power sources is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit. This includes maintaining the onsite or offsite AC sources OPERABLE during accident conditions in the event of:

a. An assumed loss of all offsite power or all onsite AC power; and

b. A worst case single failure.

AC sources satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO Two qualified circuits between the offsite transmission network and the onsite Class lE AC Electrical Power Distribution System, two separate and independent DGs, one qualified circuit between the offsite transmission network and the opposite unit's Division 2 onsite Class IE AC Electrical Power Distribution subsystem capable of supporting equipment required to be OPERABLE by LCO 3.6.4.3, "Standby Gas treatment (SGT) System," LCO 3.7.4, "Control Room Emergency Ventilation (CREV) System" (Unit 3 only), and LCO 3.7.5, "Control Room Emergency Ventilation Air Conditioning (AC) System" (Unit 3 only), and the opposite unit's DG capable of supporting the equipment required to be OPERABLE by LCO 3.6.4.3,.LCO 3.7.4 (Unit 3 only), and LCO 3.7.5 (Unit 3 only), ensure availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an anticipated operational occurrence (AOO) or a postulated DBA.

Qualified offsite circuits are those that are described in the UFSAR, and are part of the licensing basis for the unit.

Each offsite circuit from the 138 kV and 345 kV switchyards must be capable of maintaining rated frequency and voltage, and accepting required loads during an accident, while connected to the 4160 V ESS buses. An offsite circuit to (continued)

Dresden 2 and 3 B 3.8.1-4 Revision 0

AC Sources-Operating B 3.8.1 BASES LCO each unit consists of the incoming breakers and disconnects (continued) to the respective 22 and 32 RATs, RATs 22 and 32, and the respective circuit path including feeder breakers to 4160 V ESS buses. A qualified circuit does not have to be connected to the ESS bus (i.e., the main generator can be connected to the ESS bus) as long as the capability to fast transfer to the qualified circuit exists. The other qualified offsite circuit for each unit is provided by a bus tie between the corresponding ESS buses of the two units.

The breakers connecting the buses must be capable of closure. For Unit 2, LCO 3.8.1.a is met if RAT 22 is capable of supplying ESS buses 23-1 and 24-1 and if RAT 32 (or UAT 31 on backfeed) can supply ESS bus 23-1 via ESS bus 33 and 33-1 and the associated bus tie or ESS bus 24-1 via ESS bus 34 and 34-1 and the associated bus tie. For Unit 3, LCO 3.8.1.a is met if RAT 32 can supply ESS buses 33-1 and 34-1 and if RAT 22 (or UAT 21 on backfeed) can supply ESS bus 33-1 via ESS bus 23 and 23-1 and the associated bus tie or ESS bus 34-1 via ESS bus 24 and 24-1 and the associated bus tie. For Unit 2, LCO 3.8.1.c is met if RAT 32 (or UAT 31 on backfeed) is capable of supplying ESS bus 39 to support equipment required by LCO 3.6.4.3. For Unit 3, LCO 3.8.1.c is met if RAT 22 (or UAT 21 on backfeed) is capable of supplying ESS bus 29 to support equipment required by LCO 3.6.4.3, LCO 3.7.4, and LCO 3.7.5.

The respective unit DG and common DG must be capable of starting, accelerating to rated speed and voltage, and connecting to its respective 4160 V ESS bus on detection of bus undervoltage. This sequence must be accomplished within 13 seconds. Each respective unit DG and common DG must also be capable of accepting required loads within the assumed loading sequence intervals, and must continue to operate until offsite power can be restored to the 4160 V ESS buses.

These capabilities are required to be met from a variety of initial conditions, such as DG in standby with the engine hot and DG in standby with the engine at ambient condition.

Proper sequencing of loads, including tripping of non-essential loads, is a required function for DG OPERABILITY.

The opposite unit's DG must be capable of starting, accelerating to rated speed and voltage, and connecting to its Division 2 Class IE AC electrical power distribution subsystem on detection of bus undervoltage. This sequence (continued)

Dresden 2 and 3 B 3.8.1-5 Revision 0

AC Sources-Operating B 3.8.1 BASES LCO must be accomplished within 13 seconds and is required to be (continued) met from the same variety of initial conditions specified for the respective unit and shared DGs. For Unit 2 to meet LCO 3.8.1.d, DG 3 must be capable of supplying ESS bus 34-1 on a loss of power to the bus in order to supply ESS bus 39 to support equipment required by LCO 3.6.4.3. Similarly, for Unit 3 to meet LCO 3.8.1.d, DG 2 must be capable of supplying ESS bus 24-1 on a loss of power to the bus in order to supply ESS bus 29 to support equipment required by LCO 3.6.4.3, LCO 3.7.4, and LCO 3.7.5.

In addition, fuel oil storage and fuel oil transfer pump requirements must be met for each required DG.

The AC sources must be separate and independent (to the extent possible) of other AC sources. For the DGs, the separation and independence are complete. For the offsite AC sources, the separation and independence are to the extent practical. A qualified circuit may be connected to both divisions of either unit, with manual transfer capability to the other circuit OPERABLE, and not violate separation criteria. A qualified circuit that is not connected to the 4160 V ESS buses is required to have OPERABLE manual transfer capability to the 4160 V ESS buses to support OPERABILITY of that qualified circuit.

APPLICABILITY The AC sources are required to be OPERABLE in MODES 1, 2, and 3 to ensure that:

a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and

b. Adequate core cooling is provided and containment OPERABILITY and other vital functions are maintained in the event of a postulated DBA.

A Note has been added taking exception to the Applicability requirements for the opposite unit's Division 2 AC electrical power sources in LCO 3.8.1.c and d, provided the associated required equipment (SGT subsystem, CREV System (Unit 3 only), and Control Room Emergency Ventilation AC System (Unit 3 only)) is inoperable. This exception is (continued)

Dresden 2 and 3 B 3.8.1-6 Revision 0

AC Sources-Operating B 3.8.1 BASES APPLICABILITY intended to allow declaring of the opposite unit's (continued) Division 2 supported equipment inoperable either in lieu of declaring the opposite unit's Division 2 source inoperable, or at any time subsequent to entering ACTIONS for an inoperable opposite unit Division 2 source. This exception is acceptable since, with the opposite unit powered Division 2 equipment inoperable and the associated ACTIONS entered, the opposite unit Division 2 AC sources provide no additional assurance of meeting the above criteria.

The AC power requirements for MODES 4 and 5 and other conditions in which AC sources are required are covered in LCO 3.8.2, "AC Sources-Shutdown."

ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable unit or common DG. The.Note allows application of LCO 3.0.4.b to the opposite unit DG. There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable unit or common DG and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.

With an opposite unit DG inoperable, the risk increase of entering a MODE or other specified condition in the Applicability is smaller and can be assessed on a case-by-case basis.

A.1 To ensure a highly reliable power source remains with one offsite circuit inoperable, it is necessary to verify the availability of the remaining required offsite circuit on a more frequent basis. Since the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action not met.

However, if a second required circuit fails SR 3.8.1.1, the second offsite circuit is inoperable, and Condition C, for two offsite circuits inoperable, is entered.

(continued)

Dresden 2 and 3 B 3.8.1-7 Revision 21

AC Sources-Operating B 3.8.1 BASES ACTIONS A.2 (continued)

Required Action A.2, which only applies if the division cannot be powered from an offsite source, is intended to provide assurance that an event with a coincident single failure of the associated DG does not result in a complete loss of safety function of critical systems. These features are designed with redundant safety related divisions (i.e.,

single division systems are not included). Redundant required features failures consist of inoperable features associated with a division redundant to the division that has no offsite power.

The Completion Time for Required Action A.2 is intended to allow time for the operator to evaluate and repair any discovered inoperabilities. This Completion Time also allows an exception to the normal "time zero" for beginning the allowed outage time "clock." In this Required Action the Completion Time only begins on discovery that both:

a. The division has no offsite power supplying its loads; and

b. A redundant required feature on the other division is inoperable.

If, at any time during the existence of this Condition (one offsite circuit inoperable) a redundant required feature subsequently becomes inoperable, this Completion Time would begin to be tracked.

Discovering no offsite power to one 4160 V ESS bus of the onsite Class lE Power Distribution System coincident with one or more inoperable redundant required support or supported features, or both, that are associated with any other ESS bus that has offsite power, results in starting the Completion Time for the Required Action. Twenty-four hours is acceptable because it minimizes risk while allowing time for restoration before the unit is subjected to transients associated with shutdown.

The remaining OPERABLE offsite circuit and DGs are adequate to supply electrical power to the onsite Class 1E Distribution System. Thus, on a component basis, single failure protection may have been lost for the required feature's function; however, function is not lost. The (continued)

Dresden 2 and 3 B 3.8.1-8 Revision 21

AC Sources-Operating B 3.8.1 BASES ACTIONS AL (continued) 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time takes into account the component OPERABILITY of the redundant counterpart to the inoperable required feature. Additionally, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

A.3 With one offsite circuit inoperable, the reliability of the offsite system is degraded, and the potential for a loss of offsite power is increased, with attendant potential for a challenge to the plant safety systems. In this condition, however, the remaining OPERABLE offsite circuit and DGs are adequate to supply electrical power to the onsite Class 1E Distribution System.

The 7 day Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and the low probability of a DBA occurring during this period.

The second Completion Time for Required Action A.3 establishes a limit on the maximum time allowed for any combination of required AC power sources to be inoperable during any single contiguous occurrence of failing to meet LCO 3.8.1.a or b. If Condition A is entered while, for instance, a DG is inoperable, and that DG is subsequently returned OPERABLE, the LCO may already have been not met for up to 7 days. This situation could lead to a total of 14 days, since initial failure to meet the LCO, to restore the offsite circuit. At this time, a DG could again become inoperable, the circuit restored OPERABLE, and an additional 7 days (for a total of 21 days) allowed prior to complete restoration of the LCO. The 14 day Completion Time provides a limit on the time allowed in a specified condition after discovery of failure to meet LCO 3.8.1.a or b. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently. The "AND" connector between the 7 day and 14 day Completion Times means that both Completion Times apply simultaneously, and the more restrictive Completion Time must be met.

(continued)

Dresden 2 and 3 B 3.8.1-9 Revision 21

AC Sources-Operating B 3.8.1 BASES ACTIONS A.3 (continued)

Similar to Required Action A.2, the Completion Time of Required Action A.3 allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."

This exception results in establishing the "time zero" at the time LCO 3.8.1.a or b was initially not met, instead of at the time that Condition A was entered.

B.1 To ensure a highly reliable power source remains with one DG inoperable, it is necessary to verify the availability of the required offsite circuits on a more frequent basis.

Since the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action being not met. However, if a circuit fails to pass SR 3.8.1.1, it is inoperable. Upon offsite circuit inoperability, additional Conditions must then be entered.

B.2 Required Action B.2 is intended to provide assurance that a loss of offsite power, during the period that a DG is inoperable, does not result in a complete loss of safety function of critical systems. These features are designed with redundant safety related divisions (i.e., single division systems are not included). Redundant required features failures consist of inoperable features associated with a division redundant to the division that has an inoperable DG.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."

In this Required Action the Completion Time only begins on discovery that both:

a. An inoperable DG exists; and

b. A redundant required feature on the other division (Division 1 or 2) is inoperable.

(continued)

Dresden 2 and 3 B 3.8.1-10 Revision 21

AC Sources-Operating B 3.8.1 BASES ACTIONS B.2. (continued)

If, at any time during the existence of this Condition (one DG inoperable), a redundant required feature subsequently becomes inoperable, this Completion Time begins to be tracked.

Discovering one required DG inoperable coincident with one or more inoperable redundant required support or supported features, or both, that are associated with the OPERABLE DG(s), results in starting the Completion Time for the Required Action. Four hours from the discovery of these events existing concurrently is acceptable because it minimizes risk while allowing time for restoration before subjecting the unit to transients associated with shutdown.

The remaining OPERABLE DGs and offsite circuits are adequate to supply electrical power to the onsite Class lE Distribution System. Thus, on a component basis, single failure protection for the required feature's function may have been lost; however, function has not been lost. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time takes into account the component OPERABILITY of the redundant counterpart to the inoperable required feature. Additionally, the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and low probability of a DBA occurring during this period.

B.3.1 and B.3.2 Required Action B.3.1 provides an allowance to avoid unnecessary testing of OPERABLE DGs. If it can be determined that the cause of the inoperable DG does not exist on the OPERABLE DG(s), SR 3.8.1.2 does not have to be performed. If the cause of inoperability exists on other DG(s), they are declared inoperable upon discovery, and Condition E or G of LCO 3.8.1 is entered, as applicable.

Once the failure is repaired, and the common cause failure no longer exists, Required Action B.3.1 is satisfied. If the cause of the initial inoperable DG cannot be confirmed not to exist on the remaining DG(s), performance of SR 3.8.1.2 suffices to provide assurance of continued OPERABILITY of those DGs.

(continued)

Dresden 2 and 3 B 3.8.1-11 Revision 21

AC Sources-Operating B 3.8.1 BASES ACTIONS B.3.1 and B.3.2 (continued)

In the event the inoperable DG is restored to OPERABLE status prior to completing either B.3.1 or B.3.2, the station corrective action program will continue to evaluate the common cause possibility. This continued evaluation, however, is no longer under the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months constraint imposed while in Condition B.

According to Generic Letter 84-15 (Ref. 5), 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is a reasonable time to confirm that the OPERABLE DG(s) are not affected by the same problem as the inoperable DG.

B.4 In Condition B, the remaining OPERABLE DGs and offsite circuits are adequate to supply electrical power to the onsite Class 1E Distribution System. The 7 day Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

The second Completion Time for Required Action B.4 establishes a limit on the maximum time allowed for any combination of required AC power sources to be inoperable during any single contiguous occurrence of failing to meet LCO 3.8.1.a or b. If Condition B is entered while, for instance, an offsite circuit is inoperable and that circuit is subsequently restored OPERABLE, the LCO may already have been not met for up to 7 days. This situation could lead to a total of 14 days, since initial failure of the LCO, to restore the DG. At this time, an offsite circuit could again become inoperable, the DG restored OPERABLE, and an additional 7 days (for a total of 21 days) allowed prior to complete restoration of the LCO. The 14 day Completion Time provides a limit on the time allowed in a specified condition after discovery of failure to meet LCO 3.8.1.a or

b. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently. The "AND" connector between the 7 day and 14 day Completion Times means that both Completion Times apply simultaneously, and the more restrictive must be met.

(continued)

Dresden 2 and 3 B 3.8.1-12 Revision 21

AC Sources-Operating B 3.8.1 BASES ACTIONS DLA (continued)

Similar to Required Action B.2, the Completion Time of Required Action B.4 allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."

This exception results in establishing the "time zero" at the time that LCO 3.8.1.a or b was initially not met, instead of the time that Condition B was entered.

C.1 and C.2 Required Action C.1 addresses actions to be taken in the event of inoperability of redundant required features concurrent with inoperability of two offsite circuits.

Required Action C.1 reduces the vulnerability to a loss of function. The Completion Time for taking these actions is reduced to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months from that allowed with one division without offsite power (Required Action A.2). The rationale for the reduction to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is that Regulatory Guide 1.93 (Ref. 6) allows a Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for two required offsite circuits inoperable, based upon the assumption that two complete safety divisions are OPERABLE.

When a concurrent redundant required feature failure exists, this assumption is not the case, and a shorter Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is appropriate. These features are designed with redundant safety related divisions, (i.e.,

single division systems are not included in the list).

Redundant required features failures consist of any of these features that are inoperable because any inoperability is on a division redundant to a division with inoperable offsite circuits.

The Completion Time for Required Action C.1 is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." In this Required Action, the Completion Time only begins on discovery that both:

a. Two required offsite circuits are inoperable; and

b. A redundant required feature is inoperable.

(continued)

Dresden 2 and 3 B 3.8.1-13 Revision 21

AC Sources-Operating B 3.8.1 BASES ACTIONS C.1 and C.2 (continued)

If, at any time during the existence of this Condition (two offsite circuits inoperable), a redundant required feature subsequently becomes inoperable, this Completion Time begins to be tracked.

According to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition C for a period that should not exceed 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . This level of degradation means that the offsite electrical power system does not have the capability to effect a safe shutdown and to mitigate the effects of an accident; however, the onsite AC sources have not been degraded. This level of degradation generally corresponds to a total loss of the immediately accessible offsite power sources.

Because of the normally high availability of the offsite sources, this level of degradation may appear to be more severe than other combinations of two AC sources inoperable that involve one or more DGs inoperable. However, two factors tend to decrease the severity of this degradation level:

a. The configuration of the redundant AC electrical power system that remains available is not susceptible to a single bus or switching failure; and

b. The time required to detect and restore an unavailable offsite power source is generally much less than that required to detect and restore an unavailable onsite AC source.

With both of the required offsite circuits inoperable, sufficient onsite AC sources are available to maintain the unit in a safe shutdown condition in the event of a DBA or transient. In fact, a simultaneous loss of offsite AC sources, a LOCA, and a worst case single failure were postulated as a part of the design basis in the safety analysis. Thus, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time provides a period of time to effect restoration of one of the offsite circuits commensurate with the importance of maintaining an AC electrical power system capable of meeting its design criteria.

(continued)

Dresden 2 and 3 B 3.8.1-14 Revision 21

AC Sources-Operating B 3.8.1 BASES ACTIONS C.1 and C.2 (continued)

According to Regulatory Guide 1.93 (Ref. 6), with the available offsite AC sources two less than required by the LCO, operation may continue for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . If two offsite sources are restored within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , unrestricted operation may continue. If only one required offsite source is restored within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , power operation continues in accordance with Condition A.

D.1 and D.2 Pursuant to LCO 3.0.6, the Distribution System ACTIONS would not be entered even if all AC sources to it were inoperable, resulting in de-energization. Therefore, the .Required Actions of Condition D are modified by a Note to indicate that when Condition D is entered with no AC source to any 4160 V ESS bus (i.e., the bus is de-energized), ACTIONS for LCO 3.8.7, "Distribution Systems-Operating," must be immediately entered. This allows Condition D to provide requirements for the loss of the required offsite circuit and one required DG without regard to whether a division is de-energized. LCO 3.8.7 provides the appropriate restrictions for a de-energized division.

According to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition D for a period that should not exceed 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . In Condition D, individual redundancy is lost in both the offsite electrical power system and the onsite AC electrical power system. Since power system redundancy is provided by two diverse sources of power, however, the reliability of the power systems in this Condition may appear higher than that in Condition C (loss of both required offsite circuits). This difference in reliability is offset by the susceptibility of this power system configuration to a single bus or switching failure. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and the low probability of a DBA occurring during this period.

(continued)

Dresden 2 and 3 B 3.8.1-15 Revision 21

AC Sources-Operating B 3.8.1 BASES ACTIONS .L (continued)

With two required DGs inoperable, there is no more than one remaining standby AC source. Thus, with an assumed loss of offsite electrical power, sufficient standby AC sources may not be available to power the minimum required ESF functions. Since the offsite electrical power system is the only source of AC power for the majority of ESF equipment at this level of degradation, the risk associated with continued operation for a very short time could be less than that associated with an immediate controlled shutdown. (The immediate shutdown could cause grid instability, which could result in a total loss of AC power.) Since any inadvertent unit generator trip could also result in a total loss of offsite AC power, however, the time allowed for continued operation is severely restricted. The intent here is to avoid the risk associated with an immediate controlled shutdown and to minimize the risk associated with this level of degradation.

According to Regulatory Guide 1.93 (Ref. 6), with both DGs inoperable, operation may continue for a period that should not exceed 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . The Completion Time assumes complete loss of onsite (DG) AC capability to power the minimum loads needed to respond to analyzed events.

F.1 and F.2 If the inoperable AC electrical power sources cannot be restored to OPERABLE status within the associated Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

Condition G corresponds to a level of degradation in which all redundancy in the AC electrical power supplies has been lost. At this severely degraded level, any further losses in the AC electrical power system will cause a loss of (continued)

Dresden 2 and 3 B 3.8.1-16 Revision 21

AC Sources-Operating B 3.8.1 BASES ACTIONS G.1 (continued) function. Therefore, no additional time is justified for continued operation. The unit is required by LCO 3.0.3 to commence a controlled shutdown.

SURVEILLANCE The AC sources are designed to permit inspection and REQUIREMENTS testing of all important areas and features, especially those that have a standby function, in accordance with UFSAR, Section 3.1.2.2.9 (Ref. 7). Periodic component tests are supplemented by extensive functional tests during refueling outages (under simulated accident conditions).

The SRs for demonstrating the OPERABILITY of the DGs are consistent with the recommendations of Regulatory Guide 1.9 (Ref. 8), Regulatory Guide 1.108 (Ref. 9), and Regulatory Guide 1.137 (Ref. 10), as addressed in the UFSAR.

The Surveillances are modified by two Notes to clearly identify how the Surveillances apply to the given unit and the opposite unit AC electrical power sources. Note 1 states that SR 3.8.1.1 through 3.8.1.20 are applicable only to the given unit AC electrical power sources and Note 2 states that SR 3.8.1.21 is applicable to the opposite unit AC electrical power sources. These Notes are necessary since the opposite unit AC electrical power sources are not required to meet all of the requirements of the given unit AC electrical power sources (e.g., the opposite unit's DG is not required to start on the opposite unit's ECCS initiation signal to support the OPERABILITY of the given unit).

Where the SRs discussed herein specify voltage and frequency tolerances, the following summary is applicable. The minimum steady state output voltage of 3952 V is 90% of the nominal 4160 V output voltage. This value, which is specified in ANSI C84.1 (Ref. 11), allows for voltage drop to the terminals of 4000 V motors whose minimum operating voltage is specified as 90% or 3600 V. It also allows for voltage drops to motors and other equipment down through the 120 V level where minimum operating voltage is also usually specified as 90% of name plate rating. The specified maximum steady state output voltage of 4368 V is equal to the maximum operating voltage specified for 4000 V motors.

It ensures that for a lightly loaded distribution system, the voltage at the terminals of 4000 V motors is no more than the maximum rated operating voltages. The specified (continued)

Dresden 2 and 3 B 3.8.1-17 Revision 21

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE minimum and maximum frequencies of the DG are 58.8 Hz and REQUIREMENTS 61.2 Hz, respectively. These values are equal to +/- 2% of (continued) the 60 Hz nominal frequency and are derived from the recommendations found in Regulatory Guide 1.9 (Ref. 8).

SR 3.8.1.1 This SR ensures proper circuit continuity for the offsite AC electrical power supply to the onsite distribution network and availability of offsite AC electrical power. The breaker alignment verifies that each breaker is in its correct position to ensure that distribution buses and loads are connected to their preferred power source and that appropriate independence of offsite circuits is maintained.

The 7 day Frequency is adequate since breaker position is not likely to change without the operator being aware of it and because its status is displayed in the control room.

SR 3.8.1.2 and SR 3.8.1.8 These SRs help to ensure the availability of the standby electrical power supply to mitigate DBAs and transients and maintain the unit in a safe shutdown condition.

To minimize the wear on moving parts that do not get lubricated when the engine is not running, these SRs have been modified by a Note (Note 1 for SR 3.8.1.2 and Note 1 for SR 3.8.1.8) to indicate that all DG starts for these Surveillances may be preceded by an engine prelube period and followed by a warmup prior to loading.

For the purposes of this testing, the DGs are started from standby conditions. Standby conditions for a DG mean that the diesel engine coolant and oil are being continuously circulated and temperature is being maintained consistent with manufacturer recommendations.

In order to reduce stress and wear on diesel engines, the manufacturer has recommended a modified start in which the starting speed of DGs is limited, warmup is limited to this lower speed, and the DGs are gradually accelerated to synchronous speed prior to loading. These start procedures are the intent of Note 2 of SR 3.8.1.2.

(continued)

Dresden 2 and 3 B 3.8.1-18 Revision 21

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.2 and SR 3.8.1.8 (continued)

REQUIREMENTS SR 3.8.1.8 requires that, at a 184 day Frequency, the DG starts from standby conditions and achieves required voltage and frequency within 13 seconds. The 13 second start requirement supports the assumptions in the design basis LOCA analysis of UFSAR, Section 6.3 (Ref. 12). The 13 second start requirement is not applicable to SR 3.8.1.2 (see Note 2 of SR 3.8.1.2), when a modified start procedure as described above is used. If a modified start is not used, the 13 second start requirement of SR 3.8.1.8 applies.

Since SR 3.8.1.8 does require a 13 second start, it is more restrictive than SR 3.8.1.2, and it may be performed in lieu of SR 3.8.1.2.

In addition, the DG is required to maintain proper voltage and frequency limits after steady state is achieved. The voltage and frequency limits are normally achieved within 13 seconds. The time for the DG to reach steady state operation, unless the modified DG start method is employed, is periodically monitored and the trend evaluated to identify degradation of governor and voltage regulator performance.

To minimize testing of the common DG, Note 3 of SR 3.8.1.2 and Note 2 of SR 3.8.1.8 allow a single test of the common DG (instead of two tests, one for each unit) to satisfy the requirements for both units. This is allowed since the main purpose of the Surveillance can be met by performing the test on either unit. However, to the extent practicable, the tests should be alternated between units. If the DG fails one of these Surveillances, the DG should be considered inoperable on both units, unless the cause of the failure can be directly related to only one unit.

The 31 day Frequency for SR 3.8.1.2 is consistent with Regulatory Guide 1.9 (Ref. 8). The 184 day Frequency for SR 3.8.1.8 is a reduction in cold testing consistent with Generic Letter 84-15 (Ref. 5). These Frequencies provide adequate assurance of DG OPERABILITY, while minimizing degradation resulting from testing.

(continued)

Dresden 2 and 3 B 3.8.1-19 Revision 21

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.3 REQUIREMENTS (continued) This Surveillance verifies that the DGs are capable of synchronizing and accepting a load approximately equivalent to that corresponding to the continuous rating. A minimum run time of 60 minutes is required to stabilize engine temperatures, while minimizing the time that the DG is connected to the offsite source.

Although no power factor requirements are established by this SR, the DG is normally operated at a power factor between 0.8 lagging and 1.0 when running synchronized with the grid. The 0.8 power factor value is the design rating of the machine at a particular kVA. The 1.0 power factor value is an operational condition where the reactive power component is zero, which minimizes the reactive heating of the generator. Operating the generator at a power factor between 0.8 lagging and 1.0 avoids adverse conditions associated with underexciting the generator and more closely represents the generator operating requirements when performing its safety function (running isolated on its associated 4160 V ESS bus). The load band is provided to avoid routine overloading of the DG. Routine overloading may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY.

The 31 day Frequency for this Surveillance is consistent with Regulatory Guide 1.9 (Ref. 8).

Note 1 modifies this Surveillance to indicate that diesel engine runs for this Surveillance may include gradual loading, as recommended by the manufacturer, so that mechanical stress and wear on the diesel engine are minimized.

Note 2 modifies this Surveillance by stating that momentary transients because of changing bus loads do not invalidate this test. Similarly, momentary power factor transients above the limit do not invalidate the test.

Note 3 indicates that this Surveillance should be conducted on only one DG at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations.

(continued)

Dresden 2 and 3 B 3.8.1-20 Revision 21

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.3 (continued)

REQUIREMENTS Note 4 stipulates a prerequisite requirement for performance of this SR. A successful DG start must precede this test to credit satisfactory performance.

To minimize testing of the common DG, Note 5 allows a single test of the common DG (instead of two tests, one for each unit) to satisfy the requirements for both units. This is allowed since the main purpose of the Surveillance can be met by performing the test on either unit. However, to the extent practicable, the test should be alternated between units. If the DG fails one of these Surveillances, the DG should be considered inoperable on both units, unless the cause of the failure can be directly related to only one unit.

SR 3.8.1.4 This SR provides verification that the level of fuel oil in the day tank is at or above the level at which fuel oil is automatically added. The level is expressed as an equivalent volume in gallons, and is selected to ensure adequate fuel oil for a minimum of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months of DG operation at full load plus 10%.

This SR also provides verification that there is an adequate inventory of fuel oil in the storage tanks to support each DG's operation for approximately 2 days at full load. The approximate 2 day period is sufficient time to place the unit in a safe shutdown condition and to bring in replenishment fuel from an offsite location.

The 31 day Frequency is adequate to ensure that a sufficient supply of fuel oil is available, since low level alarms are provided and facility operators would be aware of any large uses of fuel oil during this period.

SR 3.8.1.5 and SR 3.8.1.7 Microbiological fouling is a major cause of fuel oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water (continued)

Dresden 2 and 3 B 3.8.1-21 Revision 21

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.5 and SR 3.8.1.7 (continued)

REQUIREMENTS environment in order to survive. Removal of water from the fuel oil day tank once every 31 days eliminates the necessary environment for bacterial survival. This is accomplished by draining a portion of the contents from the bottom of the day tank to the top of the storage tank.

Checking for and removal of any accumulated water from the bulk storage tank once every 92 days also eliminates the necessary environment for bacterial survival. This is the most effective means of controlling microbiological fouling.

In addition, it eliminates the potential for water entrainment in the fuel oil during DG operation. Water may come from any of several sources, including condensation, ground water, rain water, contaminated fuel oil, and breakdown of the fuel oil by bacteria. Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. The Surveillance Frequencies are established by Regulatory Guide 1.137 (Ref. 10). This SR is for preventive maintenance. The presence of water does not necessarily represent a failure of this SR provided that accumulated water is removed during performance of this Surveillance.

SR 3.8.1.6 This Surveillance demonstrates that each fuel oil transfer pump operates and automatically transfers fuel oil from its associated storage tank to its associated day tank. It is required to support continuous operation of standby power sources. This Surveillance provides assurance that each fuel oil transfer pump is OPERABLE, the fuel oil piping system is intact, the fuel delivery piping is not obstructed, and the controls and control systems for automatic fuel transfer systems are OPERABLE.

The Frequency for this SR is consistent with the Frequency for testing the DGs in SR 3.8.1.3. DG operation for SR 3.8.1.3 is normally long enough that fuel oil level in the day tank will be reduced to the point where the fuel oil transfer pump automatically starts to restore fuel oil level by transferring oil from the storage tank.

(continued)

Dresden 2 and 3 B 3.8.1-22 Revision 21

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) Transfer of each 4160 V ESS bus power supply from the normal offsite circuit to the alternate offsite circuit demonstrates the OPERABILITY of the alternate circuit distribution network to power the shutdown loads. The 24 month Frequency of the Surveillance is based on engineering judgment taking into consideration the plant conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

Operating experience has shown that these components usually pass the SR when performed on the 24 month Frequency.

Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

SR 3.8.1.10 Each DG is provided with an engine overspeed trip to prevent damage to the engine. Recovery from the transient caused by the loss of a large load could cause diesel engine overspeed, which, if excessive, might result in a trip of the engine. This Surveillance demonstrates the DG load response characteristics and capability to reject the largest single load without exceeding predetermined voltage and frequency and while maintaining a specified margin to the overspeed trip. The largest single load for each DG is a service water pump (686 kW). The specified load value conservatively bounds the expected kW rating of the single largest loads under accident conditions. This Surveillance may be accomplished by:

a. Tripping the DG output breaker with the DG carrying greater than or equal to its associated single largest post-accident load while paralleled to offsite power, or while solely supplying the bus; or

b. Tripping its associated single largest post-accident load with the DG solely supplying the bus.

Consistent with Regulatory Guide 1.9 (Ref. 8), the load rejection test is acceptable if the diesel speed does not (continued)

Dresden 2 and 3 B 3.8.1-23 Revision 0

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.10 (continued)

REQUIREMENTS exceed the nominal (synchronous) speed plus 75% of the difference between nominal speed and the overspeed trip setpoint, or 115% of nominal speed, whichever is lower.

This corresponds to 66.73 Hz, which is the nominal speed plus 75% of the difference between nominal speed and the overspeed trip setpoint.

The time, voltage and frequency tolerances specified in this SR are derived from Regulatory Guide 1.9 (Ref. 8) recommendations for response during load sequence intervals.

The 3 seconds specified in SR 3.8.1.10.b is equal to 60% of the 5 second load sequence interval associated with sequencing the ECCS low pressure pumps during an undervoltage on the bus concurrent with a LOCA. The 4 seconds specified in SR 3.8.1.10.c is equal to 80% of the 5 second load sequence interval associated with sequencing the ECCS low pressure pumps during an undervoltage on the bus concurrent with a LOCA. The voltage and frequency specified are consistent with the design range of the equipment powered by the DG. SR 3.8.1.10.a corresponds to the maximum frequency excursion, while SR 3.8.1.10.b and SR 3.8.1.10.c are steady state voltage and frequency values specified to which the system must recover following load rejection. The 24 month Frequency takes into consideration the plant conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

This SR is modified by a Note. The reason for the Note is to minimize testing of the common DG and allow a single test of the common DG (instead of two tests, one for each unit) to satisfy the requirements for both units. This is allowed since the main purpose of the Surveillance can be met by performing the test on either unit. If the DG fails one of these Surveillances, the DG should be considered inoperable on both units, unless the cause of the failure can be directly related to only one unit.

(continued)

Dresden 2 and 3 B 3.8.1-24 Revision 0

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.11 REQUIREMENTS (continued) Consistent with Regulatory Guide 1.9 (Ref. 8), paragraph C.2.2.8, this Surveillance demonstrates the DG capability to reject a full load without overspeed tripping or exceeding the predetermined voltage limits. The DG full load rejection may occur because of a system fault or inadvertent breaker tripping. This Surveillance ensures proper engine generator load response under the simulated test conditions.

This test simulates the loss of the total connected load that the DG experiences following a full load rejection and verifies that the DG does not trip upon loss of the load.

These acceptance criteria provide DG damage protection.

While the DG is not expected to experience this transient during an event, and continues to be available, this response ensures that the DG is not degraded for future application, including reconnection to the bus if the trip initiator can be corrected or isolated.

In order to ensure that the DG is tested under load conditions that are as close to design basis conditions as possible, a load band (90% to 100%) has been specified based on Regulatory Guide 1.9 (Ref. 8).

The 24 month Frequency takes into consideration the plant conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

This SR is modified by two Notes. To minimize testing of the common DG, Note 1 allows a single test of the common DG (instead of two tests, one for each unit) to satisfy the requirements for both units. This is allowed since the main purpose of the Surveillance can be met by performing the test on either unit. If the DG fails one of these Surveillances, the DG should be considered inoperable on both units, unless the cause of the failure can be directly related to only one unit. Note 2 modifies this Surveillance by stating that momentary transients outside the voltage limit do not invalidate this test.

(continued)

Dresden 2 and 3 B 3.8.1-25 Revision 0

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) Consistent with Regulatory Guide 1.9 (Ref. 8),

paragraph C.2.2.4, this Surveillance demonstrates the as designed operation of the standby power sources during loss of the offsite source. This test verifies all actions encountered from the loss of offsite power, including shedding of the nonessential loads and energization of the emergency buses and respective loads from the DG. It further demonstrates the capability of the DG to automatically achieve the required voltage and frequency within the specified time.

The DG auto-start and energization of permanently connected loads time of 13 seconds is derived from requirements of the accident analysis for responding to a design basis large break LOCA (Ref. 12). The Surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability has been achieved.

The requirement to verify the connection and power supply of permanently connected loads is intended to satisfactorily show the relationship of these loads to the DG loading logic. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation. For instance, a component or system may be out-of-service and closure of its associated breaker during this test may damage the component or system. In lieu of actual demonstration of the connection and loading of these loads, testing that adequately shows the capability of the DG system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The Frequency of 24 months takes into consideration plant conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

This SR is modified by a Note. The reason for the Note is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs shall be started from standby conditions, that is, with the engine coolant and lube oil being continuously circulated and temperature maintained consistent with manufacturer recommendations.

(continued)

Dresden 2 and 3 B 3.8.1-26 Revision 0

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) Consistent with Regulatory Guide 1.9 (Ref. 9), paragraph C.2.2.5, this Surveillance demonstrates that the DG automatically starts and achieves the required voltage and frequency within the specified time (13 seconds) from the design basis actuation signal (LOCA signal). In addition, the DG is required to maintain proper voltage and frequency limits after steady state is achieved. The time for the DG to reach the steady state voltage and frequency limits is periodically monitored and the trend evaluated to identify degradation of governor and voltage regulator performance.

The DG is required to operate for 2 5 minutes. The 5 minute period provides sufficient time to demonstrate stability.

The Frequency of 24 months takes into consideration plant conditions required to perform the Surveillance, and is intended to be consistent with the expected fuel cycle lengths.

This SR is modified by a Note. The reason for the Note is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil being continuously circulated and temperature maintained consistent with manufacturer recommendations.

SR 3.8.1.14 Consistent with Regulatory Guide 1.9 (Ref. 8) paragraph C.2.2.12, this Surveillance demonstrates that DG non-critical protective functions (e.g., high jacket water temperature) are bypassed on an ECCS initiation test signal and critical protective functions (engine overspeed and generator differential current) trip the DG to avert substantial damage to the DG unit. The non-critical trips are bypassed during DBAs and provide an alarm on an abnormal engine condition. This alarm provides the operator with sufficient time to react appropriately. The DG availability to mitigate the DBA is more critical than protecting the engine against minor problems that are not immediately detrimental to emergency operation of the DG.

(continued)

Dresden 2 and 3 B 3.8.1-27 Revision 0

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.14 (continued)

REQUIREMENTS The 24 month Frequency is based on engineering judgment, takes into consideration plant conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

SR 3.8.1.15 Regulatory Guide 1.9 (Ref. 8), paragraph C.2.2.9, requires demonstration that the DGs can start and run continuously at full load capability for an interval of not less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , 22 hours2.546296e-4 days 0.00611 hours 3.637566e-5 weeks 8.371e-6 months of which is at a load equivalent to 90%

to 100% of the continuous rating of the DG and 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months of which is at a load equivalent to 105% to 110% of the continuous rating of the DG. The DG starts for this Surveillance can be performed either from standby or hot conditions. The provisions for prelube and warmup, discussed in SR 3.8.1.2, and for gradual loading, discussed in SR 3.8.1.3, are applicable to this SR.

In order to ensure that the DG is tested under load conditions that are as close to design conditions as possible, testing must be performed at a power factor as close to the accident load power factor as practicable.

When synchronized with offsite power, the power factor limit is s 0.85. This power factor is chosen to bound the actual worst case inductive loading that the DG could experience under design basis accident conditions.

The 24 month Frequency takes into consideration plant conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

This Surveillance is modified by three Notes. Note 1 states that momentary transients do not invalidate this test. The load band is provided to avoid routine overloading of the DG. Routine overloading may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY.

Similarly, momentary power factor transients above the limit do not invalidate the test. Note 2 is provided in recognition that under certain conditions, it is necessary (continued)

Dresden 2 and 3 B 3.8.1-28 Revision 0

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.15 (continued)

REQUIREMENTS to allow the surveillance to be conducted at a power factor other than the specified limit. During the Surveillance, the DG is normally operated paralleled to the grid, which is not the configuration when the DG is performing its safety function following a loss of offsite power (with or without a LOCA). Given the parallel configuration to the grid during the Surveillance, the grid voltage may be such that the DG field excitation level needed to obtain the specified power factor could result in a transient voltage within the DG windings higher than the recommended values if the DG output breaker were to trip during the Surveillance.

Therefore, the power factor shall be maintained as close as practicable to the specified limit while still ensuring that if the DG output breaker were to trip during the Surveillance that the maximum DG winding voltage would not be exceeded. To minimize testing of the common DG, Note 3 allows a single test of the common DG (instead of two tests, one for each unit) to satisfy the requirements for both units. This is allowed since the main purpose of the Surveillance can be met by performing the test on either unit. If the DG fails one of these Surveillances, the DG should be considered inoperable on both units, unless the cause of the failure can be directly related to only one unit.

SR 3.8.1.16 This Surveillance demonstrates that the diesel engine can restart from a hot condition, such as subsequent to shutdown from normal Surveillances, and achieve the required voltage and frequency within 13 seconds. The 13 second time is derived from the requirements of the accident analysis for responding to a design basis large break LOCA (Ref. 12). In addition, the DG is required to maintain proper voltage and frequency limits after steady state is achieved. The time for the DG to reach the steady state voltage and frequency limits is periodically monitored and the trend evaluated to identify degradation of governor and voltage regulator performance.

(continued)

Dresden 2 and 3 B 3.8.1-29 Revision 0

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.16 (continued)

REQUIREMENTS The 24 month Frequency takes into consideration the plant conditions required to perform the Surveillance, and is intended to be consistent with the expected fuel cycle lengths.

This SR is modified by three Notes. Note 1 ensures that the test is performed with the diesel sufficiently hot. The requirement that the diesel has operated for at least 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months at approximately full load conditions prior to performance of this Surveillance is based on manufacturer recommendations for achieving hot conditions. Momentary transients due to changing bus loads do not invalidate this test. Note 2 allows all DG starts to be preceded by an engine prelube period to minimize wear and tear on the diesel during testing. To minimize testing of the common DG, Note 3 allows a single test of the common DG (instead of two tests, one for each unit) to satisfy the requirements for both units. This is allowed since the main purpose of the Surveillance can be met by performing the test on either unit. If the DG fails one of these Surveillances, the DG should be considered inoperable on both units, unless the cause of the failure can be directly related to only one unit.

SR 3.8.1.17 Consistent with Regulatory Guide 1.9 (Ref. 8),

paragraph C.2.2.11, this Surveillance ensures that the manual synchronization and load transfer from the DG to the offsite source can be made and that the DG can be returned to ready-to-load status when offsite power is restored. It also ensures that the auto-start logic is reset to allow the DG to reload if a subsequent loss of offsite power occurs.

The DG is considered to be in ready-to-load status when the DG is at rated speed and voltage, the output breaker is open and can receive an auto-close signal on bus undervoltage, and the individual load timers are reset.

The Frequency of 24 months takes into consideration plant conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

(continued)

Dresden 2 and 3 B 3.8.1-30 Revision 0

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.18 REQUIREMENTS (continued) Under accident conditions with loss of offsite power loads are sequentially connected to the bus by the automatic load sequence time delay relays. The sequencing logic controls the permissive and starting signals to motor breakers to prevent overloading of the DGs due to high motor starting currents. The -10% load sequence time interval limit ensures that a sufficient time interval exists for the DG to restore frequency and voltage prior to applying the next load. There is no upper limit for the load sequence time interval since, for a single load interval (i.e., the time between two load blocks), the capability of the DG to restore frequency and voltage prior to applying the second load is not negatively affected by a longer than designed load interval, and if there are additional load blocks (i.e., the design includes multiple load intervals), then the lower limit requirements (-10%) will ensure that sufficient time exists for the DG to restore frequency and voltage prior to applying the remaining load blocks (i.e.,

all load intervals must be 2 90% of the design interval).

Reference 14 provides a summary of the automatic loading of ESS buses.

The Frequency of 24 months takes into consideration plant conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

SR 3.8.1.19 In the event of a DBA coincident with a loss of offsite power, the DGs are required to supply the necessary power to ESF systems so that the fuel, RCS, and containment design limits are not exceeded.

This Surveillance demonstrates DG operation, as discussed in the Bases for SR 3.8.1.12, during a loss of offsite power actuation test signal in conjunction with an ECCS initiation signal. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the DG system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

(continued)

Dresden 2 and 3 B 3.8.1-31 Revision 0

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.19 (continued)

REQUIREMENTS The Frequency of 24 months takes into consideration plant conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

This SR is modified by a Note. The reason for the Note is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil being continuously circulated and temperature maintained consistent with manufacturer recommendations.

SR 3.8.1.20 This Surveillance demonstrates that the DG starting independence has not been compromised. Also, this Surveillance demonstrates that each engine can achieve proper frequency and voltage within the specified time when the DGs are started simultaneously.

The 10 year Frequency is consistent with the recommendations of Regulatory Guide 1.9 (Ref. 8).

This SR is modified by a Note. The reason for the Note is to minimize wear on the DG during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations.

SR 3.8.1.21 With the exception of this Surveillance, all other Surveillances of this Specification (SR 3.8.1.1 through SR 3.8.1.20) are applied only to the given unit AC sources.

This Surveillance is provided to direct that appropriate Surveillances for the required opposite unit AC sources are governed by the applicable opposite unit Technical Specifications. Performance of the applicable opposite unit Surveillances will satisfy the opposite unit requirements, as well as satisfying the given unit Surveillance (continued)

Dresden 2 and 3 B 3.8.1-32 Revision 0

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.21 (continued)

REQUIREMENTS Requirement. Exceptions are noted to the opposite unit SRs of LCO 3.8.1. SR 3.8.1.9 and SR 3.8.1.20 are excepted since only one opposite unit offsite circuit and DG is required by the given unit's Specification. SR 3.8.1.13, SR 3.8.1.18, and SR 3.8.1.19 are excepted since these SRs test the opposite unit's ECCS initiation signal, which is not needed for the AC electrical power sources to be OPERABLE on the given unit.

The Frequency required by the applicable opposite unit SR also governs performance of that SR for the given unit.

As Noted, if the opposite unit is in MODE 4 or 5, or moving irradiated fuel assemblies in the secondary containment, the following opposite unit SRs are not required to be performed: SR 3.8.1.3, SR 3.8.1.10 through SR 3.8.1.12, and SR 3.8.1.14 through SR 3.8.1.17. This ensures that a given unit SR will not require an opposite unit SR to be performed, when the opposite unit Technical Specifications exempts performance of an opposite unit SR (however, as stated in the opposite unit SR 3.8.2.1 Note 1, while performance of an SR is exempted, the SR must still be met).

REFERENCES 1. UFSAR, Section 3.1.2.2.8.

2. UFSAR, Section 8.2.

3. UFSAR, Chapter 6.

4. UFSAR, Chapter 15.

5. Generic Letter 84-15, July 2, 1984.

6. Regulatory Guide 1.93, Revision 0, December 1974.

7. UFSAR, Section 3.1.2.2.9.

8. Regulatory Guide 1.9, Revision 3, July 1993.

9. Regulatory Guide 1.108, Revision 1, August 1977.

(continued)

Dresden 2 and 3 B 3.8.1-33 Revision 0

AC Sources-Operating B 3.8.1 BASES REFERENCES 10. Regulatory Guide 1.137, Revision 1, October 1979.

(continued)

11. ANSI C84.1, 1982.

12. UFSAR, Section 6.3.

13. UFSAR, Section 8.3.1.5.1.

Dresden 2 and 3 B 3.8.1-34 Revision 0

Page 1 John Boska - Re:

John Boska - Electronic Tech Re: Electronic Specs Tech Specs Page if1.

From: John Boska To: O'Brien, Margaret Date: 9/6/05 8:22AM

Subject:

Re: Electronic Tech Specs Peggy, I have thought about your comments. Unfortunately, it is not realistic to ask OCIO to maintain both a hard copy and an electronic copy (we would double their work in this area). Our question is if the electronic copy is worth giving up the official hard copy. I think most PMs would agree it is worth it. With the electronic copy, all of the NRC will have access to the TS without coming to the PM's cubical. It should help the tech reviewers and regional personnel. The PM would inherit the current hard copy and if he wants to, would keep it up to date so he would have a hard copy when needed in a hurry.

John P. Boska Indian Point Project Manager, DLPM FitzPatrick Project Manager U.S. Nuclear Regulatory Commission 301-415-2901 email: jpb1 @nrc.gov

>>> Margaret O'Brien 09/02/05 4:02 PM >>>

John, Grosslyn Hill of OCIO is the only person that updates all 100 and some technical specifications. If one person will still be assigned to update the TSs, getting it done in 10 working days does not sound feasible.

An important aspect of our office seems to be at the mercy of another office, OCIO. Something this important should have some control by the folks that need it and use it.

(We used to have an order and exemption book similar to the authority file book. They too were updated by Grosslyn's office, but when funds were cut that effort was cut. That was a useful compilation of documents, in one place, for the PMs. Now it is gone. )

Also, when a PM needs TSs for an urgent phone call. How do you get what you need really fast. It's not like pulling a book off a shelf and running to a conference room for a call with the tech folks and the licensee. What kind of set up would the PMs have to be able to do that quickly without pulling up the TSs on the computer, running the pages, and taking them to the meeting? There's nothing like a hard copy in those situations.

peggy

>>> John Boska 09/01/05 10:26 AM >>>

I am working on a project to have electronic licenses and Tech Specs for all power reactors. Attached is a functional requirements statement. If you have time, please give me any comments you have on this.

Thanks. P.S., if this project is adopted, the PM will no longer have an official record copy of TS, they could maintain their own copy or use the electronic copy.

John P. Boska Indian Point Project Manager, DLPM FitzPatrick Project Manager U.S. Nuclear Regulatory Commission 301-415-2901 email: ipbl @nrc.pov CC: Chernoff, Harold; Laufer, Richard; Milano, Patrick; Pickett, Douglas; Roberts, Darrell

6/10/2003 EMD-ESI OWNERS GROUP POSITION On The EDG Load Requirements For Periodic Surveillance BACKGROUND The Technical Specification Surveillance Requirements (TS SR's) for the monthly load/run test and the fiull load rejection test state that testing is to be performed at 90 to 100% of the EDG continuous rating. However, at some nuclear plants, the projected LOOP-LOCA loads are larger than the continuous rating of the EDG. Thus, the EDG is not tested to the maximum projected accident load during the monthly and full load rejection tests. This issue was raised by the NRC during an inspection of one plant in 2002 and was reported as an unresolved item.

DISCUSSION The NRC initially approved the plant's Technical Specification Upgrade Program (TSUP) section for EDG testing. The Safety Evaluation (SE) required the plant to verify that the auto-connected loads to each EDG do not exceed the 2000-hour rating of 2860 kW. The SE indicated that the TSUP changes are consistent with GL 93-05 to assure loading is in accordance with the appropriate recommendations and, therefore, are acceptable. In the TSUP, the 31-day loading test and the full load rejection test were to be conducted with a load of 95 to 100% of 2600 kW (i.e., the continuous rating of the EDG). This seems to indicate that the NRC recognized that the loads could cxceed the continuous rating, but that testing to 95 to 100% of the continuous rating was acceptable.

Later, as part of ITS, the plant committed to the testing portions of Regulatory Guide (RG) 1.9, Revision 3. The tests specified in Sections 2.2.2, 2.2.8, and 2.2.9 of RG 1.9 are to be performed based on 90 to 100% of the EDG continuous rating. Station TS SR's Sections 3.8.1.3, 3.8.1.1 1, and 3.8.1.15 implemented these sections of the RG. Since the values stated in the TS SR's are based on the continuous rating of the EDG, the plant is in compliance with the licensing basis.

In addition, the RG and the plant's TS SRs require that the EDG be tested to 105 to 110% of its continuous rating every tvo years for at least two hours. The accident loads are less than 110% of the continuous rating. Thus, the capability of the EDG to supply the accident loads is tested.

The NRC has reviewed and approved similar testing schemes for plants with similar loading situations. At another plant, the NRC reviewed the testing scheme at a time vhen the EDG continuous rating was 2750 kW and the accident load was 2938 kW. In the SE, the NRC stated, "Forthe monthly lest, the intent is to avoid exceeding the conntinuous duity rating on afrequtenzt basis but to detect performnance degradationpriorto a failure. We believe that the monotlhly test should exercise the EDG, confirm its operability, and detect degradationor afailure before a second EDGfailrreis likely to occur.

Page 1 of 2

6/10/2003 During the 18-mont/i testing, the test loads envelope the calculatedaccident loads. It is ourposition that it is not necessary or desirableto envelope the design basis accident loads, thich might occur once hi 10,000 years, by a test that is repeated 12 times each year. We have dleternzinedthat simulation, or enveloping, the accident loads every 18 mnonths is sufficient."

At a third plant, the NRC approved a submittal in which the licensee described a projected accident load of 3059 kW for an EDG with a continuous rating of 2600 kW.

The submittal stated, "The load rangespecifedfor the monthly test is 21 00 to 2600 Ar which isjust below the EDG 's continuous rating of2600 kI. The purpose of the monthly test is satisfiedby this load range because the putpose is to demonstratethe EDG startingand load handling capabilityandnot to envelope the design basis accident conditions. Monthly testing in this range satisfies tie EDC manufacturer'srecommendationsfor routine testing.

Testing the EDG to the 110% condition monthly does not improve the reliability of the EDG. Rather, this testing practice unnecessary accelerates the wear of the diesel engine.

Similarly, conducting the full load rejection test above the continuous rating will cause significant inductive voltage in the generator windings, which increases the rate of degradation of the generator windings. This assessment is endorsed by Engine Systems, Inc. (ESI), the EMD EDG supplier.

OWNERS GROUP POSITION The monthly testing base on 90 to 100% of the continuous rating of the EDG is designed to operate the EDG and detect incipient failures. During the 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months load run test, the EDG is operated up to 110% of the continuous rating to demonstrate the EDG's load carrying capability. The oxerall testing scheme of the EDG, including the monthly and other testing, will adequately test the EDG's capability.

Page 2 of 2

Adequacy of Operation at Rated Power Factor for 10 Minutes during Dresden Diesel Generator Endurance Testing Introduction The NRC has questioned the diesel generator endurance test procedure used by Exelon at the Dresden Nuclear Generating Station. The requirements for this test given in Revision 3 of Regulatory Guide 1.9 require that the diesel generator operate overexcited at a power factor of 0.8 to 0.9 during the test. (The expected power factor of the load for Dresden during an accident is 0.88 to 0.89.) Various factors were considered in developing the diesel generator test procedures.

The major considerations in selecting a 10 minute test of the generator capability to supply 1550-1600 kVArs and then testing the generator at a lower VAr output for the remainder of the test are discussed in detail below.

Diesel Generator Internal Voltage and Potential Gencrator Transient Overvoltage Condition During the endurance test, the diesel generator operates in parallel with the offsite source, which is designed to provide the VArs required by the loads while maintaining approximately rated voltage on the auxiliary buses. When the diesel generator produces VArs during the test it provides VArs to the loads that had been provided by the offsite source. (The test procedure requires that the generator be operated at a power factor of about 0.85. The power factor of the calculated accident load is 0.88-0.89.) The effect of the VArs supplied by the generator is to raise the voltages in the auxiliary power system.

During this mode of operation if the generator load were to be removed suddenly, the voltage at the terminals of the generator will rise because there would no longer be a voltage drop through the generator internal impedance and because of substransient effects. This would result in a substantial rise in the generator voltage until the subtransient effects have died away and the generator voltage regulator could act to reduce the generator excitation current. Industry experience with generators similar to those used at Dresden indicates that the sudden loss of load to a generator that is operating at full reactive power output while in parallel with the offsihe source can result in a voltage transient that exceeds the generator manufacturer's maximum recommended voltage and the technical specification maximum voltage [1]. Full load rejection tests conducted on the LaSalle HPCS diesel generator, which is similar to the Dresden diesel generators, resulted in the generator terminal voltage exceeding 5000 volts for about 50 milliseconds. Note that this transient overvoltage is much higher during testing at rated power factor when the generator is operated in parallel with the offsite source than would be encountered during LOCA conditions when the diesel generator is the only power source. The stress that the overvoltage causes to the insulation results in cumulative damage. Therefore, the time that the generator is operated at rated power factor is limited to minimize the probability that the eenerator could be exDosed to such a Dotentiallv d yoltage. The Coover-

VAr Requirements during Load Sequencing During refueling outages, the diesel generator is tested by starting the motors required during an accident with the offsite power source disconnected. While starting, a typical power plant auxiliary motor draws 6 to 6.5 times its normal current. The initial starting power factor is very low. Because of this, the maximum required reactive power capability of the diesel generator is called upon while starting the various motors connected to the generator. Therefore, this test envelopes the reactive power testing during the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months endurance test, and this causes a greater stress to the excitation system compared to the steady state endurance test. The peak demand on the excitation system during functional testing or an accident lasts about 14 seconds.

Generator Armature and Rotor Temperature The major difference between operating the generator at 0.85 power factor for a 10 minute test or for a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months test is on the temperature rise of the generator.

The Dresden generators are designed to operate at much lower temperatures than are allowed by the insulation systems used in the generator. The armature of each generator uses Class H insulation that is operated at a temperature rise of 850 C at the continuous rating of 3250 kVA. A Class H insulation system is rated for a 125 0 C rise above a 40'C ambient temperature (winding temperature of 1650 C) [2]. The armature winding will reach 1250 C at the nameplate rating, which is much less than the winding temperature of 1650 C allowed for Class H insulation. In a similar fashion, the field winding uses a Class F insulation system with a temperature rise of 60'C rise at the generator continuous rating. A Class F insulation system is rated for a temperature rise of 105'C over a 40'C ambient temperature (winding temperature of 1450 C) [3]. The Unit 2 diesel generator loading calculation states that the accident load, including manually connected loads, is 2851.2 +j 1557 kVA, or 3248.6 kVA, which is essentially the same as the continuous rating of the generator.

The reduction in the armature temperature from operating at less than rated VAr output can be estimated as follows, based on the rated temperature rise of 850 C during operation at the nameplate power factor of 0.8:

The generator is rated for operation at 0.8 power factor. The change in armature current due to operating at the test power factor of 0.85 is I,=0.8 / 0.85= 0.94 per unit The resistance loss in the armature is proportional to the square of the current or P1,0,=(0.94) 2 =0.89 per unit Assuming that the resistance losses in the armature are the largest loss, the temperature rise will be proportional to the loss. Since the expected temperature rise of a fully loaded generator is 850 C, Tne=85 x 0.89 = 751C.

During operation at unity power factor, Ia= 0.8 per unit and P1,,,= (0.8)2 = 0.64. The resulting temperature rise is Tne=0.64 x 85 = 541C. Therefore, the difference in armature temperature rise between operation at unity power factor and the test power factor of 0.85 is 75 - 54 = 21'C For comparison, the amount of margin due to operating a Class H insulation system at a 850 C temperature rise is 40'C. The difference in armature winding operating temperature is relatively comparable to the design margin inherent in the generator design. Also, the reduced operating temperature of the insulation system minimizes the threat of thermal Page 2 of 4

deterioration of the rotor insulation system. The greater risk of generation insulation damage because of possible tripping during sustained testing at full VAr output outweighs the need to verify the capability of the exciter to deliver full VAr output for a sustained period of time because of small risk of thermal damage to the rotor.

The principle effect on the excitation system from operating at a lower power factor will be to heat the field. This will increase the field resistance, which will increase the required excitation voltage.

During testing, the measured field current is 64-65 amperes. The rated field current is 100 amperes at the rated load, which is based on 0.8 power factor. The required field current during operation at 0.85 power factor at rated voltage will be less, although the exact field current is difficult to estimate because of the non-linearity of saturation. The rated temperature rise of the field is 60'C. Assuming a 40'C ambient, the field temperature will be 1000 C.

During operation at unity power factor, the field current will be 65 A/100 A = 0.65 per unit of rated. Therefore, the field temperature rise will be 60 x (0.65)2 = 25 0C. The field temperature in a 40'C ambient will be 650 C.

The change in the resistance of copper with temperature is given by the following formula:

R2 234.5+T_ 2 RI 234 .5+T 1 Therefore, the increase in field resistance is:

= 1.12 This increase is modest, and is certainly less than the increase in 234.5 + 65 voltage required to force the field during the starting of a large motor.

As stated above, the greatest challenge to the reactive capability of the generator (and therefore the greatest challenge to the excitation system) is the sequential starting of the large motors during the load sequencing test that is conducted during refueling outages. This test combined with the 10 minutes of operation at the load power factor during the endurance test adequately demonstrates that the generator excitation system and the generator field are able to perform their safety function when required.

In addition, the duration of the highest reactive power (low power factor) demand during an accident condition is an order of magnitude smaller than the duration for which the endurance test is conducted (14 seconds versus 10 minutes). Therefore, the endurance test envelopes the higher reactive power demand condition during an accident condition.

Effect of VAr Output on the Diesel Engine The reactive (VAr) output of the generator represents power that is temporarily stored and released in the magnetic and electrostatic fields associated with the electrical equipment.

Therefore, the reactive power output of the generator does not affect the load placed on the diesel engine except for losses (which are very low).

Page 3 of 4

Miscellaneous Generator Structures The generator bearings are located outside of the hottest part of the generator (the generator armature and coils). Therefore, the difference in the bearing temperature from the difference in generator winding temperature rise will be limited. The difference in reactive power output of the generator has a very small effect on the generator torque since the reactive power will only affect the losses, which are small in relation to the real (kilowatt) output of the generator. The temperature in the generator is limited by the generator insulation to a much lower temperature than would affect the characteristics of the metal structural and mechanical components of the generator. Therefore, the difference in reactive power loading will not have a significant effect on these components.

Conclusion Operating the diesel generator for 10 minutes at its rated power factor combined with the load sequencing test that is conducted during refueling outages adequately demonstrates the ability of the EDG to perform its design basis function for the following reasons:

Since the reactive power output of the generator has a negligible effect on the mechanical power input to the generator, the duration of operation at rated power factor does not affect the testing of the capability of the diesel engine.

Since the reactive power demand during motor starting is greater than that during steady state operation at rated power factor, the adequacy of the of the excitation system to perform its safety function is proven during the motor starting tests that are conducted during refueling outages. The 10 minutes of operation at rated power factor confirm this.

The reduction in generator temperature rise due to operating the generator at rated power factor for only 10 minutes compared to a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months test is relatively modest. In any case, the generator insulation system is designed with significant temperature margin so that it should never operate near its rated temperature to increase the generator reliability.

The risk of insulation damage to the generator outweighs the advantage of sustained testing at rated power factor while the generator is in parallel with the offsite source.

References I. EMD-ESI Position Paper Power Factor Loading during Emergency Diesel Generator Testing

2. ANSI C50.12-1965 "Salient Pole Synchronous Generators and Condensers."

3. NEMA MG-1-1974 Motors and Generators.

Page 4 of 4

ML052580444

Contents

Text

SUBJECT:

Background

SUBJECT:

Background

Subject:

Navigation menu

ML052580444

Text

SUBJECT:

Background

SUBJECT:

Background

Subject:

Navigation menu

Search