ML092400176

VVR-042181-1, Rev 8, Verification and Validation Report for Square D Masterpact Circuit Breaker (Including the Micrologic Trip Unit).

ML092400176
Person / Time
Site:	Three Mile Island
Issue date:	08/16/2009
From:	Nuclear Logistics
To:	Office of Nuclear Reactor Regulation
References
VVR-042181-1, Rev 8
Download: ML092400176 (246)

Text

{{#Wiki_filter:Attachment 2 NLI Report VVR-042181-1, Revision 8 Verification and Validation Report for Square D Masterpact Circuit Breaker (Including the Micrologic Trip Unit)

N17CLLXR (IS I]C ~T VERIFICATION AND VALIDATION REPORT FOR SQUARE D MASTERPACT CIRCUIT BREAKER (INCLUDING THE MICROLOGIC TRIP UNIT) NLI Report VVR-042181-1 Revision 8 June 2009

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8] Nuclear Logistics, Inc. Page i APPROVAL VERIFICATION AND VALIDATION REPORT FOR SQUARE D MASTERPACT CIRCUIT BREAKER (INCLUDING THE MICROLOGIC TRIP UNIT) The document was originally approved on 6/11/2009, as a NLI proprietary report. It is resigned as a non-proprietary version. There are no changes to the content of this document. Prepared by: T

                          -A    D                       date___

I. '~ -

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page ii REVISION HISTORY Revision Description Date 0 Original Issue 05/7/04 1 Added clarifications. 6/2/04 Incorporated neutral current transformer configuration 10/13/05 and QR-042181-1-SUPPl. Updated information and address client comments 9/12/2008 Correct typographical error 11/07/2008 Add firmware revisions (section 2.2) 2/6/2009 Add details on P and H series trip unit HC16 3/26/2009 microcontroller and address client comments Add data on shunt trip, UV (undervoltage), and close 4/22/2009 coils. Address client comments. 6/11/2009

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page: iii TABLE OF CONTENTS 1.0

SUMMARY

OF RESULTS 1.1 Scope 1.2 Limitations 1.3 Project Specific Activities 1.4 Codes and Standards 1.5 Conclusion 2.0 EQUIPMENT IDENTIFICATION 2.1 Safety Function 2.2 Equipment Configuration 2.3 Human Machine Interface 2.4 Test Devices 2.5 Cyber Security 2.6 Traceability of the Test Specimen to the Production Units 3.0 SOFTWARE QUALITY ASSURANCE AND LIFECYCLE MANAGEMENT 3.1 Software Quality Assurance Plan 3.2 Software Lifecycle Management Plan 4.0 ABNORMAL CONDITIONS AND EVENTS 4.1 Environmental Service Conditions 4.2 Seismic Service Conditions 4.3 Electromagnetic Interference/Radio Frequency Interference (EMI/RFI) 4.4 Voltage Range 4.5 Infant Mortality of Electronic Components 4.6 Fault in Non Safety Plant System 4.7 Hardware/Software Faults 4.8 Loss of Power 4.9 Overcurrent Condition 5.0 FAILURE MODES AND EQUIPMENT RELIABILITY 5.1 Hardware Failure Modes and Effects Analysis 5.2 Hardware Reliability 5.3 Firmware Reliability 6.0 REQUIRED SYSTEM CHARACTERISTICS 6.1 Verification of Required System Characteristics 6.2 Separation Criteria 6.3 Common Mode Failure Evaluation 7.0 IMPLEMENTATION OF REQUIRED CHARACTERISTICS 7.1 Commercial Grade Audit of Schneider/Square D 7.2 NLI Testing

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page iv 7.2.1 Qualification Testing 7.2.2 Dedication/Factory Acceptance Testing (FAT) 7.2.3 Validation Testing 7.2.4 Failure Modes & Effects Testing 7.2.5 ANSI Design Testing 7.3 Operating History 7.4 Users Manuals 8.0 CONFIGURATION MANAGEMENT PLAN 8.1 Schneider Firmware Configuration Control and Error Reporting 8.2 NLI Configuration Control 8.3 Plant Lifetime Configuration Control 9.0 QUALITY ASSURANCE 10.0 MEASUREMENT & TEST EQUIPMENT

11.0 REFERENCES

ATTACHMENT A: Trip Unit Configurations and NLI Audit of Schneider/Square D ATTACHMENT B: NLI Validation Test Plan VVTP-042181-1 with test data ATTACHMENT C: Failure Modes & Effects Analysis ATTACHMENT D: NLI V&V Plan VVP-042181-1 ATTACHMENT E: NLI Validation Test Plan VVTP-042181-2, rev. 2 with test data

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 1 1.0

SUMMARY

OF RESULTS 1.1 Scope This Verification & Validation (V&V) program was performed to demonstrate the acceptability of Square D Micrologic trip units to meet the requirements for the use of digital components in safety related applications in nuclear power plants. The Micrologic devices will be referred to as a "trip unit" or "trip device" in this report. This report also addresses the shunt trip device, UV (undervoltage) trip device, and close coil in the Masterpact circuit breakers (referred to in the report as "coils"). These coils contain microcontrollers with firmware. There are no user configurable setpoints or field modifications. Rev. 8 The circuit breakers are supplied with and without the Micrologic trip devices. For those breakers supplied with the Micrologic trip devices, all of this report is applicable. For those breakers supplied without the Micrologic trip devices, only the sections of this report that refer to "coils" are applicable. Rev. 8 The Micrologic trip units are used in the Masterpact AC low voltage switchgear breakers (up to 600 vac nominal). The trip units are the digital devices that provide the protective function of the switchgear breaker and trip the breaker when an overcurrent condition is detected. The coils provide the close, shunt trip and UV functions on the breaker. The typical application for the Masterpact. breakers at nuclear plants in the United States is as part of a replacement breaker to replace existing low voltage breakers. A summary of this application is as follows: The Masterpact breaker with Micrologic trip unit is manufactured by Schneider/Square D. Square D is the company that supplies the Masterpact breakers with trip units in the United States. Schneider is the parent company located in France. A summary of the Schneider/Square D activities and locations is presented in section 7.1 of this report.

• The Masterpact breaker is converted by Square D Services in West Chester, Ohio to the specific replacement breaker configuration. This involves the design and manufacture of the electrical and mechanical interfaces to the existing switchgear. Square D Services is a long term NLI partner.
• The Masterpact circuit breakers are also supplied in new Square D switchgear.
• Square D Services performs the ANSI design testing required in accordance with ANSI C37.59 and other applicable ANSI standards.
• NLI performs the required dedication activities:

o Production controls and Quality Control oversight of Square D activities. o Dedication of materials. o Dedication/Factory Acceptance Testing (FAT) of the replacement breakers.

• NLI performs the required qualification activities, including the following:

o Seismic qualification. o EMI/RFI qualification. o V&V as documented in this report. o Mild or harsh environment qualification.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 2 Safety related breakers are supplied to nuclear plants in accordance with the NLI Nuclear Quality Assurance Program which meets the requirements of IOCFR50 Appendix B, 10CFR21, and ASME NQA- 1. The trip units use Application Specific Integrated Circuit (ASIC) and microcontroller technologies. The coils use microcontroller technology. This report documents the results of the V&V of the software/hardware used in the trip devices and coils. Trip Unit Configuration The specific range of equipment and parameters that are addressed by this V&V report are as follows:

   " Standard, Ammeter, Power, and Harmonic models of the Micrologic trip device (3.0, 5.0, 3.0A, 5.OA, 6.OA, 5.OP, 6.OP, 5.0H, and 6.0H).

o All protective functions (L, S, I, G) including 4-wire neutral protection. o L: Long time delay. o S: Short time delay. o I: Instantaneous. o G: Ground fault protection.

• The safety function of the trip device is:

o Maintain low voltage power circuits during normal conditions, including no spurious tripping. o Interrupt low voltage circuits in overcurrent conditions. o Modify the trip settings using the Incremental Fine Tuning (IFT) function on the H and P series trip units. This is performed using the touchpad on the front of the trip unit. Rev. 8

• The non-safety related features (communications, etc.) cannot interfere with the proper operation of the trip unit.
• All other functions of the trip device are considered non-safety related:

o External communications, interlocking, etc. are considered to not be safety related functions. The history storage and recall functions are non-safety related. o This V&V program verified that these functions will not impact the safety related function of the trip unit. o The basis for this is as follows:

                    " Based on NLI experience, most plants will not require these options.

V&V of these options would be on a case by case basis, depending on plant specific requirements.

                    " V&V of these features, especially the communication feature, would be significantly more complicated and would involve 50.59 issues that would be very plant specific.

• The Schneider/Square D design documents identify that the communications features, metering, indicator lights, and history information files are outside the ASIC core protection design and are not required for protective functions.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 3 The excerpt from the Masterpact catalog in Attachment A identifies features for each model of trip unit. Coil Configuration The components addressed in the V&V report are the UV, shunt trip, and close coils for the Masterpact NT and NW circuit breakers:

    " Shunt trip and close coil (nominal rating of 125vdc/120vac):

o NW breaker: Square D p/n S33812. o NT breaker: Square D p/n S48493.

• Undervoltage trip (nominal rating of 125vdc/120vac):

o NWbreaker: Square D p/n S33821. o NT breaker: Square D p/n S48503. Report Summary This V&V report provides the following detailed information:

• Section 1.2: Limitations of this V&V program.
• Section 1.3: Activities that will be performed by NLI for each individual project where the components are supplied.
• Section 1.4: Summary of the codes and standards that are met by this V&V program.

The detailed evaluation of the applicable standards is contained in the V&V Plan in Attachment D.

• Section 1.5: Report conclusion.
• Section 2.0: Detailed summary of the equipment configuration.
• Section 3.0: Summary of the Software Quality Assurance Plan. The detailed plan is contained in the V&V Plan in Attachment D. Summary of the Software Lifecycle Management Plan.
• Section 4.0: Identification and evaluation of the Abnormal Conditions and Events (ACE's).
• Section 5.1: Summary of the Failure Modes and Effects Analysis.
• Section 5.2 and 5.3: Equipment reliability information.
• Table 6.1: Identification of the applicable critical characteristics, the acceptance criteria for each critical characteristic, the methods used to verify the critical characteristics, and the results.
• Section 6.2: Evaluation of separation criteria.

   " Section 6.3: Evaluation of common mode failure.

• Section 7.1: Summary of the Schneider/Square D audits.

   " Section 7.2: Summary of the NLI V&V activities.

• Section 7.3: Summary of the product operating history, including nuclear plant operating experience.
• Sections 8.1 and 8.2: Schneider/Square D and NLI configuration control activities.
• Section 8.3: Required plant configuration control activities.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 4 Attachment A contains the NLI audit report of Schneider/Square D and supporting Schneider documents. The supporting documents are proprietary and are not included in the versions of this report that are released. These documents are available for review at the NLI facility. 1.2 Limitations The following limitations are applicable to this V&V program; o The following configurations were not addressed in this V&V program. The trip unit is not considered qualified in these configurations: o The trip unit is not qualified with any permanent communications features connected, such as Modbus communications. o The trip unit is not qualified with an external power supply connected.

• The xx.P and xx.H series trip units allow fine tuning of the trip curve using the Incremental Fine Tuning (IFT) function. Use of the IFT for fine tuning the trip current thresholds is evaluated in this report and is acceptable.

o Use of the IFT function to fine tune other functions is not evaluated in this report and is not a qualified configuration.

   " The xx.P and xx.H series trip unit have the capability for external communications to perform the Incremental Fine Tuning functions. Use of this function has not been evaluated and should not be used. The touchscreen on the front of the trip unit should be used to perform this function.
   " The Square D Full Function Test Kit (FFTK) is used to test the trip unit and collect data from the trip unit. Per the Square D manual, the FFTK can be connected to the breaker with the breaker installed and operating. This configuration has not been evaluated by NLI. The breaker is considered inoperable with the test kit connected to the trip unit.

See the additional information on the FFTK in section 2.4 of this report.

• The following functions are included on some of the Micrologic trip unit models. These functions are not included in the trip unit V&V (see details in references [20, 30]):

o Advanced Protection

• Alarms.
• Minimum (Under) and Maximum (Over) Demand Current and Voltage Protection.
• Current or Voltage Unbalance Protection.
• Reverse Power Protection (rPmax).
• Minimum (Under) and Maximum (Over) Frequency Protection.
• Load Shedding.
• Phase Rotation Protection.

o M2C and M6C Programmable Contact Kits o Zone-selective Interlocking. o Metering. o Graphic Display Screen.

• Non-safety related on the base and xx.A units.
• Safety related on the xx.P and xx.H units.

o Contact Wear Indicator.

            " Trip Unit History.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 5 These features are considered non-safety related. The V&V activities have verified that these non-safety related functions will not impact the safety related trip function of the trip unit. Coils: The following coil configurations are not addressed in this V&V program. The coils are not considered qualified in these configurations:

• The coils can be configured for external communications. This is not a qualified configuration.

Installation of this equipment must be evaluated on a plant specific basis in accordance with the plant procedures for 10CFR50.59 evaluations. 1.3 Proiect Specific Activities This V&V report documents the activities that were performed for the V&V of the Micrologic trip units and coils for safety related applications. The following activities are performed for each specific project to verify the applicability of this report and dedicate and qualify the supplied trip units:

• Hardware and software configuration review to verify applicability of this report.
• NLI FAT/dedication testing on 100% of the supplied equipment. The FAT/dedication testing will include the following trip unit specific critical characteristics:

o Record the trip unit configuration data (part number, serial number, code and revision). o Primary injection testing on the supplied circuit breaker. 0 Verify a sample of the trip curve points for each active function (L, S, I, G). 0 Verify proper operation of the trip unit with the CT's, ratings plug, and actuator. o Circuit breaker at degraded and over voltage conditions to verify proper operation of the trip unit across the primary voltage range (the trip unit is powered from the CT's on the primary bus). o Test the circuit breaker across the plant specified range of control voltages. This includes operation of all of the coils. o Note: The dedication plan for each replacement breaker type will include additional critical characteristics that verify the proper operation of the entire breaker assembly.

• Verify that the plant specific ACE's and ACE levels are enveloped by this report and supporting documentation or testing is performed per the client specific requirements.

o Seismic qualification: Seismic qualification is plant specific and specific to the configuration of the replacement breaker. o EMI/RFI. o Environmental service conditions. o Voltage range. o Additional ACE's as defined by the plant.

• ANSI design testing: The ANSI design testing is a function of the trip unit and the replacement breaker. It is required for each replacement breaker design and is performed for each breaker design in accordance with IEEE C37.59-2002 [18].

Masterpact Circuit Breaker V&V Report VVR-042181-l, Rev. 8 Nuclear Logistics,Inc. Page 6 In addition to this report, the following documents will be prepared for each plant/breaker configuration (including the trip unit and the coils), as applicable: o Seismic qualification report. o EMI/RFI qualification report. o Design drawings..

• Instruction manual.

o ANSI design report. o NLI Factory Acceptance Testing (FAT)/Dedication Test plan and report. 1.4 Codes and Standards The firmware for the trip unit and coils was developed under the controls of the Schneider/Square D ISO 9001-2000 quality assurance program. The hardware and firmware are being dedicated for safety related applications by NLI under the controls of the NLI Nuclear Quality Assurance Program [19]. The applicable codes and standards are identified in the NLI V&V Plan [23] in Attachment D of this report. These codes and standards form the basis for the V&V activities and this V&V report. Note: Most of the codes and standards referenced in the V&V Plan are for controls of the entire software lifecycle. Many of the codes and standards are very prescriptive concerning the required activities and documentation. Since this project is the dedication of existing commercial software, only certain requirements of these standards are applicable. The V&V plan [23] documents the method used to meet the applicable requirements of the applicable codes and standards. The V&V plan is contained in Attachment D of this report. Section 3.0 of this report contains a summary of the key software documents. 1.5 Conclusion This V&V program was performed in accordance with the guidelines of EPRI-TR-102348 [4] and EPRI TR-106439 [5]. The dedication program was performed in accordance with the NLI Nuclear Quality Assurance Program and it includes all of the provisions of EPRI-TR-106439. The dedication program was based on commercial grade audits of the Schneider facility and testing by NLI. The activities that were performed are summarized below.

• The trip unit and coil requirements are documented in this report.
• The trip unit and coil design was performed by Schneider/Square D. The trip unit and coil design is documented in the Schneider/Square D documents that were reviewed by NLI during the audits.
• Detailed hardware Failure Modes and Effects Analyses (FMEA's) were performed by Schneider/Square D [21] and supplemental black box FMEA testing was performed by NLI [23]. Rev. 8
• The ACE's were identified and addressed by testing or analysis (see section 4.0 of this report).

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 7

• The trip unit and coil critical characteristics (electrical, mechanical, firmware, process, dependability) were identified by NLI based on the function of the equipment. The trip unit and coil critical characteristics were verified based on audits of Schneider, testing at NLI, and evaluation of the operating history. The critical characteristics were found to
• meet the acceptance criteria.
• Table 6.1 identifies the critical characteristics of the trip unit and coil, including the digital system.
• Lifetime configuration control of the components is as specified in section 8.0 of this report.

0 Nuclear plant operating experience was reviewed and evaluated. These activities ensure that the acceptance features in Figure 3-2 of EPRI TR-106439 were followed for the firmware dedication process. There was an acceptable blend of the NLI dedication efforts, product operating experience, and the vendor efforts to demonstrate that the components are acceptable for this safety related application. NLI has provided an acceptable level of control over the development, installation, testing, and maintenance of the firmware under the control of the NLI Nuclear Quality Assurance Program. The firmware are within the bounds of the dedication and all critical characteristics have been successfully verified by audits, tests, and inspections. The operating history of the trip unit shows very good performance with no software problems in approximately 50,000 installed units. The operating history of the coils shows very good performance with no firmware problems in well over 100,000 installed units. There have been no revisions to the trip unit software since it was issued in 1998. There have been no revisions to the coil firmware since it was issued in 2002. The manufacturer, Schneider, has an excellent record for support and addressing past problems. Our review of the trip unit's and coils' overall architecture, hardware, and firmware design shows a high quality design without any weaknesses. This includes the failure analysis which was performed that shows that all failures are adequately addressed in the equipment design. All of these activities provide reasonable assurance that the trip unit and coils will perform their safety-related functions. The quality of the trip unit and coils, both hardware and firmware, is equivalent to equipment that is developed under the controls of a Nuclear Quality Assurance Program.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 8 2.0 EQUIPMENT IDENTIFICATION 2.1 Safety Function The safety functions of the trip devices are:

    " Maintain low voltage power circuits during normal conditions, including no spurious tripping.

• Interrupt low voltage circuits in overcurrent and ground fault conditions.
• The non-safety related features (external communications, etc.) cannot interfere with the proper operation of the trip unit.
• Modify the trip settings using the Incremental Fine Tuning (IFT) function on the H and P series trip units. This is performed using the touchpad on the front of the trip unit. Rev. 8 The communications, interlocking, historical data storage and other functions not associated with breaker tripping are considered to be non-safety related functions and are addressed as follows:
• The trip units are not qualified with any communications features operational or connected.
• The internal communication firmware and hardware are demonstrated to not impact the operation of the safety related function of circuit protection.

The safety functions of the coils are:

• UV: Allow the breaker to close during a normal voltage condition (coil energized). Trip the breaker in an undervoltage condition (coil de-energized, spring return). Not inadvertently trip the breaker.

o Shunt trip: Allow the breaker to close with no control voltage applied (coil d-energized). Trip the breaker with control voltage applied (coil energized). Not inadvertently trip the breaker. o Close coil: Close the breaker with voltage applied (coil energized). See the additional information is section 2.2.1 on the operation of the coils. 2.2 Equipment Configuration The trip unit is available in a number of configurations, as follows:

• Standard, Ammeter, Power, and Harmonic models of the Micrologic trip device (3.0, 5.0, 3.OA, 5.OA, 6.OA, 5.OP, 6.OP, 5.0H, and 6.0H).
• All available functions (L, S, I, G).
• The equipment data sheets in the V&V Plan in Attachment D provide details on the equipment configurations.
• Incremental Fine Tuning (IFT) of the trip settings is part of the design of the x.xH and x.xP trip units.

The current revisions of the firmware are: o ASIC: version 2.7.

• HC 11 Microcontroller (used in all xx.A trip units): Version 1.027.
• HC16 Microcontroller (used in xx.P and xx.H trip units units): Plogic-2005.AF.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 9 See additional details below. 2.2.1 Trip Unit and Coil Models Trip Units This V&V program addresses the model 3.0, 5.0, 3.0A, 5.OA, 6.OA, 5.0P, 6.OP, 5.OH, and 6.OH Micrologic trip devices. The part number designations are as follows:

• Trip unit functions:

o Model 3.0: LI functions. o Model 5.0: Selective LSI functions. o Model 6.0: Selective LSIG functions.

• Advanced functions:

o Suffix x.xA: Ammeter measurements. o Suffix x.xP: Power measurements. o Suffix x.xH: Harmonic metering. All of the models use the same ASIC for the protective functions. Different microcontrollers are used in the different series trip units. The two microcontrollers are discussed in sections 2.2.2. 15 and 2.2.2.16. Incremental Fine Tuning (IFT) of the trip settings is only available on the x.xH and x.xP units. Coils The components addressed in the V&V report are the UV and shunt trips for the Masterpact NT and NW circuit breakers:

• Shunt trip and close coil (nominal rating of 125vdc/120vac):

o NW breaker: Square D p/n S33812. o NT breaker: Square D p/n S48493.

• Undervoltage trip (nominal rating of 125vdc/120vac):

o NW breaker: Square D p/n S33821. o NT breaker: Square D p/n S48503. The identifier and current revision of the firmware is:

• Hardware part number: 51005451AA, revision B.
• Firmware revision: V15.

The configuration of the coils are as follows:

• The package, mounting, circuit board and configuration of the coils are all the same, except as evaluated below:

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 10 o NW vs. NT part numbers: The wiring and connectors are different to mate with the electrical components in the breakers. o Operation of the shunt trip, close coil, and UV are the same, except as follows:

                   " Shunt trip: The shunt trip is normally de-energized with the plunger retracted. The coil is energized for a short duration to extend the plunger.

The plunger impacts the trip latch and trips the breaker. When the coil is de-energized, the spring returns the plunger to the retracted position.

                   " Close coil (same part number as the shunt trip): The close coil is normally de-energized with the plunger retracted. The coil is energized for a short duration to extend the plunger. The plunger impacts the close latch and trips the breaker. When the coil is de-energized, the spring returns the plunger to the retracted position.
                   " UV: With the coil de-energized, the plunger is extended and the breaker cannot be closed. The coil is energized to retract the plunger. This allows the breaker to be closed. When the voltage is lowered below the setpoint or removed, the coil is de-energized and the spring returns the plunger to the extended position. The extended plunger hits the trip latch and trips the breaker.

2.2.2 Equipment Confi2uration The equipment configuration is provided in the following sections:

• Circuit breaker: sections 2.2.2.1.
• Trip unit: sections 2.2.2.2 - 212.2.16.
• Coils: section 2.2.2.17.

Additional details are provided in the NLI audit report and Schneider/Square D documents in Attachment A. 2.2.2.1 Breaker Configuration The overall configuration of the circuit breaker is as follows:

• The low voltage power circuit breaker is installed in the low voltage switchgear. Each circuit breaker is in an isolated cubicle.
• The trip unit is mounted on the circuit breaker. There is one trip unit per circuit breaker.
• Each circuit breaker contains 3 current transformers (CTs). The 3 CT's power the trip unit. There are no other power sources for the trip unit. Some circuit breakers may be supplied with an external neutral CT.
• Operation of the trip function is as follows; o During an overcurrent or ground fault event, the CT's send a signal (current) to the trip unit that is proportional to the primary current through the circuit breaker or neutral CT.

o The trip unit compares the signal from the CT's to the settings. The settings are made in the field by mechanical switches on the front of the trip unit, except for the neutral protection setting. The neutral protection setting is set via the

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 11 electronic menu (lcd).

• Incremental fine tuning of the trip units can be made in the field using the touchpad on the front of the trip unit.

o If the current to the trip unit exceeds the setting for the required time delay, the trip unit sends a signal to the actuator. o The actuator trips the breaker. The actuator will fire and trip the breaker each time it receives a signal. There is no signal processing by the actuator. o The trip unit external interfaces are as follows: o Power and current signal from the CT's. o Output signal to the actuator. o There are no other input/output (I/O) signals. The operation of the coils is as follows: o All of the coils are installed in the breaker.

                    " The unextended UV and shunt trip coil plungers are in close proximity (approximately 1/4") to the trip latch. Extension of the coil plunger hits the trip latch and trips the breaker.
                    " The unextended close coil plunger is in close proximity (approximately 1/4") of the close latch. Application of control voltage extends the plunger, hitting the latch and closing the breaker.

o UV coil: The coil is energized with control voltage to retract the plunger. This allows the breaker to be closed. When the control voltage is removed or reduced below the dropout voltage of the coil, the spring return extends the plunger. The plunger hits the trip latch and trips the breaker. o Shunt trip coil: The coil plunger is normally retraced and the breaker can iibe closed. Application of control voltage extends the plunger, hitting the trip latch and tripping the breaker. 2.2.2.2 Trip Unit Performance Specifications The performance characteristics of the trip devices are as follows: Accuracy (% of input): Trip Unit Performance: Long-time pickup (Ir) + 1.05%, + 20% Long-time delay (tr) +0% -20% Short-time pickup (Isd) +/- 10% Short-time delay (tsd) for 5.OA trip units, accuracy is per Square D Catalog 0613CT0001R4/08, page 24, Table 24. For all H trip units, accuracy is per Square D Catalog 48049-330-01, page 13, Table 3, and for all P trip units, accuracy is per Square D Catalog 48049-137-04, page 12, Table 3.(2.OA and 3.0A have no short time delay) Instantaneous (Ii) +/- 10% This accuracy is for the entire trip system (trip device + CT's).

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 12

• Linearity (% of input): The device is linear +/- 0.001% throughout the range. The air core CT is considered completely linear. The linearity deviation is due to the inherent characteristics of the A/D converters.
• Drift: Total drift over 10 years is <1%. The drift is due to design characteristics of the CT, RC coupling effects of the CT and small changes in the ADC reference voltage. The drift characteristics are based upon accelerated life testing of Masterpact and Micrologic production units.

" Temperature affect: No known temperature affect on accuracy, linearity, or drift throughout the operating temperature range of -22°F to 140'F have been identified.

• Response Time from input to output with change of state:

   " Digital: 544 pseconds + user selected trip delay time + 20 milli-seconds.

• Analog: 1ýtsecond + 20 milli-seconds.
• Note: Change of state is defined to be the total time from current detection to when the breaker contacts transition from fully closed to contacts fully open.

2.2.2.3 Trip Unit Architecture The trip units consists of the following digital devices:

• ASIC: The ASIC performs the safety related trip functions.
• Microcontroller:

o Base trip units (xx series) do not contain a microcontroller. o HC 11 Microcontroller (used in all xx.A trip units): This microcontroller performs no safety related functions and is isolated from the ASIC. See additional details in section 2.2.2.15. o HC16 Microcontroller (used in xx.P and xx.H trip units): This microcontroller is not isolated from the ASIC and can be used to fine tune the trip settings. See additional details in section 2.2.2.16. 2.2.2.4 Trip Unit ASIC The schematic of the ASIC portion of the trip unit is contained on the following page.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 13 Counter Addr[8:0]

    -1iF F 16 times 20-5F 4 times                        MCROM 100-1 FF forever                                 LD CTRL ADDR DATA[31 :0] INPUTSEL WRCTRL MULT CTRL SHIFTCTRL W arn

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 I, Nuclear Logistics, Inc. Page 14I The Application Specific Integrated Circuit (ASIC) provides core protection functions using both digital and analog circuitry. Both the digital and analog circuitry are contained on the ASIC. These core ASIC functions are safety related. Rev. 8

        " The digital portion of the ASIC supports user selectable safety-related circuit breaker protection functions. The user selectable functions are made with the mechanical switches on the front of the trip unit. The hardware and firmware provides True RMS Current Sensing.
        " The incremental fine tuning is implemented by the microcontroller in the x.xP and x.xH units. Details are contained in section 2.2.2.16.

• The analog portion of the ASIC provides over temperature thermal imaging protection and instantaneous high current protection. This provides redundant, safety related backup to the digital portion of the ASIC. These analog protection functions provide additional breaker/circuit protection and are not incorporated into the trip curve.

o Thermal imaging: Thermal imaging is similar to the thermal memory of the thermal element in a thermal-magnetic molded case circuit breaker. The thermal imaging algorithm reflects the actual heating and cooling characteristics of the conductors and accurately monitors the thermal condition of the conductors. The thermal imaging provides protection from a sequence of intermittent faults that are below the trip unit settings. This allows the normal cycling of loads without nuisance tripping. The thermal imaging is not included in the trip unit curves. The breaker will trip per the trip curve, unless there have been recent intermittent faults that have heated the conductors. A note is included on the trip curves to provide additional information. o Instantaneous high current protection: Faults at or above the instantaneous override value are cleared in 25 msec or less. o Note: Failure of the digital portion of the ASIC will result in loss of breaker coordination and ground fault protection. The backup analog portion of the ASIC provides basic protective functions only. The digital portion of the ASIC is a hard-coded, deterministic, continuous loop over-current protection device. The design is very simplistic in nature and has been designed for high reliability. Decisions are made by hard-logic methodology. No conditional instructions, jumps, calls, or interrupt functions are used. The digital portions of the ASIC are designated as follows:

    " Microcode is contained in the MCROM, which provides instructions for the sequencing of trip unit activities and arithmetic manipulation of measured current data and user selected protection variables.

• The THROM provides the constants and thresholds, which are used during the manipulation of the measured current data. Decisions are made by hard-logic methodology.

MCROM and THROM are the Schneider/Square D internal designations. The following additional information is provided on the ASIC architecture:

• The MCROM is a masked program device. It controls the sequence of activity in the safety-related digital portion of the ASIC. The MCROM microcode is contained in an Alcatel CMOS07 masked ROM library.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page' 15

• The ASIC architecture is deterministic. The continuous loop process completes each cycle every 544 [tseconds. Instructions are located in the MCROM, which contains 2 Kbytes of microcode for the main program and two start up programs. There are no interrupt driven tasks.

" The MCROM instructions of the digital portion of the ASIC are implemented through one Reduced Instruction Set Computer (RISC) device. Implementation of instructions does not use a compiler or assembler because all instructions are hard coded into the MCROM. The instructions are in the form of 32-bit microcode. The instructions are supplied directly to the RISC device without decoding or sequencing. The operating frequency is 2.0 MHz.

• The ASIC digital protection design has no operating system, multitasking, self-diagnostics, or interrupt usage. All register addresses are singularly unique and are addressed and accessed by hard-coded instructions. The digital portion of the ASIC contains the following components:

o 6583 logic ports (and-or gates). o One RAM 256x32. o One ROM 512x32. o One ROM 2048x16. o One 32x16 Multiplier.

• There are no safety-related communications or handshaking. The ASIC is a hardware device, whose digital protection feature uses hard-wired arithmetic calculator capabilities in order to complete protection algorithms. As configured for safety related applications, the microprocessor's trip unit has no external communication capabilities.

" The THROM contains all thresholds and constants for the calculation of the trip unit protection values. The THROM contains 4 Kbytes of 16 bit digital words. The MCROM contains the microcode which sequences the digital portion of the ASIC's trip unit's execution of the overload protection activities. The MCROM contains 2 Kbytes of 32-bit machine language code.

• The trip unit contains no PROM or external memory. Field programming is not available.
• When the digital portion of the ASIC's protection functions are lost, all user selectable protection functions are lost; however, basic protection functions are retained. The basic protection functions that are retained are detected of a high temperature condition and detection of current in excess of the circuit breaker's interrupt rating.
• There are no hardware or software watchdog timers in the digital portion of the ASIC.

The architecture information above is valid for all Micrologic trip units. The incremental fine, tuning (IFT) in the x.xH and x.xP units is implemented by overwriting the rotary switch trip

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 16 settings with the IFT settings in the ASIC RAM (EEPROM). Additional information is provided in section 2.2.2.16 of this report. ASIC Operation Operation of the ASIC is summarized below. The NLI audit report and Schneider/Square D design data provides additional information. o A 2.0 MHz clock drives the ASIC microprocessor. A crystal oscillator controls the clock frequency. The sequence of events performed by the microprocessor is dictated by the masked code set located in the MCROM. o The ASIC startup or restart sequence completes 384 microseconds after the trip unit is powered. During the 384 microseconds start sequence the digital words created by the interface of the rotary switch positions or IFT and the state of the and-or gates are restored. All other information to perform the safety-related function of the ASIC is contained in the MCROM and THROM.

• A complete protection cycle occurs every 544 microseconds. Poles are evaluated in the sequence: 0, A, B, C. The logic for each pole is processed in 128 microseconds and the decision to trip or not trip is processed in 32 microseconds. The L, S, G, and I for each pole are calculated separately every 544 microseconds, as applicable. The NLI audit report in Attachment A contains a table which depicts the sequencing of the digital portion of the ASIC after completion of the start up sequence.

o Each pole (A, B, C) is calculated separately. o Each function (L, S, I, G) is calculated separately.

• User selectable trip functions (L, S, I, and G with time delays) are chosen by rotary switch position selection. The rotary switch position configures its portion of the hard-wired decision logic by means of and-or gates. Regardless of model, each rotary switch has its own and-or gate matrix. Each matrix is independent but all are contained in the same silicon device. Each function (L, S, I, G) is logically independent, except as follows:

o Long time pickup and long time delay are dependant. o Short time pickup and short time delay are dependant. o Ground fault pickup and ground fault delay are dependant.

• The neutral protection setting is chosen thru the electronic menu.

2.2.2.5 Trip Unit Non-Safety Functions The trip unit non-safety related functions are identified below:

• All functions on the HC 11 microprocessor are non-safety related (metering, trip indication, communication, display). The HC 11 microprocessor is isolated from the ASIC and is considered non-safety related. Details are provided in the following sections.
• The HC16-series microprocessor is safety related. The details are provided in the following sections:

o The touchscreen can be used for incremental fine tuning, a safety related function.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Rv 17 Page Nuclear Logistics, Inc. o The metering, trip indication, and communications functions are non-safety related. Details of the HC11 and HC16 microprocessors are contained in sections 2.2.2.15 and 2.2.2.16 of this report. 2.2.2.6 Trip Unit Input/Output and Signal Conditioning Inputs The inputs to the ASIC are:

• Up to four (3 primary bus + neutral bus) analog current measurements from air-core CTs are converted through by A-to-D converters into digital words and placed into dedicated registers.
• Up to seven user selectable current and time-delay settings in the form of digital words, which are selected by adjustment of break-before-make rotary switch positions. This provides the user adjustable L (long time), S (short time), I (instantaneous), andl' G (ground) functions.

o Series x.xP and x.xH trip units: The user selectable settings can also be input using the incremental fine tuning function. Details are provided in section 2.2.2.16.

• Constants and thresholds contained in the THROM, which are used for calculation1 , of protection values, are compared with the user selected current and time-delay settings.
• The power to the trip device is from the current transformers that are powered from the load side of the breaker primary power.

There is no input range checking provision. The current from the CT is input directly to the A-to-D. The A-to-D digital word is stored in a dedicated register. The word is manipulated by instructions from the MCROM. The result is compared against the user selected protection parameters. If the measured current exceeds the user selected parameters or the instantaneous current rating to the circuit breaker, the trip unit initiates a trip command, which trips the circuit breaker and opens the contacts. Signal conditioning in the ASIC is limited to analog to digital conversion of AC voltage and current values from the CT's. Analog voltage values are determined by the use of a fixed value resistance bridge located in the ASIC. Analog current values are determined from current transformers. The analog values are converted to digital words by a silicon-based A-to,-D converter. There is no process noise filtering, except as summarized below. It is not required due to the quality of the signal from the CT's. The following additional information is provided:

• A filter capacitor has been installed on the input to the Micrologic due to inadvertent Ap trips due the surges during breaker closure in some applications (see additional details[ in Section 7.3).
• Air-core current transformers and appropriate analog circuits convert the current input to voltage input for the A-D converter. Resistive voltage dividers and their related analog circuits scale the voltage inputs to the A-D converters. The ASIC is built in a 0.7 micron

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 18 process which provides sufficient ruggedness for the current values encountered during 5 volt DC operation. Based on the design, it is not possible for the A to D range to be exceeded. There is no field calibration of the input signals. There is no digital to analog conversion. Outputs The trip unit output (external communications) is summarized as follows: o There is one safety-related output, the breaker trip command, which is a hard logic decision via AND and OR gates. These are switched by 5 volt (binary one) and 0 volt (binary zero) inputs that result from the user selectable current, time-delay settings, and the arithmetic functions performed in the ASIC. The use of 5 volt logic, rather than 3.3 volt logic, significantly reduces 'half-state' logic errors should there be an unlikely failure in a AND or OR gate p-n junction.

• The trip units have provisions for external communications, such as Modbus. Use of this feature is not a qualified configuration.
• There are no D-to-A converters.
• The status of the circuit breaker's main contacts (OPEN or CLOSED) is communicated by an analog signal sent via auxiliary switch contacts on the circuit breaker itself. These are electrically and physically independent of the trip unit.

2.2.2.7 Trip Unit Alarms and Diagnostics There is one failure alarm, Ap, which is an LED display on, the trip unit itself. The trip unit designers consider this display as a non-critical for information only output. This is a deliberate design consideration that provides the operator an opportunity to make the decision as to the appropriateness of interrupting power by opening the circuit breaker. The failure alarm light is activated by a hard-logic decision matrix, which is implemented through an AND/OR gate which creates a digital word that is read by the non-safety related microcontroller. The microcontroller subsequently activates the Ap LED in accordance with its programmed instructions. There is no input range checking provision or data validity checks during operation. During the start sequence diagnostics activities are limited to verification that the user configurable L, S, I, G are restored to the appropriate RAM addresses. During the run sequence the availability of voltage and current data at the appropriate RAM addresses is confirmed. If there is an absence of voltage and current data at the required RAM addresses, the ASIC will detect a failure condition and activate the failure alarm, Ap. This failure alarm will not trip the breaker. Other "Advanced Protection, Ap" features are discussed in section 2.2.2.14. There are no safety-related digital communications outside the trip unit associated with the trip function.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 19

• The status of the circuit breaker's contacts (OPEN or CLOSED) is communicated by an analog signal sent via auxiliary switch contacts on the circuit breaker. These contacts are electrically and physically independent from the trip unit.

    " The IR trip indicator LED, Isd/Ii trip indicator LED, and Ap indicator LED are considered as non-critical, for information only outputs by the trip unit designers.

The reset of the indicator LED's is as follows:

• The IR trip indicator LED and IsdIIi trip indicator LED are reset by depressing the reset button on the face of the trip unit.
• If the Ap fault clears, the Micrologic will operate per design, and the Ap indicator LED will remain on. The Ap indicator LED is reset manually.

2.2.2.8 Trip Unit Failure State and Trip Function Diversity If the trip unit fails, the breaker will stay in the existing state (opened or closed), as follows:

• If the breaker is open, the trip device is unpowered. The breaker will stay in the open position. The breaker can be manually closed.

" If the breaker is closed, the breaker will stay closed. The backup analog circuits in the trip device would provide thermal and overcurrent protection (see details below). The breaker can be manually opened.

• The failed state is not selectable.
• In case of clock (gate) failure, the ASIC ceases to perform its digital protection functions in accordance with user selected trip parameters and leaves the breaker in the closed position.

The Ap indicator LED is lighted to alert operator or maintenance personnel.

• Diverse overcurrent protection is provided by the analog portion of the ASIC as follows:

o Thermal protection that is measured by a positive temperature coefficient thermistor. When the thermistor reaches 115-125'C, the breaker will trip. o Instantaneous overcurrent protection is provided when the current exceeds the circuit breaker's instantaneous overload trip interrupt (DIN) rating. o In either condition, the circuit breaker contacts will open within 20 milliseconds. o Both of these diverse trip functions are operational following failure of the digital portion of the ASIC or clock (gate) failure.

• In all cases, remote indication of the breaker position and interlocks are through the mechanical auxiliary switches and would not be impacted by the failure of the trip unit.

Note that loss of the digital portion of the trip unit would remove the breaker coordination with upstream and downstream breakers. The purpose of the diverse analog protection is to provide ultimate protection to the breaker and power system. The digital portion of the trip unit (hardware and software) is demonstrated to be highly reliable (see section 5.0) and use of the analog protection is a very low probability event.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 20 2.2.2.9 Trip Unit Internal Power Supply The internal power supply in the trip unit is a very simple device, as follows:

• Power is derived from the 3 primary CT's.
• The internal power supply consists of a four-diode bridge rectifier, filter, and regulating circuit. All components are board mounted and are designed for high reliability.

" There is a filter network on the output of the internal power supply. 2.2.2.10 Trip Unit Battery Some of the trip unit models contain a battery. The purpose of the battery is to power the memory and external communication features. These features are considered non-safety related. The trip unit protective functions are powered by the breaker CT's and the battery is not required for these functions. The NLI validation testing verified that the trip unit protective functions operated properly with no battery installed and with a dead battery installed (see the test data in Attachment B). The battery is not required to maintain the IFT trip settings. See the additional details in section 2.2.2.16. 2.2.2.11 Trip Unit Computer System Redundancy and Diversity The trip unit contains no internal redundancy. Nuclear plant system redundancy is discussed in section 6.2 of this report. The trip unit does contain diverse thermal and instantaneous trip functions that operate in the event of a failure of the digital system. Section 2.2.2.7 of this report provides additional details on the diverse thermal and instantaneous trip functions. 2.2.2.12 Trip Unit Computer System Testability The computer system is highly testable as follows: " Primary injection testing of the breaker is used to confirm operation per the trip curve.

• Secondary injection testing of the trip unit is used to confirm operation per the trip curve.

This testing is performed with the circuit breaker and trip unit out of service. There is no in-service testing available. 2.2.2.13 Trip Unit Unused Software Function Blocks There are no unused software function blocks.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 21 2.2.2.14 Trip Unit Advanced Protection (Ap) Functions The advanced protection (Ap) functions are summarized below. The Schneider Micrologic manual [33] identifies the Ap functions that are accessible to the user. These functions can provide additional protection and alarms, if configured by the user. The inadvertent Ap trips that have been documented are the result of protection features that are build into the trip unit. These functions are described in detail in section 7.3. 2.2.2.15 Trip Unit HCl Microcontroller (used in all xx.A trip units) Non-safety related functions, including metering, display, trip indication, and ASIC failure indication, are accomplished with the HC1lseries microcontroller controlled circuitry. The details are as follows:

   " No safety related functions are performed on the microcontroller.

• The microcontroller cannot be used to modify any of the ASIC settings.

   " The ASIC communicates with the microcontroller using a closed serial interface through an optical coupler. The ASIC provides metering and indication information to the microcontroller.
   " The optical coupler provides electrical isolation between the ASIC and the microcontroller.

• The ASIC will perform all protection functions with the non-safety related microprocessor removed from the trip unit. This is evident because the most basic of the Micrologic trip units, the 3.0 and 5.0, perform all of the core protection functions without any on-board microprocessor.
• No failure modes of the microcontroller have been identified that would disable the ASIC safety related functions.

The trip sequence of operation of the ASIC is as follows. The microcontroller is not involved in the trip sequence.

• The rotary switch positions are converted to 4-bit words by GRAYBIN and sent via the MUX to the ROM (Read-Only-Memory) stack.
• The ROM stack sends the switch settings to the RAM stack which looks-up the THROM protection table equivalent switch values and inserts those values into the ASIC calculation loop. J'

   " If the switch setting protection thresholds are exceeded, a trip command in issued by the ASIC.

There is also a provision for the addition of external communications capabilities to the trip units; however, this option is not addressed in this V&V report. Connection of the externlal communications is not considered a qualified configuration.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 22 2.2.2.16 Trip Unit HC16 Microcontroller (used in xx.P and xx.H trip units units) The HC16 microcontroller performs non-safety related functions, including metering, trip indication, and ASIC failure indication. The HC16 microcontroller is also used to perform Incremental Fine Tuning (IFT) of the trip current settings. The IFT of the trip current settings is a safety related function. This is achieved as follows:

• The user selected IFT currents are input using the touchpad on the trip unit. The ITF program instructions cannot be modified.
• The ASIC program instructions cannot be modified. The trip values selected by the rotary switches are stored in the ASIC RAM (EEPROM). These values are replaced with the IFT values in the ASIC RAM. The ASIC RAM stored trip values are implemented by the ASIC using the ASIC on-board THROM stored protection algorithms.

Input of the IFT trip current values are limited as follows:

• The IFT values can only be input to be less than the current rotary switch value.

Therefore, the IFT values will always be between the rotary switch value and the next lowest rotary switch setting.

• The IFT cannot be set lower than the rotary switch setting below the current setting.

The following flowchart identifies the IFT sequence to fine tune the trip current settings:

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc.

1. Page 23 F-Does ROM stack contain digitized rotary switch values?

If NO, GRAYBIN commanded to write digitized

                  ,/      [      _rotary switch values ASIC ROM stack FIf YES, write ASIC ROM vles to ASIC RAM stack D-o-ASIC RAM stack values correlate with ASIC ROM stack values?

IFfNO, rewrite ASIC ROM stack values to ASIC RAM stack IfYES, read microcontroller RAM I____FT current threshold values

                             *A-re-FT current threshold values available in the microcontroller RAM stack INO,_AS*C will use the ASIC RAM stacks THROM table equivalent
                         ]values and initiate the protection calculation sequence 4

IfYES, write microcontroller RAM IFT current threshold values to ASIC RAM stack Do ASIC RAM stack values correlate with microcontroller RAM stack values? If NO, microcontroller RAM stack commanded to write IFT current threshold values to ASIC RAM

         +

IfYES, ASIC will use the ASIC RAM stack's IFT current threshold values THROM table equivalent values and initiate the protection calculation sequence

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 24 The HC 16 microcontroller also allows Incremental Fine Tuning (IFT) of other functions. At no time should any other functions be changed using the IFT function. These functions are implemented by the microcontroller. This is not a qualified condition. Potential failure modes of the HC 16 microcontroller are evaluated as follows: o Battery failure: Battery failure does not impact the IFT settings. o The EEPROM does not require electrical power to maintain the settings. Once the IFT settings are programmed into the EEPROM, loss of the battery will not impact the settings. o If the battery fails, the IFT settings cannot be programmed from the touchpad.

• Voltage power supply: An additional voltage power supply is installed in these trip units to power the microcontroller and the larger LCD display. Failure of this power supply will cause the microcontroller to fail. This will cause the trip unit to default to the rotary switch protection settings. This would result in a partial loss of breaker coordination, however, the protective functions will be maintained.

o The MPE (enable microprocessor) function controls the ability of the microcontroller to input to the ASIC. M HIGH (+5 volts): Values of the rotary switch may be overridden by the microcontroller, using the IFT function. 0 LOW (0 volts): Values of the rotary switch may not be overridden by the microcontroller. If the microcontroller is not in service due to a loss of power supply voltage, defective watchdog timer, or a microcontroller hardware failure, a hard-logic latch takes the MPE to LOW.

• Note: The MPE is held LOW by a hard wired connection in the xx.A series trip units.

Firmware failures of the microcontroller are not considered credible, based on the rigorous Schneider programming and testing regime and the operating history of the trip unit. No potential failure modes of the HC16 microcontroller are identified that would prevent the ASIC portion of the trip unit to perform the trip function. Failure of the microcontroller would cause the trip unit to revert to the rotary switch settings. This would cause a slight change in the breaker coordination, however, the breaker would still perform the required trip functions. 2.2.2.17 Coil Architecture 2.2.2.17.1 Summary of Operation. MN: Undervoltage release (UVR). This release instantaneously opens the circuit breaker when its supply voltage drops to a value between 35 and 70% of its rated voltage. Any attempt to close the circuit breaker equipped with an MN (VR) release when its supply voltage is less than 85% of the rated voltage inhibits closing of the main contacts.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 25 MX: Shunt trip release (SHT). This release instantaneously opens the circuit breaker whenever its supply voltage is 50% over its rated supply voltage. This release may be have a continuous or transient supply. XF: Shunt close (SHCL). This electromagnet closes the circuit breaker whenever its supply voltage is more than 50% of its rated supply voltage. 2.2.2.17.2 Architecture The architecture of the coils is as follows: (1) The only difference between MX/XF actuators and MN actuator is mechanical. They have the same electrical characteristics (same microcontroller and coils). (2) Microcontroller: 8 bit MOTOROLA 68HC805P18 (3) There have been no firmware revisions since 2002. (4) There is no communication in NLI supplied equipment with the trip unit (ASIC or its companion microcontroller). (5) Programming language - assembler. (6) There are no unused software blocks or complied code. (7) All measured parameters are stored in direct addressed RAM. (8) Program values are stored in an EEPROM and are read-into the microcontroller ROM during initialization. (9) The microcontroller initialization sequence verifies hardware and firmware operation. (10) The total code consists of the following eight code modules

a. RESS.ASM

b. RAM.ASM

c. TCARRE.ASM

d. TU.ASM

e. TIAPP.ASM

f. TIMAI.ASM

g. T_BOB.ASM

h. CONST.ASM (11) There are no internal diagnostics other than a time-out watch dog during main loop program operation.

(12) Power to the coils is from the plant control power. A 5 volt power supply is used to power the electronics. The FMEA did not identify the power supply as a critical part in the design life/mean time to failure (MTTF) of the coils (see section 5.1.3). (13) There is no battery used. (14) The hardware/firmware system is testable. The NLI dedication/FAT testing tests the system on 100% of the supplied breakers.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 26 (15) The common mode failure evaluation is contained in section 6.3. 2.2.2.17.3 Firmware Operating Sequence The firmware operating sequence is as summarized below: Measurementphase

• Regulation of the maintain current:

            -  Maintain current measurement
                   " Activate the maintain transistor. Wait 34[ts
                   " Put CDE_1=1 during lO0is
                   " Input the maintain current measurement
            -  Comparison of the maintain current measurement with the previous measurement.
            -  Management of transient failures
            - Actuate or inhibit of the maintain transistor.

• Management of BP and COM (if COM module installed) functions:

            - Read the input BP and management of the function BP
            -  Management of the function COM.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 27

   " Network voltage
          - Read the network voltage
          - FIR filter, which gives an output value each 8 cycles
   " Determination of the next condition
          - Functions BP and COM
          - If the output data of the FIR filter is higher than the first threshold, go to the activation phase.

Activation phase

• Regulation of activate current:

          - Initiation of the activate current measurement

• Put G activate =1
• Input the activate current measurement

          - Comparison of the activate current measurement with the previous measurement.
          - Initiate or inhibit of the activation transistor.
   " Network voltage - is there a measured network voltage value or FIR value
   " Determination of next condition
          - The firmware remains in the activation phase for 80ms
          -    Go to the delay phase Delay phase
   " Regulation of maintain current:
          -    Maintain the current measurement
                   " Activate the maintain transistor. Wait 34pts
                   " Put CDE_1=1 during 10ts
                   " Input the maintain current measurement
          -    Comparison of the maintain current measurement with the previous measurement.
          -    Initiate or inhibit of the maintain transistor.
   " Network voltage
          - Read the network voltage
          - FIR filter, which gives an output value each 8 cycles
   " Determination of next condition
          - The firmware will stay in idle period phase for 30ms
          - Go to the maintain phase.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 28 2.3 Human Machine Interface Trip Unit: The Human/Machine Interfaces are as follows:

   " All trip units: Rotary switches on the front of the trip unit.

• Series x.xH and x.xP trip units: The touchpad on the front of the trip unit can be used to make the IFT adjustments.

Except for the IFT adjustments, no field programming can be performed on the trip unit. There are no field configurable tuning constants, scaling factors, or other user programming. Coils: There are no human-machine interfaces. 2.4 Breaker Test Kits Schneider/Square D supplies a Full Function Test Kit (FFTK) to test the breaker and collect data from the trip unit. This test kit is summarized as follows:

• The FFTK communicates with the trip unit digitally.
• Operation of the FFTK with the breaker operating is as follows:

o The FFTK can be connected to a breaker when the breaker is on-line. o The FFTK can be used to change/modify the protective settings with the breaker on-line. o NLI has not evaluated to condition of the FFTK being connected to a breaker that is installed and operating. The breaker is considered inoperable with the test kit connected to the trip unit.

• The test kits are used to test the trip unit on the bench (secondary injection). The test kit can be used to override some of the trip unit functions when connected to the trip unit (thermal imaging, ground fault).

o When disconnected, the FFTK does not impact the trip unit settings. The trip unit settings are made using the mechanical switches on the front of the unit.

• The FFTK has a RS232 serial port that supports communications with a computer. If this feature is used, the plant must implement the proper cyber security for the connected computer.

Schneider/Square D supplies a Hand Held Test Kit to test the breaker.

• The test kit communicates with the trip unit digitally.

   ° The test kit cannot be connected to the breaker while the breaker is in operation.

• The test kit is used to test the breaker on the bench. The test kit can be used during testing of the breaker to defeat ground fault and thermal imaging.
• The test kit has no ports to connect to a computer.

2.5 Cyber Security 2.5.1 Micrologic Trip Unit Cyber security for the Micrologic trip units is addressed as follows:

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 29

• The trip units have the capability for permanently installed communications, such as Modbus. This configuration has not been evaluated by NLI and is not a qualified configuration.
• The ASIC logic gates are analog devices that are not susceptible to viruses or bugs. The logic resides on a ROM (read only memory).
• The trip units can interface digitally with the Schneider/Square D test kits. See the information below on these kits.
• The xx.P and xx.H series trip unit have the capability for performing the IFT functions.

The following information is provided: o The IFT functions can be programmed from the touchpad on the front of the trip unit. There is no security on this function and it must be controlled procedurally by the plant. Only the trip current IFT function is addressed in this report. , o Fine tuning of functions other than the trip currents is not addressed in this repo rt. This is an unqualified condition and must be controlled procedurally. o Section 1.2 identifies the limitations of this V&V effort. The features that are not addressed in the V&V report should not be used. The non-safety related information must be controlled procedurally. o The IFT functions can be programmed using a computer. This is an unqualified condition and must be controlled procedurally. 2.5.2 Test Kits Full Function Test Kit (FFTK) Cyber security for the FFTK is addressed as follows:

   " Schneider/Square D implement appropriate cyber security measures to verify that the FFTK is supplied virus free.

• The FFTK can be used to change the protective features/functions on the trip unit. The appropriate plant procedures should be implemented to control this activity.
• The FFTK has an RS232 serial port for communications with a computer. If this feature is used, the plant must implement the proper cyber security for the connected computer.

Hand Held Test Kit Cyber security for the Hand Held Test Kit is addressed as follows:

   " Schneider/Square D implement appropriate cyber security measures to verify that the test kit is supplied virus free.

• The test kit can be used to defeat certain features during breaker testing. It cannot be used to change the protective features/functions on the trip unit. The appropriate plant procedures should be implemented to control this activity.

The test kit does not have ports to connect to a computer. 2.5.3 Coils The coils are hard coded microcontrollers that cannot be field modified. The microcontroller is mounted on a circuit board inside of the coil sealed plastic housing. Opening the plastic housing would damage the coil. No cyber security requirements are applicable. Rev. 8

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 30 2.6 Traceability of the Test Specimens to the Production Units Traceability of the test specimens to'the supplied trip units is documented for each project. The following methodology is used to document the traceability:

• The test specimens and the production units will be shown to have the same hardware and software configuration:
• Trip unit physical configuration.
• Trip unit part number, revision level, and serial number. (Note: The circuit boards and digital chips in the trip units are not accessible to record the part number and revision level).
• There are no field configurable circuit board settings (DIP switches, jumpers, etc.).

The functional testing of the test specimen and the dedication testing of the production units will provide added assurance that the production units were manufactured to the same design standards and perform in an equivalent manner to the test specimen. 3.0 SOFTWARE QUALITY ASSURANCE AND LIFECYCLE MANAGEMENT 3.1 Software Quality Assurance Plan Project activities were performed in accordance with the NLI Nuclear Quality Assurance Program [19], which meets the requirements of IOCFR50 Appendix B, 10CFR21, and ASME NQA-1. The software quality assurance plan for this project is contained in the V&V Plan in Attachment D of this report. The firmware was developed under the controls of the Schneider IS09001-2000 quality assurance program. A Software Quality Assurance Plan was developed and implemented for this firmware by Schneider. Additional details are presented in section 7.1.3 of this report and the source inspection of the Schneider facility that is contained in Attachment A. The dedication, configuration review, and other activities that are performed for each circuit breaker, as identified in section 1.3, are performed in accordance with the NLI Nuclear Quality Assurance Program. 3.2 Software Lifecycle Management Plan The methods that are used to control the lifecycle of the software is presented in this section. The lifecycle model presented in IEEE 1012 was used to identify the relevant lifecycle steps. The software was developed as commercial grade software and is being dedicated for safety related applications. As such, the explicit documentation requirements in IEEE 1012 are not met.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 31 The Software Lifecycle Management Plan addresses the following:

• NLi Lifecycle Activities: The lifecycle management of the computer system that was previously developed under the controls of the Schneider commercial quality assurance program.
• Plant Specific Activities: The plant specific activities that are performed.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 32 Lifecycle Step NLI Lifecycle Activities Plant Lifecycle Activities Concept None. Not applicable. This activity was performed by Schneider. It is not relevant to the V&V program being performed by NLI. Requirements NLI audited Schneider. The audits verified that Schneider The requirements are documented in the plant has a detailed specification for the equipment. specification. Design NLI audited Schneider. The audits verified that Schneider Not applicable. used a controlled process for the design of the equipment. See the specific critical characteristics in section 6.0 of this report. Implementation NLI audited Schneider. The audits verified that Schneider The implementation is documented in the plant specific used a controlled process for the implementation of the modification package. equipment design. See the specific critical characteristics in section 6.0 of this report. Component NLI audited Schneider. The audits verified that Schneider Not applicable. Testing used a controlled process for the component testing. See the specific critical characteristics in section 6.0 of this report. Integration NLI audited Schneider. The audits verified that Schneider Not applicable. Testing used a controlled process for the integration testing. See the specific critical characteristics in section 6.0 of this report.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 33 System Testing NLI audited Schneider. The audits verified that Schneider Not applicable. used a controlled process for the testing of the trip units. NLI performed independent validation testing of the programmer. NLI performs dedication testing of all supplied equipment. See the specific critical characteristics in section 6.0 of this report. Acceptance Not applicable. The plant performs acceptance testing prior to installation Testing in accordance with plant procedures. Installation and Not applicable. The plant performs installation and checkout in Checkout accordance with plant procedures. Operation and NLI supplies plant specific Users Manuals. The plant performs operation and maintenance in Maintenance accordance with plant procedures. Configuration NLI audited Schneider. The audit verified that Schneider The firmware cannot be field modified. Management has a controlled process for documentation and reporting problems. See section 8.0 of this report for details. The breaker settings made using mechanical switches. The plant documents and controls the breaker settings in accordance with plant procedures. If the plant uses IFT, the settings must be documented in accordance with the plant procedures.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 34 4.0 ABNORMAL CONDITIONS AND EVENTS (ACE's) The guidance provided in Annex F of IEEE Standard 7-4.3.2-1993 [1] was used to identify the various ACEs that could impact the capability of the components to perform the intended safety functions. The Abnormal Conditions and Events (ACEs) that could impact the proper operation are identified in this section. The methods which are used to evaluate each of the ACE's are also presented. Note: The ACE's and the ACE levels specified below are expected to envelope most of the Class IE applications in nuclear power plants. Plant specific levels that are not enveloped will be evaluated and tested on a plant specific basis as specified in section 1.3 of this report. 4.1 Environmental Service Conditions The following service conditions are defined:

• Operating time: continuous
• Temperature range: 40-104'F (note 1)
• Relative Humidity: 98% (non-condensing) maximum
• Radiation: 5E3 rad gamma Notes:

1. The maximum temperature of 104'F is the maximum ambient temperature. The components are demonstrated to be acceptable for a total temperature of 121'F (1047F ambient + 17'F in-switchgear temperature rise).

The mild environment qualification is in accordance with IEEE 323-1974/1983 [2], IEEE C37.81-1989 [12], and IEEE C37.82-1987 [13]. Environmental qualification is performed on a plant specific basis, as required to meet the plant specifications. 4.2 Seismic Service Conditions Seismic qualification of the components on the breaker is performed for each specific breaker configuration. The seismic qualification includes the following:

    " Seismic qualification is by testing in accordance with IEEE 344-1975/1987 [3], IEEE 323-1974/1983 [2], IEEE C37.81-1989 [12], and IEEE C37.82-1987 [13]. The test plan provides detailed acceptance criteria for the seismic testing.

• The test specimen includes the replacement breaker with the components installed.

    " The TRS envelopes the plant specific RRS. The breaker is qualified to the amplified in-switchgear RRS.
    " Note that the trip unit is solid state and is seismically rugged. However, the seismic qualification of the breaker in the switchgear must be demonstrated.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 35 The seismic service conditions are met by testing of the components on the breaker for each breaker configuration. 4.3 Electromagnetic Interference/Radio Frequency Interference (EMI/RFI) EMI/RFI emissions and susceptibility requirements are defined for the trip unit based on EPRI TR-102323, revision 1 [6]. The trip unit will be qualified by testing as specified in the project specific qualification plan [29]. The test plan provides detailed acceptance criteria for the EMI/RFI testing. The EMI/RFI qualification will be met by testing of the trip unit on a representative breaker. This testing is independent of the replacement breaker configuration so only one test will be performed, as follows:

• All replacement breaker configurations use the Masterpact NT or NW breakers. Power to the trip unit is from the CT's on the breaker.
• The only wiring to the trip unit are the wiring from the CT's and the wiring to the actuator. This wiring is self contained and not connected to any plant wiring. Therefore, the breaker wiring does not impact the conducted susceptibility or emissions of the trip unit.

   " The trip unit is open at the front of the breaker on all of the replacement breaker configurations. Therefore, the radiated emissions and susceptibility would be the same for all breaker configurations.

The EMI/RFI service conditions will be met by testing of the trip unit on a breaker, for one representative breaker configuration. In mid-2005, inadvertent Ap tripping was identified in two nuclear plants in the U.S. where replacement Masterpact breakers were installed. Testing by NLI and Square D determined that the tripping was due to high voltage surges. A modification was made to the breakersýý to eliminate this susceptibility. The issue and testing are fully addressed in NLI qualification report QR-042181-1-SUPP1 [32]. Coils: Supplemental EMI/RFI qualification testing was performed on the coils in accordance with EPRI TR-102323, revision 3, as documented in reference [33]. 4.4 Voltage Range The trip units are powered by current transformers (CT's) on the main bus. The equipment is required to operate across the plant specified voltage range for the AC bus. The standard voltage conditions are specified as follows:

• Typical nominal plant voltages are 480vac and 575vac.

   " Minimum voltage will be 480vac (75%) = 360vac.

• Maximum voltage will be 575vac (110%) = 635vac.

The following testing is performed to verify proper operation of the trip units across the voltage

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 36 range:

   " The NLI Validation Testing verified proper operation at 360vac and 635vac. The test data is contained in Attachment B.

• The dedication testing for each project will include testing across the client specified voltage range.

Note: The purpose of the testing was only to verify the proper operation of the trip unit across any expected voltage range. The actual operating and interrupt rating of the circuit breakers is not addressed by this testing and is in accordance with the Schneider/Square D literature. Note: The secondary control voltages at the plants are typically 125vdc, 120vac, and 250vdc. The secondary power is not used to power the trip unit. The dedication testing of the circuit breakers with trip units includes testing across the secondary voltage range for breaker trip, close, and charge. Coils: Dedication/FAT testing is performed on 100% of the supplied breakers. The testing include operation of the coils across the plant specific control voltage range. This demonstrates proper operation for the plant specific requirements. 4.5 Infant Mortality of Electronic Components Micrologic Trip Unit: NLI's previous practice was to burn in the Micrologic trip devices for at least 48 hours during the dedication testing. This was determined to not be necessary and was discontinued. The following information is provided:

• The electronics are burned in by Schneider/Square D during manufacture. The bum-in for the Micrologic trip unit was witnessed by the NLI auditor during the audit, with a bum-in time of approximately 8 hours (overnight). Rev. 8
• NLI's experience with the burn-in of approximately 250 trip units identified no infant failures.
• There has only been one field failure reported to NLI due to failure of electronics. The failure was attributed to the failure of an electronic component. This was identified as an isolated case.
• The NLI dedication testing includes primary injection testing. This exercises the trip unit and verifies proper operation.

Coils: NLI does not have information that the coils are burned-in at Schneider. A burn-in is not considered required as follows:

   " The electrical circuit in the coils is a simple circuit.

o The coils are exercised during the dedication testing of the breakers. There have been no failures of the coils during the dedication testing.

   " There have been no coils failures reported to NLI from installed breakers.                     Rev. 8

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Pg 37 Page, 3I 4.6 Fault in Non Safety Plant System The Class 1E trip units do not interface with the non-safety plant equipment. The trip unit is self contained within the breaker as follows:

   " The trip unit receives power from the CT's on the breaker's primary circuit.
   " The trip unit sends the trip signal to the actuator in the breaker.

The coils receive safety related control power, so it is electrically isolated from non-safety plant systems. The EMI/RFI qualification [29, 33] verifies that EMI/RFI emissions from non-safety plant equipment do not impact the operation of the trip units or coils. Since the trip devices and coils are physically and electrically separated from non-safety related plant systems, faults in these systems will not impact these components. 4.7 Hardware/Software Faults Potential faults in the hardware or firmware were evaluated by vendor audit and NLI testing. The fault areas that were evaluated include programming or logic errors, problems With hardware/software integration, potential for unintended functions, potential for data handling problems, and hardware defects. Table 6.1 of this plan identifies the faults that were addressed. Credible faults in the HC16 microcontroller in the x.xH and x.xP trip units are identified and evaluated in 2.2.2.16. There are no identified faults that are unacceptable. There are no unacceptable software/hardware faults identified. 4.8 Loss of Power By design and construction, the trip units and coils are designed to be unpowered for an indefinite amount of time. NLI testing verified that the trip units and coils operate properly following loss of power with no loss of programming. The following testing is performed:

• The Validation Testing verified proper operation of the trip units following loss of power.

The test data is contained in Attachment B.

• The dedication testing of 100% of the supplied trip units includes primary and secondary injection testing and other functional tests. The supplied trip units and coils will have been unpowered from the time they were tested in the factory until tested by NLI. It is estimated that this is 1 month to 1 year. This will verify proper operation following1 an extended time unpowered.

As discussed in section 2.2.2.16, the IFT function writes to the EEPROM. Therefore, indefinite

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 38 loss of primary or battery power will not result in the loss of these settings. By design and NLI testing, the trip unit is acceptable for loss of power conditions. 4.9 Overcurrent Condition One of the safety functions of the trip unit is to trip the breaker in an overcurrent event in accordance with the published trip curves. The following activities are performed to verify this attribute:

• ANSI design testing is performed as follows.

o This testing has been performed by Square D on the Masterpact breaker with Micrologic trip unit. o Additional ANSI design testing is required for each replacement breaker configuration. This testing will be performed on a plant/replacement breaker specific basis and submitted to the client as part of the design testing.

    " The NLI audit of Schneider verified proper programming of the trip curves.

o NLI validation testing verified proper programming of the trip curves. o NLI dedication testing will verify proper programming of the trip curve for a sample of the trip points on 100% of the shipped trip units. The V&V, ANSI design testing, and dedication activities document the acceptability of the trip unit to operate in overcurrent conditions. Coils: The coils operate on the control voltage, which is protected from overcurrent conditions by fusing or circuit breakers, in accordance with plant design requirements.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Page 39 Nuclear Logistics, Inc. 5.0 FAILURE MODES AND EQUIPMENT RELIABILITY 5.1 Hardware Failure Modes and Effects Analysis (FMEA) 5.1.1 FMEA Methodology Schneider performed detailed hardware FMEA's which were reviewed by NLI (see reference [33] in Attachment C for the trip unit and section 7.1.8 for the coils). A summary of the FMEA methodology is as follows:

   " An external functional analysis was performed. This methodology shows the ties between the studied item and its environment in order to determine a failure relationship.

The methodology used is M.I.S.M.E (method of systematic inventory of the surrounding environment). Note: This technique was used as part of the functional and safety requirements analysis performed by the European Organization for Nuclear Research for the CERN Safety Alarm Monitoring System.

   " An internal functional analysis by functional block diagram was performed in accordance with MIL-HDBK-217F.
   " A dysfunctional analysis was performed showing the consequences of a failure on the I

operability of the trip unit.

• Reliability calculations were performed in accordance with MIL-HDBK-217F. The results are summarized in section 5.2 of this report.
• An A.M.D.E.C. quantified for a temperature of 40'C in a stationary environment. Note:

AMDEC is a technique used for the development of products and processes in order: to reduce the risk of failures and to document the actions undertaken. It is part of the QS 9000 'whole quality system' methodology. 5.1.2 Trip Unit FMEA 5.1.2.1 Summary of Schneider FMEA Results Based on data from Schneider, there are two credible failure modes that could impact ASIC operation. These failure modes are identified and evaluated below:

• Loss of clock (gate pulse).

o This postulated failure results in a loss of the ASIC's digital protection functions. The diverse analog instantaneous and thermal imaging functions are maintained. o This failure mode is considered a low probability event based on the simplicity of the design and reliability of the parts used. The equipment reliability documented in section 5.2 includes clock failures.

• Loss of 24 volt DC power.

o This postulated failure results in a loss of all ASIC protection functions, including the diverse analog instantaneous and thermal trip functions.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 40 o This failure mode is considered a low probability event based on the simplicity of the design and reliability of the parts used. The equipment reliability documented in section 5.2 includes loss of the internal power supply. o Note: Loss of power will result in loss of the ASIC analog protection functions. The power is required to generate the logic state to initiate the trip command. Both of these failures are acceptable as follows:

   " These are hardware failures in the system and are not a function of the firmware. The hardware is manufactured with a minimum number of components and is highly reliable (see section 5.2).

o Hardware failure of a proven production like the Micrologic trip device is a random event. Common cause failure of this type of hardware is not credible. o The operating experience for the Micrologic trip devices demonstrates a robust, reliable design. No failures of the clock or power supply have been documented. The potential failure modes of the HC16 microcontroller and the impact on the trip function are identified and evaluated in section 2.2.2.16 of this report. This data was collected during an audit at Schneider/Square D. No unacceptable failure modes were identified. 5.1.2.2 NLI FMEA Testing NLI performed supplemental FMEA testing. The FMEA testing is included with the Validation testing in Attachment B. The following potential failure modes were tested by NLI:

• Remote communications, alarms, and interlocks do not impact operation of the trip unit.

Note that these functions are not electrically connected.

• Trip unit operates properly with battery removed or a dead battery.

The trip unit responded as specified in the Schneider design documents during the FMEA testing. No additional failure modes were identified. 5.1.3 Coil FMEA The results of the Schneider FMEA for the coils is summarized as follows:

• Function of coil to actuate: The critical parts are the integrated circuit, regulator, comparator, transistors and varistors. The calculated reliability is presented in section 5.2.2.
• Function of energized coil to not inadvertently release (UV release and trip breaker): The critical parts are the transistors and regulator. The calculated reliability is presented in section 5.2.2.

    " The microcontroller and the power supply are not identified as limiting parts.

• The reliability of the hardware is identified in section 5.2. The reliability of the hardware is based on the individual components. No especially sensitive components were identified.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 41 NLI performed supplemental testing. Radiation exposure was used to disable the microcontroller. Note that this is a microcontroller hardware failure, not a firmware failure. The results were as follows:

• With the microcontroller disabled, the coils will not respond to the applied and will spring return to the de-energized position:

o UV coil:

                   " If the coil is de-energized, it cannot be energized and the breaker cannot be closed.
                   " If the coil is energized, it will spring return the plunger to the extended position and trip the breaker.

o Shunt trip coil will not pick up. o Close coil will not close the breaker.

• This failure mechanism is equivalent to an electrical failure of the same components in the original breakers (spring return to the de-energized position). The microcontroller failure does not introduce an additional breaker failure mechanism.

As identified above, the Schneider FMEA identified that the microcontroller was not one of the components that limits the reliability of the circuit. 5.1.4 Conclusions The Schneider/Square D FMEA's were performed in a rigorous manner and addresses the relevant potential failure modes. The FMEA identified two hardware failure modes that could impact the trip unit operation. These failure modes were determined to be acceptable, as identified above. The NLI testing did not identify any additional unacceptable failure modes. No potential failure modes have been identified that have unacceptable consequences. 5.2 Hardware Reliability 5.2.1 Micrologic Trip Unit A hardware reliability simulation was performed by Schneider Electronics in accordance with MIL-HDBK-217F. The calculated failure rates were as follows for ground fixed applications:

• 3.11 E-6h-l@40C.
• 5.64E-6lhl@1OOoC.

The design of the trip unit ASIC is based on the previous generation of the Masterpact ASIC design (NSF and NSJ series circuit breakers). The core protection functions in these older generation trip units were accomplished through the use of 350 components. The current Micrologic ASIC design performs the same core protection functions using 53 components. The smaller number of components significantly increases the reliability of the system.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 42 All of the microcode for the present ASIC digital protection is new, though the function of the trip unit is conceptually very similar to the previous design. Due to the reduced number of components, architectural design, and small amount of microcode, the trip unit is more reliable than any previous analog or digital overload protection model designs. 5.2.2 Coils A hardware reliability simulation was performed by Schneider Electronics in accordance with MIL-HDBK-217F (see the report number identified in section 7.1.8). The calculated hardware failure rates are as follows:

• Failure rate at 105'C:

o Coil does not energize: 4.61 E-6 hl o Coil inadvertently releases: 1.28 E-6 h1

• Failure rate at 40'C:

o Coil does not energize: 1.27 E-6 h1 o Coil inadvertently releases: 3.7 E-6 h-W' The coils have a small number of components, a simple architectural design, and a small amount of microcode. The hardware failure rates of the coils are low. 5.3 Firmware Reliability A software failure modes and effects analysis was not performed. NLI concludes that the firmware is highly reliable. No software flaws or software coding flaws have been identified. The following information is provided: Rev. 8

    "   A highly controlled process was used to develop and test the software and the software/hardware system (see the details in section 7.1.3 of this report).
    " A highly controlled process is used during production of the trip units and coils. (see the details in section 7.1 of this report).

• The logic gates in the trip unit are analog devices that are custom manufactured for the Micrologic design. Since the ASIC protection scheme was designed as a hardware process, there is no firmware in the traditional sense. Program instructions are incorporated into a read only memory (ROM) by layering die-cut metal oxide mask layers during manufacture. This process insures that there is no possibility of the wrong program being loaded or external memory address or data lines to fail.
• Schneider emulation and black-box testing sufficiently verify compliance with design requirements. White-box testing for this type of device is inappropriate because exogenous stimulus to create an out-of-design event is not considered a viable failure mechanism.
• The operating history identifies a highly reliable design (see details in section 7.3 of this report).

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page, 43 1

• No firmware failures have been identified during NLI testing. No trip units or coils have been returned to NLI with failures due to the firmware.

Rev. 8

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 44 6.0 REQUIRED SYSTEM CHARACTERISTICS 6.1 Verification of Required System Characteristics The required system characteristics that the hardware/software systems must possess are identified in Table 6.1. The following information is presented for each critical characteristic: o Acceptance criteria.

   " Results of the V&V activities.
   " Reference documents.

Section 7 of this report provides the details on the activities that were performed to verify that the exciter system possesses the required attributes. Note: During the audit of Schneider and the NLI Validation Testing, critical characteristics were identified that were not included in the V&V Plan [23]. These are included in Table 6.1.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 45 TRIP UNIT SOFTWARE V&V CRITICAL CHARACTERISTICS TABLE 6.1 "Ref' documents are the plans that will be used to verify the critical characteristic, as follows:

• VVTP-042181-1 [26]: NLI validation test plan to verify the software/hardware design of the trip unit. These are design tests and will be performed on one of the trip units.

   *    (Project specific dedication plan) [25]: These production tests and inspections will be performed on 100% of the supplied trip units.

• SVR-042181-1 [21 ]: NLI audit report of the Schneider Micrologic trip unit facilities which is contained in Attachment A of this report.
• VVR-042181-1: This V&V report.

o Note: The V&V audit report contained in Appendix A was supplemented by another audit in 12/2008 to collect additional information on the HC 16 microcontroller. This data is contained in the body of this report. Critical Characteristic Acceptance Criteria Results Reference Oualitv Assurance Proaram Quality Assurance Program that The software and hardware were developed Verified during the audit of SVR-042181-1 controlled the development of the under the controls of the Schneider ISO 900 1- Schneider/Square D. See the summary in software/hardware. 2000 quality program. section 7.1.3 of this report. Acceptable. Industry standards used to control the The software is developed and tested in Verified during the audit of development and testing of the software. accordance with industry recognized codes Schneider/Square D. See the summary in and standards. section 7.1.3 of this report. See section 7.1.8 for the data on the coils. Acceptable. Software Lifecycle Software specification/software Software specification documents the detailed Verified during the audit of SVR-042181-1 requirements. software requirements. Schneider/Square D. See the summary in section 7.1.3 of this report. See section 7.1.8 for the data on the coils. Acceptable.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 46 Critical Characteristic Acceptance Criteria Results Reference Procedural controls used during software Software development controlled by Verified during the audit of SVR-042181-1 development. Schneider procedures. Document the Schneider/Square D. See the summary in procedures used and evaluate process. section 7.1.3 of this report. See section 7.1.8 for the data on the coils. Acceptable. Failure Modes & Effects Analysis Failure Modes & Effects Analysis performed Verified during the audit of Schneider and SVR-042181-1 and used during software development. review of the FMEA by NLI. NLI performed supplemental FMEA VVTP-042181 -1 testing. See details in section 5.1 of this report. Acceptable. Development and testing approach. Schneider developed and tested the software See the summary in section 7.1.3 of SVR-042181-1 in small function based blocks of code. this report. Development and testing documented. Acceptable. Independence of software development Independent personnel used. See the summary in section 7.1.3 of SVR-042181-1 and testing. this report. Acceptable.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 47 Critical Characteristic Acceptance Criteria Results Reference Integrated hardware/software testing. Integrated testing of the hardware/software See the summary of Schneider SVR-04218 1-1 system was performed. activities in sections 7.1.3 and 7.1.4 of this report. See section 7.1.8 for the data on the coils. NLI performed validation testing of the VVTP-04218 1-1 hardware/software system (see section 7.2 of this report). NLI performs dedication testing on (project specific 100% of the supplied equipment (see dedication plan) section 7.2 of this report). Acceptable. Product operating history. Installed units operating properly. Specify See the summary in section 7.3 of this SVR-042181-1 number of operating units, time in service, report. and number and types of identified problems. Acceptable.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 48 Critical Characteristic Acceptance Criteria Results Reference Error handling. 1. Code errors are identified, documented, The audit of Schneider verified a SVR-042181 -1 evaluated, and reported in a controlled controlled program to identify, manner by Schneider. evaluate, and report errors and

2. Mechanism for reporting and evaluating changes.

user reported problems. VVR-042181-1 NLI configuration control activities meet the requirements for safety related equipment. See the details in Section 8.0 of this report. Acceptable. Problem reporting to plant. Identified problems are evaluated and The audit of Schneider verified a SVR-042181 -1 reported to the client. controlled program to identify, evaluate, and report errors and changes. VVR-042181-1 NLI configuration control activities meet the requirements for safety related equipment. See the details in Section 8.0 of this report. Acceptable.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 49 Critical Characteristic Acceptance Criteria Results Reference Software updates and service bulletins. Schneider has a formal process to alert The audit of Schneider verified a SVR-042181-1 customers concerning software updates and controlled program to identify, provides service bulletins. evaluate, and report errors and changes. Section 8.0 of this plan identifies the Schneider and NLI actions. Acceptable. Configuration Control Revision control. Revision control used on code, chips, and The audit of Schneider verified a SVR-04218 1-1 boards. controlled program for revision control. NLI configuration control activities meet the requirements for safety VVR-042191 -1 related equipment. See the details in Section 8.0 of this report. Acceptable.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 50 Critical Characteristic Acceptance Criteria Results Reference Hardware configuration. Hardware per Schneider and NLI design The audit of Schneider verified the SVR-042181-1 documentation and drawings. required production controls. NLI dedication testing verifies proper (Project specific operation and configuration. dedication plan) Acceptable. Electrical interfaces including wire, Per Schneider/Square D and NLI design The audit of Schneider verified the SVR-042181-1 terminations, and grounding. drawings. required production controls. NLI dedication testing verifies proper (Project specific operation and configuration. dedication plan) Acceptable. Manufacturing controls of code. Controls to assure correct code installed on The audit of Schneider verified proper SVR-042181-1 each unit. revision control. See sections 7.1.4 and 7.1.8 of this report for a summary Traceability between development and of the production controls. production code is documented. NLI configuration control activities are VVR-042181-1 per section 8.0 of this report. Acceptable.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 51 Critical Characteristic Acceptance Criteria Results Reference Regression testing or evaluations. Regression testing or evaluations performed The audit of Schneider documented SVR-042181-1 when code is revised. that regression testing has not been required since there have been no changes to the code. NLI dedication testing of replacement Dedication plan for parts will document compatibility with each project. the original configuration. Acceptable. Software/Hardware Critical Characteristics-Trip Unit Data storage. Per Schneider design specifications. The audit of Schneider verified per the SVR-042181-1 Schneider design documents. Acceptable. Signal conditioning and logic functions Per Schneider design specifications. The audit of Schneider verified per the SVR-042181-1 Schneider design documents. Acceptable. System response time. Per Schneider design specifications. The audit of Schneider verified per the SVR-042181-1 Schneider design documents. Acceptable.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 52 Critical Characteristic Acceptance Criteria Results Reference Remote alarms and indications. The communication features are not The audit of Schneider verified per the SVR-042181-1 considered safety related and will not be Schneider design documents. connected in the plant. NLI validation testing did not identify VVTP-042181-1 Local indication is considered non-safety potential problems caused by the non-related. safety indication. The V&V program verified that the non- Acceptable. safety related communication and local indication features will not impact the safety related functions of the trip unit. Watchdog timer. Per Schneider design. The ASIC is deterministic and no SVR-042181-1 watchdog timer is in the circuit. Acceptable. Timing and clock control. Per Schneider design. The audit of Schneider verified per the SVR-042181-1 Schneider design documents. Acceptable.

Masterpact Circuit Breaker V&V Report VVR-042181-l, Rev. 8 Nuclear Logistics, Inc. Page 53 Critical Characteristic Acceptance Criteria Results Reference Output alarms. Non-safety related. See above. The audit of Schneider verified per the SVR-042181-1 Schneider design documents. NLI validation testing did not identify VVTP-042181-1 potential problems caused by the non-safety indication. Acceptable. Features which could impact operation. No features which could interrupt operation The audit of Schneider verified per the SVR-042181-1 (interruptions, diagnostics, manual inputs, Schneider design documents. non-essential application programs, unauthorized programs or data modifications). NLI validation testing did not identify VVTP-042181 -1 features that could impact the trip unit operation. Acceptable.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 54 Critical Characteristic Acceptance Criteria Results Reference Security. The base program is on the ASIC chip and Plant configuration control per section VVP-042181-1 cannot be field modified. The trip current can 8.3 of this report. Cyber security be field modified using the IFT function on requirements are per section 2.5 of this the x.xH and x.xP units. report. The trip unit does not contain security. The trip settings can be changed from the front of the trip unit. This must be procedurally controlled by the plant. Note that this is no change from solid state trip units currently used in safety related applications. Year 2000 compliance. Units recognize dates beyond 12/31/99 N/A. The digital system does not use SVR-042181-1 correctly. time sensitive functions. Acceptable. Processor restart and initialization. Following removal of power, the trip unit By design and Schneider testing, the SVR-042181-1 maintains the settings. trip unit maintains all settings during an indefinite removal of power. VVTP-042181-1 NLI validation testing verified proper operation following removal of power. IFT settings are also maintained upon loss of power (see section 2.2.2.16). Acceptable.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 55] Critical Characteristic Acceptance Criteria Results Reference Data validity checks. The system contains logic to perform checks There are no input range checking SVR-042181-1 of the validity of intermediate results. provisions or data validity checks during operation. They are not required due to the deterministic operation. During the start sequence, diagnostics verify that the user selected L, S, I, G settings are restored to the correct RAM addresses. The digital system is deterministic and there are no intermediate results. Acceptable. User configurable input values. All trip units: The user inputs are hard wired Use of the hard wired switches to set This report. switches. the trip currents is acceptable. Use of x.xP and x.xH trip units: The IFT function the IFT function to fine tune the trip provides user configurable trip current current settings is acceptable (see settings. section 2.2.2.16). Use of the touchpad to change fine tune other parameters is not acceptable and must be controlled procedurally (see sections 1.2 and 2.5.1). Acceptable.

Masterpact Circuit Breaker V&V Report VVR-042181-I, Rev. 8 Nuclear Logistics, Inc. Page 56 Critical Characteristic Acceptance Criteria Results Reference Loss of input instruments. Trip unit responds to loss of CT signal per A winding short in a CT would be SVR-042181-1 Schneider design. detected as an overcurrent condition. An open CT would be sensed in the x.OH series trip unit only. Failure of the CT's is not considered a credible failure mechanism due to the design and construction of the CT's. Acceptable. Diagnostics. Not applicable. Not applicable. Not applicable. The programming is deterministic and diagnostics are not required.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 57 Critical Characteristic Acceptance Criteria Results Reference Software/Hardware Critical Characteristics-Coils Data storage. Per Schneider design specifications. See the data in section 2.2.2.17 This report. Acceptable. Signal conditioning and logic functions Per Schneider design specifications. See the data in section 2.2.2.17 This report. Acceptable. System response time. Per Schneider design specifications. See the data in section 2.2.2.17. This report. Acceptable. Remote alarms and indications. None used in the safety related configuration. None. The communications features This report. are not connected in the safety related configuration. Acceptable. Watchdog timer. Per Schneider design. Timeout watchdog during the main This report. loop program operation. See section 2.2.2.17 of this report. Acceptable. Timing and clock control. Per Schneider design. See the data in section 2.2.2.17. This report. Acceptable.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 58 Critical Characteristic Acceptance Criteria Results Reference Output alarms. None used in the safety related configuration. None. The communications features This report. are not connected in the safety related configuration. Acceptable. Features which could impact operation. No features which could interrupt operation The audit of Schneider, review of This report. (interruptions, diagnostics, manual inputs, Schneider documents and NLI testing non-essential application programs, did not identify any features that could unauthorized programs or data modifications). interrupt operation. Acceptable. Security. The firmware is coded on the microcontroller The firmware is coded on the This report. and cannot be field modified. microcontroller and cannot be field modified (see section 2.2.2.17). Acceptable. Year 2000 compliance. Units recognize dates beyond 12/31/99 N/A. The digital system does not use This report correctly. time sensitive functions. Acceptable.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 59 Critical Characteristic Acceptance Criteria Results Reference Processor restart and initialization. Following removal of power, the By design and Schneider testing, hard This report. microcontroller maintains the code. coding is used. The initialization sequence verifies hardware and firmware operation (see section 2.2.2.17 of this report). NLI dedication testing verifies proper operation following extended duration with no power. Acceptable. Data validity checks. Per Schneider design documents.

• There are no input range checking This report.

provisions or data validity checks during operation. They are not required due to the deterministic operation.

                                                                                   " The microcontroller initialization sequence verifies that there no hardware or firmware problems.

• There are no intermediate results.

Acceptable. User configurable input values. There are no user configurable input values. There are no user configurable input This report. values (see section 2.2.2.17 of this report). Acceptable.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 60II Critical Characteristic Acceptance Criteria Results Reference Loss of input instruments. There are no input instruments. There are no input instruments (see This report. section 2.2.2.17 of this report). Acceptable. Diagnostics. Not applicable. Not applicable (see section 2.2.2.17 of This report. The programming is deterministic and this report). diagnostics are not required.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 61 Critical Characteristic Acceptance Criteria Results Reference Human Interface Critical Characteristics-Trip Unit Switch settings. The rotary switches used to set the trip The Schneider design was verified SVR-042181-1 settings operate per the Schneider design. during the audit. NLI validation testing included VVTP-04218 1-1 primary injection testing to validate 100% of the trip settings. NLI dedication testing includes (Project specific primary and secondary injection testing dedication plan). to verify a sample of the trip settings. Acceptable. Operation of touchpad or computer. x.xP and x.xH trip units: The touchpad can be Use of the IFT function to fine tune the This report. used to change the trip settings. trip current settings is acceptable (see section 2.2.2.16). Use of the touchpad to change fine tune other parameters is not acceptable and must be controlled procedurally (see sections 1.2 and 2.5.1). Acceptable. Setting switch security. Security as specified above. Per plant configuration control as VVR-042181-1 specified in section 8.3 of this plan. Human Interface Critical There are no human-machine interfaces for Not applicable (see section 2.2.2.17 of This report. Characteristics-Coils the coils.-- this report).

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 62 Critical Characteristic Acceptance Criteria Results Reference Trip unit specific hardware/software critical characteristics Trip unit operation on Masterpact NT Trip unit mounts and interfaces properly with The audit of Schneider verified the trip SVR-042181-1 and NW breakers. the Masterpact NT and NW breakers, unit is for use on the NW and NT including physical mounting, wiring, CT Masterpact breakers. interface, ratings plug interface, and flux shifter interface. Validation testing by NLI documented VVTP-042181-1 operation on the NW breaker. Dedication testing by NLI on 100% of (Project specific the supplied breakers will verify proper dedication plan). operation. Acceptable. Trip unit interfaces properly with ratings Trip unit + ratings plug provide trip settings The audit of Schneider verified the trip SVR-04218 1-1 plug. per the Square D published trip curves. unit is for use on the NW and NT Masterpact breakers. Validation testing by NLI documented VVTP-042181-1 operation on the NW breaker. Dedication testing by NLI on 100% of Project specific the supplied breakers will verify proper dedication plan. operation. Acceptable.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 63 Critical Characteristic Acceptance Criteria Results Reference Trip settings. Verify that the trip settings are per the Square The audit of Schneider verified this SVR-042181-1 D curves. critical characteristic. Validation testing by NLI tested 100% VVTP-042181-1 of the switch settings by primary injection testing. Dedication testing by NLI (test (Project specific representative settings). dedication plan). Acceptable. Function defeats operate properly. The function is defeated. The audit of Schneider verified this SVR-042181-1 critical characteristic. Defeat of the function does not impact operation of the active functions. Acceptable. VVTP-042181-1 Validation testing by NLI verified this critical characteristic. Acceptable.

                                                                                                   -1 Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc.

Page 64 Critical Characteristic Acceptance Criteria Results Reference No spurious tripping. There is no spurious tripping outside the The audit of Schneider verified this SVR-042181-1 active trip functions and the trip curve. critical characteristic. Validation testing by NLI verified this VVTP-042181-1 critical characteristic. See additional information in Section 7.3. Acceptable. Non safety functions do not interfere External communications functions are non- The audit of Schneider verified this SVR-042181-1 with safety related trip function. safety related. The communication feature critical characteristic. will not be connected in the plant. VVTP-042181-1 Verify that the communication functions will Validation testing by NLI verified this not interfere with the trip function. critical characteristic. Acceptable. Breaker position on ASIC failure. The breaker will remain in the current The audit of Schneider verified this SVR-042181-1 position upon ASIC failure. critical characteristic. Validation testing by NLI verified this VVTP-042181-1 critical characteristic. Acceptable.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 65 Critical Characteristic Acceptance Criteria Results Reference Indication on ASIC failure. If the ASIC fails, and LED on the front of the The audit of Schneider verified this SVR-042181-1 trip unit will light. critical characteristic. Acceptable. Short circuit protection on digital failure. If the digital portion of the ASIC fails, the trip The audit of Schneider verified this SVR-042181-1 unit will still provide short circuit protection. critical characteristic. See additional details in section 2.2.2.3. Acceptable. Thermal protection on digital failure. If the digital portion of ASIC fails, the trip The audit of Schneider verified this SVR-042181-1 unit will still provide overcurrent protection. critical characteristic. Validation testing by NLI verified this VVTP-042181-1 critical characteristic. Acceptable. Battery function. The battery is not required for the safety The audit of Schneider verified this SVR-042181-1 related trip function. The trip operates per the critical characteristic. trip curve with the battery removed or a dead battery. Validation testing by NLI verified this VVTP-042181-1 critical characteristic. Note: The IFT settings are copied to an EEPROM and battery power is not required to maintain these settings (see section 2.2.2.16). Acceptable.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 66 Critical Characteristic Acceptance Criteria Results Reference Trip unit performance upon loss of clock The digital protective function is lost. The audit of Schneider verified this SVR-042181-1 (gate pulse). The analog instantaneous and thermal trip critical characteristic. functions are maintained. Acceptable. Trip unit performance upon loss of All trip functions are lost (digital and analog). The audit of Schneider verified trip SVR-042181-1 internal power supply. unit operation. See the additional data is section 2.1.2.8 of this report. Acceptable.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 67 Critical Characteristic Acceptance Criteria Results Reference Coil specific hardware/firmware critical characteristics Coils operation on Masterpact NT and Coils mount and interfaces properly with the Dedication testing by NLI on 100% of This report. NW breakers across voltage range. Masterpact NT and NW breakers, including the supplied breakers verifies proper physical mounting, wiring, and latch operation. Testing is performed across (Project specific interface. the plant specific control voltage range dedication plan). (see section 7.2.2 of this report). Acceptable. Coil settings. There are no coil settings. Not applicable (see section 2.2.2.17 of This report. this report). Acceptable. No spurious tripping. There is no spurious operation of the coils No spurious operation has been This report. (energization or de-energization as documented by Schneider or during applicable). NLI testing. EMI/RFI testing identified no spurious operation. The FMEA addressed the hardware failure rate for spurious operation. Acceptable.

Masterpact Breaker V&V Report Circuit Inc. VVR-042181-1, Rev. 8 Nuclear Logistics, Page 68 Critical Characteristic Acceptance Criteria Results Reference Non safety functions do not interfere Connection of the communication features is Not applicable (see section 2.2.2.17 of This report. with safety related trip function. not a safety related configuration. this report). Acceptable. Position upon loss of control power. Per Schneider design documents. Spring return of the plunger retracted This report. (shunt trip and close coils) or plunger extended (LV) verified during NLI dedication testing. See section 7.2.2 of this report. Acceptable. Battery function. No batteries are used. There is no battery installed (see This report. section 2.2.2.17 of this report). Acceptable. Coil performance upon loss of Per Schneider design documents. The coil returns to the spring return This report. microcontroller. position. Per the Schneider FMEA, microcontroller failure is not a significant reliability issue. No impact on the trip function of the breaker. Acceptable.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 69 Critical Characteristic Acceptance Criteria Results Reference ACE's Critical Characteristics The following ACE's are Components operate properly when exposed NLI testing and analysis. Section 4.0 of this identified: to the identified ACE's. report.

• Environmental service The evaluation of each ACE is conditions. documented in section 4.0 of this
• Seismic service report.

conditions.

• EMI/RFI. Acceptable.
• Voltage range (undervoltage to overvoltage).
• Infant mortality of electronics.

          " Fault in non-safety plant system.

• Hardware/software faults.
• Loss of power.

Masterpact Circuit Breaker V&V Report VVR-042181-l, Rev. 8 Nuclear Logistics, Inc. Page 70 6.2 Separation Criteria 6.2.1 Micrologic Trip Unit The following information on the Micrologic trip units that is related to separation criteria is presented:

• The Micrologic trip units are self-contained on each circuit breaker. They are located within the switchgear cubicle for each breaker, as are the currently installed trip units.

Installation of the replacement breaker with the trip units does not change the physical location or separation of the breakers or trip units.

   " The electrical interfaces to and from the trip units are fully contained on each breaker.

o The trip units are powered from the CT's on the breakers, which are powered from the primary bus. Note that the CT's are not directly connected electrically to the primary bus. o The trip units receive their input signal from the CT's. o The trip units send their output signal to the actuator on the breaker. o In the qualified configuration, the trip units do not communicate with any other devices in the plant. o The electrical interfaces of the Micrologic trip units are the same as the currently installed solid state trip units.

• If the Micrologic trip units are replacing electromechanical trip units, there are no CT's and wiring. The separation of the Micrologic trip units is still maintained from this configuration, because the trip units are self-contained within each switchgear cubicle.

Installation of the Micrologic trip units maintains the same level of physical and electrical separation as the existing trip units on the low voltage switchgear breakers. 6.2.2 Coils The following information on the Masterpact shunt trip, close coil, and UV trip that is related to separation criteria is presented:

   " The coils are self-contained on each circuit breaker. They are located within the switchgear cubicle for each breaker, as are the currently installed devices. Installation of the replacement breaker with the coils installed does not change the physical location or separation of the breakers or the coils.
   " The electrical interfaces to and from the coils are fully contained on each breaker.

o Each coil in a breaker is electrically and physically independent. o The coils are powered from external control power. o The coils receive their signals from the plant logic outside the switchgear. o The output of the coils is a mechanical function (plunger actuation). There is no electrical or digital output. o In the qualified configuration, the coils do not communicate with any other devices in the plant.

            " The electrical interfaces of the coils are the same as the currently installed coils.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 71 Installation of the Masterpact coils maintain the same level of physical and electrical separation as the existing trip units and coils on the low voltage switchgear breakers. 6.3 Common Mode Failure Evaluation The following activities were performed by Schneider/Square D and NLI to verify that the components operate as intended: Trip units: The equipment architecture is robust by design and manufacture. o The trip unit is a simple ASIC architecture. It is deterministic with all commands executed sequentially in every cycle without interrupts or jumps. o By design, the number of components was minimized. This resulted in a highly reliable system with a very low failure rate. o Potential failures of the microcontrollers have been evaluated as follows:

                    " X.x.A trip units: The safety related trip function on the ASIC is isolated from the HC 11 microcontroller. The microcontroller does not perform safety related functions.
                    " X.xP and x.xH trip units: The safety related HC16 microcontroller interfaces with the safety related ASIC. The HC 16 microcontroller can be used for IFT of the trip currents. This V&V report documents the acceptability of the microcontroller. No firmware failure modes were identified. Credible hardware failure modes were evaluated and determined to be acceptable (see section 2.2.2.16).

o The breaker + trip unit maintain instantaneous and thermal protection in the event of failure of the ASIC. o With an installed base of over 50,000 trip units, there have been no reported software related failures. The software has not been revised since it was released in 1998. o The detailed FMEA by Schneider/Square D and FMEA testing by NLI did not identify any unacceptable failure modes. The two credible failure modes that were identified (see section 5.1) are hardware failures. The robust Schneider design of the trip units eliminate these hardware failures as potential common mode failure mechanisms.

• Coils: The equipment architecture is robust by design and manufacture.

o The components use simple micontroller architecture. It is deterministic with all commands executed sequentially in every cycle without interrupts. o By design, the number of components was minimized. This resulted in a highly reliable system with a very low failure rate. o With an installed base of over 100,000 coils, there have been no reported firmware related failures. The firmware has not been revised since 2002.

   " The component's design and development was performed in a rigorous manner and is well documented.

• Rigorous production controls are used by Schneider/Square D to assure that 100% of the supplied trip units meet the design requirements.
• Extensive production testing is performed, including the following:

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 72 o Schneider tests each algorithm on 100% of the supplied trip units during the production testing. The testing verifies 100% of the functions sequenced by the MCROM instructions, approximately 40% of trip decision calculations supported by THROM data, and approximately 25% of each rotary switch and-or gate logic matrix. o Schneider tests the supplied coils. o NLI performs dedication testing on 100% of the supplied breakers, with the trip units and coils installed, as applicable.

  " Detailed quality assurance/quality control processes and procedures are implemented throughout the lifecycle of the trip units, by both Schneider/Square D and NLI.

o Activities performed by Schneider/Square D are controlled by their ISO 9001 quality assurance program. Based on the NLI audit, Schneider/Square D has a comprehensive program for the control of the trip unit design, development, testing, and manufacture. o Activities performed by NLI are performed under the controls of the NLI Nuclear Quality Assurance Program.

• The applicable ACE's have been identified and addressed by testing or analysis. Based on these activities, no ACE's have been identified that would prevent operation of the devices.

  " Each trip unit and each coil are electrically and physically isolated from the other trip units and coils on the breaker and in the plant. The different coils in the breaker (UV, shunt, close) are electrically isolated from each other.

o Known ACE's have been identified and addressed by testing or analysis. Some of these ACE's could impact multiple trip devices. Based on these activities, ACE's are not credible failure mechanisms for the trip units. o There are no credible single events that could cause failure of multiple trip units.

• Trip units only: The identified plant issues have been addressed with hardware modifications (see section 7.3 for details).

Based on the extensive design, development and testing performed by Schneider/Square D and NLI and the equipment configuration in the nuclear plant, common mode failure of the Micrologic trip units and coils is not considered credible.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 73 7.0 IMPLEMENTATION OF REQUIRED CHARACTERISTICS The activities identified in this section are performed to verify that the components possess the required characteristics identified in section Table 6.1. 7.1 Commercial Grade Audit of Square D/Schneider Audits were performed at the Schneider/Square D facilities that are involved in the design, manufacture, and testing of the Micrologic trip unit. The audit report is contained in Attachment A of this report. The audits verified implementation of the critical characteristics specified in Table 6.1. The audit demonstrated that the Schneider technical, management, and quality assurance program controlled the applicable critical characteristics as identified in Table 6.1. A summary of the audit activities and results are presented in this section. The detailed audit results are contained in Attachment A. A supplemental audit of the Schneider/Square D facilities was performed in December 2008 at the design and engineering facility in Grenoble, France to collect additional information on the HC16 microcontroller. The audit was performed by Archie Bell, who peformed the original audit. This information is included in the body of this report. 7.1.1 Summary of Audited Facilities The firmware was developed by Square D/Schneider under the controls of their commercial ISO 9001-2000 quality assurance program. NLI performed commercial grade audits of the Schneider design and manufacturing facility. The following Schneider/Square D facilities are involved in the design and manufacture of the components and breakers: Schneider facilities in France that were audited by NLI: o Grenoble, France: Trip unit design and engineering. o Montmelian, France: Trip unit manufacture. o Moirans, France: Manufacture, assembly and testing of the Masterpact breaker modules. The Masterpact breaker is a modular breaker with bolts and screws used to assemble the modules. The various modules include the 3 contact modules, trip unit module, mechanism module, etc. All of the modules are manufactured and tested in fixtures at the Schneider facility in Moirans, France.

• The Square D test facility in Cedar Rapids, Iowa was audited. Some of the design and development testing was performed at this facility. This facility also assembles the Masterpact modules and tests the completed breakers.
• The Square D Services in West Chester, Ohio was audited. This facility receives the assembled and tested Masterpact breakers (with trip units) and assembles them into the replacement breakers with carriages.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 74 The Square D assembly facility in Columbia, SC was not audited. Some of the Masterpact modules are assembled and tested in this facility. An audit of this facility is not required for the V&V based on the following: o No design or manufacturing of the components occurs in this facility. The trip unit and coils are modules that are attached to the breaker. o NLI dedication/FAT testing is performed on 100% of the supplied breakers and confirms that the trip devices and coils operate per design. 7.1.2 Summary of Audit Activities The following activities were performed during the audit:

1. Face-to-face interviews with engineering personnel, reviews of testing documents, and analysis of the Micrologic trip unit design documents at Square D's engineering and test facilities in Cedar Rapids, IA.

2. Reviews of the Micrologic design documents with the Schneider's Micrologic design team and quality assurance representatives, inspection of test facilities, verification of measurement and test equipment calibration, reviews of trip unit design methodology, development documentation, control and testing requirements, and analysis of test results and documentation at Schneider Electric's design and testing facilities in Grenoble, France. Additional information was collected during teleconference calls.

3. Interviews with production and quality control personnel, inspection of trip unit production, testing, and packaging operations, and analysis of assemble methods, test equipment certification, and test reports at Schneider Electric's Micrologic production facilities in Montmelian, France. This is the only facility in the world that assembles the Micrologic trip unit.

4. Interviews with production and quality control personnel, inspection of circuit breaker production, testing, and packaging operations, analysis of receipt, in-process and post-production inspection and test methods, test equipment certification, and documentation of test results at Schneider Electric's Masterpact production facilities in Moirans, France.

5. Additional information was transmitted electronically to NLI, to support the V&V activities.

A second audit of the Schneider design and engineering facilities in Grenoble, France was performed in December 2008 to collect additional information on the x.xP and x.xH trip units with the HC 16 microcontroller. This data is included in this report. 7.1.3 Design and Development Controls (Trip Unit) A summary of the design and development controls used by Schneider for the Micrologic trip unit is presented:

• Schneider Electric managed the digital design and microcode development and testing as a hardware project, which is consistent with the design and validation toolsets provided by ASIC manufacturing houses such as AMI Semiconductor (AMIS). The Micrologic design team management and quality assurance activities comply with the intent, where applicable, of the following IEC documents: 1131-1-1992; 1131-2-1992; 1131-3-1992;

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 75 and 1131-4-1995 for microcontrollers, which correlate, where applicable, to the requirements of IEEE Standards 830-93, 603-91, 828-90, 1042-87, 1008-87, and 1042-

87. The titles and content follow European format and in some cases requirements are combined in a single document.

• Verification and validation of new designs falls under 'qualification activities' and are controlled by Schneider Electric Procedure PCO 09. During the design phase, the calculation constants and formulas were determined by simulation. The final versions of the masked program device code (located in the MCROM) and the constants and thresholds (located in the THROM) were finalized based on testing, which was performed and documented in accordance with controlled procedures and plans.
• Extracts of the design documents have been obtained and are in NLI's possession.

Complete versions of the design documents are available for review at the Square D facility in Cedar Rapids, IA. Test plans and reports, quality manuals and procedures, generic ASIC design methodology and implementation methods and techniques, and Micrologic production and testing documentation were reviewed and are available for review at NLI's facility.

• Good software coding practices were used during the development of the software. The ASIC design requirements were documented using Verilog simulation toolsets specifically designed by Cadence and AMIS for ASIC applications. The good software practices included the following:

o Data flow was written in a modular, overlay fashion. o Design notes are included with the data flow to allow review by a cognizant peer. o Design requirements are safeguarded with a tool similar to source safe, which date stamps the file each time that it is saved/closed.

• During prototype coding, the designer performed simulations. All integrated testing was performed by second party or peer reviewers. This approach is consistent with the intent of IEEE Standards 1008-1987 and 829-1983.

I Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. .I Page 76 0 The flowchart below identifies the high-level design flow:

• The software testing and integrated software/hardware testing that was performed is summarized below. This testing was performed during the development and prototype portion of the project.
• The threshold and constant data contained in the THROM was developed in Grenoble, France using a "C" language program that generated theoretically ideal data, which was documented on a Microsoft Excel spreadsheet.

     " The THROM data was validated by testing in Cedar Rapids, IA.

• Correction (tuning) of the code was performed in Grenoble, France and implemented through a THROM revision.
• The MCROM machine level code was written in Grenoble, France and tested in Cedar Rapids, IA to verify that the deterministic instruction loop correctly sequenced the THROM data and the user input digital words.
• This iterative process continued until the design requirements were met.
• Black box (input/output) testing only was performed during development due to the simplistic nature of the ASIC architecture.
• The following Schneider/Square D controlling procedures were used to control the design process:

     " Requirements Definition.
     " SubcontractingDesign Requirements.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 77

• Validation of Technical or Design Requirements.
• ProjectStartup andProgress Tracking (Form).

   " Software Quality Assurance.

• Qualificationof Productsand Systems.
• Storage and Distribution of Quality Document.
• Software Quality Reviews.

The following reports document the development testing that was performed by Schneider/Square D:

• Test Report - Validation of Micrologic 5. OA CurrentMeasurements.

   " Test Report - Aging Tests Applicable to Micrologic 2. OA, 3. OA, 5. OA, and 6. OA.

• Test Report - ASIC Developmental Testing.
• Test Report - Micrologic 5. OA PostProductionTesting.
• Test Report -- EMC per ANSI/IEEE C37.90, Test Report - Multiple Power Circuit Breaker Frames per UL 1066, ANSI C3 7.50 and C3 7.13, EMC per IEC 60947-2 Annex F.
• Test Plan - PostProduction Testing.
• Test Report - PostProductionAutomated Testers.

7.1.4 Production Controls and Testing (Trip Unit) The following summary of the production controls used during the manufacture and testing of the trip devices is presented:

• After production release, engineering oversite was transferred to the sustaining/product improvement organization.

o This transfer of responsibility was accomplished in accordance with procedure Transfer of Technical Management after Product Release. o Activities after product release are performed in accordance with procedure Project Activities after Product Release.

• The following Schneider/Square D procedures control the production processes:

o The requirements for procurement are identified in procedure Purchasing of Inventory Items. Items are purchased from two levels of approved suppliers. Certified supplier's products are accepted without additional testing based upon a defined grading system. Products from uncertified suppliers are subject to acceptance testing, which are performed in accordance with documented plans. Incoming certified products are differentiated from non-certified products by a two-alpha prefix on the item's part number. o Production planning and control is accomplished in accordance with the following procedures: o Design Review and Production Startup (Form). o ProductionPlanning. o Modification of ProductionPlans. o Distribution andModification of the ProductionPlan.

• A summary of the production process is as follows:

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 78 o The overall architecture and design, MCROM and THROM microcode and data, functional and environmental testing against IEC standards, and test design was performed at Schneider in Grenoble, France. o Alcatel (Belgium), now AMI Semiconductor, http://www.amis.com. performed the analog design, mechanical layout, and manufacturers the ASIC semiconductor device, which includes masking the code for the MCROM and THROM devices. o AMIS provides the completed, tested silicon devices to Solectron Corporation, http://www.solectron.com, where the Micrologic printed wire boards are manufactured. o Solectron Corporation provides the manufactured and tested printed wire board assemblies to Schneider Electric's assembly plant in Montmelian, France where the Micrologic trip units are fully assembled and tested. o AMI Semiconductor and Solectron Alcatel both have ISO 9001-2000 compliant quality assurance programs and are certified suppliers of Schneider Electric. A high level of control and quality is maintained by Schneider/Square D throughout the production process. A summary of the production testing performed by Schneider prior to shipment is as follows: o After assembly, the Micrologic trip units are functionally tested to verify compliance with the design requirements at Schneider Electric's production facilities in Montmelian, France. The testing verifies 100-percent of the functions sequenced by the MCROM instructions, approximately 40-percent of trip decision calculations supported by THROM data, and approximately 25-percent of each rotary switch and-or gate logic matrix. o The production testing is performed by automated means using a robotic test bed and automatic test equipment. Automated testing of the completed trip unit assembly verifies the correct hardware and software configuration of the assembly. Automated testing is performed in accordance with Schneider Electric document "Planfor the Four Function Testers PROXIMA ", Revision T, dated 2/19/2002. The automated testing is performed using software controlled M&TE. The verification and validation activities for the testing software is documented in Schneider Electric document "Qualification of the FourFunction Testers PROXIMA ", dated 2/5/2003. The production testing performed by Schneider provides a very high level of confidence that the supplied trip devices are in accordance with the design documents. 7.1.5 Product Support The long term product support that will be provided by NLI and Schneider is summarized in section 8.0 of this report.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 79 7.1.6 Audit Documents Extracts of the design, testing, and production documents have been obtained and are in NLI's possession. Complete versions of the design documents are available for review at the Square D facility in Cedar Rapids, IA. Test plans and reports, quality manuals and procedures, generic ASIC design methodology and implementation methods and techniques, and Micrologic production and testing documentation are available at NLI's facility in Fort Worth, TX. The Schneider documents which were made available to NLI are maintained in accordance with the NLI Quality Assurance Program. Some Schneider documents are proprietary to Schneider and were reviewed during the audit but will not be released to NLI. 7.1.7 Trip Unit Microcontrollers The requirements for the ELU and ELH microcontroller software (firmware) are documented in Schneider Electric design specification PROANAA, Version 1.1, dated 4/23/2002. The design concept was further amplified in Schneider Electric specification, Conception des Protections Avanc6es ELU/H, dated 5/13/2004. Coding was performed in accordance with Schneider Electric coding specification N' 5100511735, Version 4, dated 9/14/2001. The code consists of 41 modules. Only 9 modules instruct management of IFT current threshold data, main program loop and related interrupts, and ASIC communications. The majority of the remaining modules implement the remaining IFT and display functions. The program uses a RTXC operating system and is coded in C and assembler. The operating system was exhaustively tested by Schneider Electric prior to its selection for use for controlling the ELU and ELH advanced protection and display functions. Integrated hardware/software testing is documented in Schneider Electric report GT040349, Declencheur PROXIMA Micrologic 5.OP 6.OH, dated 6/28/2004. 7.1.8 Coil Documentation The lifecycle of the coils is controlled under the same ISO 9000 quality assurance program and implementing procedures as the trip units. The controls and higher level procedures identified above are applicable to the coils. The following specifications and procedures are applicable to the coils. These documents were reviewed and the applicable information was included in this report.

• Technical Design Requirements: Schneider Electric document 5100512854, Revision B, PROXIMA Auxiliary Design File, (English Translation), dated 3/11/2005.
• PROXIMA Auxiliaries Relay Software Specification: Schneider Electric document 5100512993, Revision B, Description of PROXIMA Auxiliary Software (English Translation), dated 12/12/2005.

" Coding Specification: Schneider Electric document 5100511735, Revision 4, Manual for the Development of Program Code, dated 9/14/2001.

• Acceptance Test Requirements: Schneider Electric document 5100561500, Revision Al, Functional Test Specification for PROXIMA Auxiliaries, undated.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 80

• FEMA Documents: Schneider Electric document 51311620, Revision B, Study of Reliable Function of PROXIMA Auxiliaries, dated 1/20/2003 (references MIL-HDBK-217) -

firmware not considered. 7.2 NLI Testing Testing and analysis is performed by NLI to fully document the V&V of the components. The testing and analysis address the critical characteristics identified in Table 6.1, as applicable. 7.2.1 Qualification Testing Qualification testing and analysis will be performed in accordance with the requirements for each utility. The testing will be performed on a single test specimen which is the same configuration as the production units which are being delivered. This testing will include the following:

• EMIIRFI testing.
• Seismic testing.
• Mild environment analysis.

Sections 4.1-4.3 provide details on the qualification testing. The qualification reports are separate documents. 7.2.2 Dedication Testing 100% of the production units will be dedicated to verify the functional requirements of the computer based systems are met. The dedication will be based on testing 100% of the supplied units as identified in section 1.3 of this plan. The testing specified in the dedication plan will be performed at the NLI facility and/or the Square D facility with NLI personnel witnessing the testing. The dedication testing will include the applicable ANSI Production Tests. The characteristics that will be verified by dedication testing are identified in Table 6.1. The dedication plans and dedication reports are separate documents. Coils: The dedication testing includes testing across the plant specific control voltage range, including undervoltage and overvoltage conditions. This testing is performed on 100% of the supplied circuit breakers. 7.2.3 Validation Testing NLI has performed validation testing [13] to verify that the trip units meet the Schneider design specifications. This testing supplements the data collected during the audit of Schneider. The characteristics that were verified by the validation testing are identified in Table 6.1. The validation test plan and test data sheets are contained in Attachment B. The basis for the validation test plan sample size is documented in the test plan.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 81 The trip unit responded as specified in the Schneider design documents during the Validation testing. Based on the information supplied by Schneider, it was determined that no additional validation testing was required for the coils. 7.2.4 Failure Modes & Effects Testing As discussed in section 5.1.1, detailed FMEA's were performed by Schneider. The supplemental testing performed by NLI is also identified in section 5.1.1. 7.2.5 ANSI Design Testing The Masterpact breaker with the Micrologic trip unit has previously been design tested per the applicable ANSI requirements. Additional design testing will be performed on each replacement breaker configuration in accordance with the requirements of ANSI C37.59 [18]. 7.3 Operating History 7.3.1 Firmware Operating History Trip Units The following operating history information was provided by Schneider [20]. This data applies to the current generation of the Micrologic hardware and current revision of the ASIC (v.2.7):

• There have been no revisions to either the THROM/MCROM microcode or the ASIC hardware since its production release in 1998.
• Over 50,000 Micrologic trip devices using the current ASIC MCROM microcode revision are in use, with approximately 17,000 deployed in the United States.
• Schneider has been shipping the same version since product rollout during 1998. To date, none have been recalled.
• No outstanding, uncorrected software errors exist at this time.
• Presently, no microcode revisions are planned.
• Schneider intends to support this product for the foreseeable future.

Coils The following information was provided by Square D/Schneider. This information is applicable to the current revision of the coil firmware.

    " There have been no revisions to either the code or the hardware since the production release in 2002.

• Schneider has been shipping the same version since 2002. To date, none have been recalled. No firmware failures have been identified.
• Approximately 100,000 units have been sold in the past 2 years.
• No outstanding, uncorrected firmware errors exist at this time.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 82

   " Presently, no microcode revisions are planned.

• Schneider intends to support this product for the foreseeable future.

NLI dedication tests 100% of the coils across the plant specified control voltage. There have been no coil failures during dedication. NLI has no coils returned due to field failures. The large installed base with no reported software problems and no software revisions indicates a high level of equipment reliability. 7.3.2 Hardware Operating History Two hardware modifications have been made to the Micrologic trip device since 2005. These modifications are evaluated in the following sections. These issues are hardware only and do not affect the firmware. 7.3.2.1 Capacitor to Reduce Electromagnetic (EM) Susceptibility Inadvertent Ap trips were identified in the fall of 2006 in applications where the breaker was used to start a motor (OE 21873, OE 21799). The trip would occur when the breaker was closed to start a motor. Extensive testing was performed by NLI and Square D. The inadvertent tripping was attributed to a voltage surge during closure of the breaker that is interpreted by the Micrologic trip device as a short circuit condition. Square D modified the design of the Micrologic circuit to add a filter capacitor. The purpose of the capacitor was to eliminate the inadvertent trip. Surge testing of the modified design was performed at 6kV. The testing addressed the configuration where the breaker is used to start the motor (surge during the breaker closing operation). There were no inadvertent trips. The 6kV test level is much greater than the test levels specified in EPRI TR-102323 and the ANSI standards. The impact of this modification on the qualification and V&V of the Micrologic trip device is as follows:

• V&V: The modification is a hardware change only. There is no modification of the firmware. There is no impact on the V&V of the Micrologic.

    " EMI/RFI qualification: EMI/RFI susceptibility is reduced by the modification. The capacitor is a passive component, so the modification does not impact the EMI/RFI emissions of the trip unit.
    " Seismic Qualification: The added capacitor is a small, board mounted device. It is seismically insensitive and will not impact the qualification of the Micrologic.

• Design Life: The capacitor type used in the filter is the same type of capacitor used in other locations in the Micrologic. There is no impact to the design life.
• Reliability: The modification addresses and identified problem and will increase the reliability of the trip unit.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 83 7.3.2.2 Performer Plug Modification In the fall of 2007, two cases additional cases of inadvertent Ap trips were identified (OE 26769). These trips were on breakers with the new Micrologic trip unit design. The trips occurred when the breakers were being used to start motors. Square D/Schneider evaluated the inadvertent Ap trips. The root cause was identified as the mechanical pin connection between the performer plug and the Micrologic trip device. The performer plug is plugged into the trip unit. The performer plug is factory installed and defines two types of fault protection.

• Maximum instantaneous fault level.
• Maximum close into the fault level: This fault level is lower than the instantaneous level. This protects the circuit breaker if it is closed into a fault.

In a very small number of cases, the mechanical shock of closing the breaker causes a short time discontinuity in the plug connection between the performer plug and the trip unit. This discontinuity causes the "maximum close onto fault level" to revert to a very low value current for a very short time. If this discontinuity occurs during the motor inrush (when the breaker is used to start a motor), this low level can be below the motor inrush current, which would cause the breaker to Ap trip. The manufacturing tolerance of the female pin connector on the performer plug causes the problem. This problem occurs on a very small number of the connectors. The design of the performer plug was modified to improve the reliability of the breakers and to eliminate this issue. All beakers supplied after 5/2008 contain the modified performer plug. The impact of this modification on the qualification and V&V of the Micrologic trip device is as follows:

   " V&V: The modification is a hardware change only. There is no modification of the firmware. There is no impact on the V&V of the Micrologic.

• Electromagnetic Interference/Radio Frequency Interference (EMI/RFI) Qualification:

The modification does not change the circuit of the performer plug. Therefore, it will not impact the EMI/RFI qualification.

   " Seismic Qualification:          The modification makes the performer plug/trip unit pin connections tighter. This will increase the seismic resistance of the equipment. There is no impact on the seismic qualification.
   " Design Life: There is no change in the materials of the part. There is no impact to the design life.

• Reliability: The modification addresses and identified problem and will increase the reliability of the trip unit.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 84 7.3.2.3 Other Operating Experience Other nuclear plant operating experience has been reviewed (OE 24418, 24311, and 23935) have been reviewed. These issues are hardware issues and are not related to the Micrologic trip units. These issues have been addressed in the NLI design and dedication activities. 7.3.2.4 Coils No hardware modifications have been made to the coils since they were released in 2002. No hardware issues have been identified by NLI or Square D. No coils have failed NLI dedication testing (100% sample size) and no coils have been returned from the client due to failures in the field. No nuclear plant operating experience issues (OE's) have been identified for the coils. 7.4 Users Manuals The Schneider/Square Users Manuals have been reviewed by NLI. The manuals are accurate and provided the required level of detail. NLI prepares Users Manuals for the supplied equipment. The NLI Users Manuals address the plant specific requirements and nuclear industry specific issues. The NLI Users Manuals include copies of the applicable Schneider/Square D manuals.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 85 8.0 CONFIGURATION MANAGEMENT PLAN 8.1 Schneider Firmware Configuration Control and Error Reporting The activities summarized below are performed by Schneider for the long term support of the Micrologic trip unit and coils.

• Configuration management, both revision control and revision verification, is accomplished using the VERILOG tool set. Configuration management requirements are documented in Schneider Electric controlled procedures. The configuration management activities comply, as applicable, with the intent of IEC 1131-1-1992, IEC 1131-4-1995, and IEEE Std. 1042-1987.
• Management, resolution, and communication of customer reported defects are controlled in accordance with the following Schneider/Square D procedures:

o Managing Customer Complaints. o Managing CustomerReturns. o Communication of ProductDefects.

• Upon receipt, a customer complaint is documented in a worldwide product quality database (Productquality database(L V InSchneidert area)). Locally developed decisions are reviewed and validated at Schneider Electric corporate design and quality assurance.

Solutions outside of local capabilities are submitted to Schneider Electric corporate for resolution. Once a solution is implemented and verified, the defect and its resolution are made available to all Schneider Electric service centers for distribution.

• Schneider's corrective action complies with the requirements of ISO 9002-1994 and 9001-2000.
• The mechanism used to implement the customer feedback process is for customer reported errors to be processed and resolved in the USA through the Square D customer service program, which receives updates from the world wide Schneider Electronics network.

   " Code revisions:

o Trip unit: Presently, no microcode revisions are planned. Should a product enhancement be made to add additional capability, the THROM constants and thresholds may be changed, but no MCROM microcode revisions would be considered necessary. With any microcode revision, full configuration control measures would be taken. Testing would include regression testing during the integration phase. Microcode design development, testing, maintenance, and retirement activities comply with the intent of a software lifecycle management scheme as describe in IEEE Standard 1074-1995. o Coils: No changes to the code are planned. If revisions are made, the configuration control activities would be as specified above.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 86 The metrics that are used for product trends are field failure ranked for the following: o Hardware. o Software. o Electrical. o Display. 8.2 NLI Configuration Control The following process is used by NLI to identify, document, evaluate, and report firmware modifications and errors:

• NLI documents the as-supplied hardware and firmware configuration for 100% of the supplied trip units. The following information is identified for the each trip unit:
• Trip unit part number and serial number.
• Chip and firmware part number and revision number, as available.
• NLI contacts Schneider every year and any modifications or reported errors will be identified.
• Errors will be documented and evaluated in accordance with the NLI Nonconformance Report (NCR) process [28]. Notification in accordance with IOCFR21 will be made in accordance with NLI procedures [28], if required.
• Design changes which are not the result of errors will be evaluated by NLI for impact on the existing system and future replacement trip units.
• NLI will submit all NCR's and 10CFR21 reports associated with the trip unit hardware and software to the client. Evaluation of design changes will also be submitted.

This approach is based on the following:

• The Schneider audits and the NLI testing will verify the as-supplied configuration.
• Schneider will not make the source codes available to NLI. Schneider will not freeze the hardware or software configuration.
• Schneider has a controlled program for the following activities:
• Document revisions to hardware and software.
• Perform regression testing and/or analysis to fully evaluate the impact of the hardware and software changes on the system. The test method and results are documented in an auditable form.

8.3 Plant Lifetime Configuration Control Configuration control following delivery of the equipment is the responsibility of the nuclear plant. It is recommended that the configuration control procedures address the following issues:

• Changes to the trip settings using the switches on the front of the trip unit must be procedurally controlled. Note that the same procedural controls are currently implemented on existing solid state trip units.
• The breaker is considered inoperable with the FFTK connected.
• The FFTK can be used to purposefully or inadvertently change the trip

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 87 settings/functions on the trip units. Use of the FFTK should be procedurally controlled. The following should be done as a minimum:

• Control access to the FFTK.
• Personnel training on the use of the FFTK.

           . The trip settings should be verified just before or after the FFTK is disconnected.

• Communications features external to the circuit breakers cannot be enabled (trip unit, shunt trip, UV, close).

       *   (xx.P and xx.H series trip units only): If the Incremental Fine Tuning (IFT) feature is used, the following requirements should be met:

• Procedureally control the trip setpoint changes.
• Document the ITF settings that are input.
• Input the ITP settings using the touchpad on the trip unit, not an external connection.
• The cyber security recommendations in section 2.5 of this report should be followed.
• Section 1.2 of this report identifies limitations to the qualified configuration. These limitations must be controlled as follows:
• Hardware limitations, such as no external power supply or permanent communications, are controlled by the system design.
• The other limitations are controlled procedurally.

9.0 QUALITY ASSURANCE Project activities were performed in accordance with the NLI Quality Assurance Program which meets the requirements of 10CFR50 Appendix B, 10CFR21 and ASME NQA-l [19]. 10.0 MEASUREMENT & TEST EQUIPMENT Measurement & Test Equipment used by NLI during testing is controlled by the NLI M&TE program (procedure NLI-QUAL-05, latest revision). The NLI test data sheets document the M&TE that is used during the testing. The calibration of M&TE is traceable to NIST or equivalent standards.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 88

11.0 REFERENCES

Note: (project specific) indicates NLI documents that are developed for each specific breaker/trip unit supply project. Industry/Re2ulatory Documents

1. IEEE Std 7-4.3.2-1993, "IEEE Standard Criteria for Digital Computers in Safety Systems of Nuclear Power Generating Stations."

2. IEEE 323-1974/1983, "IEEE Standard for Qualifying Class 1E Equipment for Nuclear Power Generating Stations."

3. IEEE 344-1975/1987, "IEEE Recommended Practices for Seismic Qualification of Class 1E Equipment for Nuclear Power Generating Stations."

4. EPRI TR-102348, "Guidelines for Licensing of Digital Upgrades", 12/1993.

5. EPRI TR-106439, "Guideline on Evaluation and Acceptance of Commercial Grade Digital Equipment for Nuclear Safety Applications", Final report, October 1996.

6. EPRI TR-102323, "Guidelines for Electromagnetic Interference Testing in Power Plants,"

revision 1.

7. IEEE 730-1989, "Software Quality Assurance Plans."

8. IEEE 1012-1986, "Standard for Software Verification and Validation Plans."

9. IEEE 1028-1988, "IEEE Standard for Software Review and Audits."

10. ASME NQA-la-1995, Appendix 7A-2, "Nonmandatory Guidance for Commercial Grade Items", 1995.

11. EPRI 5652,"Guidelines for the Utilization of Commercial Grade Items in Nuclear Safety-Related Applications."

12. IEEE C37.81-1989, "IEEE Guide for Seismic Qualification of Class 1E Metal-Enclosed Power Switchgear Assemblies".

13. IEEE C37.82-1987, "IEEE Standard for the Qualification of Switchgear Assemblies for Class 1E Applications in Nuclear Power Generating Stations".

14. IEEE 384-1977/1981/1992, "Criteria for Separation of Class 1E Equipment and Circuits".

15. NRC R.G. 1.75, "Physical Independence of Electrical Systems".

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 89

16. NRC R.G. 1.89, "Qualification of Class 1E Equipment for Nuclear.Power Plants".

17. NRC R.G. 1.100, "Seismic Qualification of Class lE Equipment for Nuclear Power Plants".

18. IEEE C37.59-2002, "IEEE Standard for Conversion of Power Switchgear Equipment".

NLI and Schneider/Square D Documents

19. NLI Quality Assurance Manual, Rev. 8, 12/14/07.

20. Schneider Electric manual 48049-137-04, "Micrologic 5.0P and 6.OP Electronic Trip Units",

revision dated 05/2003.

21. NLI audit report of Schneider/Square D, report SVR-042181-1, revision 0, (contained in Attachment A of this report).

22. (not used)

23. NLI V&V Plan VVP-042181-1, "Software Verification and Validation Plan for Square D Micrologic Trip unit", revision 0 (contained in Attachment D of this report).

24. NLI design drawings for breaker/trip unit (project specific).

25. NLI dedication plan with dedication test data (project specific).

26. NLI Software/Hardware Validation Test Plan with test data, VVTP-042181-1, revision 0 (contained in Attachment B of this report).

27. NLI Instruction Manual (project specific).

28. NLI Procedure NLI-QUAL-08, "Nonconformances and 10CFR21 Reporting," (latest revision).

29. NLI EMI/RFI plan and report (project specific).

30. Schneider Electric manual 48049-207-03, "MICROLOGIC 2.0, 3.0, and 5.0 Electronic Trip Units", dated 12/01.

31. Seismic plan and report (project specific).

32. NLI Qualification Report Supplement QR-042181-1-SUPP1, "Supplemental Qualification Report for Square D Micrologic Trip Unit".

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page 90

33. NLI report QR-042181-5, "EMI/RFI Qualification Report for Masterpact Circuit Breaker Shunt Trip and Undervoltage Trip", (latest revision).

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page A.4l1 Attachment A Trip Unit Configurations and NLI Audit of Schneider/Square D

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page A.2 Trip Unit Configurations

Masterpact NT and NW Universal Power Circuit Breakers Micrologic Electronic Trip Systems Table 20: Micrologic Trip Unit Features Microllogic Trip Unit (X= Standard Feature 0 = Available Option) Standard Ammeter Power Harmonics Feature 2.0 3.0 5.0 2.OA 3.OA 5.0A 6.OA 5.OP 6.OP 5.OH 6.01-1 LI x x LSO x x LSI X X X X 1 LSIG/Ground-Fault Trip X X X 12 Ground-Fault Alarm/No Trip X X 12 Ground-Fault Alarm and Trip X X Adjustabte Rating Plugs X X X X X X X X X X X True RMS Sensing X X X X X X X X X X X UL Usted X X X X X X X X X Thermal Imaging X X X X X X X X X X X Phase-Loading Bar Graph X X X X X X X X LED for Long-Time Pick-Up X X X X X X X X X X X LED for Trip Indication x X X X X X X X Digital Ammeter X X X X X X X X 3 Zone-Selective Interlocking X X X X X X X Communications 0 0 0 0 X X X X LCD Dot Matrix Display x x x x 4 4- 4 4 4 + 4 4 .4- 4-Advanced User Interface x x x x Protective Relay Functions x x x x Neutral Protectioni X X X X Contact Wear Indication X X X X Incremental Fine Tuning of Settings x x x x Selectable Long-Time Delay Bands X X X X Power Measurement X x x x Power Quality Measurements x x Waveform Capture I X X I Requires neutral current transformer on three-phase four-wire loads. 2 Requires the M2C/M6C Programmable Contact Module. 3 Not available for 2.OA trip unit as upstream devices. Micnlogic 5.OP and 6.01 Trip Units Micrologic 5.0H and 6.01-1Trip Units 21 04/2008 Schneider ©2000-2008 Schneider Electric All Rights Reserved OElectric

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page A.4 NLI audit report SVR-042181-1 and the supporting Schneider documents are proprietary. These documents are not included in the version of this report that is released to our clients. These documents are available at the NLI facility for review. The Schneider/Square D documents listed below are attachments to the NLI audit report. Document # Title MQ MDE-E Rev. A Group Schneider QA Manual No Document # Grenoble ISO 9001-2000 ISO Certification for Design and Testing PAQOOHO 1 AFI Moirans QA Manual No Document # Moirans ISO 9001-2001 and ISO 14001-1996 Certificates PAQ 02 H06 0 00 B AFI Moirans Receipt Inspection Procedure No Document # Montmelian QA Manual, Revision B No Document # Montmelian ISO 9001-2001 and IS014001 -1996 Certificates No Document # AMIS ASIC Design Brochure No Document # AMI Semiconductor Background, Products, and QA No Document # Cadence Design Systems Background and Products No Document # Solectron Corporation Background, Products, and QA 60069-001, Rev. A Mixed Signal ASIC Programming Manual No Document # Cadence - System Design and Verification Overview No Document # An Introduction to RISC Processors 0600DB9901 8/00 Data Bulletin -- Field Testing and Maintenance Guide for Micrologic Electronic Trip and Thermal-Magnetic Molded Case Circuit Breakers 0603DB0102 8/01 Data Bulletin -- Electronic Trip Insulated Case Circuit Breakers 0613H09902 Micrologic Trip Units - Product Overview' 48049-136-03 02/02 Micrologic A Series Trip Units 48049-137-03 05/02 Micrologic 5.OP and 6.OP Trip Units 48049-183-01 06/01 K669 Full Function Test Kit Procedure 07, Rev. D Group Schneider Requirements Definition Procedure 09, Rev. C Group Schneider Subcontracting Design Requirements Procedure 13, Rev. D Group Schneider Validation of Technical or Design Requirements Procedure 15, Rev. E Group Schneider Managing Customer Complaints Procedure 16, Rev. C Group Schneider Managing Equipment Returns Procedure 17, Rev. D Group Schneider Communication of Product Defects Procedure 18, Rev. A Group Schneider Corrective and Preventative Actions Form PRC 703-Ic Group Schneider Design Review and Production Startup Form Procedure PAEL-GO 1 Group Schneider Software Quality Assurance

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page A.5 Procedure PCO-01, Rev. F Group Schneider Technical and Manufacturing Development Processes Procedure PCO-03, Rev. B Group Schneider Purchasing of Inventory Items Procedure PCO-09, Rev. G Group Schneider Qualification of Products and Systems Procedure PCO-10, Rev. D Group Schneider Project Activities after Product Release Procedure PCO- 11, Rev. E Group Schneider Transfer of Technical Management after Product Release Procedure PCO-13, Rev. F Group Schneider Management of M&TE Procedure PCO- 15, Rev. D Group Schneider Product Protection Checklist Procedure PCO-16, Rev. C Group Schneider Production Planning Procedure PCO-17, Rev. C Group Schneider Distribution and Modification of the Production Plan Procedure PCO-18, Rev. C Group Schneider Modification of Production Plans Procedure PCO- 19, Rev. D Record of Proving Test Storage and Distribution of Quality Documents Procedure PAEL-GO1 Group Schneider Software Quality Assurance (Extract) Test Report PROELA0020 Validation of Micrologic 5.OA Current Measurements w/ NW08 Test Report PROELA0024 Micrologic 2.OA, 3.OA, 5.OA, and 6.0A 1000 Hour Temperature Cycle Test Test Report PROELA0030 Complete Summary of Micrologic Trip Unit Testing CEI Qualification Testing No Document # Group Schneider Index of Activity and Process Instructions and Procedures PROANAA Group Schneider Specification of the ASIC (Extract) PROA PROXIMA, Rev. 2.7 Alcatel Specification of the User Specific Integrated Circuit PROA (Extract) 5100513140-B 6/28/01 Failure Modes and Effects Analysis PROXIMA release ELA version (Extract) A48155 Square D Report - ASIC Verification Testing During Development Extract) PR CDC 4230T, Rev. T Plan for the Four Function Testers PROXIMA (Extract) R FORVEIL, 2/5/03 Qualification of the Four Function Testers PROXIMA (Extract) Various Document #s Micrologic Trip Unit Final Acceptance Tester M&TE Calibration Certificates Test Report 205490 Micrologic Trip Unit SN 205490 Factory Post-Assembly Test Results 151 a0 1 EC Certificate of Conformity Micrologic Trip Unit 2.0-7.OH w/ Masterpact NW and NT 411_00 IEC Certificate of Conformity Micrologic 5.OA Emissions Test EEC 945 1996-11 F IEC-60947-2E Collection Technique No. 149 EMC: Electromagnetic Compatibility IEC 60947-1 Edition 3.2-2001 Part 1 General Rules IEC 60947-2 Edition 2.2 2001-11 Part 2 Circuit Breakers K1 1-314a-00 Record of Proving Test Micrologic 5.OA w/ NW08 HI KI 1-314b-00 Record of Proving Test Micrologic 7.OA w/ NW08 H1 KI 1-527-00 Record of Proving Test Micrologic 5.OA w/ NW40 BH1 UL and ANSI Certification Test Report for Masterpact NW NW08H1 UL and ANSI Certification Test Report for Masterpact NW NW08H2

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page A.6 UL and ANSI Certification Test Report for Masterpact NW NW08L1 UL and ANSI Certification Test Report for Masterpact NW NW08N1 UL and ANSI Certification Test Report for Masterpact NW NW16H1 UL and ANSI Certification Test Report for Masterpact NW NW16H2 UL and ANSI Certification Test Report for Masterpact NW NW16L1 UL and ANSI Certification Test Report for Masterpact NW NW 16N 1 UL and ANSI Certification Test Report for Masterpact NW NW20H 1 UL and ANSI Certification Test Report for Masterpact NW NW20H2 UL and ANSI Certification Test Report for Masterpact NW NW20L1 UL and ANSI Certification Test Report for Masterpact NW NW32H1 UL and ANSI Certification Test Report for Masterpact NW NW32H2 UL and ANSI Certification Test Report for Masterpact NW NW32LI UL and ANSI Certification Test Report for Masterpact NW NW40H2 UL and ANSI Certification Test Report for Masterpact NW NW40L1 UL and ANSI Certification Test Report for Masterpact NW NW50H2 UL and ANSI Certification Test Report for Masterpact NW NW50L1 ANSI C37_90 Test Report Electromagnetic Compatibility Schneider Electric Response to NLI Questions (MS PowerPoint)

COMMERCIAL GRADE AUDIT REPORT Vendors: Audit Report No.: SVR-042181-01, Revision 1 Schneider Electric Square D Grenoble, France Cedar Rapids, IA, USA Moirans, France Montmelian, France Audited Facilities: Grenoble, France Moirans, France Montmelian, France Cedar Rapids, IA, USA Audit Dates: Various 2-5/2003 Audit Results:

• Inspection Plan No.: VVP-042181-01 (latest revision)
• Team Member: Mr. Archie C. Bell
• Persons contacted: Mr. Jacques Galla, QC Process Manager - Montmelian, France Mr. Pierre Blanchard, Design Engineer - Grenoble, France Mr. Christian Raymond, Qualification Manager - Grenoble, France Mr. Pierre Miguet, Technical Quality Assurance Manager - Grenoble, France Mr. Charles Yufera, Coordination Manager - Moirans, France Mr. Eric Bettega, Design Engineer - Grenoble, France Mr. Daniel Duc, International Marketing Manager - Grenoble, France Mr. Alan Kuntz, Applications Engineer - Cedar Rapids, IA, USA Mr. Gregg Weiss, Design Engineer - Cedar Rapids, IA, USA Audit Performance: The following activities were performed during this audit.

Interviews with engineering personnel, reviews of testing documents, and analysis of the Micrologic trip unit design documents at Square D's engineering and test facilities in Cedar Rapids, IA. Interviews with the Micrologic trip unit design team and quality assurance representatives, inspection of test facilities, verification of measurement and test equipment calibration, reviews of trip unit design methodology, development documentation, control and testing requirements, and analysis of test results and documentation at Schneider Electric's design and testing facilities in Grenoble, France. Interviews with production and quality control personnel, inspection of trip unit production, testing, and packaging operations, and analysis of assemble methods, test equipment certification, and test reports at Schneider Electric's Micrologic production facilities in Montmelian, France. This is the only facility in the world that assembles the Micrologic trip unit. Interviews with production and quality control personnel, inspection of circuit breaker production, testing, and packaging operations, analysis of receipt, in-process and post-production inspection and test methods, test equipment certification, and documentation of test results at Schneider Electric's Masterpact production facilities in Moirans, France. This is the only facility in the world that assembles the complete Masterpact circuit breaker and its modular components. Summary of Results: Schneider Electric's and Square D's documented and implemented quality assurance programs for development, testing, and manufacturing control of software and hardware complies with NLI QA program requirements. NOTE: See attached REPORT DATA for additional information. Required Actions: None. SVR-042181-01, Revision 1 Page 1 of 21

REPORT DATA A. Background The Masterpact circuit breaker and Micrologic trip unit design and manufacture are controlled by Schneider Electric and are marketed and supported by four of Schneider Electric's Strategic Business Units - Merlin Gerin, Modicon, Square D, and Telemecanique. The Masterpact circuit breaker and Micrologic trip unit design control and IEC performance testing are performed at Schneider Electric's design and testing facilities in Grenoble, France. Additional testing of the circuit breaker and trip unit was performed at Square D's engineering and test facilities in Cedar Rapids, Iowa. The Masterpact circuit breaker assemblies and components are manufactured and tested at Schneider production and test facilities in Moirans, France. The Micrologic trip units are manufactured and tested at Schneider Electric's production facilities in Montmelian, France. Masterpact circuit breaker IEEE testing and Micrologic trip unit protection function beta testing was performed by Square D's Cedar Rapids, Iowa facility. The NW and NT series circuit breakers are assembled in the United States using the modular components manufactured in Moirans, France. The NW series breakers are assembled in Columbia, South Carolina and the NT series breakers are assembled in Cedar Rapids, Iowa. Final fabrication of the Masterpact circuit breaker in the configurations provided by NLI is performed by Square D Services in West Chester, Ohio. B. Trip Unit Overview The Micrologic trip units provide user selectable tripping functions on electronic trip circuit breakers. There are four trip unit versions. All use the identical protection circuitry and programming. The versions are:

   " Models 3.0 and 5.0 provide user configurable basic circuit protection: long-time, instantaneous and optional short-time adjustments with no metering or communications functions.
   " Models 3.OA, 5.OA, and 6.OA provide user configurable basic circuit protection plus integrated ammeter and phase loading bar graph metering functions, LED trip indication, zone selective interlocking, optional ground-fault protection, and MODBUS communications.

• Models 5.OP and 6.OP provide user configurable basic circuit protection and "A-Model" features plus advanced relay protection, inverse definite minimum time lag (IdmtL) long-time delay, ground-fault alarm and MODBUS communications.
• Models 5.OH and 6.0H provide user configurable basic circuit protection and "P-Model" features plus enhanced monitoring and metering, power quality measurements, and waveform capture.

The Micrologic trip unit architecture is divided into two distinct substructures or circuits. The Application Specific Integrated Circuit, ASIC, provides core protection functions using both digital and analog circuitry. The digital portion of the ASIC supports user selectable safety-related circuit breaker protection functions. The analog portion provides over temperature (trip unit) and instantaneous high current protection. Non-safety related activities, including metering, trip indication, and ASIC failure indication, are accomplished with HC 11-series or HC 16-series (depending on the trip unit model selected) microprocessor controlled circuitry. The non-safety circuitry is coupled to the ASIC through a serial interface (SIF) data line only. The ASIC has no interface with the non-safety related microprocessor other than providing information for the metering and indicator functions. The ASIC will perform all safety-related protection functions with the non-safety related microprocessor removed from the trip unit. This is evident because the most basic of the Micrologic trip units, the 3.0 and 5.0, perform all of the core protection SVR-042181-01, Revision 1 Page 2 of 21

I functions without any on-board microprocessor or metering and indicator functions. The following is a block diagram of a typical trip unit that has metering and/or indicator functions and communications capabilities:

            ----- SAFETY RELATED ----                  ---------------------- NON-SAFETY RELATED ----------------

Line V Itage 24 Nonsafety-

                                                                            <            a ASIC                        Features
                                                                           ~Meters/

oll Indicators

                                              ..          Decoupling       Communication e digital portion of the ASIC is a hard-coded, deterministic, continuous loop over-current protection device. The design is simplistic in nature and has been designed for high reliability. The ASIC contains two ROM devices - MCROM 32-bit and THROM 16-bit. The MCROM is a masked program device that controls the sequence of activity of the digital portion of the ASIC and provides instructions for the arithmetic manipulation of measured current data and user selected protection variables. The THROM is also a masked program device that provides the constants and threshold information that are used during the comparison of the measured current data to the user selected tripping criteria.

Decisions are made by hard-logic methodology. No conditional instructions, jumps, calls, of interrupt functions are used. There are no watchdog functions or conditional branching in the ASIC. User selectable trip functions are chosen by rotary switch position selection. The number of rotary switches found on a Micrologic trip unit is model specific. For example, the Model 3.0 series has three rotary switches to select: long-time pick up (Ir); long-time delay (t,); and instantaneous pickup (I1). The Model 6.0 series has seven rotary switches to select: long-time pick up (Ir); long-time delay (tr); short-time pick up (Isd); short-time delay (T*d); instantaneous pickup (Ii); ground-fault pick up (Ig); and ground-fault delay (tg). The rotary switch position configures it's portion of the hard-wired decision logic by means of and-or gates. Regardless of model, each rotary switch has it's own and-or gate matrix. Each matrix is independent but all are contained in the same silicon device. Even though each and-or gate is logically independent, there are some dependent relationships; those relationships are: long-time pick up (Ir) and long-time delay (tr); short-time pick up (Isd) and short-time delay (T~d); and ground-fault pick up (Ig); and ground-fault delay (tg). C. ASIC Design Overview SVR-042181-01, Revision 1 Page 3 of 21

An ASIC device is a custom purpose integrated circuit that may be purely digital or a hybrid digital and analog design. The design process is typically performed using custom tool sets, which are provided by the manufacturer or a tool design house. As such, the majority ASIC design projects are managed as mechanical rather than software projects. The design tools support a data flow, storage, instruction sequencing, and hard-logic decision architecture. Simulation, through the use of the tool set, is the preferred medium of ASIC designers. After the prototype design is complete, it exported via the tool set to an ASIC manufacturer where the manufacturing design is realized in the form of completed hardware. The digital portion of the ASIC in the Micrologic trip unit uses a 32-bit microprocessor that uses Reduced Instruction Set Computer (RISC) architecture. The processor design is optimized to sequence the activities in the performance of the trip unit's protection functions. The instructions to the processor are 32-bit microcode contained in a ROM. Start-up occurs 384 microseconds after the trip unit in powered. A complete protection cycle occurs every 544 microseconds. The following is a diagram illustrates the ASIC design: Counter MCROM__ SI: 0-1F 16 times Addr[8:0] RCTR S2: 20-5F 4 times RAM '-AD P: 100-1FF forever LDCTR

                                                               - ADD DATA[31"0]               - INPUTSE                           U                C U          MULTCTRL       ,ULTREG
                                                               -   MULTCTR               __

SHIFTCTR __ SVR-042 181-01, Revision 1 Warn GF Alarm TRIP Page 4 of 21

CRITICAL ACCEPTANCE RESULTS CHARACTERISTIC CRITERIA Quality Assurance Program Quality Assurance The software and Software and hardware design, manufacturing and testing for the trip units are controlled by a documented quality program that hardware were assurance programs. The design, verification, configuration control, manufacturing, and post-production testing of controlled the developed, the Masterpact circuit breaker and the Micrologic trip units are controlled by the Schneider Electric quality system. development of the manufactured, Independent Quality Assurance organizations at the Grenoble, GrenobleISO 9001-2000 ISO Certificationfor software/hardware. and tested under Design and Testing, Moirans, Moirans ISO 9001-2001 and ISO 14001-1996 Certificates,and Montmelian, the controls of Montmelian ISO 9001-2001 and JSO14001 -1996 Certificates,France facilities provide oversight over the the Schneider design, manufacturing and testing activities. Electric and Square D Quality A documented quality assurance program controls design testing performed at the Square D facility in Cedar Assurance Rapids, Iowa. An independent Quality Assurance organization provides oversight of testing activities. programs. Verified by inspection, document review, and personnel interview during this audit. SATISFACTORY. QA program Standards cited in Schneider Electric's Grenoble, Moirans, and Montmelian facilities documented QA programs MQ MDE-E Rev. A compliance QA Program Group Schneider QA Manual,PAQ 00 H 01 1 AFI Moirans QA Manual, and Montmelian QA Manual, manual and Revision B cite the ISO 9001-2000 and ISO 14001 standards as the guideline for determining quality system implementing requirements. Where applicable software design and development microcode design and development activities procedures comply with the requirements of IEC 1131-2-1992, IEC- 1131-3-1992, and IEC 1131-4-1995. Where applicable, correlate with development and final product testing activities of the integrated trip unit and circuit breaker suite comply with the design, requirements of IEC 60947-1, IEC 60947-2, NF EN 60947-1, and NF EN 60947-2. manufacture, and testing of the The documented QA program at Square D's Testing Division in Cedar Rapids, Iowa documented QA program cite Masterpact the ISO 9001-2000 standard as the guideline for determining quality system requirements. Where applicable, circuit breaker product testing activities of the integrated trip unit and circuit breaker suite comply with the requirements of UL and Micrologic 1066, ANSI C37.50, and C37.13. trip units. Both Schneider Electric's and Square D's M&TE maintenance and calibration program documents cite ISO 10012-1 as the guideline for determining quality system requirements. Verified by inspection, document review, and personnel interview during this audit. SATISFACTORY. SVR-042181-01, Revision 1 Page 5 of 21

QA Program Hierarchy of QA Both Schneider Electric's and Square D's quality systems are controlled by hierarchical documentation matrices. documentation Program Quality program commitments are documented in published QA Program manuals. Quality program implementing implementing procedures are typically grouped by discipline of organizational function such as design, manufacture, inspection documentation and test, material control, purchasing, quality control, and quality assurance. Product or task specific instructions identifies design, provide specific requirements for work accomplishment - Group Schneider Index ofActivity andProcess manufacture, and Instructionsand Procedures. testing requirements Verified by inspection, document review, and personnel interview during this audit. SATISFACTORY. Subtier supplier Acceptance Schneider Electric's subtier suppliers are approved on the basis of audits, historical performance, and periodic controls methodology testing. These activities are procedurally controlled and are performed at the Schneider Electric Grenoble facility. complies with ISO 2001-2000 Schneider Electric uses two primary subtier suppliers to support development and manufacture of the Micrologic requirements. trip unit. Alcatel, now AMI Semiconductor http://www.amis.com - (AMIS), wrote the ASIC implementing specification, constructed the prototype test versions of the ASIC, and now manufacturers the ASIC semiconductor device, which includes masking the code for the MCROM and THROM devices. AMIS provides the completed, tested silicon devices to Solectron Corporation http://www.solectron.com, where the Micrologic printed circuit boards were designed, constructed for prototype testing, and are now manufactured. Solectron Corporation provides the completed, tested printed circuit board assemblies to Schneider Electric's assembly plant in Montmelian, France where the Micrologic trip units are fully assembled and tested. AMI Semiconductor, AMI Semiconductor Background,Products,and QA, and Solectron, Solectron CorporationBackground,Products, and QA, are both have ISO 9001-2000 compliant quality assurance programs and are certified suppliers of Schneider Electric. Products provided by certified suppliers are accepted on the basis of Certificates of Test and Conformance provided with the item, batch, or lot. Verified by inspection, document review, and personnel interview during this audit. SATISFACTORY. SVR-042181-01, Revision 1 Page 6 of 21

CRITICAL ACCEPTANCE RESULTS CHARACTERISTIC CRITERIA Software Lifecycle Microcode design development, testing, maintenance, and retirement activities comply with the intent of a software lifecycle management scheme as describe in IEEE Standard 1074-1995. Verified by procedure reviews, digital file inspections, personnel interviews, and test documentation reviews during this audit. SATISFACTORY. Software Software The basis of the design of the ASIC is based on the previous generation of the Masterpact ASIC design (NSF and specification/software specification NSJ series circuit breakers), whose core protection functions were accomplished through the use of 350 requirements. documents the components. The present ASIC design performs the same core protection functions using 53 components. All of detailed software the microcode for the present ASIC digital protection design is new, though the function of the trip unit is requirements. conceptually very similar to the previous design. The current revisions of the design specification documents are located at Square D in Cedar Rapids, Iowa. These documents are: Group Schneider, "Specification of the ASIC PROANAA", a 195-page document and Alcatel Mietec, "Specification of the User Specific IntegratedCircuitPROA ", a 50-page document. The Group Schneider specification fully documents both the hardware and software requirements for the ASIC. The requirements for the digital portion of the ASIC include, but not limited to: the methodology for measuring and converting voltage and current levels; the sequencing of calculations; microprocessor properties; and the sequencing of the start-up and run routines. Alcatel Mietec, a division of AMI Semiconductor, is the designer, developer, and manufacturer of the ASIC silicon-based microcircuit chip. Alcatel Mietec developed the ASIC manufacturing specification based upon the Schneider Group's ASIC design specification. The most recent version of the Alcatel specification is revision 2.7 dated 1/5/1999. Verified by specification document review, and personnel interviews during this audit. SATISFACTORY. Procedural controls Software Schneider Electric designers chose to manage the digital design and microcode development and testing as a used during software development hardware project, which is consistent with the design and validation toolsets provided by ASIC manufacturing development. controlled by houses such as AMI Semiconductor (AMIS). Micrologic design team management and quality assurance activities Schneider comply with the intent, where applicable, of the following IEC documents: 1131-1-1992; 1131-2-1992; 1131 procedures. 1992; and 1131-4-1995 for micro-controllers, which roughly correlate to the requirements of IEEE Standards 830-Document the 93, 603-91, 828-90, 1042-87, 1008-87, and 1042-87. The titles and content follow European format and in some procedures used cases requirements are combined in a single document. and evaluate process. Activities at the Schneider Group design and development facility are controlled by documented procedures and implementation forms. The control and revision of theses procedures is in Grenoble, France. The upper-tier implementing procedures include: Procedure07, Rev. D, Requirements Definition;Procedure09, Rev. C, SVR-042181-01, Revision 1 Page 7 of 21

SubcontractingDesign Requirements, Procedure13, Rev. D, Validation of Technical or Design Requirements, Form PRC 703-1c, ProjectStartup and ProgressTracking, Procedure PAEL-GO1, Software Quality Assurance, ProcedurePCO-09, Rev. G, Qualification of Productsand Systems; ProcedurePCO-19,Rev. D, Storage and Distributionof Quality Documents. Available documents, interviews with the Schneider Electric design team in France, and the demonstrated quality of the deployed trip unit product (no microcode revisions since product rollout) reflect that the Schneider Group design and development activities were accomplished by a professional engineering staff extremely familiar with trip unit design and comfortable in implementing a structured, rigorous approach toward project management within the constraints of the complexity of the overall project. SATISFACTORY. Failure Modes & Failure Modes & The Schneider Electric design team in Grenoble developed a FEMA analysis, 5100513140-B 6/28/01 Failure Effects Analysis Effects Analysis Modes and Effects Analysis PROXIMA release ELA version, during the initial stages of the writing of the performed and "Specification of the ASIC PROANAA ". The FEMA analysis was refined upon receipt of the Alcatel used during "Specification of the User Specific IntegratedCircuitPROA". The completed study contains: software " An external functional analysis methodology showing the ties between the studied item and its environment development. in order to determine a failure relationship. The methodology used is M.I.S.M.E (Method of Systematic Inventory of the Surrounding Environment). Note: This technique was used as part of the functional and safety requirements analysis performed by the European Organization for Nuclear Research for the CERN Safety Alarm Monitoring System.

• An internal functional analysis by functional block diagram in accordance with MIL-HDBK-217F.

                                      " A dysfunctional analysis showing the consequences of a failure on the operability of the trip unit.

• A quantification of the rate of global failure of the ELA (x.OA trip units) devices using compilations of reliability data for two temperatures 40 and 100°C in both stationary and mobile applications.

                                      " An AMDEC quantified for a temperature of 40'C in a stationary environment "Note: AMDEC is a technique used for the development of products and processes in order to reduce the risk of failures and to document the actions undertaken. It is part of the QS 9000 'whole quality system' methodology.
                                      " The study concludes that the occurrence of an ASIC failure is 3.11 E-6 h-I @ 40'C and 5.67 E-6 h-I @

100 0C. There are two creditable failure modes that impact ASIC operation:

• Loss of clock (gate pulse), which results in a loss of the ASIC's digital protection functions.
• Loss of power, which results in a loss of all ASIC protection functions.

Neither failure affects circuit breaker operation. If the circuit breaker contacts are closed when a trip unit (ASIC) failure occurs, the contacts will remain closed. When the digital portion of the ASIC's protection functions are lost, all user selectable protection functions are lost; however, protection functions are retained for detected high temperature condition and detected current in excess of the circuit breaker's interrupt rating. SVR-042181-01, Revision 1 Page 8 of 21

When all ASIC protection functions are lost, no protection functions are retained. This condition is consistent with all electronic trip device designs - analog or digital. Verified by FEMA analysis review and personnel interviews during this audit. SATISFACTORY. Development and Schneider The Micrologic trip unit was designed by the Schneider Group design team located in Grenoble, France using tool testing approach. developed and sets from Cadence Design Systems http://www.cadence.com CadenceDesign Systems Backgroundand Products. tested the The design and development process occurred during 1994-1998. A Schneider Group strategic business unit - software in small Square D, performed beta testing of the ASIC design. Flow charts that are contained in the extracts of function based "Specification of the ASIC PROANAA" depict the design, development, and verification processes. blocks of code. Development and Code was written in functional blocks or modules, 60069-001, Rev. A Mixed Signal ASIC ProgrammingManual, as testing documented in specifications "Specification of the ASIC PROANAA" and "Specification of the User Specific documented. IntegratedCircuitPROA". Development and testing activities included: simulations, fourier analysis, reliability analysis, software testing, hardware testing, and software-hardware integration testing. ASIC design requirements were documented using Verilog simulation toolsets specifically designed by Cadence, Cadence - System Design and Verification Overview, and AMIS, AMIS ASIC Design Brochure, for ASIC applications. Data flow was written in a modular, overlay fashion. Design notes are included with the data flow to allow review by a cognizant peer. Design requirements are safeguarded with a tool similar to source safe, which date stamps the file each time that it is saved/closed. Review of available documents, interviews performed during the audit, and electronic files inspected at the Schneider Group design and development facility reflect a structured, rigorous approach toward requirements definition, revision control of project related documents, development of test plans, and documentation of developmental testing results. SATISFACTORY. Independence of Independent During the design and development phase, the ASIC design requirements were documented using Verilog design software development personnel used. and simulation toolsets specifically designed by Cadence for ASIC applications and in hardcopy design and testing. specifications. These activities were procedurally controlled. The threshold and constant data contained in the THROM was developed in Grenoble, France using a "C" language program that generated theoretically ideal data, which was documented on a Microsoft Excel spreadsheet. Testing in Cedar Rapids, IA validated the THROM data. Correction of the code was performed in Grenoble, France and implemented through a THROM revision. The MCROM machine level code requirements were written in Grenoble, France. The requirements were realized in the silicon microcircuit fabricated by Alcatel, now AMI Semiconductor (AMIS). Black box (input/output) testing only was performed during development due to the simplistic nature of the ASIC architecture. The trip unit was tested by Square D in Cedar Rapids, IA, A48155 Square D Report - ASIC Verification Testing During Development (Extract), to verify that the deterministic instruction loop correctly sequenced the THROM data and the user input digital words. This iterative process SVR-042181-01, Revision 1 Page 9 of 21

continued until the design requirements were met. Available documents, completed interviews, and inspection of the completed tool set electronic files during this audit demonstrate that the Schneider Group design and development activities were accomplished by a professional engineering staff extremely familiar with trip unit design and comfortable in implementing a structured, rigorous approach toward project management within the constraints of the complexity of the overall project. SATISFACTORY. Integrated Integrated testing During prototyping, the designer performed simulations. Integration testing was performed by second party or peer hardware/software of the hardware/ reviewers. This approach is consistent with the intent of IEEE Standards 1008-1987 and 829-1983. testing. software system was performed. During product development, the integrated circuit breaker and trip unit suite was tested to verify conformance to the design requirements and the IEC standards at the Schneider Electric test facility located in Grenoble, France. These tests included, but were not limited to: Test Report PROELA 0020, Validation ofMicrologic 5. OA Current Measurements wi NW08; Test Report PROELA0024, Micrologic 2. OA, 3. OA, 5. OA, and 6.OA 1000 Hour Temperature Cycle Test; Test Report PROELA0030, Complete Summary of Micrologic Trip Unit Testing JEC Qualification Testing. Additional testing was performed at the Square D facility to verify conformance to the design requirements and the IEEE standards The final versions of the masked program device code (located in the MCROM) and the constants and thresholds (located in the THROM) were finalized based on testing, which was performed and documented in accordance with controlled procedures and plans. Report of these activities include, but are no limited to: K11-314a-00, Record of ProvingTest Micrologic 5.OA w/ NW08 HI; K11-314b-00, Record ofProving Test Micrologic 7. OA w/NW08 HI; and KlJ-527-00, Record of Proving Test Micrologic 5.OA w/NW40 BH1. After product rollout, Schneider Electric continues to test the integrated circuit breaker and trip unit suites in thee test facility located in Grenoble, France in order to verify product consistency. Certification of these tests included, but were not limited to: 151aO1, IEC Certificateof Conformity Micrologic Trip Unit 2.0-7.OH w/ MasterpactNW and NT and 411_00, IEC Certificate of Conformity Micrologic 5. OA Emissions Test EEC 945 1996-11. Verified by inspection, witnessing of testing, review of test documentation, and personnel interview during this audit. SATISFACTORY. SVR-042181-01, Revision 1 Page 10 of 21

Product operating Installed units There has been no revision of either the THROM or MCROM microcode or the ASIC hardware product rollout in history. operating 1998. Over 50,000 trip units deployed worldwide, 16,000-17,000 units deployed in the USA. They have been properly. Specify shipping the same microcode versions since product rollout. number of operating units, Verified by document review, personnel interview, and electronic file review during this audit. time in service, SATISFACTORY. and number and types of identified problems. Error handling. 1. Code errors Since production release, there have been no microcode updates preformed. Presently, no microcode revision is are identified, planned. Should a product enhancement be made to add additional capability, the THROM constants and documented, thresholds may be changed, but no MCROM microcode revisions would be considered necessary. With any evaluated, microcode revision, full configuration control measures would be taken. Testing would include regression testing, and reported as applicable, during the integration phase. in a controlled A mechanism is established for customer reported errors to be processed and resolved in the USA through the manner by Square D customer service program, which receives updates from the world wide Schneider Electronics network. Schneider. Upon receipt, a customer complaint is documented in a worldwide product quality database. Locally developed

2. Mechanism decisions are reviewed and validated at Schneider Electric corporate design and quality assurance. Solutions outside for reporting of local capabilities are submitted to Schneider Electric corporate for resolution. Once a solution is implemented and and verified, the defect and its resolution are made available to all Schneider Electric SBU service centers for evaluating distribution.

user reported problems. Verified by procedure reviews, personnel interviews, and electronic file reviews during this audit. SATISFACTORY. Software updates and Schneider has a Management, resolution, and communication of customer reported defects, hardware upgrades, and software service bulletins. formal process to revisions are controlled in accordance with Schneider Electric procedures: Procedure15, Rev. E, Managing alert customers Customer Complaints;Procedure 16, Rev. C, Managing Equipment Returns, Procedure17, Rev. D, concerning Communication of ProductDefects; and Procedure18, Rev. A, Corrective and PreventativeActions software updates and provides Verified by procedure reviews, personnel interviews, and electronic file reviews during this audit. service bulletins. SATISFACTORY. SVR-042181-01, Revision 1 Page 11 of 21

CRITICAL ACCEPTANCE RESULTS CHARACTERISTIC CRITERIA Configuration Control Revision control. Revision control Configuration management, both revision control and revision verification, is accomplished using the VERILOG used on silicon tool set. Configuration management requirements are documented in Schneider Electric controlled procedures. The devices. configuration management activities comply, as applicable, with the intent of IEC 1131-1-1992, IEC 1131-4-1995, and IEEE Std. 1042-1987. Each revision has a unique identifier and is traceable to the design documents. After product rollout engineering oversight was transferred to sustaining/ product improvement organization. This transfer of responsibility was accomplished in accordance with ProcedurePCO-11, Rev. E, Transfer of Technical Management after ProductRelease. Activities after product release are performed in accordance with Procedure PCO-]0, Rev. E, ProjectActivities after ProductRelease. To date, there have been no revisions of the MCROM or THROM microcode. The requirements for both the MCROM and THROM microcode is contained in "Specification of the User Specific IntegratedCircuitPROA," Revision 2.7, dated 1/5/99. Should microcode revisions be required in the future due to product enhancement or problems identified in the field, the development, testing, and deployment will be controlled by the same procedures and written with the same tool sets as the original release version. Verified by procedure and specification reviews and personnel interviews during this audit. SATISFACTORY. Manufacturing Controls to Schneider Electric's manufacturing configuration control is a composite of vendor and purchasing control, controls of code. assure correct production planning, material control, manufacturing control, and quality control. code installed on The requirements for procurement are identified in ProcedurePCO-03, Rev. B, PurchasingofInventory each unit. Items. Items are purchased from two levels of approved suppliers. Certified supplier's products are accepted without additional testing based upon a defined grading system. Products from uncertified Traceability suppliers are subject to acceptance testing, which are performed in accordance with documented plans. between Incoming certified products are differentiated from non-certified products by a two-alpha prefix on the development and item's part number. A Certificate of Test or Certificate of Conformance from the supplier accompanies production code each certified product shipment. is documented. Implementation was verified by inspection, procedure reviews, and personnel interviews at Schneider Group's assembly plant in Moutmelian, France. SATISFACTORY.

• Production planning is accomplished in accordance with the following procedures: Form PRC 703-1c, Design Review and ProductionStartup, ProcedurePCO-18,Rev. C, ProductionPlanning,Procedure PCO-19,Rev. D, Modification ofProductionPlans, and ProcedurePCO-I7, Rev. C, Distribution Modification of the ProductionPlan. Specific requirements for material, manufacturing, and quality control SVR-042181-01, Revision 1 Page 12 of 21

are also identified in controlled documents at Schneider Group's assembly plant in Montmelian, France. Implementation was verified by inspection, procedure reviews, and personnel interviews at Schneider Group's assembly plant in Montmelian, France. SATISFACTORY.

• Implementation of vendor and purchasing control, production planning, material control, manufacturing control, and quality control practices are accomplished by document review, inspection, and interview of cognizant manufacturing and quality personnel at Schneider Group's assembly plant in Montmelian, France.

The result of these evaluation activities reflect a well trained and motivated workforce whose activities reflect compliance with documented requirements, excellent material and manufacturing work practices, and an active culture of quality improvement. SATISFACTORY.

• Automated testing of the completed trip unit assembly verifies the correct hardware and software configuration of the assembly, Test Report 205490, Micrologic Trip Unit SN 205490 Factory Post-Assembly Test Results. Automated testing is performed in accordance with Schneider Electric document PR CDC 4230T, Rev. T, Planfor the FourFunction Testers PROXIMA, Revision T. The automated testing is performed using software controlled M&TE, Micrologic Trip Unit FinalAcceptance Tester M&TE CalibrationCertificates.The verification and validation activities for the testing software is documented in Schneider Electric document R FORVEIL, 2/5/03, Qualificationof the FourFunction Testers PROXIMA4.

The qualification testing included regression and black box testing. Verified by specification document reviews and personnel interviews during this audit. SATISFACTORY. Regression testing or Regression Regression testing is not applicable to this product due the small amount of code written. The THROM contains all evaluations, testing or thresholds and constants for the calculation of the trip unit protection values. The THROM contains 4 Kbytes of evaluations 16-bit digital words. The MCROM contains the microcode which sequence, the digital portion of the ASIC's performed when execution of the overload protection activities. The MCROM contains 2 Kbytes of 32-bit machine language code. code is revised. Should microcode revisions be required in the future due to product enhancement or problems identified in the field, the testing will be controlled by the same procedures and written with the same tool sets as the original release version. Micrologic trip unit developmental, functional, qualification, and manufacturing testing is performed in accordance with written plans that identify acceptance criteria, using calibrated Measurement and Testing Equipment, and the results are documented in written reports. The following testing information has been reviewed: Test Report PROELA 0020, Validation of Micrologic 5. OA Current Measurements; Test Report PROELA0024, Aging Tests Applicable to Micrologic 2.0A, 3.0A, 5.OA, and

6. OA; Test Report A48155, ASIC Developmental Testing, Test Report 205490, Micrologic 5. OA Post Production Testing, Test Report-- EMC per ANSI/IEEE C37.90, Test Report - Multiple Power CircuitBreaker Framesper UL 1066, ANSI C37.50 and C37.13, EMCper IEC 6094 7-2 Annex F.

Verified by test report reviews, project document inspection, and personnel interviews during this audit. SATISFACTORY. SVR-042181-01, Revision 1 Page 13 of 21

CRITICAL ACCEPTANCE RESULTS CHARACTERISTIC CRITERIA Software/Hardware Data storage. Per Schneider Data storage in the ASIC is in the form of digital words that are stored in dedicated addresses within a 256x32 design RAM in the ASIC. specifications. Verified by specification document reviews and personnel interviews during this audit. SATISFACTORY. Signal conditioning Per Schneider Signal conditioning in the ASIC is limited to analog to digital conversion of AC voltage and current values. Analog and logic functions design voltage values are determined by the use of a fixed value resistance bridge located in the ASIC. Analog current specifications. values are determined from current transformers. The analog values are converted to digital words by a silicon-based A to D converter. Logic functions in the ASIC are limited to hard-wired decisions on the form of and-or gates. There are 6583 and-or gates in the ASIC. Verified by specification document reviews, printed circuit board inspections, and personnel interviews during this audit. SATISFACTORY. System response time. Per Schneider A complete protection cycle occurs every 544 microseconds. Poles are evaluated in the sequence: 0, A, B, C. The design cycle for each pole is 128 microseconds. The decision to trip, or not is made during the final 32 microseconds. specifications. The response time from input to output with change of state:

                                            " Digital: 544 microseconds + user selected trip delay time + 20 milliseconds.

• Analog: 1 microsecond + 20 milliseconds.

Verified by specification document review and personnel interviews during this audit. SATISFACTORY. Remote alarms and The There is one failure alarm, Ap, which is a LED display on the trip unit itself. The trip unit designers consider this indications. communication display as a non-critical for information only output. The circuit breaker will not open if the ASIC fails. This is a features are not deliberate design consideration that provides the operator an opportunity to make the decision as to the considered safety appropriateness of interrupting power by opening the circuit breaker. The failure alarm light is activated through a related and will hard-logic decision matrix, which creates a digital word that is read by the non-safety related microcontroller. The not be connected non-safety related microcontroller subsequently activates the Ap LED in accordance with its programmed in the plant. instructions. Local indication There are no safety-related digital communications outside of the ASIC associated with the Micrologic trip unit's is considered performance of its trip functions. The status of the circuit breaker's contacts (OPEN or CLOSED) is communicated non-safety by an analog signal sent via auxiliary switch contacts on the circuit breaker itself. These are electrically and SVR-042181-01, Revision 1 Page 14 of 21

related. physically independent of the trip unit. There are no safety-related input or output displays or alarms. The Ir trip indicator LED, Isd/Ii trip indicator LED, and Ap self-protection indicator LED are considered by the trip unit designers as non-critical, for information only outputs. Verified by specification document reviews, witness of trip unit post-production testing, and personnel interviews during this audit. SATISFACTORY. Watchdog timer. Per Schneider There are no hardware or software watchdog timers in the digital portion of the ASIC, Schneider Electric Response design. to NLI Questions. Verified by specification document reviews and personnel interviews during this audit. SATISFACTORY. Timing and clock Per Schneider A 2.0 MHz clock drives the ASIC microprocessor. A crystal oscillator controls the clock frequency. The sequence control. design. of events performed by the microprocessor is dictated by the masked code set located in the MCROM. A complete protection cycle occurs every 544 microseconds. Poles are evaluated in the sequence: 0, A, B, C. The cycle for each pole is 128 microseconds. The decision to trip, or not is made during the final 32 microseconds. Verified by specification document reviews and personnel interviews during this audit. SATISFACTORY. Output Alarms Per Schneider There is one failure alarm, Ap, which is a LED display on the trip unit itself. The trip unit designers consider this design. display as a non-critical for information only output. The circuit breaker will not open if the ASIC fails. This is a deliberate design consideration that provides the operator an opportunity to make the decision as to the appropriateness of interrupting power by opening the circuit breaker. The failure alarm light is activated through a hard-logic decision matrix, which creates a digital word that is read by the non-safety related microcontroller. The microcontroller subsequently activates the Ap LED in accordance with its programmed instructions. Verified by specification document review, trip unit developmental test path note inspection, and personnel interviews during this audit. SATISFACTORY. Features that could There are no No conditional instructions, jumps, branching, calls, of interrupt functions are used in the ASIC's impact operation. features that microcode instruction set, Schneider Electric Response to NLI Questions. could interrupt operation There is no non-essential or unused code in the ASIC's microcode instruction set, Schneider ElectricResponse (interruptions, to NLI Questions. diagnostics, manual inputs, There is no provision in the Micrologic trip unit design for manual inputs or data modification. non-essential application Verified by specification document reviews, FEMA analysis inspection, and personnel interview during this programs, audit. SATISFACTORY. SVR-042181-01, Revision 1 Page 15 of 21

unauthorized Testing may be performed using a full function test kit by injecting a test current directly into the trip unit through a programs or data receptacle on the trip unit. This testing may be performed when the circuit breaker contacts are open or closed. modifications). However, the circuit breaker contacts should not be passing current because the test kit secondary current inputs override the current measurement activity of the ASIC, 48049-183-01 06/01, K669 Full Function Test Kit. The Micrologic trip unit cannot be replaced when the circuit breaker is closed. The trip unit's long-time rating plug may be replaced when the circuit breaker is closed. NOTE: If the long-time rating plug is removed when the circuit breaker is closed, the overload protection defaults to 40% of the circuit breaker's rating. The time delay remains at user selected levels, 48049-183-01 06/01, K669 Full Function Test Kit. Verified by user manual reviews and personnel interview during this audit. SATISFACTORY. Security The base There is no provision or capability to modify, revise, or alter the microcode information contained in the ASIC. program is on the The ASIC contains two ROM devices - MCROM 32-bit and THROM 16-bit. The MCROM is a masked ASIC chip and program device that controls the sequence of activity of the digital portion of the ASIC and provides cannot be field instructions for the arithmetic manipulation of measured current data and user selected protection modified. variables. The THROM is also a masked program device that provides the constants and threshold information that are used during the comparison of the measured current data to the user selected tripping criteria, Schneider Electric Response to NLI Questions. Verified by specification document reviews and personnel interviews during this audit. SATISFACTORY. Year 2000 compliance. Units recognize The ASIC does not use or output information that contains day, date, year, or time data, Schneider Electric dates beyond Response to NLI Questions. 12/31/99 correctly. Verified by specification document reviews and personnel interviews during this audit. SATISFACTORY. Processor restart and Following The ASIC startup or restart sequence completes 384 microseconds after the trip unit in powered. The trip unit is initialization. removal of powered when the circuit breaker contacts are closed. If power to the circuit breaker contacts is lost, the trip unit power, the will not function unless the user has chosen to provide auxiliary power through the external power supply programmer connector. maintains the settings. When power is restored, the MCROM microcode initiates the ASIC digital protection startup routine. The ASIC begins its digital protection activities within 3 milliseconds of power restoration. The analog protection of the ASIC begins its protection activities within 1 microsecond upon the restoration of power. There is no loss of the user configurable L, S, I, G functions because they are restored during the startup or restart process. During the 384 microseconds start sequence the digital words created by the interface of the rotary switch positions and the state of the and-or gates are restored. All other information to perform the safety-related function of the ASIC is contained in the MCROM and THROM. SVR-042181-01, Revision 1 Page 16 of 21

Verified by specification document review, trip unit developmental test path note inspection, and personnel interviews during this audit. SATISFACTORY. Data validity checks The system There is no input range checking provision or data validity checks during operation. During the start sequence contains logic to diagnostics activities are limited to verification that the user configurable L, S, I, G are restored to the appropriate perform checks RAM addresses. During the run sequence the availability of voltage and current data at the appropriate RAM of the validity of addresses is confirmed. intermediate results. Verified by specification document review, trip unit developmental test path note inspection, trip unit post-production test report review, and personnel interviews during this audit. SATISFACTORY. User configurable The user inputs The only user inputs to the ASIC are by rotary switch position selection. Each rotary switch has it's own and-input values are hard wired or gate matrix that creates a digital word, which identifies a selected trip condition characteristic. The switches. design prevents invalid of out of range parameter inputs. Verified by user specification document reviews, user manual reviews, and personnel interview during this audit. SATISFACTORY. Loss of input Trip unit Analog current values are determined from current transformers. By the nature of the design, the detection of instruments responds to loss current is highly reliable; however, if there is a winding-to-winding short in the CT, the trip unit would sense an of CT signal per over-current condition and trip the breaker. An open CT winding would be detected by x.0 H-series model trip Schneider design. units, which would initiate a trip action if the out-of-phase condition detection were selected. NOTE: Due to the inherent ruggedness of CT construction, an open CT winding in not considered a creditable failure mechanism. Verified by specification document review and personnel interviews during this audit. SATISFACTORY. Diagnostics The The digital portion of the ASIC is a hard-coded, deterministic, continuous loop over-current protection programming is device. The design is simplistic in nature and has been designed for high reliability. By design the ASIC deterministic and start up diagnostic is limited verification of the presence of clock pulses, Schneider ElectricResponse to NLJ diagnostics are Questions. limited Verified by specification document review and personnel interviews during this audit. SATISFACTORY. SVR-042181-01, Revision 1 Page 17 of 21

Switch settings The rotary User selectable trip functions are chosen by rotary switch position selection. The number of rotary switches used to switches found on a Micrologic trip unit is model specific. The rotary switch position configures it's set the user portion of the hard-wired decision logic by means of and-or gates. Regardless of model, each rotary configurable trip switch has it's own and-or gate matrix. Each matrix is independent but all are contained in the same points operate per silicon device. Schneider Electric design. Verified by specification document review, Square D developmental test report inspection, trip unit post-production test report review, and personnel interviews during this audit. SATISFACTORY. CRITICAL ACCEPTANCE RESULTS CHARACTERISTIC CRITERIA Programmer specific hardware/software Trip unit operation on Programmer Proper trip unit operation and fit-up on Masterpact NT and NW breakers was verified during IEC and ANSI Masterpact NT and mounts and testing performed by Schneider Electric and Square D, ANSI Certification Test Reports for MasterpactNWO8H1, NW breakers. interfaces NWO8H2, NWO8L1, NWO8N1, NW16H1, NW16H2, NW16L1, NW16N1, NW2OH1, NW2OH2, NW2OL1, NW properly with the NW32H1, NW32H2, NW32L1, NW4OH2, NW4OL1, NW5OH2, and NW5OL1. Masterpact NT and NW Verified by IEC and ANSI test report reviews and personnel interviews during this audit. breakers, SATISFACTORY. including physical mounting, wiring, CT interface, ratings plug interface, and flux shifter interface. Schneider Electric second party contractors and test department personnel in Grenoble, France verified the ratings The ratings plug Programmer + interfaces properly ratings plug plug interface with the trip unit during integration testing. with the trip unit. provide trip settings per the Verified by inspection during this audit. SATISFACTORY. Square D published trip The ratings plug interface with the trip unit was demonstrated during IEC and ANSI testing performed by curves. Schneider Electric and Square D. Verified by test report reviews and personnel interviews during this audit. SATISFACTORY. SVR-042181-01, Revision 1 Page 18 of 21

Trip settings. Verify that the Trip unit trip command compliance with published curves was verified during developmental testing at-Square D trip settings are and during IEC and ANSI testing performed by Schneider Electric and Square D. per the Square D curves. Verified by specification document review, trip unit developmental test path note inspection, IEC and ANSI test report reviews, and personnel interviews during this audit. SATISFACTORY. I function defeat The function is I function defeat operation was verified during integration testing that was performed by Schneider Electric operates properly. defeated. second party contractors and test department personnel in Grenoble, France. I function defeat Verified by specification document review, trip unit developmental test path note inspection, and personnel does not impact interviews during this audit. operation of the active functions. L No spurious tripping. There is no The IEC and ANSI testing of the production units of the Micrologic trip unit and Masterpact NT and NW breaker spurious tripping suites performed by Schneider Electric and Square D did not identify incidents of spurious tripping. Industry outside the active experience has identified incidents of spurious tripping (see section 7.3 of the main body of the V&V report). trip functions and the trip curve. Verified by IEC and ANSI test report reviews and personnel interviews during this audit. SATISFACTORY. Non-safety functions Communications The only interface between the ASIC and the non-safety related functions is the serial communications line. A do not interfere with and display shorted or open serial interface line does not interfere with the ASIC's safety related function as demonstrated by safety related trip functions are FEMA analysis and integration testing that was performed by Schneider Electric second party contractors and test function. non-safety department personnel in Grenoble, France. related. The communication Verified by specification document review, trip unit developmental test path note inspection, FEMA feature will not document review, and personnel interviews during this audit. SATISFACTORY. be connected in the plant. Verify that the communication and display functions will not interfere with the trip function. SVR-042181-01, Revision 1 Page 19 of 21

Breaker position on The breaker will The breaker will remain in the current position upon ASIC failure as demonstrated by FEMA analysis and ASIC failure. remain in the integration testing that was performed by Schneider Electric second party contractors and test department current position personnel in Grenoble, France. upon ASIC failure. Verified by specification document review, trip unit developmental test path note inspection, FEMA document review, and personnel interviews during this audit. SATISFACTORY. Indication on ASIC If the ASIC fails, The ASIC failure LED on the front of the programmer will light upon ASIC failure as demonstrated by FEMA failure. and LED on the analysis and integration testing that was performed by Schneider Electric second party contractors and test front of the department personnel in Grenoble, France. programmer will light. Verified by specification document review, trip unit post-production test report review, and personnel interviews during this audit. SATISFACTORY. Short circuit protection If the ASIC fails, The analog portion of the ASIC provides short circuit when the digital portion of the ASIC fails as demonstrated on ASIC failure. the programmer by FEMA analysis and integration testing that was performed by Schneider Electric second party contractors and will still provide test department personnel in Grenoble, France. short circuit protection. Verified by specification document review, trip unit developmental test path note inspection, and personnel interviews during this audit. SATISFACTORY. Battery function. The battery is not Verified by design review. The battery circuit is completely independent to the ASIC power supply circuit. required for the safety related trip Verified by specification document review, FEMA analysis review, and personnel interviews during this function. audit. SATISFACTORY. Trip unit performance The digital In case of clock (gate) failure, the ASIC stops performing its digital protection functions in accordance with user upon loss of clock protective selected trip parameters and leaves the breaker in the closed position. The Ap indicator LED is lighted to alert (gate pulse) function is lost; operator or maintenance personnel. There is no loss of protection capabilities because the ASIC will continue to analog short trip the circuit breaker when the trip unit (measured by a positive temperature coefficient thermistor) reaches 115-circuit and 125 °C or contact current reaches or exceeds the circuit breaker's instantaneous overload trip interrupt (DIN) thermal trip rating. When the temperature or instantaneous overload trip current threshold is reached, the circuit breaker functions are contacts will open within 20 milliseconds. maintained. Verified by specification document reviews, FEMA analysis inspection, and personnel interview during this audit. SATISFACTORY. SVR-042181-01, Revision 1 Page 20 of 21

Trip unit performance All protective In case of a power supply failure, the ASIC ceases to perform both its digital and analog protection features. The upon loss of ASIC functions are lost. circuit breaker will remain in the closed position and the Ap indicator LED is lighted to alert operator or power supply maintenance personnel. Verified by specification document reviews, FEMA analysis inspection, and personnel interview during this audit. SATISFACTORY. Prepared by:. 01, Q5-3ý Date:2114L Reviewed by:_ _______________Date:_____ Approved by:___ ___ ___ Date: ,2/** *7< NOTE: For 10CFR50 Appendix B verifications, approver must be NLI certified Lead Auditor. SVR-042181-01, Revision 1 Page 21 of 21

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page B. 1 I Attachment B NLI Validation Test Plan VVTP-042181-1 with Test Data

Verification and Validation Test Plan (NLI Validation Test Plan for Microlozic 6.0P Programmer) Verification Plan #VVTP-04218 1-1, Rev. 1

Description:

Digital trip device for Square D Mastepact NT and NW low voltage switchgear breakers Manufacturer / Model: Square D/Schneider Micrologic 6.OP Programmer Safety Function: To maintain low voltage power circuits during normal operation and interrupt circuits during fault conditions. Remote communications, interlocks, remote alarms, and history storage and recall are not safety related functions. Critical Characteristic Sample Acceptance: ____ _ __ _ _ _ _ _ Size . .... ,, Criteria Ref Method Notes:

1. This plan includes FMEA testing.

2. All testing will be performed on a Square D Masterpact NT or NW, unless specified otherwise.

3. Functions

• L =Long time.
• S = Short time.
• I = Instantaneous.
• GG=Ground.

VVTP-042181-1, Rev. I Page I

Verification Plan #VVTP-042181-1, Rev. 1

Description:

' Digital trip device for Square D Mastepact NT and NW low voltage switchgear breakers Manufacturer / Model: Square D/Schneider Micrologic 6.OP-Programmer Safety Function: To maintain low voltage power circuits during normal operation and interrupt circuits during fault conditions. Remote communications, interlocks, remote alarms, and history storage and recall are not safety related functions. Critical Character*istic Sample Acceptance Size . __

      .      .........                        .    .            Criteria C                             Ref                   Method Verification of all trip settings     1    Programmer actuates per the published trip        1, 2  Primary injection testing per the test CC#l                                       curve [1] in all applicable normal and                  sequence in Attachment I.

abnormal configurations. Function defeat switches operate per design. Signal condition and logic functions are per the Schneider design, Programmer is per the Schneider design and published data. There are no trip unit features that could interrupt operation. Programmer operates on I Programmer can be mounted on the 1,2 Primary injection testing per the test Square D Mastepact NT or Masterpact NT or NW and interfaces sequence in Attachment I. NW breaker. properly with the CT's, ratings plug, and CC#1A actuator. Note: Dedication testing of 100% of the shipped trip units will verify Programmer operates per the trip curve [1] proper operation on each specific installed in the Masterpact NT or NW. breaker. CA VVTP-04218 I-1, Rev. 1 Page 2

Verification Plan #VVTP-042181-1, Rev, 1

== Description:== Digital trip device for Square D Mastepact NT and NW low voltage switchgear breakers Manufacturer / Model: Square D/Schneider Micrologic 6.OP Programmer Safety Function: To maintain low voltage power circuits during normal operation and interrupt circuits during fault conditions. Remote communications, interlocks, remote alarms. and historv storaae and recall: are not safety related functions. Critical, Charactei;istic Sample Acceptance

 "____"___ "_.... _____      :: - Size ,

I_____....__ .__

                                ..        ...                 *Criteria                     Ref                     Method.

Programmer operates per 1 Programmer interfaces properly with the 1, 2 Primary injection testing per the test design with ratings plugs. Masterpact ratings plugs. sequence in Attachment I. C(C#1B Programmer operates per the trip curve [1] installed in the Masterpact NT and NW with

       . ....         __ratings                   plugs.

Output alarms are per design. 1 The output alarms that will be operational 1, 2 Primary injection testing per the test CC#1C are the LED's on the front of the trip unit. sequence in Attachment I. The remote alarm and communication features will not be connected in safety related application. Verify that the LED alarms and rest operate per design:

                                         * "alarm": LED on when the trip unit is in an overload condition.

• Trip LED: LED on when the trip unit trips and remains on until reset.

                                         - "test/reset': button resets the trip LED. I VVTP-042181-1, Rev. I Page 3

Verification Plan #VVTP-042181-1, Rev. 1

Description:

Digital trip device for Square D Mastepact NT and NW low voltage 'switchgear breakers Manufacturer / Model: Square D/Schneider Micrologic 6.OP Programmer Safety Function: To maintain low voltage power circuits during normal operation and interrupt circuits during fault conditions. Remote communications - interlocks,

                                                -    - remote
                                                            -   alarms_,----J--~-------------
                                                                ---       and history storage and recall are not safety related functions.  -

Critfical Charlcteristic. Sample . . Acceptance Size. _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ CrtraRef. .Method Remote communications, 1 The remote communications, alarms, and 1, 2 Primary injection testing per the test alarms, and interlocks do not interlock functions will not be connected in sequence in Attachment I. impact trip unit operation. the plant and are not qualified for safety CC#lD' related applications. This testing will verify that the remote communications, alarms, and interlock functions will not impact the safety related protection functions of the trip unit. No spurious tripping. I The trip unit does not spuriously fire. 1, 2 Primary injection testing per the test CC#lE __ sequence in Attachment I. Operation of the reset button. I The reset button resets the trip lights. 1, 2 Primary injection testing per the test CC#1F sequence in Attachment I. The breaker trips per the trip curve with and Test with the programmer reset and without the reset. not reset. Programmer restarts after loss 1 Programmer restarts and operates per design 1, 2 Perform injection primary testing of power, following loss of power.. after the trip unit has been CC#2 unpowered for at least 48 hours. Note: By design, the trip unit and ASIC technology is designed to operate properly Test per the test sequence in after being unpowered for an indefinite Attachment I. Iamount of time. cv (not used) N/a N/a N/a N/a CC#3 VVTP-042181-1, Rev, I Page 4

Verification Plan #VVTP-042181-1. Rev. 1

== Description:== Digital trip device for Square D Mastepact NT and NW low voltage switchgear breakers Manufacturer / Model; Square D/Schneider Micrologic 6.OP Programmer Safety Function: To maintain low voltage power circuits during normal operation and interrupt circuits during fault conditions. Remote communications, interlocks, remote alarms, and history storage and recall are not safety related functions. Critical Charctristic San Acicepta nce Criteria.. Ref MethOd (not used) N/a. N/a N/a N/a CC#4 (not used) N/a N/a N/a N/a CC#5 Programmer operates properly 1 Programmer operates properly with the 1, 2 Perform primary injection testing with battery remove or dead battery removed, with the battery removed and with a battery. dead battery installed. Perform CC#6 Programmer operates properly with a dead testing with the battery installed and battery installed in the trip unit. then removed and then reinstalled. Test per the test sequence in Attachment I. Memory does not impact trip I The trip unit contains memory that records 1,2 Perform primary injection testing of unit operation, breaker history. the breaker after recalling history CC#7 Verify that recalling of history from memory from memory. does not affect the trip unit settings. Verify that the primary injection testing trip times and currents are per the trip curves [1] after history is recalled from memory. Test per the test sequence in Attachment I. VVTP-04218 I-1, Rev. I Page 5

Verification Plan #VVTP-0421 81-1, Rev. 1

== Description:== Digital trip device for Square D Mastepact NT and NW low voltage switchgear breakers Manufacturer / Model: Square D/Schneider Micrologic 6.OP Programmer Safety Function: To maintain low voltage power circuits during normal operation and interrupt circuits during fault conditions. Remote communications, interlocks, remote alarms, and history storage and recall are not safety related functions. Critic*a-lharIth'a e*-tic- Sample AIceptance

i~~i::iA c f isf , :sf.-p e,..  : ? ,, ,, ..

          .. __.__._:"__-._..__._._                                Criiteria                     Ref                   Method Secondary test set does not                I     Testing of the trip unit with the secondary       1, 2 Perform primary injection testing of impact trip unit settings.                       test set overrides the switch settings.                the breaker after the secondary CC#8                                             Verify that the secondary testing does not             injection testing.

permanently change the trip unit settings. Verify that the primary injection testing trip times and currents are per the trip curves [1] after testing with the secondary test set. Test per the test sequence in Attachment I. Function defeat switches 1 The defeat switches for I properly defeats 1, 2 Test per the sequence in Attachment A operate per design this function. IL CC#9 Operation across voltage 1 Programmer powers up properly across the 1,2 Test per the sequence in Attachment range voltage range of 300-650vac. I. CC#10 Note: The programmer is powered from the CT's, which provide current to the programmer. Primary injection testing of the breaker provides less than 10 vac. By design, the programmers are designed to operate a very low voltage levels. VVTP-042181-1, Rev. I Page 6

Verification Plan #VVTP-042181-1. Rev. 1

== Description:== Digital trip device for Sauare D Mastepact NT and NW low voltage switchgear breakers Manufacturer/ Model: Su.uare D/Schneider Micrologic 6.OP Programmer Safety Function: To maintain low voltage power circuits during normal operation and interrupt circuits during fault conditions. Remote communications, interlocks, remote alarms, and history storage and recall are not safety related functions, Critical Characteristic . Saple Acceptance __________________Criteia R7ef 1.Method Sample Size: A sample size of 1 trip unit is used for the validation testing. The traceability of this testing is based on the following:

       " The audit of Schneider verified configuration control.

• Dedication testing will be performed on 100% of the supplied trip units in accordance with the applicable dedication/Factory Acceptance Test plan. The dedication activities include verification of a sample of the trip points 100% of the shipped units.
• Perform some of the testing was performed on a Micrologic model 3.0 to provide added assurance.

The basis for the number of trip points tested during primary and secondary injection testing is as follows:

• The audit of Schneider documented that the logic and programming for the L, S, I, and G functions are separate in the trip unit. Therefore, testing each function separately is acceptable. 100% of the switch settings for each function will be tested to verify that the breaker trips per the published curves [1].
• As discussed above, each function has independent logic and programming, therefore, one function will not interfere with the other functions.

        " The signals from the 3 CT's are each compared to the trip settings that are set by the switch. The testing per the plan is only required to be performed on one phase, since this testing is validating that the field settable switches on the trip unit properly set the AND and OR gates. The testing is varied between the phases to provide additional assurance.

References:

1. Square D Masterpact Micrologic trip curves, "Masterpact NT/NW Universal Power Circuit Breakers, Section 7: Trip Curves",

dated 6/01.

2. Square D Masterpact Micrologic manual 48049-137-04, "Micrologic 5.OP and 6.OP Electronic Trip Units", dated 05/2003.

VVTP-042181-1, Rev. I Page 7

VVTP Approval Prepared: a & ,eiw-I Wae -ý-D~ As S- Approved:

                                              '        ate                 Date VVTP-042181-1, Rev. I Page 8

Validation Test Plan for Square D/Schneider Micrologic Programmer VVTP-042181-1, revision 0 Attachment I Data Recording* Record the following data, as applicable:

         " Programmer model and sin.                                /klicA0VLee-c. Sla 0q    1P - n     -Io \              ,A
         " Programmer code name and revision.                     P1,": g ,A       6                                         :

• Breaker model and s/n. /)XfJi-P Al MI?.

11-

• Rating plug model and size. 1/1- R2-CPO.4 oPEFRx 51 E-CC

[PERFORM CC#3, 4, SA, 5B AFTER THE OTHER CC'S ARE COMPLETED. CC#1, #1A to 1E, #2, #6. #7, #8 PRIMARY INJECTION TESTING Objective: The purpose of this testing is as follows: o (CC#1) Test some combinations of switch settings on the trip unit. o (C#1A) Programmer operates on Square D Masterpact NT or NW breaker. o (CC#IB) Programmer operates per design with the rating plug installed. o (CC#1 C) Output alarms are per design. o (CC#ID) Remote communications, alarms and interlocks do not impact trip unit operation. o (CC#IE) No spurious tripping. o (CC#IF) Programmer trips per curve with and without reset. o (CC#2) Test to verify that loss of power will not impact the trip unit settings. o (CC#6) Test to verify that battery removal or a dead battery will not impact the trip unit safety function. o (CC#7) Verify that recalling information from memory will not impact the trip unit safety function. o (CC#8) Verify that secondary injection testing does not impact the settings or trip unit function. o Primary injection testing of the defeat functions is tested separately in CC#9. Initial Conditions o Programmer installed on the NT or NW breaker. o Primary power to-the bus and trip unit powered. Test Sequence-Primary Injection o Perform secondary injection testing and record the results (the purpose of this step is to verify CC#8). Record trip settings, trip time, and SAT/UNSAT:

            ;Vo'"-1             Instantaneous test #1: I 'x                    0. 0 36 C-,mf      SA 1'

• Instantaneous test #2: 9x 0. oq e*eor S.-:--

Short time test #1: 10 - of;: 0d(I*t *,sA S' $A4~C~~ II*-[ .c,,,OA-/. U Short time test #2: << . L aA a.41 gEcojA' Wr If'Tr S---T Long time test #1: Iy, .*$ . s_*..,0s ýA =1 W.Io VVTP-042181 -1, Rev. I Page 9

Long time test #2: 2*1C.I* Co M-S.. - o Perform primary injection testing with the conditions and settings per Table 1 which is attached. CC#9 Defeat switches for each function operate properly. Test using primary injection. Initial Conditions o Programmer installed on the breaker. o Primary power to the bus and trip unit powered. Test Sequence o Testing will be by primary injection. o Record current, time, and trip/no trip for each test. o Test A phase. £-/do~ Defeat I only (set to off).

• Inject current in S range and verify trip: 240o0o A
• Injection current in I range and verify no trip: , Aia 7thd h~c.
• Simulate ground fault and verify trip: ) qqoN Niec- re-w
• Inject current in L range and verify trip: 172aoA o Test B phase.

Defeat I only (set to off).

• Inject current in S range and verify trip: a',OOA ,,-sc Th^rP 4:.t
• Injection current in I range and verify no trip: 2',,o A. .do-1A ' .r c0C
• Simulate ground fault. and verify trip: IMitw A d.-Psi 7*P
• Inject current in L range and verify trip:  ;?aa A ,-t, £EC 7-rP o Test C phase.

Defeat I only (set to off). './* q

• Inject current in S range and verify trip: 1i4oWA .4oSEc 7-htp 'J
• Injection current in I range and verify no trip: ,a"" ,k.
• AEc * . I o Simulate ground fault and verify trip: /q' A . 7",,*P SInject current in L range and verify trip: 417" A "'3 e-* T,.P CC#1OProgrammer operation across primary voltage range.
• Initial Conditions o Programmer installed on the breaker.

o Primary power to the bus and trip unit powered.

  " Test Sequence o Apply 300 vac to each primary phase and verify that the programmer powers up.
                 " Phase A:      300 VA _-

• Phase B: _ _ _ , _

                 " Phase C:

o Apply 650 vac to each primary phase and verify that the programmer powers up.

• Phase A: I,-

VA-(o

• Phase B: _

                 " Phase C:

(.\k VVTP-042181 -1, Rev. I Page 10

TABLE 2 PRIMARY INJECTION TESTING The data in each column is as follows: 0 Battery in, out, or dead: o In: Battery installed. o Out: Battery removed. o Dead: Battery installed but dead.

• Recall from memory before test:

o Yes: Recall some information from memory immediately prior to the specified test. o No, Do not recall information from memory immediately prior to the specified test.

• Phase: Primary injection to the specified phase.
• Reset before test:

o No: Do not reset the programmer with the reset button prior to the test. o Yes: Reset the programmer with the reset button prior to the test 0 Tested functions: Set the trip unit per the specified settings. 0 Record other function settings: The functions that are not being tested should be set to random settings. Record these settings.

• Record results:

o Record trip time and current. o Alarm light on when in overload condition (Y, N). o Trip light on following trip (Y, N). o Reset operates to reset the trip unit (Y, N). o (current and time): Record the simulated test current and trip: time for the tested function.

• SAT/UNSAT: Document whether the testing meets the published trip curve [11 or not. Verify no spurious trips.

Battery Recall Phase Reset? Tested Record other Record Results SAT/ in, out, from function function settings (current and time, alarm light, trip UNSA dead memory light, reset) T before test Instantaneous t7-Dead7 - No .... A No 1=2 , /, 0 Current= 6*oo, Time- o.o4qec -,Tv7" -JOH Sii 'r . i VVTP-042181-1, Rev. I A* 43 0

                                                                            *Page                                                            11

c,- P. Alarm: Y~; Trim 4~s Reset: ,vc' Dead No A No 1=3 Current= . f ,A Time= -0. Wl. r Alarm: S .Trip: 2ý" Reset: ,4o ._--_- Dead No B No I=4 Current- i.,poo 4 Time= 0.4 Alarm: -As Trip: VeS Reset: 10. ____ Dead No B No 1=6 Current= Iq,.zoo A Time- p.op. rc I , _ Alarm: /fs Trip: Les Reset: NVo ,47-Dead No B Yes

              .Y               1=8                                        Current= ag,0 a         Time=   6,oq s Alarm: ]e_ Trip: Yes    Reset: #'0           ._7-_

Dead No C Yes 1=10 Current= 3;L00 A Time- 0.0 - _ __ __ _ Alarm: 9.c Trip: Y/e- Reset: )op Dead No C No 1=12 Current- 3 k- o0 ,4 Time= s. 0 ec ____..Alarm: j. Trip: kFS Reset: o _____ Dead Yes C No 1=15 Current= Qfod 4 Time= . Alarm: Y.5 Trip: ýIgs Reset: S47 \K Ground Fault Dead No A No Lg=A, Tg=. 1 on ,- 7"-,.z ,, Current= LooO A Time= j.q ce ___t-___ ý.,_ e.',.-

                                                                  - ce-r  Alarm: /.0 Trip: jgq. Reset: _..o-Dead   No  A     No    Lg=A, *=g2on            *To *,*-- P,- e             Current= ,        4. Time= d.;3 5
                                %S___              b   ____4_,  .         Alarm: vo Trip: .s Reset:            0p Dead   No  A     No    Lg=A, Tg"-. W,     onr'                             Current-- lo a          Time= ,.Ogo

6. - 0. bss,-e or- g: Alarm: AMo Trip: y_' Reset: _p-Dead No A No Lg=A, Tg=.4 on ,, Current= looo A- Time= 4,6x.*-

S" -6 c*-*-,,,* ,.- Alarm: wo Trip: Ves Reset: o-Dead No A No Lg=A, Tg=.4 off Current= ljoo A Time= O.'*, $fS 0 O.-tr*-cc Alarm: )o Trip: Le Reset: lo .5÷-- Dead No A No Lg=A, Tg=.3 off Current= .o o 4' Time= _-ah Se

                      .1A-      . Z + Stc                                 Alarm: A0 Trip: (*,s Reset: ,Io               _

Dead No A No Lg=A, Tg=.2 off Current= oo ,4 Timq= C4t Sac

                       ,__SEC-  *Iit.c                                    Alarm: 4o Trip:j*t  &,O Reset:

Dead No A Yes Lg=A, Tg=.I off Current= IoO ,A Time- g. ,SB I_ *of-

                        ,_II        SE.          .                        Alarm: VO Trip: _es Reset:-.5L-'-

Dead No A Yes Lg=A, Tg=0 off \ Current= /Io &0A Time= . Orr g!c VVTP-042181-1, Rev. I Page 12

                                                           !          Alarm: YEs TriD: *c. Reset: 'ts                                 JDh Dead No B Yes  Lg=B, Tg=.l on.                                        Current-- JŽ2Lo              Time- o.?r*-

_ _O____ .\*__ _ _ Alarm: j Trip: ¥ Reset: yg$s sf~4.-j Dead No B Yes Lg=B, Tg=.2 on Current-= /J A

                                                                                            ,4-0   Time=

0.,\- 0o,9 - Alarm: AL- Trip: Y Reset: ____-_ Dead No B Yes Lg=B, Tg=.3 on Current= JgO .24 Time= 0. c _____ -___. _____Alarm: S_ Trip: Ac Reset: 11_=7_- Dead No B Yes Lg=B, Tg=.4 on Current= aro4 Time= oio 03:1_- __.______ Alarm: 4. Trip: 9F- Reset: ../o*_s S"__I= Dead No B Yes Lg=B, Tg=.4 off Current- j,,e /I j Time= -. ,4 get 2.#%-_.__re Alarm: $ Trip: _&.s Reset: y-cs Dead No B Yes Lg=B, Tg=.3 off Current= Iieo 4ý Time=- _.p\ -O.3ASrrc Alarm: ýLo Trip: *5 Reset: J-7"A Dead No B Yes Lg=B, Tg=.2 off Current= /4V .P- Time= d 16 a 6 -1*-k - 0. I*d Sc _ _ Alarm: . Trip: y Reset: A Dead No B Yes Lg=B, Tg=. 1 off Current= W A- Time= dof:?

               &x     t -.6, N ci o.,-                                               Alarm: Ye Trip: 51       p           As Reset: .*_,,          +-"

Dead No B Yes Lg=B, Tg=O off Current= 1/,'o 4.; Time= O.o3*4-0.o..- .orsc Alarm: ýrk-s Trip: jF Reset: ya ___ Dead No B Yes Lg=C, Tg=.I on Current= ,P-10 4 Time= _,o -o.r0. Sec. Alarm: _*s Trip: ,-_s Reset: )* s Dead No B Yes Lg=C, Tg=.2 on Current= Jj*4 0 Time= , _,___ _ .__ ____ Alarm: . Trip: .. Reset: , ss Dead No B Yes Lg=C, Tg=.3 on Current= ]qqO A Time= Alarm: . Trip: 4ks Reset: 4s,- Dead No B Yes Lg=C, Tg=.4 on Current= ,j 4 Time= j 0.31-o. lt-lc Alarm: "-, Trip: _j-% Reset: _s .g*-7" Dead No B Yes Lg=C, Tg=.4 off Current= frI 'l 0 A Time= 0-1c Sc 0.-. - Alarm: Y/es Trip: fs Reset: ZEE 5"4-r" Dead No B No Lg=C, Tg=.3 off Current= lqlO A Time= o.U ý'k _._,*,-o.__ *c Alarm: Js Trip: Lsj Reset: ova ___T" Dead No B No Lg=C, Tg=.2 off Current-- 4"0 Time= I0.1 c ___.\-o_________ ._ Alarm: AL Trip: {. Reset: 19FT" -Dead No B No Lg=C, Tg-.1-off_ Current- I/+/--!t - Time== O. 10 sec r

0. of,, o. It%Aýrr VVTP-042181-1, Rev. I Page 13

Alarm: (lo Trip: A&s Reset: ,vo Dead No B No Lg=C, Tg=O off Current= qyoA.,4 Time= t.O0' + St _.0_-_, _Op __ Alarm:____ Trip: _4.s Reset: 0o -If"- Dead No B No Lg=D, Tg=.l on Current- 46a c A Time- d, JA Oo-ot0. 1.q.c.c 19 Alarm: _,b -Trip: Q,5 Reset: ,da- , B No Lg=D, Tg=.2 on Current-  !,-oo Time= .. A Dead No __.___9. - LtsIte Alarm: do Trip: - Reset: jo Dead No B No Lg=D, Tg=.3 on Current- {p o A- Time= ________ _______ o. - o.'

• _Alarm: ,)0 Trip: yks Reset: ',d __--_"

Dead No B No Lg=D, Tg=.4 on Current= ao ,4A Time= 8,

                                                                                                                                        .,o
    ._.._____                              C. -o'cec-                                             1_Alarm: ,.)0 Trip: ýes Reset: ,M Dead        No            B          No   Lg=D, Tg=.4 off                                            Current-           A       Time=

__.__ -__.,_______-__ Alarm: ,dc Trip: A i Reset: "{ - _- Dead No B No Lg=D, Tg=.3 off Current- /6go Time= #,2,6 _.2t,-0.1% o ýec Alarm: ,0 Trip: . Reset: ,j Dead No B No Lg=D, Tg=.2 off. Current- !ta o A Time= a 1%A SEC- - Alarm: )o Trip: yts Reset: Oo s',+ JD Dead No B No Lg=D, Tg=.1 off Current-- Time= , 0,_r-_ _l___ - Alarm: jo' Trip: j Reset: o *, "4- - In No B No Lg=D, Tg=O off Current= &c Time= ___Ox.-o.orsec Alarm: A/c) Trip: -+/- Reset: ____ In No C No Lg=E, Tg=.1 on Current= JI-6o A Time= ci Sfc _ _ _ _ _ _ &,-s-- Alarm:. j-O Trip: ý)_ Reset: /j0-In No C No Lg=E, Tg=.2 on Current= 13-o 4 Time= 6.1- Sa ___ _ , _, ,n F_..._'r _ Alarm: M Trip: &[ Reset: _ So In No C No Lg=E, Tg=.3 on Current- 176o A Time= 9-aVSk

                                                                    /2LP-'r" *                  -   Alarm: )vo Trip: 9e-5 Reset: yoo-In         No            C          No    Lg=E, Tg=.4 on                                            Current- /t60       0A     Time= ,          s..

_____ ,C..4.- 4e Alarm: vo Trip: &,LReset: 4j2 JW'- In No C No Lg=E, Tg=.4 off Current- /1 Time= 6.*, 1kSe Alarm: %lo Trip: &/ Reset: vo - In No C No Lg=E, Tg=.3 off Current-- 1-46A Time= O.£-t. c Alarm: jo Trip: _ES Reset: Ko" In No C No Lg=E, Tg=.2 off Current= 17-60A Time= 0.1:+ so- S,,'c" VVTP-042181-1, Rev. I Page 14

                                                                                                                                    ..64

_ __ _ _ _ _ Alarm: 4k.u Trip: Žes Reset: ,/0 faq In No C No Lg=E, Tg=.1 off Current= /'+(a , Time= 0 -t sa Alarm: ovo Trip: j/4. Reset: 1Lo,, In No C No Lg=E, Tg=O off Current-= l'r-g A Time= 0.on .-. Alarm: yO Trip: )SJ Reset: Wde Jr-7 In No C No Lg=F, Tg=.I on Current- /?12o A- Time=-0,1 Alarm: A, Trip: Vc_ Reset: yvO) A7-In No C No Lg=F, Tg=.2 on Current- J..fO A Time= a. t;

                                                              -Alarm: WO       Trip:  4k    Reset:     ,o_-

In No C No Lg=F, Tg=.3 on Current- /1 R.0 A Time- e Alarm: 4o Trip:

• Reset: y-In No C No Lg=F, Tg=.4 on Current= /yaO A Time= 0.,k(

I Alarm: , Trip:

• Reset: O -T" In No C No Lg=F, Tg=.4 off Current= j/j, o d Time= E I Alarm: do Trip: j¢.s Reset: ýo ___-_

In No C No Lg=F, Tg=.3 off Current= qg2j A Time= a. Alarm: 00 Trip: _S& Reset: ,-.0 ' In No. C No Lg=F, Tg=.2 off Current= J.aO A- Time= CI117 I_ _ _Alarm: .jo Trip: Al Reset: oV In No C No Lg=F Tg=. 1 off Current= /q0 A .Time= g.l St. Alarm: do Trip: )es Reset: ,)o *4-In No C No Lg=F Tg=O off Current- /.20, q Time= 0.o* Alarm: y Trip: _S Reset: em ._,__- In No C No Lg=G, Tg=.I on Current= o"oo-o A Time= 0-'( Alarm: oa Trip: _4s Reset: ,,10 <Q-In No C No Lg=G, Tg=.2 on Current-= gar-o A Time= o. "-- Alarm: to Trip: ýg Reset:. o s 5 In No C No Lg=G, Tg=.3 on Current= QoiO eq - Time= t,.."o Alarm: A20 Trip: ,Ms Reset: 40 . In No C No Lg=G, Tg=.4 on Current= gorO Q 4 Time= jocl z Alarm: -o Trip: j'A Reset: AO ____- In No C No Lg=G, Tg=.4 off Current- 2 Ot-O A Time= o.,-:zc-Alarm: lg0 Trip: /jj Reset: ,/0 .flqr In- No C No Lg=G, Tg=.3 off ._--Current=----o O-'1-Time e . VVTP-042181-1, Rev. I Page 15

Alarm: A/o Trip: Yes Reset: VO In No C No Lg=G, Tg=.2 off Current= I o0 4" Time-- 0.l _.__-.f-_ __1q_ __.__ Alarm: ajo Trip: Yie Reset: &a_ ,7 In No C No Lg=G, Tg=. I off Current= ;2oe- A Time= j. ii _,_o. tO,0. N *_ _ Alarm: vo Trip: /1es Reset: jo 4"7-- In No C No Lg=G, Tg=O off Current= R O A Time= e. og .C- _ _ __c-corSe Alarm: VO Trip: jr Reset: ja f-7" In No C No Lg=H, Tg=.l on Current= a.,*o A c-1 Time= 0.0 ____ -__.0-t______ Alarm: do Trip: i.kr Reset: .o. In No C No Lg=H, Tg=.2 on Current= o Time= a, It A 1-(- 0. tq Si Alarm: _, Trip: _ Reset: VD S-r-In No C No Lg=H, Tg=.3 on Current= o.ato 4 Time=

                    .n-No.Alarm:                                         .V Trip: %k- Reset:       "_

In No C No Lg=IH, Tg=.4 on Current=- sL.,o A Time= .,!s.., _Alarm: sic__ ,,O Trip: _k*j Reset: -do In No C No Lg=H, Tg=.4 off Current= 2a,40 4: Time= _____, ., S* C Alarm: no Trip: j* Reset: ,t ,_-- In No C No Lg=H, Tg=.3 off Current= . A- Time= ot.a+?.si ___.,-O. 3 ZSi __Alarm: A1, Trip: yu Reset: ),p In No C No Lg=H,-Tg=.2 off Current= A Time= OJ,6 ..* 0-_-_,___* Alarm: )0 Trip:jk;*. Reset: ,o S4-In No C No Lg=H Tg=. 1 off Current= =4o Time= 0. ,) q 6-01t - m.Sea Alarm: go Trip: "y Io Reset: AL") - In No C No Lg=H Tg=O off Current= 2aAo A Time= *,a

                        ;--()o.or___                          Alarm: ,)c      Trip:  ,.jý. Reset: #o             .__-_-

In No C No Lg=J, Tg=. 1 on Current= a 4 vo A- Time= d,Oq S-of- - d. I't Se Alarm: .&4. Trip: .4s Reset: S/5"-" In No C No Lg=J, Tg=.2 on Current= 2 o o 4 Time= .,/* *6 __ 1" 0. t't* Alarm: Vo Trip:As__ Reset: Aior In No C No Lg=J, Tg=.3 on Current= q(4oo *- Time= O-al In Yes.C No Alarm: AJO Trip: AS Reset: <1 T-In Yes C No Lg=J, Tg=.4 on Current-= 44 Time= 0,41 s_, __._.-o.t___ Alarm:g/d Trip: As Reset: .jp -_ _-r_ In Yes C No Lg=J, Tg=.4 off Current= OA 0o Time= d..LC ýt-- 0 "3X --. ,tt-t, VVTP-042181 - 1,Rev. I Page 16

Alarm:WO Trip: _ýeS Reset; A10 In Yes C No Lg=J, Tg=.3 off Current-- ,4. Time- o.1*;e.c

                           .aM- 6.3j -

O___ _ Alarm: Aj* Trip: )..s Reset: y.'d _"__-- In Yes C No Lg=J, Tg=.2 off Current- .2ea.4 Time= j,1ijer 0 ..o -0, tl',tc Alarm: lvd Trip: )ks Reset: ,jo ,*-r-In Yes C No Lg=J Tg=.I off Current- .ooA Time= 1.1* O_ r_-o ._N_ _ _c Alarm: A Trip: As Reset: ,&> . ___ In Yes C No Lg=J Tg=Q off Current= .2 vy04 Time= dorsa Ing Yes, 0vs Cr Alarm: Ato Trip: A*s Reset: AAL ___ Short Time Time= 2. crcr- \\/ In No A No Isd=l.5, Current-- tsd=.lon , ;2'r

                                                               ..- "p .      Alarm: ý<.t Trip: Ve- Reset: ývo                  647-In    No    A  Yes           Isd=l.5,                                       Current= 3jo,               Time- L. 1sec.,

tsd=.2on £[qo - Alarm: i.. Trip: Y&L/ Reset: Pf* _-r_ 6 7 In No A Yes Isd=1.5, Current= I Coo Time= -a_ tsd=.3on - - Alarm: Trip: EL.r Reset: 1S so.r In No A Yes Isd=l.5, Current= -oA, Time= 1d. t gc*c tsd=.4on /d. i',' re . Alarm: yf- Trip: ýv.s Reset: AS In No A Yes Isd=l.5, tsd=.4 Current-  ?, s Time= .'42ac off _.3___-_o.___ Alarm: ý_. Trip: 9E..v Reset: *s ___-_ In No A Yes Isd=l.5, tsd=.3 Current= "9,,, Time= .o2f.c off . - Alarm:

• Trip: k4r Reset: eIS Z-r-In No A Yes Isd=l.5, tsd=.2 Current- 36ov., Time= -I dl off - O 0-a.j ca.sg,Alarm: Ys Trip: V4j Reset: t)es .ce'+

In No A Yes Isd=l.5, tsd=.l Current- 3cw A Time= O.I*: off - - !. - Alarm: 9s Trip: Yu Reset: .i-<f" In No A No Isd=1.5, tsd=O q Current= ?6oo,4 Time= b).poL* off 0.o. -- o.or'a Alarm: _b Trip: YE Reset: x Qf In No A No isd=2, tsd=.lon 4,,4.rrz. . r at24 Current= ',.OV4 Time= I'tec ______.oSrtr,

                                                              .-        -    Alarm: Vs Trip: )'-         Reset:     o" In    No     A No      Isd=2, tsd=.2on                                      Current='yOO,4              Time= ;L. 4 IAlarm:
                                                 .                                          Trip: 1 Reset: 2}0               JPPT

--In*-- No - -A No -- Isd=2, tsd=.3oný4= =-ý-" -SsI p -Current- -4z"l4 *- Time= -M$S 5'i.. VVTP-042181-1, Rev. I Page 17

T T T T -. 201/2 Alarm: YfA' Trio: ~ Keset: Q~' No A No Isd=2, tsd=.4on Current= qF'aA Time- 6. ? se c. 1' In S3. _r - 7- .s cc. Alarm: -. s Trip: Les Reset: ,.0-In No A No Isd=2, tsd=.4 off Current= Ift4. Time- scc. ____ Oser S___- Alarm: Ves Trip: _pe.s Reset: A+/-& ____- In No A No Isd=2, tsd=.3 off Current- qgt.) Time- -at*t*Ac-I _.__ - 3a-cec Alarm: ýcs Trip: !-Pis Reset: ,o0 ___,__ In No B No Isd=2, tsd=.2 off Current- t40a&,4 Time= O0. )L

                                                    .l-

_______ _ .*-,ost'c Alarm: )d._ Trip: Ag Reset: A.o ___" In No B No Isd=2, tsd=.l off Current= ,.oa

                                                                                               .             Time= d.tzsc-
                                                    ,_-_.OE.I6Se-C.                 Alarm: As..s Trip; *s. Reset: 4w                  -

In No B No Isd2, tsdO off Current= 41 FzV 4 Time= d,oasrsz I . Alarm: Sle* Trip: Qsg Reset: IQo ____-_ In No B No Isd=2.5, 4w&, -,.o, ,4 Current= Cooo,+ Time= 6,ý4 r tsd=.lon ,,. 'a ,-1e". Alarm: Y.s Trip: Lex Reset: 0 ____-r-In No B No Isd=2.5, Current- co,+ Time= J. q~ tsd=.2on - *- .( ,. Alarm: Vat Trip: 44s Reset: Jdo In No B No Isd=2.5, Current= koo04 Time= P.-1e tsd=.3on - +.V Alarm: As, Trip: Ys Reset: dAo ______ Out No B No Isd=2.5, Current-- oo o,- Time= -.4 c tsd=.4on 1 - EC Alarm: -& Trip: iPs Reset: ." Out No B No Isd=2.5, tsd=.4 Current=9 h0 oii Time= OA 2' off ,35- aosec Alarm: f5. Trip: . Reset: JQ"' Out No B No Isd=2.5, tsd=.3 Current=- Time= c.;'r __ __ _off . 3- , Alarm: Ves Trip: k*S Reset: x0-Out No B No Isd=2.5, tsd=.2 . '-XASrc.o Current=- Time= 0.14-s off - Alarm: )Is Trip: ,ks Reset: Ala Out No B No Isd=2.5, tsd=.l Current= 6oov Time= o.iksar off ,or -. 1"1 Sec. Alarm: j.s Trip: *S*s Reset: 2,O . Out No B No Isd=2.5, tsd=O p Current-7 66yA Time= .oSL re off ,OA- , to"- Alarm: Ygs Trip: R/- Reset: ,140 Out No B No Isd=3, tsd=.lon ,r. , Current 7yOA Time= oS7-c jq&VA4y-\.5- 7;.ooA .&'l-.f Alarm: gZ Trip:7eS Reset: J" Out No B No Isd=3, tsd=.2on . 7 - I.'p{, Current- 7AOVA Time= o.M soc wy-7 VVTP-042181-1, Rev. I Page 18

Alarm: _ikt TriD: Vf*s Reset: AJa Out No B No Isd=3, tsd=.3on J.js - J..'-gec Current= -a.OgrA Time=IS.c

                                                  .%t                                      Alarm: *1¢ Trip: A_ Reset: /a-Out   No        B   No       Isd=3, tsd=.4on                         I-i.       sec    Current= Z. o.,6A-       Time-- ,

_ _ _(, 1 g.. Alarm: j Trip: P Reset: A5-T-Out No B No Isd=3, tsd=.4 off -Current- Time- o.%k at _ 1 _ -. -ross,. Alarm: As Trip: Vj4 Reset: yoY#7 Out No B No Isd=3, tsd=.3 off Current= -7zo oA Time- o-29.kc

                                                              *.23 - .3_zic               Alarm: &-      Trip: &es Reset:    v-Out   No        B   No     Isd=3, tsd=.2 off                                           Current= "7.XOA          Time= o'1a-s,.*.

V,1- .- o su. Alarm: g Trip: i Reset: _ 4)T Out No B No Isd=3, tsd=.l off Current- '7.oo- Time= e.II sa-Ij o_.- . I _ _gG Alarm: Ve. Trip: )&s Reset: ,.)o *4-"r-Out No B No Isd=3, tsd=O off Current= 7ýo otl Time= oorfse*

                                                             ,oa.--            rorr'e      Alarm: &-t    Trip: _ge. Reset: g_           .5"-r Out   No        B   No      Isd=4, tsd=.lon     .                  '                   Current=       o ,4. Time=o . 3,,-

_____ z a. *qg.c-, Alarm:Jk+s Trip: y-. Reset: ,7 Out No B No Isd=4, tsd=.2on Current- 76oo A Time= o), '5sac.

                                                         *   *o      -40 ;o                Alarm:  ._kL  Trip: )Yk5 Reset: da_           5A1--

Out No B No Isd=4, tsd=.3on Current= !UOO A Time= o. fqLc I__S-. sfea- Alarm: &s Trip: 9k Reset: Js - 597-Out No B No Isd=4, tsd=.4on Current= _ta A Time- /. qsec ___ . /-.- ac Alarm: _k Trip: 9* Reset: .d2o-- Out No B No Isd=4, tsd=.4 off Current= Y?6oo Time=o.qý sic.

• S 9 I Co

                                                                                    ,      Alarm: h. Trip: 4.       Reset:      o             .5-"

Out No B No Isd=4, tsd=.3 off Current -qo ,4 Time= o.a-

                                                          *~3-.'3..            .,         Alarm: Ves Trip: >Jp      Reset: doJ           .t7'17 Out   No        B   No     Isd=4, tsd=.2 off                                           Current-     76oo,4      Time= Od)7-uc
                                                          .1           2.*.o Sec          Alarm: ,ks Trip: AS       Reset:   ,/         ___-"

Out No B No Isd=4, tsd=. 1 off Current= 76oa ot Time= /c

                                                                                                                               //
                                                                  -. 1i sec,              Alarm:*  js    Trip: VS   Reset: 1O0          __-

Out No B No Isd=4, tsd=O off Current= q46 0 Ai Time= &,0st, I__o_*_i o.- 1?__tsd Alarm:-/. Trip: ks Reset: do -Out ý No-l ý=B-- No--- =sd5-tsd=.on- S2urent-j2 Poo xt..5.: 12000 VVTP-042181-1, Rev, 1 Page 19

I Alarm: ýý.s Trip: VFc Reset: ,Io Out No B No Isd=5, tsd=.2on Current= l20oo/A Time= 0. 33

                                       ._,t_- --   0.'stc              Alarm: -A-s Trip: )4 s        Reset: _2,>,

Out No B No Isd=5, tsd=.3on Current= /gooo A Time= 0o. 4 Alarm: "JI)s Trip: )L Reset: o -r-Out No B No Isd=5, tsd=.4on Current= I.oooa ,A Time= 6."4 5 gc Alarm: Orn. Trip: 24.s Reset: A.- 0.____-o.1 t . Out No B No Isd=5, tsd=.4 off Current= /Z.oy A Time= O.-SEC __0.__" 0. , jFp Alarm: -1c Trip: A5 Reset: 2oo Out No B No Isd=5, tsd=.3 off Current-- y . Time= o.ic*.- 0__.__ _- 0,__ _ . _f_ Alarm: */,.s Trip: As Reset: , Out No B No Isd=5, tsd=.2 off Current- j*gg;,j Time= 0. 91 - 1_0._P-1_-e. OX0*s.r Alarm: Yes Trip: _ES Reset: )a,27 Out No B No Isd=5, tsd=. I off Current , Time= o, t_ _.oS- Okf-tfe Alarm: Trip:Jf* Reset:; Out No B No Isd=5, tsd=O off Current=- ,a.ooo A Time= j.sit-c

0. _ _ 0 -ft r)o.- Alarm: P)j Trip: ýe-S Reset: _We .f-"r-Out No B No Isd=6, tsd=.lon Current= LqI-{oo A Time= 0"11-1

_ _oo xi.g5gqgoo Oo.- o.*0r r Alarm: _ýu Trip: x. Reset: .,o" Out No B No Isd=6, tsd=.2on Current= Jq/o*oAj Time= ., zI 0,__r- 5.19 sp-c Alarm: *k Trip: £ýz Reset: sk-Out No B No Isd=6, tsd=.3on Current- lJ(o, Time= tr.s* 10.1-i - o,,w c Alarm: 2)f Trip: 4jr Reset: Ak . - Out No B No Isd=6, tsd=.4on Current- Iqq4{ 4 Time= 0. SY ,u _OY3t- o.,r*c Alarm: 9t& Trip: Es Reset: aeo Out No B No Isd=6, tsd=.4 off Current- I/qoc.;1+ Time= 6,*t-xsyc O.I f- o.,ro :rrc Alarm: Oes Trip: .5s Reset: _&-e Out No C N-lo Isd=6, tsd=.3 off Current= /1'fQa 4 Time= AD fsc

                                       ,*"-      o .*Alarm:                      s    Trip: Ver      Reset:  e26L        ____"

Out No C No Isd=6, tsd=.2 off Current= ] oqa+ . Time-- . IPlec _._-__ 0-a_ Alarm: Jt Trip: /*, Reset:' ,2Z S4'7-Out No C No Isd=6, tsd=.l off Current- iqyo( If Time= (Il .c ____,_0O-a O c Alarm: )&.C Trip:

• Reset: /o 51T" Out No C No Isd=6, tsd=O off6 0 t u, Current= L Time- oo ____

VVTP-042181-1, Rev. I Page 20

Alarm: ~s TriD: ~J~v Reset: ,*~ , Out No. C No Isd=8, tsd=. 1on Current-- /Iao 0*A Time= 0, I SI*- ____ ,__ _'_, Ojo?- a. O c Alarm:. Trip: J&-p Reset: , Out No C No Isd=8, tsd=.2on Current- If a o it Time- o.i- s;rc O o.. o c Alarm: )ý-.cTrip:i Reset: x _._-r Out No C No Isd=8, tsd=.3on Current- I go /4 Time= (e2si'&- o.a3 - 0. &:?- I_ Alarm: L-.s Trip: ýk Reset: Ajo .__- Out No C No Isd=8, tsd=.4on Current- i9qtoA, Time=

                                                       . 5-3S-    0. 5'OS,*      Alarm: Yis Trip: )P-s Reset: . 4 ,-sr-Out     No  C      No    Isd=8, tsd=.4 off                                        Current- /9.,, 4.       Time= d,4Z5rc
                                                         -3r,- o-S'of¢_          Alarm: /_sTrip: _.sC Reset: A)99           S' out     No  C      No    Isd=8, tsd=.3 off                                        Current- if aou A       Time= Oc..-
                                                        .6 - a. 12S E*           Alarm: Vt.; Trip: _&L Reset: A .               , --

Out No C No Isd=8, tsd=.2 off Current= if .. os Time= o. Iq-c

                                                          ./( - c, L             Alarm:       Trip:      Reset: _           ____

Out No C No Isd=8, tsd=. 1 off Current=- i .A0 Time= j.) I --¢ O__ _ o, 0.o1-k

                                                                      ,          Alarm: ?ý Trip: A.      Reset: ,k'                -

Out No C No Isd=8, tsd=0 off Current- /fT2o A Time- ý5-,- 0.o 60.o-c Alarm: &% Trip: Ya. Reset: A-- Out No C No Isd=10, tsd=.lon ",- *'i Current- -)Ltooo A Time= 6. It. Se ___ g _I00oo0 'o-o 0.0t - cN v Alarm: _Y.. Trip: _ Reset: _--c, _ " Out No C No Isd=l 0, tsd=.2on Current= A- Time= e,- O, ('A-o. act Sic Alarm: _1--s Trip: j. Reset: . Out No C No Isd=10, tsd=.3on Current= 2ta. A Time= O. M'.c

                                                               - C).3 ,-   c     Alarm: *.s Trip: e.rs Reset: -               S+_-(

Out Yes C No Isd=10, tsd=.4on Current= :ooO ,, Time= .C.-;c-O" 3 5- O. r,0 ;-. Alarm: _s Trip: 9F-S Reset: Ala Out Yes C No Isd=10, tsd=.4 Current= Q'tooo A Time= O,4ý Stc 0_50off .- - Alarm: _yeS Trip: *Je- Reset: ,o0 S4,17 Out Yes C No Isd= 10, tsd=.3 Current= Quooo , Time= 6. -*sr,- off 0., 3-o.3 -sc Alarm: _W-. Trip: y- Reset: AV _-_" Out Yes C No Isd=10, tsd=.2 Current= ;2 oooyi Time= 0-I .3c 00foff O.'q- o-,9ýk. Alarm: FE- Trip: ýýp Reset: doo SAC _" Out --- Yes C -... No- Isd=10,4sd-,1 0 r.owr--o..l-skc - Current==qoA. Time= o.k( c*c. VVTP-042181-1, Rev. I Page 21

i T T T -- -, - off Alarm: ~k ~ Tm,: Y,~zs Reset AYO Out Yes C No Isd=10, tsd=0 Current Z4o5m Time= 0. osc.; _________off 0of1.o- -,0 S Alarm: 9Vs Trip: ks" Reset: tp _"____ Long Time Out No C No Ir=.4, tr=.5 r o Current= Time= __,_ __.__ -dV Alarm: Trip: Reset: Out No C No Ir.4, tr ICurrent- Time-- OutNoC__No__ t='4 tr-l 6 ~Alarm: " Trip: Reset:

• Out No C No Itr.4, tr42 Current= 3,kt, Time= _7._s

_I___ _= _ _f_ 34_4o S C Alarm: f,* Trip: As Reset: ,5",:-/" A y out No C No ir-.4, tr8 Current= . Time= O__N__N__=4 tr4

• sA Alarm: Trip: Reset: ,e' Out No C No Ir=.4, tr28 Current- Zg-qo A Time= 3__"4

_ _3f_ Iz _0_-3_ -I-_ Alarm: Y Trip: ý,.r Reset: dJo -S -'t" Out No C No Itr.4, tr= 12 Current- Time= Alarm: Trip: Reset: t4 Out No C No Ir=.4, tr=16 Current- Time= __Alarm: Trip: Reset: Out No C No Ir=.4, tr=20 Current- Time= Alarm: Trip: Reset: Out No C No Ir=.4, tr=24 Current- Time= Alarm: Trip: Reset: Out No B No Ir=.45, trl.5 Current= Time= Alarm: Trip: Reset: Out No B No Ir=-.45, tr=21 Current- Time= Alarm: Trip: Reset: Out No B No Ir=.45, tr42 Current= Time= Alarm: Trip: Reset: Out No B No Ir=.45, tr=4 Current- Time= Alarm: Trip: Reset: Out No B No IIAlarm: Ir=.45, tr=28 Current= Trip: Time= Reset:

• Out No I B INo Ir"=.45, tr=-12 "V ( Current= Timne= "

(9

                                                                    'lk)pr-     Ul-l.                                                 VVTP-042181-I, Rev. ]

on0 J)voq,ý j( ' kc Page 22

Alarm: Trip: Reset: /,,/4 out No B No Ir-.4 5, trl 16 Alarm: Current-- Trip: Reset: Time= Out No B No Ir=.45, tr=20 Current- Time-- Alarm: Trip: Reset: Out No B Yes Ir=.45, tr=24 Current- Time= Alarm: Trip: Reset: Out No B . Yes Ir=-.5, tr=.5 Current= Time= Alarm: Trip: Reset: out No B Yes Ir-.5, tr-l Current= Time= Out No B Yes Alarm: Trip: Reset: Out No B Yes Ir=.5, tr=2 Current= L/2o 0 Time= Lit scc

t. 5- 9.e ý.6, Alarm: Or-% Trio: ýýs Reset: V, c .5".47-

_5,4_7 JDH Out No B Yes Ir=.5, tr-4 Current= Time= v6l to'( Alarm:, TriD: Reset: Out No B Yes Ir=.5, tr=8 Current=- Time= Alarm: Trip: Reset: Out No B No Irt-.5, tr= 12 Current=- Time= _____Alarm: Trip: Reset: Out No B No Ir=.5, tr=16 Current-- '{1DO Time=kLi T Lie-. /-a t Alarm: ý)- Trip: ý4j

               -   -t*1-i------------------       ______________        _____________________________                                         . S Out    No     B        No         Ir=.5, tr=20                            Current=-                       Time=                            g4 c,"(

Alarm: Trip: Reset: Out No B No Ir=.5, tr=24 Current- Time-- Alarm: Trip: Reset: Out No B No Ir=.6, tr=.5 Current= Time= Alarm: Trip:, Reset: Out No B No Ir=.6, tr=l Current=- Time= Alarm: Trip: Reset: Out No B No Ir=.6, tr=2 Current= Time= Alarm: Trip: Reset: Out No B No Ir=.6, tr-4 Current=- Time= I I I Alarm: Trip: Reset: Out.I- No B No - Ir=.6, tr=8 Current= - Time=- VVTP-04218 I- 1,Rev. -1 Page 23

Alarm: Tri I Re.*et: ,out No B No Ir-. 6, tr=- 12 x/14 Current= Time= Alarm: Trip: Reset: Out No B No Ir.6, tr126 Current= Time= Alarm: Trip: Reset: Out No B No Ir-.6, tr=20 Current= Time= Alarm: Trip: Reset: Out No B No Ir=.6, tr24 Current=- Time=- _________ ,__ _Alarm: Trip: Reset: Out No B No Ir=.63, tr-.5 Current= Time= ___Alarm: Trip: Reset: Out No A No Ir=.63, tr.l Current=- Time= Alarm: Trip: Reset: out No A No Ir=.63, trl2 Current- Time= Alarm: Trip: Reset: Out No A No Ir=.63, tr-4 Current= Time= Alarm: Trip: Reset: Out No A No Ir=.63, tr=8 Current= Time= Alarm: Trip: Reset: Out No A No Ir=.63, tr=12 Current- Time= Alarm: Trip: Reset: Out No A No Ir=.63, tr-l 6 Current- Time=_" Alarm: Trip: Reset: Out No A No Ir=.63, tr=20 Current=- Time=

                                                            ._Alarm:                         Trip:     Reset:

Out No A No Ir=.63, tr=24 Current= Time=_ _ I Alarm: Trip: Reset: Out No A No Ir=.67, tr=-.25 Current- Time= \_/ ou NoANoAlarm: Trip: Reset: Out No A No Ir=.7, tr=l1 Current- 6___o ,4 Time= _._._ _:2__to_ Al Z,__ _ S Alarm: Trip: Ak- Reset: Out No A No Ir=.7, tr=2 Current= Time= I I_ IIA___ Alarm: Trip: Reset: Out No A No Ir=-.7, tr=4 V_/ ,___,"_Current- Time= VVTP-042181-1, Rev. I Page 24

Alarm: Trim Reset; Out No A No Ir=.7, tr=8 Current- Time= Alarm: Trip: Reset: Alarm; Trip: Reset: Out No A No Ir=-.7, tr= 16 Current= Time= Alarm: Trip: Reset: Out No A No Ir=.7, tr120 Current= Time-- Alarm: Trip: Reset: Out No A No I1r.7, tr=24 Current= Time= Alarm: Trip: Reset: Out No A No Itr.8, tr=.5 Current- Time=_ Alarm: Trip: Reset: Out No A No Ir-.8, tr=.5 Current= Time= Alarm: Trip: Reset: Out No A No Ir=-.8, tr=2 Current- Time= Alarm: Trip: Reset: Out No A No Ir-.8, tr=4 Current= Time= Alarm: Trip: Reset: Out No A No Ir=.8, tr--8 Current- Time= Alarm: Trip: Reset: Out No A No Ir=.8, tr=12 Current- Time= Alarm: Trip-: Reset: Out No A No Ir=. 8, tr= 16 Current- Time-Alarm: Trip: Reset: Out No A No Ir=.8, tr=21 Current=- Time= Alarm: Trip: Reset: Out No A No Ir=.8, tr=24 Current= Time=;: Alarm: Trip: Reset: Out No A No I1r-.9, tr=4.5 Current= Time= Alarm: Trip: Reset: Out No A No Ir=.9, trl-.5 Current= Time= I_ I I II\I/Alarm: Trip: Reset: CDý Out No A No I=-1.9, tr2 -Current= Time= VVTP-04218 1-1, Rev. I Page 25

Alarm: Trip: Reset: No I-.,t4Cret- Time= Out out No No A A No Ir=.9, tr=4 Current.= Alarm: Trip: Time= Reset:, Alarm: Trip: Reset: Out No A No I1r.9, tr=8 Current- Time-- Alarm: Trip: Reset: Out No A No Ir=.9, tr-12 Current- Time-- Alarm: Trip: Reset: Out No A No Itr.9, tr-l6 Current- Time= Alarm: Trip: Reset: Out No A No Itr.9, tr-20 Current- Time_ _ Alarm: Trip: Reset: Out No A No Ir=.9, tr=24 Current t Time= Alarm: Trip: Reset: Out No A No Ir1-l, tr=.5 Current= Time-- Alarm: Trip: Reset: Out No A No Ir= 1, tr-l Current=- Time-- Alarm: Trip: Reset: Out No A No Ir-1, tr-2 Current= Time=

                                                                                            -Alarm:         Trip:   Reset:

Out No A No Ir- 1, tr=4 .Current- Time= ___ Alarm: Trip: Reset: Out Yes A No Ir=1, tr=8 1 X Current= _____ Time= 51. 1 Alarm: Trip: Reset: _4 Out Yes A No I1r1, tr=12 o Current' Time *A* I 1r1l, =tr~l 6 o- S*- tc Alarm: Current= }I,-& Trip:-, Time= j. Reset: £'T Out Yes A No ___ __________ .... ~ ( Alarm: Trip: Reset: ____ Out Yes A No Ir1l, tr=20 Current- Time= Alarm: Trip: Reset: Out Yes A No Ir=l, tr=24 k.Current= Time= ____ ______ ___......___ _____ _________ ___________ Alarm: Trip: Reset: ____ VVTP-042181-1, Rev. I Page 26

Check off appropriate test: 7 TEST DATA SHEET 0l PRE-SEISMIC 0 POST-SEISMIC -0l DEDICATION 0' OTHER TEST DATA FOR: [VTP -0q'[;-1f1- /Zu..j Item Description /]os-tr" W, A--rW Manufacturer/Vendor:  ! a,,-, b Model/Part No. A)ul 3.. H.2-kAA.WCC., C. f '.0r .. Provide Summary of Test Results. Check appropriate boxes: HAll Items Passed, Discrepancy Report(s): If yes, identify below: EYes -No EN/A List SIN or ID Passed below, Qty passed: S/Ns or ID# CC# DR# Acceptable SNot Acceptable Initials/Date by PE: Acceptable SNot Acceptable Initials/Date by PE: Acceptable SNot Acceptable Initials/Date by PE: Acceptable SNot Acceptable Initials/Date by PE: Acceptable SJNot Acceptable Initials/Date by PE: OTHER (where applicable) Record all M&TE used: NLI MTE# M&TE CAL. DUE DATE NLI MTE# M&TE CAL. DUE DATE U"pdate M&TE log on computer - Performed by; Date 51c 4 Y1' NOTES: Verified by:_ Date _ _ QQ Approved by: Date S r& NOTE: Initial and date after performance of each CC#. Indicate Pass or Fail. Page:27- of Z+ Form-No. T-1004, Rev. 3

Validation Test Plan for Square D/Schneider Micrologic Programmer VVTP-042181-1, revision 0 Attachment I Data Recording Record the following data, as applicable:

  " Programmer model and s/n.                        /II               ?&)1q5
                                                                        .0 P/A): *      *}31

• Programmer code name and revision. L. 13,.0
• Breaker model and s/n. Aif74,JAiW 314. 2 I/MJ: O6, 3VII0101

  " Rating plug model and size.                      32c200,Ai? P/I: 1I125 - E PERFORM CC#3, 4, 5A, 5B AFTER THE OTHER CC'S ARE COMPLETED.

CC#1, #1A to 1E. #2, #6 #7, #8 PRIMARY JECTION TESTING Objective. The purpose of this testing is as follows: o (CC Test some combinations of switch settings on the trip unit. o (C#1 A)Nrogrammer operates on Square D Masterpact NT or NW breaker. o (CC#1 B) rogrammer operates pet design with the rating plug installed. o (CC#1 C) 0 ut alarms are per design. o (CC#1D) Re te communications, alarms and interlocks do not impact trip unit operation. o (CC#IE) No spun'us tripping. o (CC#IF) Programm trips per curve with and without reset. o (CC#2) Test to verify at loss of power will not impact the trip unit settings. o (CC#6) Test to verify tha battery removal or a dead battery will not impact the trip unit safety function. o (CC#7) Verify that recalling formation from memory will not impact the trip unit safety function. o (CC#8) Verify that secondary inje 'on testing does not impact the settings or trip unit function. o Primary injection testing of the defeat ctions is tested separately in CC#9.

• Initial Conditions o Programmer installed on the NT or NW bre .er o Primary power to the bus and trip unit powere
• Test Sequence-Primary Injection o Perform secondary injection testing and record th suits (the purpose of this step is to verify CC#8). Record trip settings, trip time, and S SAT:
• Instantaneous test #1:
• Instantaneous test #2:
• Short time test #1:

W Short time test #2: a Long time test #1: c *7[VVTP-042181-1, Rev. 0 Page 10°

off Alarm: Trip: Reset: Out Yes C No Isd= 0, tsd=O Current- Time= off Alarm: Trip: Reset: Long Time Out No C No Ir-.4, tr-.5 Alqw 4oc$3'. 0 Current- 374 0 A Time= .

                                      ..- Z.,.                            Alarm: 'Je$ Trip: WS Reset:.e.

Out No C No Ir=.4, trl ,e *, Current= 3SqO A Time=.A]Se, S-3,,,,..- .5c, . &T 1"2)C f- Alarm: ' Trip: ,be% Reset: 't S fiaT7 Out No C No Ir=.4, tr=2 1 Current- 38qO A Time- 7.0 se (,.Z.<v,.- q.e. Lo V,-5r"'oj55 Alarm: 'e, Trip: LOe5 Reset: ý, 5.7r. Out No C No Ir--.4, tr=4 Current= 3JgoA Time= L/.2¢* ."- ___c-- 2_s__ Alarm: Ye5 Trip: fej Reset: Yr Out No C No Ir=.4, tr=8 Current= ,.O A Time= 2'q.24 k _* c -. 7_*___ Alarm: w. Trip: -ec, Reset: "5c-s, Out No C No Ir=.4, tr=12 Current-- 360 4 Time= 1&7/1s 4159C - £jsec. Alarm: ,.es Trip: tzcp Reset: , Out No C No Ir=.4, tr=16 Current=.340oA Time--c .L5,a 52.- . sec., ____ Alarm: ge- Trip: cAe, Reset: -es, Out No C No Ir=.4, tr=20 Current=_394g A Time= 7Z .772c _ ..S, .S.3 see Alarm: As Trip: ,.ce5, Reset: 'ts. Out No C No Itr.4, tr=24 Current= _"lV'16 A Time- 9-5.3'/¢c ..- 93- 12$ sec. Alarm: ,-jc_, Trip: kes Reset: wcs Out No B No hr=.45, tr=.5 Current- '4320 A Time= 1. se'-

                        ,,,.3~c~         2 '~Sc                           Alarm: Aa'    Trip:      ac> Reset: -es            _

Out No B No Ir-.45, tr=l Current= g3zb A Time= e g5- _._-- -- 4 __ec- Alarm: '-eg Trip: %es Reset: j.s Out No B No Ir=.45, tr-2 Current= 432o A Time= 72 :cc (,. 2 ec - C .. Alarm: : *es Trip: '6c! Reset: 'ýet __.__ Out No B No Ir=.45, tr=4 Current= q320 A Time= Ao.6 ls~c.- 2O:;ec. Alarm: L3* Trip: %Js Reset: , ___"" Out No B No Ir=.45, tr=8 Current- '4320 A Time= 2?.11:5c _____1__ c--_

                                                  .                       Alarm: se5 Trip: L*et         Reset:    *,S Out ... No . No         IF45.tr=l2                .             -        -Time=-                            J--           5         7 4I.Set - 5(~ec..

CD A&t~ VVTP-04218" Rev. 0

                                                                                                                                  .... age 25

                                                                                                                       '4 Alarm: ge Trip: Ues       Reset: 9 es Out No B No        Ir.45, tr=-16              4:o.L,'c         . 3 .Oc  Current-L!320A            Time- -5.ja

_2___. -_ Alarm: y3e. -Trip: A c, Reset: c.e" Out No B No Ir=.45, tr=20 Current- 1'32M/ Time= lZL3sz.t Scc6 I_ - 13 5,.. Alarm: _qe Trip: c es Reset: asL Out No B Yes Ir=.45, tr=24 Current- 9(32,4 Time= $4.05 V.Se,&__ -. /25jc,. Alarm: _ Trip: Lots Reset: U!i _ _ Out No B Yes Ir=.5, tr-.5 Current- qjgo4 Time= /-mait

                ). 3 6_ -_2._*__                                          Alarm: UJyý Trip: %es Reset:      jes      -

Out No B Yes Ir-.5, tr-l Current= itgleb,# Time= 3.77.e . ____,."- l- _,'__ I. Alarm:;e Trip: fgts, Reset: b es, Out No B Yes Ir=-.5, tr=2 Current= 4 31 L Time= 1.o 5et _,.Zc_- ,9scc. Alarm: -j Trip: q v Reset: tdJ . ' Out No B Yes Ir=.5, tr-4 Current-- 4*i*Yod Time= / ,.37*e, 1/ tce. - Z*.,ec. Alarm: L.3: Trip: ,d, Reset: ,et S"7/ Out No B Yes Ir=. 5, tr=8 Current= 419206,4 Time= a2q.'IL30-25!es--5ec. Alarm: Life$Trip: '6es Reset: ý-f-Out No B No Ir=.5, tr=12 Current= ,OW-4 Time= 4(i2Zse. 1414r_,. - 5C4c. Alarm: Trip: qcs Reset: !I Cs

                                                                                       -c Out No B No          Ir=.5, tr=16                                       Current= !yýA 4           Time= 5. 72s-           ..-

_Zse-,._-- 451____

                                        ;                                 Alarm: ge,    Trip: ,e3   Reset: !jea        _           _

Out No B No Ir=.5, tr=20 Current- 4/1'0#4 Time= 72./'Is.T ___ _. -_ 3 r'-s . I Alarm : L ,e5 Trip: ,.es Reset: '-esa Out No B No Ir=.5, tr=24 Current= 4ftX Time=

                &3_s.-   cc._                                           _ Alarm:        Trip: t&5   Reset: *                    (

Out No B No Ir=. 6, tr-.5 Current 576c A - Time=/, 7-'5. __.3 *.-. 2..3sco_, Alarm:L .Trip: Ue,, Reset: 5,1-Out No B No Ir=-.6, tr=l Current- 574O, Time=

c. Trip: Reset: ce."

Out No B No Ir=.6, tr-2 Current. fgO4 Time= * "5-"

                 ,.2 :           -~c.          ______,_Alarm:                     _"e Trip          Reset:            L Out No B No            Ir=.6, tr=4                                      Current7-5164.4           Time= /*'/ M-c

• asec~. - 25cc. Alarm: qsTrip: M$ Reset: 5 Out No B No Ir=.6, tr=8 Current= .5746A Time= .21.74'.is ."i

5) . c - 7 scc.

VVTP-0421F Rev. 0 Tom plsýý A ýýAny ....,age 26

                                                                                                                                        '4 Alarm: Ya Trip: q         Reset: _+/-4F        45_-7 Out             No     B        No           Ir=.6, tr=12         MSiCS6lko¢ 3,O          Current= _,7*O,4          Time=

____ -llc,- see. Alarm: !I e f Trip: !m'5 Reset: - ._____ Out No B No Ir=.6, tr=16 Current= 574 ,4 Time= f 7-0$ 6L sec - Oe_. Alarm: L4w. Trip: me, Reset: ,a ____- Out No B No Ir=.6, tr-20 Current- M7,04 Time= 7106,5e, Out__ 4sec* - s3c. Alarm: te5 Trip: *je5 Reset: _e_-_" Out No B No Ir=.6, tr=24 Current*= A Time= outNo A5cc- 1 ____.Alarm: 4& Trip: ý3e Reset: H 5a7 Out No A No Ir=.63, tr=.5 Current= &X '?" Time= [. I 'scs 3$,cI.3s - 2.50c, Alarm: 3 Trip: ies, Reset: WE__5& Out No A No Ir=-.63, tr=l Current= 407-4 , Time= 5. 5c - 1.5se,:, Alarm: te Trip: t4es Reset: 5cx, Out No A No Ir=.63, tr=2 Current=7_4gj#" Time= 3, 5-gc _,,._f _ _.. Alarm: "es Trip: cec, Reset: _,____ Out No A No Ir=.63, tr=4 Current= 44 ,(3,, Time= 15. e,- 135 ec - 20 0c - Alarm: Lt4e Trip: _qc, Reset: .__e__- Out No A No Ir=.63, tr=8 Current . 6'g,4 Time= .9.ZZI 2*sc. --.57 :*,.. Alarm: c,Trip: , , Reset: .___. Out No A No Ir=.63, tr=12 Current= 1=4W'A Time= ./544*. q_ __.-.614le__ _ Alarm: 4,n Trip: q Reset: g-Ae . Out No A No Ir=.63, tr=16 Current= 4(*6474 Time= (.O.(Aqs .

                                     .5zS cc -          *::-S,.'                         Alarm: eS Trip: ,es Reset: ie5, Out             No     A        No          Ir=.63, tr=20                                 Current= tq"',d   W       Time= 75,4
                                     ,*st.-- ISS                                        Alarm: tA..c Trip: W Reset:                  SaT Out             No     A        No         Ir=.63, tr=24                                  CurrentOq'44              Time=--5 Sc,,.-- 1,cc.                                Alarm: Lim Trip: 4,c, Reset:

Out No A No Itr.7, tr=.5 Current= _41'A-,4 Time= 1.s n

          *1._    _.3                          - 2.5: Ie,-.                              Alarm: je Trip: (4e% Reset:                   .541--

Out No A No Ir=.7, tr-=l Current. -: 20.. Time= &.*"ie,-.

                                             -Li.5 set.                                  Alarm: _!.f, Trip: q -,, Reset: ,US Out             No     A        No            Ir=.7, tr=2                                 Current=      72oMA       Time= 74kc.

I-z N-oc-A -ct Alarm: Trip: e__ Reset: _qetT Out No _A I _No Ir-.7, tr=-4 Cu#ent-- -47ZO Tim lPq~gga 15a.7" 13 -ZO .5c VVTP-0421 F Rev. 0

                                                                                                                                            - age 27

Alarm: tbe5STrip: qe Reset: A 5.a7-Out No A No Itr.7, tr=8 MIceOL.oSIc to.0 Current-= tf'2b,4 Time= ,.M 3125S3lec. Alarm: ýI.s Trip:,-jes. Reset: I-Out No A No Ir=.7, tr=12 Current=-- 4726 Time= 2,,

             '41 -51 $ec.                              Alarm:      e Tr:           Reset:                  .5a-Out No A No        Ir=.7, tr=16                         Current=ý244                Time--51' S,,.ce 6_Z-- (-S :5.                        __-, Alarm: _tS Trip: *e5 Reset: :jet, Out No A No        Ir=.7, tr=20                          Currentz ZrX               Time= 7$'.5Cs'c                    -

(5 -'3 sce., Alarm: _qo Trip: t eReset: 3 es ___ Out No A No Ir=.7, tr=24 Current- ,4- Time= _V,05cCt, 13 -i2S -,c-. Alarm: 9es Trip: jS, Reset: !___ Out No A No Ir=-.8, tr=.5 Current-- WVA s Time= 7. Is e,. 1.3- 2.3 5cc.. Alarm:,-, Trip: L., Reset: !de_ Out No A No Ir=.8, tr-=l Current 9'4M,4 Time= 1 _4ec,. 3 -4.5 ,', _ Alarm: _> Trip:; c__Reset: Out No A No Ir=.8, tr=2 Current= 7I40, Time= L.qs . L-_ -2 ,ccs Alarm: Q Trip:,a Reset: ,,z ./ Out No A No Ir=.8, tr=4 Current= 7ZP',* Time= 1.,_,

            ) 3 - zosec.                               Alarm: c.3e Trip: tk*,      Reset:  &ý e          ____

Out No A No Ir=.8, tr=8 Current- 7Z',"OA Time= M.,X cc. Alarm: cia Trip:Me Reset: 5451 Out No A No Ir=.8, tr=12 Current- 7 Z, I4 Time= 9V.o'075 " _-//- 5/5,ec Alarm: c5/.sTrip: _ Reset: qes Out No A No Ir=.8, tr=16 Current-- 74'L4,4 Time= .1 _52-C- Sec. Alarm: tjsTrip: $1Z Reset: 5...e, Out No A No Ir=.8, tr-20 Current :; Time= 79.0p Out -93 sc,

                     'Les                              Alarm: AIt Trip:            Reset:              ..:,         (

Out No A No Ir=.8, tr-24 Current= 7:'M Time= _?2-__s *2*5 .Alarm: _q0 Trip: !je. Reset: q CS Out No A No Ir=.9, tr=.5 Current=f Time= I,

             ,e -2, 5e-.c                              Alarm: ti_ Trip: ueý        Reset:              __S___

Out No A No Ir=.9, tr=l Current= ' Time= ___ .Lj.5 ___ IAlarm: Aes Trip: !4e Reset: &4es I Out No A No Ir=.9, tr=2 Current J 1-Z10 X Time= .2.sec J.. (..2- q . 4TOA~ £/7/c ~f VVTP-0421' " Rev. 0

                                                                                                          ..... ,,-,age 28

T 1 Out No A No Ir=.9, tr=4 Mi;cco-a;t. 3.0 Current=-- @, Time= 15*,$40.; Out No A No JI-,20* Ir=.9, tr=:8 ___Alarm: ut Trip: Current-- f941,0

                                                                                                        , Reset: ,5gs Time= 3o. 7'/e.

O25 -3 '1 I Alarm: t Trip: . Reset: , ____ Out No A No Ir=.9, tr=12 Current=- 7940.4 Time= /4(r9%:z W_-51"/cc. Alarm: e Trip: ,4 Reset: ._e___ Out No A No Ir=.9, tr=16 Current=I Vyb.4 Time--kijLZ7 ___- _ _ _ Alarm: , Trip: Reset: Y, I Out No A No Ir=.9, tr=20 Current- 921,06A Time= 70'5.%s _* - 73 Sec. _ Alarm: *.,, Trip: !Ae, Reset: 4.e, Out No A No Ir=.9, tr=24 Current- SL y/o 4 - Time= "W.2.¥.5sa

                           ...             -z5 i5c-.                             Alarm: ts Trip: _es      Reset: 4.es_

Out No A No Ir=1, tr=.5 Currentý4ý*%4,0 Time--

                                     ).3-2.3,.                                   Alarm:      L Trip:",,   Reset: esl.                      -

Out No A No Ir=1, tr l Current- gt,ýA - Time= I,*.5?,c 1,3_-4'.!5__ ee, Alarm: lef Trip: .je Reset: ,f e .5sr Out No A No I1r"1, tr=2 Current- &40o4 Time= 7 ".-rc _ _.Z-f Sec. Alarm: qa Trip: tie. Reset: ,= Out No A No Ir-1, tr-4 Current=- !_4__ Time= I!jg*.5st.

                                     /41 -zo .,ýc.                               Alarm: _4g Trip: Isa     Reset:-S                 a.

Out Yes A No Ir1l, tr=8 Currentz= W-g6,4 Time= i.765e V __,75 -- 05.,.- Alarm: oe, Trip: 4,,Tx Reset: %. -- Out Yes A No Ir1, tr= 12 Current'g fojCDW - Time= -;.s

                                     -//-61 6et.,                                Alarm: je Trip: (4       Reset: e. c Out  Yes         A           No         Ir= 1, tr= 16                          Current=q'?,/W      -    Time= - /c                         ~1 52--ag :5c..                                Alarm: q.* Trip: '_t     Reset: 4_,.        50*A Out  Yes         A           No         Itr1, tr=20                            Current:9 9160A          Time=              5."t Out_ Yes_        A_____      No_  i-'Alarm:                                            ýQ Trip: .s,     Reset: jes Ou Ys     A           No    OutIr1, "Ye_tr-24                             Current;:-     d         Time= -q2        ,             "

____-._Alarm: geo Trip: 4 Reset: e _s, A pssI h LA VVTP-04218' Rev. 0

                                                                                                                                   ....ige 29

Check off appropriaw test: TEST DATA SHEET El PRE-SEISMIC 0 POST-SEISMIC N DEDICATION M OTHER TEST DATA FOR: VP- VVr?- 0q211-I : ea, / Item Description //4 %go ae7"_ W W /i7%

4) Manufacturer/Vendor: .5'qaaue D, Model/Part No. AJW .32-/2.

A4a'c*ok1ic .C) -42P 'aA.WT ,It"rULo JA1UL J. 'yW~ Check ropriate boxes: IIAl Items Passed. Discrepancy Report s): If yes, identify below: [:]Yes [ T [-N/A List S/N or ID Passed beloo , . t,Q assed: 3 / Mi31't~b)C

                            'nIIN SINs or ID#                            CC#f         DR#

Acceptable -Not Acceptable Initials/Date by PE: Acceptable LNot Acceptable Initials/Date by PE: Acceptable =Not Acceptable Initials/Date by PE:

                                                                          -Acceptable [Not Acceptable  Initials/Date by PE:
                                                                          -Acceptable .Not Acceptable  Initials/Date by PE:

OTHER (where applicable) Record all M&TE used: NLI MTE# M&TE CAL. DUE DATE NUI MTE# M&TE CAL. DUE DATE EI15pate M&TE log on comnputer~ Z/7/e' efre y Date _5/710q Initials & Date NOTES: Verified by:. Date-/ Approved by: A Date NOTE: Initial and date after performance of each CC#. Indicate Pass or Fail. Page 7 of 7 Form No. T-1004, Rev. 3

1ý1L /tnvst.s L )R.-j- .oo Ao-Ac-%-f 11~40.C C&dC a. 4T-*-3 C- Si3tA4 A'tE 4.s t ,,; 130 C,,AE 97-1. VrA. 13,lro.: 1- .0 3~oiC / s-I v

   * .1.II.

BA-Coh. S~-.%,cM. ltoý 04c.J4 OOMOf3S

• It-PON ol 3 43~o 0:5 -wsa t II It

*        [~.
    *    ~I.

• 4+ ....

II L Ii .. I, -. I- .... Li..

MASTERPACT NTINW Universal Power Circuit Breakers Section 7: Trip Curves SECTION 7: TRIP CURVES Page MICROLOGIC 6.0 A/PIH TRIP UNIT WITH ADJUSTABLE GROUND-FAULT PICKUP AND DELAY Ground Fault 12 t OFF and ON, 1f- 400 A ............................................ 144 Ground Fault 12t OFF and ON, 400 A < In !- 1200 A .................................... 145 Ground Fault 12 t OFF and ON, In> 1200 A ........................................... 146 MICROLOGIC 5.0/6.0 AIP/H TRIP UNIT Long-time Pickup and Delay, Short-time Pickup, and 12 t OFF Delay ....................... 147 Short-time Pickup and 12t ON Delay ................................................ 148 MICROLOGIC 3.0A TRIP UNIT Long-time Pickup and Delay ...................................................... 149 MICROLOGIC 5.0/6.0 NP/H TRIP UNIT Instantaneous Pickup, 2X to 15X and OFF ........................................... 150 MICROLOGIC 3.OA TRIP UNIT Instantaneous Pickup, 1.5X to 12X ................................................ 151 MICROLOGIC 2.OA TRIP UNIT Long-time Pickup and Delay, Short-time Pickup with No Delay ........................... 152 MICROLOGIC 2.0/3.0/5.0/6.0 NP/H TRIP UNIT Instantaneous Override Values ..... ......................................... 153

                        @ 1999-2001  SchneIder Electric ANRights Reseived 1999-2001 Schneider 143 Mo 6/01 6/01                  @                      Electric ADRights Reserved
                                                                                          \jv-x? -04vi- 1 1wril

MASTERPACT NT/NW Universal Power Circuit Breakers Section 7: Trip Curves MULTIPLES OF SENSOR RATING (In) MICROLOGIC 6.0 A/P/H Trip Units with Adjustable Ground-fault Pickup and Delay Characteristic Trip Curve No. 613-1 Ground Fault 12t OFF and ON I :5400 A The time-current curve information is to be used for application and coordination purposes only. Curves apply from -30°C to +60°C (-22°F to +1400F) ambient temperature. 0 z 9 0 z C-e No. O6t3TCOMI MULTIPLES OF SENSOR RATING (in) 0-i No. 01999-2001 Schneider Electric Al Rights Reserved 6/0191 Qý sg

MASTERPACT" NTINW Universal Power Circuit Breakers Section 7: Trip Curves a MULTIPLES OF SENSOR RATING (In) MICROLOGIC 6.0 AIPIH Trip Units with Adjustable Ground-fault Pickup and Delay I Characteristic Trip Curve No. 613-2 Ground Fault 12 t OFF and ON w - 400 A <In !1200 A J i. I I i-A -4 I...- II tz:e 1580i.- 1,w41 The time-current curve information is to be used for application and coordination purposes only. Curves apply from -30°C to +60°C (-22°F to +140°F) ambient temperature.

 .0 z_

a= U-C-., No. 0613TC0002 MULTIPLES OF SENSOR RATING (In) D-L N.48V430 DR - 6101 © 1999-2001 Schneider Electric All Rights Reserved 145 16 .3cý

MASTERPACT! NT/NW Universal Power Circuit Breakers Section 7: Trip Curves AMPERES x 10' MICROLOGIC 6.0 AIP/H Trip Units

         ~..

with Adjustable Ground-fault Pickup and Delay

                                +

Characteristic Trip Curve No. 613-3 A ., .... 4e* Ground Fault 12 t OFF and ON 74ii 1, > 1200 A

             .-  44   -L  L!
                                       +

_T The time-current curve information is to be used for application and coordination purposes only.

         'T1                                                                   Curves apply from -30°C to +60°C (-22°F to +140°F) ambient temperature.
                                         -L!,.t.L..i.;... L .

i'- _Ai 74 0 z 0 SI

                                        !1 i

1

                                                                                       .t A
                    -1 WLE A4 CumNo. 06137C0003 AMPERES x 103                                  0*-.3w9Wo.948M"5-013-03 (461999-2001 Schneider Electric AnlRights Reserved                                  6/01 [

MASTERPACTI NTINW Universal Power Circuit Breakers Section 7: Trip Curves I CURRENT IN MULTIPLES OF Ir (Ir= LONG-TIME SETriNGx In) MICROLOGIC 5.016.0 AlP/H Trip Units

                                                               .=:=

s Characteristic Trip Curve No. 613-4 Long-time Pickup and Delay Short-time Pickup and 12t OFF Delay m4. The time-current curve information is to be used for application and coordination purposes only.

                                                                        ="P            Curves apply from -30'C to +60°C (-22°F to +140°F)

H ambient temperature. Notes:

1. There is a thermal-imaging effect that can act to shorten the long-time delay. The thermal-imaging effect comes into play ifa current above the long-time

                                      ....                                                delay pickup value exists for a time and then is I                         cleared by the tripping of a downstream device or the

_ - circuit breaker itself. A subsequent overload will cause the circuit breaker to trip in a shorter time than normal. The amount of time delay reduction is inverse to the amount of time that has elapsed since the previous overload. Approximately twenty minutes is required between overloads to completely reset thermal-imaging.

2. The end. of the curve is determined by the

                                                         -              ,-interrupting                  rating of the circuit breaker.

3. With zone-selective interlocking ON, short-time delay utilized, and no restraining signal, the maximum unrestrained short-time delay time band applies regardless of the setting.

4. Total clearing times shown include the response times of the trip unit, the circuit breaker opening, and the extinction of the current.

F 15. For a withstand circuit breaker, instantaneous can be turned-OFF. See trip curve 613-7 on page 150 for instantaneous trip curve. See trip curve 613-10 on page 153 for instantaneous override values.

6. Overload indicator illuminates at 100%.

T I* CURRENT IN MULTIPLES OF Ir "Q o,. No. 40639OO04 (Ir w.LONG-TIME SETTING x In) w No B410S130 liii Lý- 6101 0 t999--2001 Schneider Electric AMRight s Reserved 147

MASTERPACT! NTINW Universal Power Circuit Breakers Section 7: Trip Curves CURRENT IN MULTIPLES OF Ir (tr = LONG-TIME SETIfNG x In) MICROLOGIC 5.0/6.0 AlP/H Trip Units Characteristic Trip Curve No. 613-5 Short-time Pickup and 12t ON Delay

RT"

                                                                                  '=       The time-current curve information is to be used for
                 ":I".                                .-.........
                            *,"                                                                 application and coordination purposes only.

_ Curves apply from -30°C to +60 0C (-22°F to +140°F)

                                =,

• ambient temperature.

j1. There is a thermalmaging effect that can act to

-shorten 4 IT " comes into the play ifa current long-time delay. above the long-time delayd The thermal-maging effect FT_ i- pickup a value exists for a time and then is cleared by the tripping of a downstream device or the circuit breaker I itself. A subsequent overload will cause the circuit

                                                                                         . breaker to trip in a shorter time than normal. The
            ":"        ':i'amount                                                                     of time of time that    hasdelay   reduction elapsed           is inverse since the           to the amount previous  overload.
                         ,*

• overloads to completely Approximately twenty minutes is required between reset thermalo-maging. i 4 Theend pi2. of the curve is determined by the interrupting rating ofthe circuit breaker.

                                                                .,                     3. With zone-selective interlocking ON, short-time delaycr 14 11                    '1utilized,                            and no unrestrained         restraining short-time      signal, delay  time the   maximum band  applies regardless of the setting.

4. Total clearing times shown include the response times 2 T of the trip unit, the circuit breaker opening, and the

     ,                                                                                     rn5.

For withstand circuit breaker, instantaneous can be L turned OFF. See trip curve 613-7 on page 150 for uinstananneous trip curve. See trip curve 613-10 on page u153 for instantaneous override values.

         .....                                                                         6. See Trip Curve 613-4 on page 147 for long-time pickup A                                                                 =                  and delay trip curve.

T *-, CURRENT IN MULTIPLES OF Ir Ctrip No.o66oTcoC16

• .I, LONG-TIMESETTIG X In) Dmw'N No. N1B9fi13-*5 14199-2001 Schneider Electric All Rights Reserved 6/01 page

MASTERPACT@ NTINW Universal Power Circuit Breakers Section 7: Trip Curves CURRENT IN MULTIPLES OF Ir(Kr= LONG-TiME SETTING x In) MICROLOGIC 3.OA Trip Unit

                                                  -R   -1            S     S2a!

OR Characteristic Trip Curve No. 613-6 .3 Long-time Pickup and Delay

     ....I--l-f- It-1I*I                                                      nil L,,,I               ~xL2.-Ir             1...        ~LiLL.J._LL_

4. .......

F The time-current curve information is to be used for application and coordination purposes only.

                                     -T

__4 I....... Curves apply from -30°C to +60°C (-22°F to +1400F) ambient temperature. Notes:

                                       +
             -q--rl                                                    7H-4-11             1. There is a thermal-imaging effect that can act to shorten the long-time delay. The thermal-imaging effect comes into play if a current above the long-time delay pickup H                      value exists for a time and then is cleared by the tripping of a downstream device or the circuit breaker itself. A subsequent overload will cause the circuit breaker to trip in a shorter time than normal. The amount of time Fli 4                                  delay reduction is inverse to the amount of time that has elapsed since the previous overload. Approximately twenty minutes Is required between overloads to
                                                                            -F +

completely reset thermal-imaging.

2. The end of the curve is determined by the instantaneous setting of the circuit breaker.

3. Total clearing times shown include the response times of the trip unit, the circuit breaker opening, and the 0

0 + extinction of current. zj

4. See trip curve 613-8 on page 151 foe instantaneous

                    . ......                                                                    pickup trip curve.

t r

                                         -i
                ...                                             1 4-
                                       +r t 74 T
                                                                 ÷-"P',I t-H-eere
      -T1 I I I                                                                        lcti CURRENT INMULTIPLES OF Ir                    Scnedr 5lR3hs (Ir= LONG-TIME SETTING x In)                         0-9e NO.

0684eC 13-O

                                                                  ©99200 149 6/01                                               @ 1999-2001 Schneider Electric All Rights Reserved

MASTERPACT NT/NW Universal Power Circuit Breakers Section 7: Trip Curves MULTIPLES OF SENSOR RATING (In) MICROLOGIC 5.016.0 Trip Units a Characteristic Trip Curve No. 613-7

                         .,  +     A              ,Instantaneous   '                                       Pickup, 2X to 15X and OFF The time-current curve information is to be used for application and coordination purposes only.

Curves apply from -30CC to +60°C (-22°F to +140°F) ambient temperature. Notes:

1. The end of the curve is determined by the interrupting I=

L- rating of the circuit breaker.

2. Total clearing times shown include the response times of the trip unit, the circuit breaker opening, and the A*t 0extinction of current.

S .. 3. The instantaneous region of the trip curve shows maximum total clearing times. Actual clearing times in this region can vary depending on the circuit breaker T, mechanism design and other factors. The actual clearing time can be considerably faster than 4' indicated. Contact your local sales office for additional 4- fl information. -7nfopage150iornth

4. For a withstand circuit breaker, instantaneous can be turned OFF. See trip curve 613-7 on page 150 for the instantaneous trip curve. See trip curve 613-10 on 0 page 153 for the instantaneous override values.

5. See trip curve 613-4 on page 147 and trip curve U T* 613-5 on page 148 for long-time pickup, long-time

                                                   ,,,                              delay, short-time pickup and short-time delay trip
                    ;...                                                            curves-I   V J*J L4-MULTIPLES OF SENSOR RATING (n)                         c_    N..0B13TCs-07 150 Q1999-2001 Schneider Electric AH Rights Reserved                                          6101 M   ~

MASTERPACTO NTINW Universal Power Circuit Breakers Section 7: Trip Curves MULTIPLES OF SENSOR RATING (In) MICROLOGIC 3.0A Trip Unit S

    ¶0e-Characteristic Trip Curve No. 613-8
     '~FT                                                                          Instantaneous Pickup, 1.5X to 12X
     -     r
     -     E
     -     F                                                             The time-current curve information is to be used for application and coordination purposes only.

Curves apply from -30°C to +60°C (-22°F to +140'F) EIE ambient temperature. Notes: 4 I.- 1. The end of the curve is determined by the interrupting

       '.4-F                                                              rating of the circuit breaker.

2. Total clearing times shown include the response times of the trip unit, the circuit breaker opening, and the extinction of current.

3. The instantaneous region of the trip curve shows maximum total clearing times. Actual clearing times in this region. canvary depending on the circuit breaker mechanism design and other factors. The actual clearing time can be considerably faster than

         '.1-                                                             indicated. Contact your local sales office for additional information.

4. See trip curve 613-6 on page 149 for long-time pickup and delay trip curves.

0 z 0 0 z Is F I~II

         *1-
        'di 1--
      'I,   I--
       -    L cnmm,No: 0613TCCOO0 MULTIPLES OF SENSOR RATING (In)                 DnM*1g NO.B4A0S5t3-.O 151
                                       @ 1999-2001 Schneider Electric All Rights Reserved 1ý3 Ll

MASTERPACTO NT/NW Universal Power Circuit Breakers Section 7: Trip Curves CURRENT IN MULTIPLES OF b.(Ir = LONG-TIME SETTING x In) MICROLOGIC 2.OA Trip Unit

                                              ~       ~                                      Characteristic.Trip Curve No- 6113-9
                                                                         "   -Long-time                     Pickup and Delay
                                                                          ,                  Short-time Pickup with No Delay "i                I"                         '"         The time-current curve information is to be used for application and coordination purposes only.

Curves apply from -30"C to +60°C (-22°F to +1401F)

                                                                       -                             ambient temperature.

Notes:

                                                          -,,                   1. There is a thermal-imaging effect that can act to shorten the long-time delay. The thermal-imaging effect comes into play ifa current above the long-time delay pickup value exists for a time and then Iscleared by the tripping of a downstream device or the circuit breaker S,           itself. A subsequent overload will cause the circuit S-           breaker to trip ina shorter time, than normal. The amount of time delay reduction is inverse to the amount I          of time that has elapsed since the previous overload.

44 1 .. Approximately twenty minutes is required between overloads to completely reset thermal-maging. I 82. " The end of the curve is determined by the short-time

                   *                                                   :           setting.

3. Total clearing times shown include the response times

                                  -.                   -               "           of the trip unit, the circuit breaker opening, and the W,     J 11 1extinction                                                                      of current L4.
              ----                                                                 Overload Indicator illuminates at 100%.

T URN FI 4N J.rLS (ir =LONG-TIME SETINhG x In) D.IgNo B48095-613-O9 152

                                               @ 1999-2001 Sthnelder Electric AURights Reserved                                     6/01 D

MASTERPACTO NTINW Universal Power Circuit Breakers Section 7: Trip Curves MASTERPACT NWINT MICROLOGIC 2.013.015.016.0 A/P/H Trip Unit Inst. Inst. ANSI CB Override IEC CB Override Model No. (kA RMS) Model No. (kA RMS) Characteristic Trip Curve 613-10

                   ÷1-10%                  +1-10%

NW08N1

• NW08N1 24 None NWO8NI NWIONI None None Instantaneous Override Values NW16NI None NW12N1 None NW08H1
• 24 NW16N1 None NW08H1 None NW08H1 None NW16HI None NW10H1 None NW20HI None NW12HI None NW32H1 None NW16HI None NW08H2
• 24 NW20HI None NW08H2 None NW25H1 None NWt6H2 None NW32HI None NW20H2 None NW4OHI None NW32H2 None NW50H1 None NW40H2 None NW63H1 None Note:

NW50H2 None NW08H2

• 24 as Sa NW08H2 NWIOH2 85 1. Faults at or above instantaneous override value will be NW08H3 85 NW16H3 85 NW16H2 NW2Ha3 s NW20H2 85 85 cleared at twenty milliseconds or less.

NW32H3 85 NW25a2 NW40H3 None NW32H2 85 None NW40H2 85 NW5OH3 85 NW08L1

• 24 NWSOH2 117 NW08L1 36 NW63H2 117 NW16L1 35 NW20H3 65 NW20L1 NW25H3 65 NW32L1 117 NW32H3 65 NW40LI 117 NW40H-3 65 NW501I 117 NWOBL*

24 NW08HA None NWO8LI 35 NWt6HA None NW101L1 35

 .NW20HA            None       NW12L1          35 NW32HA            None       NW116LI         35 NW40HA            None       NW20LI None                       35 NW50HA None NT08N1 -*           24       NWt0H1O       None NT08N1            None       NW12HIO       None NTOH8*1*            24       NW16ISO       None NT08H1              42       NW20H1O       None NTOSNA            None       NW25HIO       None NW32HIO       None Inst. Override  NW40HIO       None
    *ULC Model No.             R1-10S) NWO8NA        None NW1ONA        None NW08N

• 24 NW16NA None NW08N 40 NW12N 40 NW08HA None NW16N 40 NW10HA None NW20N 40 NW12HA None NW16HA None NW08H
• 24 NW20HA None NWOH 40 NW25HA None NW12H 40 NW32HA None NW16H 40 NW40HA None NW20H 40 NW5OHA None NW25H 65 NW63HA None NW30H 65 NW40H 85 NWOSHF 85 NW50N 85 NWIOHF 85 NW60H as NW12HF 85 NW16HF 85 NW08L
• 24 NW20HF 85 NW08L 35 NW25HF 85 NWI2L 35 NW32HF 65 NW16L 35 NW40HF 85 NW20L 65 NW25L 65 NW08HA10 None NW30L 65 NWIOHA1O None NW40L 75 NW12HA1O None NW50L 75 NW16HAIO None NW60L 75 NW20HAIO None NW25HAIO None NWO8HF 40 NW32HAIO None NW12HF 40 NW40HAIO None NW16HF 40 NW20HF 40 NT081-1 None NW25HF 65 NT101N None NW30HF 65 NT12HI None NW40HF 75 NT16H1 None NW6OHF 75 NT08LI 10 NW60HF 75 NT08HI-10 None NT08N
• 24 NT10H10 None NT08N 40 NTt2N1O None
• NT12N 40 NT16H1O None NTO8H
• 24 NTO8HA None NTO8H 40 NT10HA None NT12H 40 NT12HA None NTO8L1 10 NTI6HA None NTI2L1 10 NTO8HA1O None NT08L 10 NT10HA10 None NT12L 10 NT12HAIO None 40 NT16iAlO None CoNe No. 061 37COOI NT08HF Drawing No. B48095-613-10 NT12HF 40
• Maximum sensor plug 250 A 153

    -6/01                                 © 1999-2001 Schneider Electric All Rights Reserved

Micrologic 5.OP and 6.OP Electronic Trip Units v PLogic-2002-AA Unidades de disparo electronico Micrologic 5.OP y 6.0P v PLogic-2002-AA Declencheurs 6lectroniques Micrologic 5.0P et 6.0P v PLogic-2002-AA Instruction Bulletin Boletfn de instrucciones Directives dutilisation Retain for Future Use. / Conservar para uso futuro. I A conserver pour usage ultdrleur. Schneider O Electric

                                                               \j V k

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page C. 1 Attachment C Failure Modes & Effects Analysis The Schneider Failure Modes & Effects Analysis (FMEA) is a proprietary document. This document is not included in the version of this report that is released to our clients. This document is available at the NLI facility for review. The following document is attached. This document provides a detailed summary of the Schneider FMEA.

• NLI report FS-042181-1, "Summary of the Schneider Electric Failure Modes and Effects Analysis (FMEA) for the Micrologic Trip Device", revision 0.

NLI NUCLEAR LOGISTICS INC

SUMMARY

OF THE SCHNEIDER ELECTRIC FAILURE MODES AND EFFECTS ANALYSIS (FMEA) FOR THE MICROLOGIC TRIP DEVICE FS-042181-i Revision 0 December 2005 7450 Whitehall Street

• Fort Worth, Texas 76118
• 817.284.0077
• Fax 817.590.0484 ° 800.448.4214
• generalinfo@nuclearlogistics.com www.nuclearlogistics.com

Schneider Electric FS-042181-1, Rev. 0 FEMA Summary Page APPROVAL

SUMMARY

OF THE SCHNEIDER ELECTRIC FAILURE MODES AND EFFECTS ANALYSIS (FMEA) FOR THE MICROLOGIC TRIP DEVICE This summary has been prepared in accordance with the NLI Quality Assurance Program. Prepared by Or Q0§) daqte Ji7do<f Verified by:. K,Z,41ý,' date /Z120 5' Approved by: id date ,2/Z/ o-

Schneider Electric FS-042181-1, Rev. 0 FEMA Summary Page ii REVISION HISTORY Revision Description Date 0 Original Issue 1212w-/05

Schneider Electric FS-042181-1, Rev. 0 FEMA Summary Page iii TABLE OF CONTENTS 1.0 Introduction 2.0 Objectives of the Study 3.0 Applicable Reference Documents 4.0 FMEA Methodology 5.0 FMEA Summary 6.0 Summary of Results 7.0 NLI Conclusions

Schneider Electric FS-042181-1, Rev. 0 FEMA Summary Page 1

1.0 INTRODUCTION

Schneider Electric performed Verification and Validation (V&V) of the Micrologic trip device in accordance with European standards. NLI performed V&V of the Micrologic trip device in accordance with U.S. standards, as detailed in NLI report VVR-042181-1. The NLI V&V report took credit for the Failure Modes and Effects Analysis (FMEA) that was performed by Schneider Electric. This report summarizes the Schneider FMEA methodology and results. The following Schneider Electric document is summarized herein:

• Schneider report 5100513140-B, "Failure Modes and Effects Analysis PROXIMA release ELA version", dated 6/28/01. Note that the original version of the document is in French.

2.0 OBJECTIVES OF THE FMEA During the latter phases of the design of the Micrologic trip unit, the Schneider Electric design team performed an extensive Failure Modes and Effects Analysis (FEMA) to determine the reliability of trip unit and to identify opportunities to improve its reliability. The objectives of the FEMA were as follows:

• To quantify the reliability of the trip unit.

    " To comprehensively identify the probability of the failure of a critical component.

0 To predict the rate of client returns of the trip unit due to design failures.

    " To establish a plan of action to make the product more reliable (extend the mean time to failure).

3.0 APPLICABLE REFERENCE DOCUMENTS The following primary references are cited in the Schneider FMEA: Number Description 5 100 512 176-G Design Document 5 100 513 140-B Electrical Diagram MIL HDBK 217F Compilation of Reliability Data UTE80810 Compilation of Reliability Data Catalogue of Siemens & Component Reliability Data Matsushima components NF X50-153 Standard describing the M.I.S.M.E method

Schneider Electric FS-042181-1, Rev. 0 FEMA Summary Page 2 4.0 FMEA METHODOLOGY The following methodology was used by Schneider to perform the FMEA:

   " An external functional analysis was performed. This methodology shows the ties between the studied item and its environment in order to determine a failure relationship. The methodology used is M.I.S.M.E (method of systematic inventory of the surrounding environment). Note:

This technique was used as part of the functional and safety requirements analysis performed by the European Organization for Nuclear Research for the CERN Safety Alarm Monitoring System.

• An internal functional analysis by functional block diagram was performed in accordance with MIL-HDBK-217F.
• A dysfunctional analysis was performed showing the consequences of a failure on the operability of the trip unit.

   " Reliability calculations were performed in accordance with MIL-HDBK-217F. The results are summarized in section 5.2 of this report.
   " An A.M.D.E.C. quantified for a temperature of 40'C in a stationary environment. Note:

AMDEC is a technique used for the development of products and processes in order to reduce the risk of failures and to document the actions undertaken. It is part of the QS 9000 'whole quality system' methodology. 5.0 FMEA

SUMMARY

External Analysis. The M.I.S.M.E method addresses the trip unit's reliability in relation to the outside elements with which it interacts. The method is described in the standard NF X50-153. This approach identifies the exogenous variables that might adversely impact the reliability of the trip unit. The identified variables were:

a. Iron-core CT

b. Air-core CTs

c. LR Plug

d. External power

e. Physical environment

f. External communications

g. Connection with the circuit breaker

h. Operator (man-machine interface)

i. Connection to communications nexus.

Schneider Electric FS-042181-1, Rev. 0 FEMA Summary Page 3 Internal Analysis. This method addresses the trip unit's reliability in relation to and with the functional areas within the trip unit. This approach identifies the endogenous variables that might adversely impact the reliability of the trip unit. The identified variables were modular, hierarchical, and structural. A block diagram of the trip unit is presented below. Clint ap6nateur L cartehcdzmrfta. PWR+ - macwedoI Calibre eligain Sa.LMVN2S P.LULR opraleur,PMiN XIAGMGND Evaluation of Global Reliability. This method addresses the trip unit's reliability in relation to the sum of the failure rates of the components under the specified service conditions. The calculation was made with the RELEX 6.2 software, using the methodology described in MIL-HDBK-217 F. Both the Arrhenius methodology and physical testing methodologies were employed to gather data for the variables. Particular emphasis on was placed on hypothesized and historical failure rates of the following components:

a. MOS devices.

b. Capacitors.

c. Clocking devices

d. Printed circuit board materials and construction.

e. ASIC materials and construction.

f. Connectors.

g. Optical conductors.

h. Keyboard devices.

Schneider Electric FS-042181-1, Rev. 0 FEMA Summnary Page 4 Additional component types that were evaluated include the following:

a. Resistors.

b. Rotary switches.

c. Relays.

d. Integrated circuits.

e. Inductors.

f. Transformers.

Design of Subcomponents. The AMDEC methodology is an analysis of the component operation in the circuit and their effects on the functionality of the trip unit. The result of the analysis identified the following components as critical to the trip unit design:

a. Rotary switches.

b. MOS devices.

c. ASIC

d. Push-button switch

e. Optical coupler 6.0

SUMMARY

OF RESULTS The results of the FMEA are summarized as follows:

• There are no known hardware issues that exist for the ASIC or the microcontroller platform used for the four trip controllers.
• There are no known software issues that exist for the microcontroller platform used in the Ammeter, Power, or Harmonics trip controllers. The Standard variant does not include a microcontroller.

   " The total projected failure on demand has a probability of about 3.1 lx10 6 per hour 40'C in fixed service (NLI note: applicable to nuclear power plants). This probability is computed based on worst-case applications. The failure rate is based on excessively conservative data from the US MIL-HDBK-217-F. The actual operating history demonstrates that this kind of failure rate does not occur after the first year.
   " Two primary failure modes exist:

o Loss of clock (gate pulse).

                   " This postulated failure results in a loss of the ASIC's digital protection functions. The diverse analog instantaneous and thermal trip functions are maintained.
                   " This failure mode is considered a low probability event based on the simplicity of the design and reliability of the parts used. The equipment reliability documented above includes clock failures.

o Loss of 24 volt DC power.

• This postulated failure results in a loss of all ASIC protection functions, including the diverse analog instantaneous and thermal trip functions.

Schneider Electric FS-042181-1, Rev. 0 FEMA Summary Page 5

                       " This failure mode is considered a low probability event based on the simplicity of the design and reliability of the parts used. The equipment reliability documented in section 5.2 includes loss of the internal power supply.
                       " (NLI note: The 24 volt external power has not been certified for Class 1E applications by NLI).

• Both of these failures are acceptable as follows:

o These are hardware failures in the system and are not a function of the software. The hardware is manufactured with a minimum number of components and is highly reliable. o Hardware failure of a proven product like the Micrologic trip device, is a random event. Common cause failure of this type of hardware is not credible.

     " Other types of failures are less likely, including coordination failure, loss of differential protection, loss of communication, loss of display, and loss of overload indication.

NOTE: The concerns identified during the AMDEC analyses were made the subjects of a Schneider Electric corporate Six Sigmal program to identify and evaluate the critical components. The engineers evaluated and reworked the designs as necessary to minimize the risk of failure, based on risk informed analyses. They identified critical components and wrote tight specifications for"their suppliers. Components are qualified based on these specifications, which define the requirements as critical characteristics. 7.0 NLI CONCLUSION The following conclusions are made by NLI following review of the Schneider FMEA: The Schneider/Square D FMEA was performed in a rigorous manner and addresses the relevant potential failure modes. The FMEA identified two hardware failure modes that could impact the trip unit operation. These failure modes were determined to be acceptable. No potential failure modes have been identified that have unacceptable consequences. I Six Sigma is a disciplined, data driven approach and methodology for eliminating defects in any process. The term 'Six Sigma' refers to the drive to achieve six standard deviations between the mean and the nearest specification limit. Six Sigma companies use trained, certified staff to conduct measurement-based process improvement projects, designed to reduce variability and enhance quality. The methodology is based on their program's define, measure, analyze, improve, control (DMAIC) paradigm.

Masterpact Circuit Breaker V&V Report VVR-042181-1, Rev. 8 Nuclear Logistics, Inc. Page D. 1 ATTACHMENT D NLI V&V Plan VVP-042181-1

SOFTWARE VERIFICATION AND VALIDATION PLAN FOR SQUARE D MICROLOGIC TRIP UNIT Plan VVP-042181-1 Revision 1 June 2004

Micrologic Programmer V&V Plan VVP-042181-1, Rev. 1 Nuclear Logistics, Inc. Page i I, - APPROVAL SOFTWARE VERIFICATION AND VALIDATION PLAN FOR SQUARE D MICROLOGIC TRIP UNIT This plan has been prepared in accordance with the NLI Quality Assurance Program. Prepared by: a JI& date Verified by: date Approved by: "61c distj

• Micrologic. Programmer V&V Plan VVP-042181-1, Rev. 1I I Nuclear Logistics, Inc. Page ii REVISION HISTORY Revision Description Date 0 Original Issue 04/30/04 1 Added clarifications 6/Z/04

Micrologic Programmer V&V Plan VVP-042181-1, Rev. I1l Nuclear Logistics, Inc. Page iii TABLE OF CONTENTS 1.0 SCOPE 1.1 Scope 1.2 Codes and Standards 2.0 EQUIPMENT IDENTIFICATION 2.1 Equipment Configuration 2.2 Traceability of the Test Specimen to the Production Units 2.3 Safety Function 2.4 Human Machine Interface 3.0 SOFTWARE QUALITY ASSURANCE PLAN 3.1 Roles and Responsibilities 3.2 Required Documentation 3.3 Project controls 4.0 ABNORMAL CONDITIONS AND EVENTS 4.1 Environmental Service Conditions 4.2 Seismic Service Conditions 4.3 Electromagnetic Interference/Radio Frequency Interference (EMI/RFI) 4.4 Voltage Range 4.5 Infant Mortality of Electronic Components 4.6 Fault in Non Safety Plant System 4.7 Hardware/Software Faults 4.8 Loss of Power 4.9 Overcurrent Condition 5.0 FAILURE MODES AND EFFECTS ANALYSIS 6.0 REQUIRED SYSTEM CHARACTERISTICS 7.0 IMPLEMENTATION OF REQUIRED CHARACTERISTICS 7.1 Commercial Grade Audit of Square D/Schneider 7.2 NLI Testing 8.0 CONFIGURATION CONTROL 8.1 As-Supplied Configuration 8.2 Vendor Firmware Configuration Control 8.3 Plant Lifetime Configuration Control

Micrologic Programmer V&V Plan VVP-042181-1, Rev. i1 Nuclear Logistics, Inc. Page iv 9.0 EVALUATION OF RESULTS 9.1 Anomalies 9.2 Modifications 9.3 Results/Conclusions 10.0 QUALITY ASSURANCE 11.0 MEASUREMENT & TEST EQUIPMENT 12.0 DOCUMENTATION

13.0 REFERENCES

ATTACHMENT A: Equipment Data Sheets ATTACHMENT B: Seismic RRS

Micrologic Programmer V&V Plan VVP-042181-1, Rev. 1 Nuclear Logistics, Inc. Page 1 1.0 SCOPE 1.1 Scope This Verification & Validation (V&V) program was developed to demonstrate the acceptability of Square D Micrologic trip units to meet the requirements for the use of digital components in safety related applications is nuclear power plants. The Micrologic trip units are used in the Masterpact AC low voltage switchgear breakers (up to 600vac nominal). The trip units utilize ASIC technology. They are designed, manufactured, and tested by Square D's parent company Schneider Electric and upgraded for safety related applications by NLI. This plan documents the requirements for the V&V of the software/hardware used in the trip devices. The Micrologic device will be referred to as a "trip unit" or "trip device" in this plan. The specific range of parameters that will be addressed by this V&V plan are as follows:

• Standard, Ammeter, Power, and Harmonic models of the Micrologic trip device (3.0, 5.0, 3.OA, 5.OA, 6.OA, 5.0P, 6.OP, 5.OH, and 6.0H).
• All potential functions (LSIG) o Long time-delay.

          .o Short time delay.

o Instantaneous. o Ground fault protection.

• The safety function of the trip device is:

o Proper operation and breaker tripping per the curve. o No spurious breaker tripping/operation upon loss of power or other Abnormal Conditions and Events (ACE's).

• All other functions will be considered non-safety related:

o Displays, communications, interlocking, etc. will be considered to not be safety related functions. o This V&V program will verify that the operation, loss of operation, or malfunction of these functions will not impact the safety related function of the trip unit. o The basis for this is as follows: W Based on our experience, most plants will not require these options. V&V of these options would be on a case by case basis, depending on plant specific requirements. a V&V of the interlocking and communication features: would be significantly more complicated and would involve 50.59 issues that would be very plant specific. Qualification of the test specimen will be in accordance with reference 11. Dedication of the production units will be in accordance with reference 6.

Micrologic Programmer V&V Plan VVP-042181-1, Rev. 1 Nuclear Logistics, Inc. Page 2 1.2 Codes and Standards The software for the trip unit was developed under the controls of the Schneider ISO 9001 quality assurance program. The hardware and firmware are being dedicated for safety related applications by NLI under the controls of the NLI Nuclear Quality Assurance Program [I]. The applicability of the codes and standards are addressed in this section. These codes and standards form the basis for this plan. Note: Most of the codes and standards referenced in the specification are for control of the entire' software lifecycle. Many of the codes and standards are very prescriptive concerning the required activities and documentation. Since this project is the dedication of existing commercial software, only certain requirements of these standards are applicable. 1.2.1 EPRI TR-102348 Guidelines on Licensing Digital Upgrades This V&V plan meets the guidelines of this document. This industry document provides guidance on software design and quality assurance, commercial grade item dedication, environmental considerations including electromagnetic and radio frequency interference and human machine interface requirements. 1.2.2 IEEE 7-4.3.2-1993 IEEE Standard Criteria for Digital Computers in Safety Systems of Nuclear Power Generating Stations This V&V plan meets the requirements of IEEE 7-4.3.2-1993 as specified herein. The main body of this standard provides guidance for software developed under the controls of a nuclear quality assurance program and is not applicable to this plan since the trip unit firmware, was developed outside of the criteria in the standard. The main body and other Annex's of this standard were used as guidelines when developing this plan. The guidelines provided in Annex D, "Qualification of Existing Commercial Computers," were used to develop this plan which provides reasonable assurance that the integrated systems (software and hardware) satisfy the requirements necessary to accomplish the intended safety functions of the equipment. Specifically this plan reflects the objectives of Annex D including:

       & Identification of the safety function(s) that the computer systems and software must perform.

• Identification of the critical characteristics that the integrated system must possess in order to accomplish the safety function(s)
• Demonstration testing to validate that the characteristics are implemented acceptably.

Applicable sections of Annex F are used as a guide for evaluation of Abnormal Conditions and

Micrologic Programmer V&V Plan VVP-042181-1, Rev. 1 Nuclear Logistics, Inc. Page 3 Events (ACEs) which could negatively impact the capability of the trip unit digital controls. ACEs were evaluated to identify external events as well as conditions internal to the digital computer system hardware and software that have the potential to defeating the safety function. 1.2.3 EPRI TR-106439 Guidelines on Evaluation and Acceptance of Commercial Grade Digital Equipment for Nuclear Safety Applications This V&V plan meets the guidelines of this document. 1.2.4 ASME NQA-2a-1990, Part 2.7 This standard provides detailed prescriptive process and requirements for the development, procurement, maintenance and use of software as applied to the design of nuclear facilities. The process which is described is throughout the lifecycle of the software, from the requirements specification to lifetime maintenance of the system. Technical, test, and documentation requirements are specified for each lifecycle step. The standard is based on the lifecycle model in IEEE 1012. This standard is not applicable, since the software was not developed by the equipment manufacturers in accordance with the requirements of the standard. The software was previously developed, so many of the life cycle phases have been completed by the equipment vendors without performing of the specified steps. Many of the documents prescribed by this standard were not prepared by the equipment vendors. The lifecycle phases of the software will be evaluated. The procedures and processes used in each lifecycle phase will be documented. The results of each lifecycle phase will also be documented. The lifecycle phase model in IEEE 1012 will be used, as discussed in this plan. The applicable portions of this standard which have been incorporated into this plan are specified below. Section 10.2, "Software Developed Not Using This Standard," is applicable and will be met in it's entirety. This plan, in conjunction with the equipment manuals, verification and acceptance testing, and final test reports provides the required documentation and evaluations to:

1) Determine adequacy of the software/ firmware to support reliable equipment operation.

2) Identify the activities to be performed including documentation required to place the software/ firmware under configuration control including:

a) Application requirements b) Test plans and test cases required to validate the software/ firmware for acceptability

3) Satisfy user documentation requirements including:

a) User instructions b) Input and Output Specifications c) Input and Output Formats d) Description of System Limitations e) Information for obtaining user and maintenance support

Micrologic Programmer V&V Plan VVP-042181-1, Rev. 1Ij Nuclear Logistics, Inc. Page 4 1.2.5 IEEE 1012-1986 IEEE Standard for Software Verification and Validation Plans', This standard provides a detailed prescriptive process for the development of software verification and validation plans. The process which is described includes verification and validation tasks throughout the lifecycle of the software, from the requirements specification to lifetime maintenance of the system. Technical, test, and documentation requirements are specified for each lifecycle step. This standard is not fully applicable since the software/firmware was previously developed and verification and validation of many of the life cycle phases were not documented in accordance with the standard. The specific format, content, and acceptance criteria in this standard will not be used, since the firmware has previously been developed. The lifecycle model specified in Figure 1 of the standard will be used during the evaluation of the software. The following lifecycle phases will be evaluated:

        " Concept.
        " Requirements.

• Design.
• Implementation.
• Testing (Firmware and system integration).

        " Installation and Checkout.
        " Operation and Maintenance.

• Reporting Requirements.

Table 2.1 of this plan identifies critical characteristics with acceptance criteria for each phase of the software lifecycle. The audits at Schneider and the supplemental testing at NLI will verify that the acceptance criteria are met for the life cycle critical characteristics. 1.2.6 IEEE 730-1989 IEEE Standard for Software Quality Assurance Plans This standard provides the minimum requirements for preparation and content of quality' assurance plans for reviews and audits of software. The standard applies to the development of critical software from the requirements specification to lifetime maintenance of the system. Audit requirements are specified for a number of step and documents, which are prepared in accordance with IEEE 1012-1986. Since development of the firmware used in the trip unit was not documented in accordance with IEEE-1012-1986, this standard will be used as a guideline. The specific format, content, and acceptance criteria in this standard will not be used. The specific critical characteristics and acceptance criteria which will be evaluated are identified in Table 2.1 of this plan. The Software Quality Assurance Plan that will be implemented by NLI is specified in section 3 of this plan.

Micrologic Programmer V&V Plan VVP-042181-1, Rev. I Nuclear Logistics, Inc. Page 5 The NLI audit at Schneider Electric will address the following topics identified in section 3 of the standard:

       " Documentation.
       " Tests.

• Problem reporting and corrective actions.

       " Tools, techniques, and methodologies.
       " Code control.
       " Media control.

This review will provide confirmation that the integrated system design, testing, deployment, and maintenance is in accordance with the Schneider quality assurance program and that there were effective quality assurance controls in place. Code Control and Media Control at the Schneider facility will be verified by a commercial grade audit as identified in section 7.1 of this plan. Additional integrated hardware and firmware configuration testing will be performed by NLI as described in section 7.2 of this plan. Configuration control following delivery of the units to the plant will be as identified in section 8.0 of this plan. 1.2.7 IEEE 1028-1988 IEEE Standard for Software Reviews and Audits This standard provides specific requirements for the implementation of software quality assurance reviews and audits. The process which is described is throughout the lifecycle of the software from the requirements specification to lifetime maintenance of the system. Audit and documentation requirements are specified for all phases of the lifecycle of the software. Since development of the firmware used in the trip unit were not performed or documented in accordance with IEEE-1012-1986, this standard will be used as a guideline. The specific format, content, and acceptance criteria in this standard will not be used. This standard will be used as a guideline during the NLI audit at Schneider. The following specific issues will be addressed, as applicable to the actual design, development, testing, and configuration control processes:

• Technical reviews of the vendor integrated system development documentation.

0 Inspection of the vendor integrated system verification and validation test documentation.

• Audit of the vendor quality assurance programs used in the software development.
• Testing of the integrated system.

1.2.8 IEEE 828-1990 IEEE Standard for Software Configuration Management This standard provides a detailed prescriptive methodology for preparation and implementation

Micrologic Programmer V&V Plan VVP-042181-1, Rev. I Nuclear Logistics, Inc. Page 6 of a configuration management plan for software. Since the software was not developed by Schneider in accordance with this standard, the prescriptive methodology of the standard will not be met. Configuration control will be addresses as follows:

• The configuration control implemented by Schneider will be documented in the audit as presented in-Table 6.1.
• The configuration control activities by NLI and the plant are per section 8 of this plan.

The intent of this standard for a formal configuration control process is met. 1.2.9 IEEE 829-1990 IEEE Standard for Software Test Documentation This standard provides a detailed prescriptive methodology for the preparation and documentation of software documentation. The required documentation includes a test design specification, test case specification, test procedure specification, test item transmittal report, test log, test incident report, and test summary report. Since the software was not developed by Schneider in accordance with this standard, the prescriptive methodology of the standard will not be met. Software test documentation will be identified and evaluated as follows:

• Schneider's test procedures, test results, and other test documentation will be reviewed during the audit. See Table 6.1 for the specific attributes that will be reviewed.

0 NLI testing will be in accordance with written procedures with test results documented per the NLI Nuclear Quality Assurance Program. The intent of this standard for a formal software test process is met. 1.2.10 IEEE 830-1984 IEEE Standard Guide for Software Requirements Specification During the NLI audit of GE, NLI will review the software specification or equivalent document developed by GE. The results of the review will'be documented in the Audit Report that will be included in the V&V report. 1.2.11 IEEE 1008-1987 IEEE Standard for Software Unit Testing This standard provides a detailed prescriptive methodology for software unit testing. Since the software was not developed by Schneider in accordance with this standard, the prescriptive methodology of the standard will not be met.

Micrologic Programmer V&V Plan VVP-042181-1, Rev. 1 Nuclear Logistics, Inc. Page 7 Software test methodology will be identified and evaluated as follows:

• Schneiders's test procedures, test results, and other test documentation will be reviewed during the audit. See Table 6.1 for the specific attributes that will be reviewed.

a NLI testing will be in accordance with written procedures with test results documented per the NLI Nuclear Quality Assurance Program. The intent of this standard for a formal software test process is met. 1.2.12 IEEE 1016-1987 IEEE Recommended Practice for Software Design Descriptions During the NLI audit of Schneider, NLI will review the software design description or equivalent document developed by Schneider. The results of the review will be documented in the Audit Report that will be included in the V&V report. 1.2.13 IEEE 1063-1987 IEEE Standard for Software User Documentation This document provides a detailed prescriptive methodology for the structure, information content, and format for software user documentation. Since the software documentation was not developed by Schneider in accordance with this standard, the prescriptive methodology of the standard will not be met. .NLI has reviewed the Schneider documentation for the trip unit hardware/software system. The documentation is complete and well organized. The intent of this standard for technically accurate, complete and well organized software documentation is met. 1.2.14 IEEE 1074-1995 IEEE Standard for Developing Software Life Cycle Processes This standard provides a detailed prescriptive methodology for the planning, implementation, and documentation of the software lifecycle. Since the software was not developed by Schneider in accordance with this standard, the prescriptive methodology of the standard will not be met. The software lifecycle planning, implementation, and documentation will be identified and evaluated as follows:

• The controls and documentation by Schneider will be identified and evaluated during the audit of Schneider. See Table 6.1 for the specific lifecycle activities that will be addressed.
• The lifecycle activities that will be performed by NLI will be in accordance with this plan.

Micrologic Programmer V&V Plan VVP-042181-1, Rev. I Nuclear Logistics, Inc. Page 8 The intent of this standard for controlled planning, implementation, and documentation of the software lifecycle is met. 1.2.15 IEEE 1228-1994 IEEE Standard for Software Safety Plans This standard provides a detailed prescriptive methodology for the development, procurement, maintenance, and retirement of safety critical software. The purpose is to develop the processes and activities to improve the safety of the critical software. Since the software was not developed by Schneider in accordance with this standard, the prescriptive methodology of the standard will not be met. The software safety plan will be implemented as follows:

• The audits of Schneider by NLI will document the activities performed by Schneider to improve the safety of the software.
• The dedication testing, design testing, and qualification testing by NLI will improve the safety of the software.

The intent of this standard for controlled planning, implementation; and documentation of the software lifecycle is met. 1.2.16 EPRI 5652 Utilization of Commercial Grade Items in Nuclear Safety Related Applications with supplemental guidance EPRI TR-102260 These documents provide general guidance for the commercial grade dedication of equipment for use in safety related applications. The dedication and qualification program for the trip devices was developed using the guidance provided in this standard in conjunction with the other standards described in this plan. 1.2.17 IEEE 323-1974/1983 and NRC Regulatory Guide 1.89 The trip unit will be qualified for the plant specific service conditions per these documents. These requirements of these documents are met. 1.2.18 IEEE 344-1975/1987 and NRC Regulatory Guide 1.100 The trip unit will be qualified for the plant specific seismic conditions per these documents. These requirements of these documents are met. 1.2.19 IEEE 384-1977/1981/1992 and NRC Regulatory Guide 1.75 The trip devices are physically and electrically isolated as follows:

Micrologic Programmer V&V Plan VVP-042181-1, Rev. 1 Nuclear Logistics, Inc. Page 9 o The trip devices are physically located on each circuit breaker. There is no change in the physical independence or separation of the breakers/trip units from the current plant configuration.

• The trip devices have no electrical connection with other trip devices. They are powered from the CT's on the breaker and send and send a signal only to the flux shifter to trip the breaker. There is no change in the electrical separation/isolation from the current plant configuration.

The requirements of these documents are met to the extent that they are met by the current plant configuration. 2.0 EQUIPMENT IDENTIFICATION 2.1 Equipment-Configuration The trip unit is available in a number of configurations, as follows:

• Standard, Ammeter, Power, and Harmonic models of the Micrologic trip device (3.0, 5.0, 3.OA, 5.0A, 6.OA, 5.OP, 6.OP, 5.OH, and 6.0H). Various functions can be defeated to achieve the required protection.

a All potential functions (LSIG). o Long time delay. o Short time delay. o Instantaneous. o Ground fault protection.

• Various functions can be defeated to achieve the required protection.

o The equipment data sheets/technical data will be included in the V&V report. This V&V program will address all of the trip unit configurations, since they all use the same firmware. The displays, communications, interlocking, and other functions not associated with breaker tripping will be considered to be non-safety related functions and will be addressed as follows:

     " The trip units will not be qualified with any communications features operational.

o The built-in communication firmware and hardware will be demonstrated to not impact the operation of the safety related function of circuit protection. 2.2 Traceability of the Test Specimens to the Production Units Traceability of the test specimen to the production units will be performed. The following methodology will be used to document the traceability:

• The test specimens and the production units will be shown to have the same hardware and configuration:

Micrologic Programmer V&V Plan VVP-042181-1, Rev. I1 Nuclear Logistics, Inc. Page 10

              ,  Programmer physical configuration.
             " Circuit board and chip part and revision, as applicable.

• The test specimens and the production units will be shown to have the same firmware configuration (firmware revision).
• There are no field configurable circuit board settings (DIP switches, jumpers, etc.).
• The functional testing of the test specimen and the dedication testing of the production units will provide added assurance that the production units were manufactured to the same design standards and perform in an equivalent manner to the test specimen.

2.3 Safety Function The safety functions of the trip devices are: 0 Maintain low voltage power circuits during normal conditions, including no spurious tripping.

• Interrupt low voltage circuits in overcurrent conditions.
• The non-safety related features (display, communications, etc.) cannot interfere with the proper operation of the trip unit.

Abnormal Conditions and Events (ACE) are addressed in additional detail in Section 4.0. 2.4 Human Machine Interface The Human/Machine Interfaces are the switches on the front of the trip unit that are used to set the trip ranges of the trip unit. No programming can be performed on the trip unit. 3.0 SOFTWARE QUALITY ASSURANCE PLAN Project activities will be performed in accordance with the NLI Nuclear Quality Assurance Program [1] which meets the requirements of 10CFR50 Appendix B, 10CFR21, and ASME NQA-1. This plan applies to the Square D Micrologic trip units being supplied by NLI on Square D Masterpact low voltage circuit breakers. This Software Quality Assurance Plan is for the activities that will be performed by NLI. The software was developed under the controls of the Schneider IS09000 quality program, so this Software Quality Assurance Plan is not applicable to the activities performed by Schneider.

Micrologic Programmer V&V Plan VVP-042181-1, Rev. I Nuclear Logistics, Inc. Page 1II Program [1] which meets the requirements of 10CFR50 Appendix B, 10CFR21, and ASME NQA-1. This plan applies to the Square D Micrologic trip units being supplied by NLI on Square D Masterpact low voltage circuit breakers. This Software Quality Assurance Plan is for the activities that will be performed by NLI. The software was developed under the controls of the Schneider IS09000 quality program, so this Software Quality Assurance Plan is not applicable to the activities performed by Schneider. 3.1 Roles and Responsibilities The roles and responsibilities of NLI personnel are as follows: o Quality Assurance: E Responsible for the overall quality of the project.

       = Performs independent reviews of the project documents to verify conformance with the NLI Nuclear Quality Assurance Program.

a Perform software and hardware audits of the Schneider facilities. o Quality Assurance personnel will perform the following specific project activities: E Independent verification that the code burned on the programmable digital chips is traceable to the documented code. U Independent. verification of the labeling of the programmable digital chips with the code name and revision level.

• Document the as-supplied configuration of the hardware and software.

o Project Engineer: Responsible for the generation of the project documentation. o Test Technician: Responsible for performing the functional testing of the trip unit (hardware/software system). 3.2 Required Documentation The following documentation will be prepared in accordance with the NLI Nuclear Quality Assurance Program: 0 V&V Plan. o NLI Validation Test Plan. o V&V Report. o Dedication Plan.

• Dedication Report.

o Audit Plan and Audit Report (to be included in V&V report). o Instruction Manual. 0 Digital Component Configuration Data Sheet (to be included in the Instruction Manual). See section 8.1 of this plan for details.

Micrologic Programmer V&V Plan VVP-042181-1, Rev. 1 Nuclear Logistics, Inc. Page 12 The following V&V activities are performed per this plan.

• The software V&V activities are as specified in this plan.

   " Software configuration management and change control is as specified in section 8.0 of this plan.
   - Code and Media Control is as specified in Table 6.1 and section 8.0 of this plan.

• Problem and Error Reporting will be in accordance with section 8.0 of this plan.

Project records will be maintained for the plant lifetime in accordance with the NLI Nuclear Quality Assurance Program [1]. 3.3 Project Controls The following additional project controls will be implemented:

   " Design control will be in accordance with the NLI Project Performance Plan.

• Interface control will be in accordance with the NLI Project Performance Plan.

0 The following activities will be performed in accordance with the NLI Nuclear Quality Assurance Program [1]: o Independent verification and approval of safety related documents. o Design reviews. o Document control. o Vendor audits. o Calibration of measurement & test equipment. o Personnel qualification.

   " Code and Media Control is as specified in Table 6.1 and section 8.0 of this plan.

4.0 ABNORMAL CONDITIONS AND EVENTS (ACE's) The guidance provided in Annex F of IEEE Standard 7-4.3.2-1993 was used to identify the various ACEs that could impact the capability of the trip unit to perform the intended safety functions. The Abnormal Conditions and Events (ACEs) that could impact the proper operation are identified in this section. The methods which are used to evaluate' each of the ACE's are also presented. Note: The ACE's and the levels specified below are expected to envelop most of the Class 1E applications in nuclear power plants. Plant specific levels that are not enveloped will be evaluated and tested on a plant specific basis. 4.1 Environmental Service Conditions The following service conditions are defined:

Micrologic Programmer V&V Plan VVP-042181-1, Rev. I Nuclear Logistics, Inc. Page 13

• Operating time: continuous 0 Temperature range: 40-104'F (note 1)
• Relative Humidity: 98% (non-condensing) maximum
• Radiation: 5E3 rad gamma Notes:

1. The maximum temperature of 104'F is the maximum ambient temperature. The trip device will be demonstrated to be acceptable for a total temperature of 121 OF (104 0F ambient + 17'F in-switchgear temperature rise.

The mild environment qualification will be in accordance with IEEE 323-1974/1983 [3], IEEE C37.81-1989 [23], and IEEE C37.82-1987. Plant specific service conditions that are greater than the service conditions specified above will be addressed on a case by case basis by analysis or testing. 4.2 Seismic Service Conditions The trip unit will be qualified by testing for the service conditions as specified in each plant specific seismic qualification plan [11]. The seismic qualification testing will meet the requirements of IEEE 344-1975/1987 [23], IEEE 323-1974/1983 [3], IEEE C37.81-1989 [23], and IEEE C37.82-1987. The test plan provides detailed acceptance criteria for the seismic testing. The trip unit seismic qualification is to the in-switchgear levels, including any required amplification. Since the trip unit is mounted in the breaker, the breaker and trip unit will be seismically qualified together. 4.3 Electromagnetic Interference/Radio Frequency Interference (EMI/RFI) EMI/RFI emissions and susceptibility requirements are defined for the trip unit based on EPRI TR-102323, revision 1 [12]. The trip unit will be qualified by testing as specified in the qualification plan [ I1]. The test plan [11] provides detailed acceptance criteria for the EMI/RFI testing. 4.4 Voltage Range The trip units are powered by current transformers (CT's) on the main bus. The equipment is required to operate across the plant specified voltage range for the AC bus. The trip units will be tested at the minimum degraded voltage and the maximum overvoltage conditions during the dedication testing [6]. These voltage conditions are specified as follows:

• Typical nominal plant voltages are 480vac and 575vac.
• Minimum voltage will be 480vac (75%) = 360vac.

Micrologic Programmer V&V Plan VVP-042181-1, Rev. I Nuclear Logistics, Inc. Page 14 Maximum voltage will be 575vac (110%) = 635vac. 4.5 Infant Mortality of Electronic Components A total run time of at least 48 hours will be documented during the dedication testing of the production units. This will serve as a bum-in to lower the chances of infant failures of the electronic components [6). 4.6 Fault in Non Safety Plant System The Class 1E trip units do not interface with the non-safety plant equipment. The trip unit is self contained within the breaker as follows:

   & The trip unit receives power from the CT's on the breakers primary circuit.

• The trip unit sends the trip signal to the flux shifter in the breaker.

The EMI/RFI qualification [11] will verify that EMI/RFI emissions from non-safety plant equipment will not impact the operation of the trip units. 4.7 Hardware/Software Faults Potential faults in the hardware or firmware will be evaluated by vendor audit and NLI testing. The fault areas that will be evaluated include programming or logic errors, problems with hardware/software integration, potential for unintended functions, potential for data handling problems, module interface including protocols and control and data linkages and hardware defects. Table 6.1 of this plan identifies the faults that will be addressed. 4.8 Loss of Power NLI testing will verify that the trip unit reinitializes and restarts following loss of power with no loss of programming. By design and construction, the ASIC device is designed to be unpowered for an indefinite amount of time. 4.9 Overcurrent Condition One of the safety functions of the trip unit is to trip the breaker in an overcurrent event in accordance with the published trip curves. The following activities will be performed to verify this attribute:

• ANSI design testing will be performed.

o This testing has been performed by Square D on the Masterpact breaker with Micrologic trip unit. o Additional ANSI design testing is required for each replacement breaker

Micrologic Programmer V&V Plan VVP-042181-1, Rev. 1I Nuclear Logistics, Inc. Page 15 configuration. This testing will be performed on a plant/replacement breaker specific basis and submitted to the client as part of the design testing.

• The NLI audit of Schneider will verify proper programming of the trip curves.

   " NLI validation testing will verify proper programming of the trip curves.

o NLI dedication testing will verify proper programming of the trip curve for a sample of the trip points. 5.0 FAILURE MODES AND EFFECTS ANALYSIS A detailed failure modes and effects analysis (FMEA) was performed by Schneider Electric. The following actions will be performed by NLI: 0 The FMEA will be reviewed by NLI personnel for completeness. o Potential failures due to the identified ACE's will be addressed as specified in section,4.0 of this plan. o Additional potential failure modes may be identified during the V&V audits of Schneider or NLI qualification and dedication testing. If additional potential failure modes are identified, the failure modes and effects analysis will be updated. 6.0 REQUIRED SYSTEM CHARACTERISTICS The required system characteristics that the hardware/software systems must possess are identified in Table 6.1. The methods that will be used to document that the required system characteristics are met are also identified in the table. The system contains the following hardware/software systems:

• Programmer.

Note: The Schneider audit or NLI Validation Testing may identify additional critical characteristics that are not included in Table 6.1. These critical characteristics will be addressed in the V&V Report.

Micrologic Programmer V&V Plan VVP-042181-1, Rev. 1 Nuclear Logistics, Inc. Page 16 I TRIP UNIT SOFTWARE V&V CRITICAL CHARACTERISTICS TABLE 6.1 "Ref" documents are the plans and reports that are used to verify the critical characteristic, as follows:

   " VVP-042181-1: This V&Vplan.

• VVTP-042181-1: NLI validation test plan to verify the software/hardware design of the trip unit [13]. These are design tests and will be performed on one of the trip units (test specimen or one production unit).

   " VP-042181-1: NLIdedication plan [6]. These production tests and inspections will be performed on bothof the supplied trip units.
   " QP-042181-1: NLI qualification plan [11].

• SV-042181-1: NLI audit plan for the Schneider Micrologic trip unit facilities [21].
• IM-042181-1: Instruction Manual [14],

Critical Characteristic Acceptance Criteria Verification/ Validation Method Ref. Oualitv Assurance Program Quality Assurance Program that The software and hardware were developed Audit of Schneider. SV-042181-1 controlled the development of the under the controls of the Schneider ISO 9001 software/hardware. quality program. Software Lifecycle Software specification/software Software specification documents the detailed Audit of Schneider. SV-042181-1 requirements. software requirements. Procedural controls used during software Software development controlled by Audit of Schneider. SV-042181-1 development. Schneider procedures. Document the procedures used and evaluate process. Failure Modes & Effects Analysis Failure Modes & Effects Analysis performed Audit of Schneider. Review of SV-042181-1 and used during software development, Schneider FMEA. Additional testing if required by NLI. VVTP-042181-1

Micrologic Programmer V&V Plan VVP-042181-1, Rev. 1 Nuclear Logistics, Inc. Page 17 Development and testing approach. Schneider developed and tested the software Audit of Schneider. SV-042181-1 in small function based blocks of code. Development and testing documented. Independence of software development Independent personnel used. Audit of Schneider. SV-042181-1 and testing. Integrated hardware/software testing. Integrated testing o f the hardware/software Audit of Schneider. SV-042181-1 system was performed. NLI Validation and Dedication VVTP-042181-1 Testing. VP-042181-1 Product operating history, Installed units operating properly. Specify Audit of Schneider. SV-042181-1 number of operating units, time in service, and number and types of identified problems. Error handling. 1. Code errors are identified, documented, Audit of Schneider. SV-042181-1 evaluated, and reported in a controlled manner by Schneider.

2. Mechanism for reporting and evaluating Per section 8.0 of this plan. VVP-042181-1 user reported problems.

Problem reporting to plant. Identified problems are evaluated and Per NLI procedures as specified in this VVP-042181-1 reported to the client. VVP, Section 8.0. Software updates and service bulletins. Schneider has a formal process to alert Audit of Schneider. SV-042181-1 customers concerning software updates and provides service bulletins,

Micrologic Programmer V&V Plan VVP-042181-1, Rev. 1 Nuclear Logistics, Inc, Page 18 Configuration Control Revision control. Revision control used on code, chips, and Audit of Schneider. SV-042181-1. boards. NLI inspection and documentation. VP-042181I--l. Programmer hardware configuration Hardware per Schneider and NLI design NLI testing and inspection VP-042181-l. documentation and drawings [5]. Electrical interfaces including wire, Per NLI design drawings [5]. NLI testing and inspections. VP-04218 1-1 terminations, and grounding. Manufacturing controls of code. Controls to assure correct code installed on Audit of Schneider. SV-0421811-1 each unit. Traceability between development and production code is documented. Regression testing or evaluations. Regression testing or evaluations performed Audit of Schneider. SV-042181-1 when code is revised. Software/Hardware Critical Characteristics Data storage. Per Schneider design specifications. Audit of Schneider. SV-042181-1 Signal conditioning and logic functions Per Schneider design specifications. Audit of Schneider. SV-042181-1 NLI testing, VVTP-042181-1

Micrologic Programmer V&V Plan VVP-042181-1, Rev. 1 Nuclear Logistics, Inc. Page 19 System response time. Per Schneider design specifications, Audit of Schneider, SV-042181-1 NLI Validation and Dedication VVTP-042181-1 Testing. VP-042181-1 Remote alarms and indications. The communication features are not Audit of Schneider. SV-042181-1 considered safety related and will not be NLI Validation Testing. VVTP-042181-1 connected in the plant. Local indication is considered non-safety related. The V&V program will verify that the non-safety related communication and local indication features will not impact the safety related functions of the trip unit. Watchdog timer. Per Schneider design. Audit of Schneider. SV-042181-1 Timing and clock control. Per Schneider design. Audit of Schneider. SV-042181-1 Initialization Per Schneider design. Audit of Schneider. SV-042181-1 Output alarms. Non-safety related. See above. Audit of Schneider. SV-042181-1 NLI Validation Testing. VVTP-042181-1 Features which could impact operation. No features which could interrupt operation Audit of Schneider. SV-042181-1 (interruptions, diagnostics, manual inputs, NLI Validation Testing, VVTP-042181-1 non-essential application programs, unauthorized programs or data modifications).

Micrologic Programmer V&V Plan VVP-042181-1, Rev. 1 Nuclear Logistics, Inc. Page 20 Security. The base program is on the ASIC chip and Plant configuration control per section VVP-042181-1 cannot be field modified; 8.3 of this plan. The trip unit does not contain security. The trip settings can be changed from the front of the trip unit. This must be procedurally controlled by the plant, Note that this is no change from solid state trip units currently used in safety related applications. Year 2000 compliance. Units recognize dates beyond 12/31/99 Audit of Schneider. SV-04218 1-1 correctly. Processor restart and initialization. Following removal of power, the trip unit Audit of Schneider. SV-042181-1 maintains the settings. NLI.Validation Testing. VVTP-042181-1 .Data validity checks. The system contains logic to perform checks Audit of Schneider. SV-042181-1 of the validity of intermediate results. Input values The user inputs are hard wired switches. Not applicable. Not applicable. Therefore, no out of range or invalid input parameters can be input to the system. Loss of input instruments. Loss of signal from the CT's causes the trip NLI testing. VP-042181-1 unit to trip the breaker. Diagnostics Not applicable. Not applicable. Not applicable. The programming is deterministic and diagnostics are not required..

Micrologic Programmer V&V Plan VVP-042181-1, Rev. 1 Nuclear Logistics, Inc. Page 21 Human Interface Critical Characteristics Operation setting switches. Not applicable. NLI testing. VP-042181-1 There are no touchpads or computers, Operation of touchpad or computer. Not applicable. NLI testing, VP-042181-1 There are-no touchpads or computers. Setting switch security. Security as specified above. Per plant configuration control as VVP-042181-1 specified in section 8.3 of this plan. Trip Unit specific hardware/software critical characteristics Programmer operation on Masterpact NT Programmer mounts and interfaces properly Audit of Schneider. SV-042181-1 and NW breakers. with the Masterpact NT and NW breakers, Validation testing by NLI. VVTP-042 18 1-1 including physical mounting, wiring, CT Dedication testing by NLI. VP-042181-1 interface, ratings plug interface, and flux shifter interface. Programmer interfaces properly with. Programmer + ratings plug provide trip Audit of Schneider. SV-042181-1 ratings plug. settings per the Square D published trip Validation testing by NLI. VVTP-042181-1 curves. Dedication testing by NLI. VP-042181-1 Trip settings. Verify that the trip settings are per the Square Audit of Schneider. SV-042181-1 D curves. Validation testing by NLI (test all VVTP-042181-1 combinations of settings). Dedication testing by NLI (test VP-042181-1 representative settings).

Micrologic Programmer V&V Plan VVP-042181-1, Rev. 1 Nuclear Logistics, Inc. Page 22 L, S, I, or G function defeat operates The function is defeated. Audit of Schneider. SV-042181 -1 properly. Validation testing by NLI. VVTP-042181 -1 Defeat of the L, S, I, or G functions does not impact operation of the active functions. No spurious tripping. There is no spurious tripping outside the Audit of Schneider. SV-042181-1l active trip functions and the trip curve. Validation testing by NLI. VVTP-0421 8l1-1 Non safety functions do not interfere Communications and display functions are Audit of Schneider. SV-042181 -1 with safety related trip function. non-safety related. The communication Validation testing by NLI. VVTP-042181-1 feature will not be connected in the plant. Verify that the communication and display functions will not interfere with the trip function, Breaker position on ASIC failure. The breaker will remain in the current Audit of Schneider. SV-042181-1 position upon ASIC failure. Validation testing by NLI. VVT'P-042 18 1-1 Indication on ASIC failure. If the ASIC fails, and LED on the front of the Audit of Schneider. SV-042181 -1 trip unit will light. Validation testing by NLI. VVTP-042181-1 Short circuit protection on ASIC failure. If the ASIC fails, the trip unit will still Audit of Schneider. SV-04218 1-1 provide short circuit protection. Validation testing by NLI. VVTP-04218 1 -1 Battery function. The battery is not required for the safety Audit of Schneider. SV-042181-1 related trip function. Validation testing by NLI. VVTP-042181 -1

Micrologic Programmer V&V Plan VVP-042181-1, Rev. 1 Nuclear Logistics, Inc, Page 23 ACE's Critical Characteristics The following ACE's Programmer operates properly when exposed NLI testing. VP-042181-1 are identified: to the identified ACE's. QP-042181-1

• Environmental service conditions. The referenced QP and VP document the 0 Seismic service specific requirements and acceptance criteria conditions. for each ACE.

0 EMI/RFI. 0 Voltage range (undervoltage to overvoltage). 0 Infant mortality of electronics.

• Fault in non-safety plant system.
• Hardware/software faults
• Loss of power.

Micrologic Programmer V&V Plan VVP-042181-1, Rev. 1 Nuclear Logistics, Inc. Page 24 7.0 IMPLEMENTATION OF REQUIRED CHARACTERISTICS The activities identified in this section will be performed to verify. that trip unit possesses the required characteristics identified in section Table 6.1. 7.1 Commercial Grade Audit of Square D/Schneider The firmware was developed by Schneider under the controls of their commercial ISO 9001 quality assurance program. NLI will perform a commercial grade audit of the Schneider design and manufacturing facility. The audits will include review of the controlling procedures and implementation of the critical characteristics specified in Table 6.1. The documents which are reviewed will be identified in, the audit report. The Schneider documents which are made available to NLI will be maintained in accordance with the NLI Quality Assurance Program. Some Schneider documents are proprietary to Schneider and will be reviewed during the audit but will not be released to NLI. 7.2 NLI Testing Testing and analysis will be performed by NLI to fully document the V&V of the trip units. The testing and analysis address the critical characteristics identified in Table 6.1. 7.2.1 Qualification Testing Qualification testing and analysis will be performed in accordance with the qualification plan [ 11]. The testing will be performed on a single test specimen which is the same configuration as the production units which are being delivered. This testing will include the following:

• EMI/RFI testing.
• Seismic testing.
• Mild environment analysis.

7.2.2 Dedication Testing 100% of the production units will be dedicated to verify the functional requirements of the computer based systems are met. The dedication will be based on testing as identified in dedication plan VP-042181-1 [6]. The testing specified in the dedication plan will be performed at the NLI facility and/or the Square D facility with NLI personnel witnessing the testing. The dedication testing will include the applicable ANSI Production Tests. The characteristics that will be verified by testing are identified in Table 6.1.

Micrologic Programmer V&V Plan VVP-042181-1, Rev. I Nuclear Logistics, Inc. Page 25 7.2.3 Software/Hardware Design Testing NLI will perform supplemental validation testing [13] to verify that the trip units meet the Schneider design specifications. This testing will supplement the data collected during the audit of Schneider. The characteristics that will be verified by testing are identified in Table 6.1. 7.2.4 ANSI Design Testing The Masterpact breaker with the Micrologic trip unit has previously been design tested per the applicable ANSI requirements. Additional design testing will be performed on each replacement breaker configuration in accordance with the requirements of ANSI C37.59 [16]. The ANSI design tests will be submitted to the client. 8.0 CONFIGURATION CONTROL 8.1 As-Supplied Configuration The NLI Digital Component Configuration Data Sheets [22] will document the as-supplied hardware and firmware configuration. The data sheets will contain the following information for the each trip unit:

• Programmer part number and serial number.
• Chip and firmware part number and revision number, as available.

8.2 Vendor Firmware Configuration Control The following process will be used to identify, document, evaluate, and report firmware modifications and errors:

       " The as-built firmware configuration of the supplied units will be documented and controlled as specified in section 8.1 of this plan.
       " NLI will contact Schneider every 6 months and any modifications or reported errors will be identified.
       " Errors will be documented and evaluated in accordance with the NLI Nonconformance Report (NCR) process [15]. Notification in accordance with I OCFR21 will be made in accordance with NLI procedures [15], if required.

• Design changes which are not the result of errors will be evaluated by NLI for impact on the existing system and future replacement trip units.

       " NLI will submit all NCR's and 10CFR21 reports associated with the trip unit hardware and software to Duke Power. Evaluation of design changes will also be submitted.

Micrologic Programmer V&V Plan VVP-042181-1, Rev. 1I Nuclear Logistics, Inc. Page 26 This approach is based on the following:

• The Schneider audits and the NLI testing will verify the as-supplied configuration.
• Schneider will not make the source codes available to NLI. Schneider will not freeze the hardware or software configuration.
• Schneider has a controlled program for the following activities (to be verified in the audit):
• Document revisions to hardware and software.

                 " Perform regression testing and/or analysis to fully evaluate the impact of the hardware and software changes on the system. The test method and results are documented in an auditable form.

8.3 Plant Lifetime Configuration Control Configuration control following delivery of the equipment is the responsibility of the nuclear plant.. It is recommended that the configuration control procedures address the following issues: ,

• Changes to the trip settings using the switches on the front of the trip unit must be procedurally controlled. Note that the same procedural controls are currently implemented on existing solid state trip units.

There are no methods for the user to change the firmware, so no additional controls are required. 9.0 EVALUATION OF RESULTS 9.1 Anomalies Any anomalous behavior identified during any phase of testing will be documented and evaluated. The evaluation will determine whether the anomaly was due to equipment malfunction, test conditions or an unrelated cause such as improper test setup. If the anomaly was due to the equipment or test conditions, its impact on the safety function of the specimen will be determined. The anomaly disposition will be in one of the following manners based on engineering evaluation:

• No impact on operational requirements or safety function.

0 Anomaly acceptable.

• Retest.

0 Item not suitable for function/service conditions. Anomalies which are due to unrelated causes will be identified as such, and the test will be continued. Anomalies will be documented using the Test Anomaly Form 9.1. 9.2 Modifications Any modifications made'to the test specimen prior to or during the testing sequence will be fully

Micrologic Programmer V&V Plan VVP-042181-1, Rev . 1I Nuclear Logistics, Inc. Page 27 documented and evaluated. The impact of the modifications on the qualification of the production units will be determined. If the modification has an impact on the qualification of the production units, a retest or partial retest of the test specimen will be performed in the modified configuration. If it can be determined by analysis that the modification has no impact on the qualification of the production units, a retest will not be required. All required retesting and analyses will be documented in the qualification report. 9.3 Results/Conclusions The results of the V&V activities will be presented in a report. The results will include a positive statement regarding the qualification status of the test specimen and the feasibility of a common cause failure mechanism within the hardware or software. 10.0 QUALITY ASSURANCE Project activities will be performed in accordance with the NLI Quality Assurance Program which meets the requirements of 10CFR50 Appendix B, IOCFR21 and ASME NQA-1 [1].

Micrologic Programmer V&V Plan VVP-042181-1, Rev. 1 Nuclear Logistics, Inc. Page 28 TEST ANOMALY Form 9.1 date: Anomaly #: A. IDENTIFICATION Test Specimen/Procedure/Equipment: Test Procedure/Step:

Description:

" i.* "-* B. DISPOSITION date: Prepared by: by:d -date: Reviewed by:.

                                                         -date:-

Approved by: Approved by: -date: date:

Micrologic Programmer V&V Plan VVP-042181-1, Rev. 1 Nuclear Logistics, Inc. Page 29 11.0 MEASUREMENT & TEST EQUIPMENT Measurement & Test Equipment used will be controlled by the NLI M&TE program (procedure NLI-QUAL-05, Revision 4). The Qualification Report will identify the M&TE which was used. A statement will be made in the Qualification Report as to whether the M&TE are traceable to NIST or equivalent standards. 12.0 DOCUMENTATION A Software Verification & Validation Report will be prepared which summarizes the testing, audits, and evaluations which were performed. The test data sheets, supporting calculations, and any other relevant data will be included in the report, where applicable.

13.0 REFERENCES

1. NLI Quality Assurance Manual, Rev. 1, 7/91 including applicable Supplements.

2. IEEE Std 7-4.3.2-1993, "IEEE Standard Criteria for Digital Computers in Safety Systems of Nuclear Power Generating Stations."

3. IEEE 323-1974/1983, "IEEE Standard for Qualifying Class 1E Equipment for Nuclear Power Generating Stations."

- - 4. IEEE 344-1975/1987, "IEEE Recommended Practices for Seismic Qualification of Class 1E Equipment for Nuclear Power Generating Stations."

5. NLI design drawings for replacement breaker (project specific).

6. NLI dedication plan (project specific).

7. EPRI TR-102348, "Guidelines for Licensing of Digital Upgrades", 12/1993.

8. IEEE 730-1989, "Software Quality Assurance Plans."

9. IEEE 1012-1986, "Standard for Software Verification and Validation Plans."

10. IEEE 1028-1988, "IEEE Standard for Software Review and Audits."

11. NLI qualification plan (project specific).

12. EPRI TR-102323, "Guidelines for Electromagnetic Interference Testing in Power Plants",

revision I.

13. NLI Software/Hardware Validation Test Plan, VVTP-042181-1, (latest revision).

14. NLI Instruction Manual (project specific).

Micrologic Programmer V&V Plan VVP-042181-1, Rev. 1 Nuclear Logistics, Inc. Page 30

15. NLI Procedure NLI-QUAL-08, "Nonconformances and 10CFR21 Reporting," (latest revision).

16. (not used)

17. ASME NQA-la-1995, Appendix 7A-2, "Nonmandatory Guidance for Commercial Grade Items", 1995.

18. EPRI 5652,"Guidelines for the Utilization of Commercial Grade Items in Nuclear Safety-Related Applications."

19. EPRI TR-102323, "Guidelines for Electromagnetic Interference Testing in Power Plants",

9/94.

20. (not used).

21. NLI Source Verification Plan SV-042181-1, "Source Verification Plan for Schneider Programmer", (latest revision).

22. NLI drawings (project specific),"Digital Component Configuration Data Sheet". J *

23. IEEE C37.81-1989, "IEEE Guide for Seismic Qualification of Class 1E Metal-Enclosed Power Switchgear Assemblies".

24. IEEE C37.82-1987, "IEEE Standard for the Qualification of Switchgear Assemblies for Class IE Applications in Nuclear Power Generating Stations".

25. IEEE 384-1977/1981/1992, "Criteria for Separation of Class 1E Equipment and Circuits". f'~

26. NRC R.G. 1.75, "Physical Independence of Electrical Systems".

27. NRC R.G. 1.89, "Qualification of Class 1E Equipment for Nuclear Power Plants".

28. NRC R.G. 1.100, "Seismic Qualification of Class 1E Equipment for Nuclear Power Plants".

Micrologic Programmer V&V Plan VVP-042181-1, Rev. I Nuclear Logistics, Inc. Page A. I Attachment A Equipment Data Sheets The equipment data sheets/technical data will be included in the V&V report. JA

I Micrologic Programmer V&V Plan VVP-042181-1, Rev.1 Nuclear Logistics, Inc. Page B.1 Attachment B Seismic RRS The seismic RRS are plant specific and the seismic qualification will be performed with the trip unit installed on the specific replacement breaker type. The seismic RRS and TRS will Ax be included in the seismic qualification report for each breaker typelnuclear plant.

                                                                                    .1 Masterpact Circuit Breaker V&V Report                           VVR-042181-1, Rev. 8 Nuclear Logistics, Inc.                                                    Page E. 1 II ATTACHMENT E NLI Validation Test Plan VVTP-042181-2

Item Verification Plan Verification Plan # VVTP-042181-2, Revision 2 Manuf./Model: Square D (Schneider Electric) / Micrologic 6.UP Programmer Identification: Digital trip device for Square D Masterpact NT and NW low voltage switchgear circuit breakers Safety Function: To maintain low voltage power circuits during normal operation and interrupt circuits during fault conditions. Note: This verification plan is a supplement to VVTP-0421 81-1 and is used in order to test the 4-wire ground fault/neutral protection configuration. The 3-wire ground fault configuration and ground fault trip times have previously been validated. Critical Characteristic Sample Acceptance Size Criteria Ref Method Long-time neutral 1 Acceptance criteria is per the attached test 1, 2, 3 Connect a Masterpact circuit breaker with a protection data table. Micrologic 6.OP programmer, type A rating plug, CC#1 400A sensor plug and external neutral current transformer model S34036. See Ref. 1 for proper wiring. The breaker referenced on the wiring diagram is not the test specimen. Keep the wiring from the current transformer to the trip unit as short as possible. Using a Micrologic test set, defeat the ground fault protection. Use this test setup for all CC's. Perform long-time primary injection testing on the neutral line per the attached test data table. Short-time neutral 1 Acceptance criteria is per the attached test 2, 3, 4 Perform short-time primary injection testing on protection data table. the neutral line per the attached test data table. CC#2 Instantaneous neutral 1 Acceptance criteria is per the attached test 2, 5 Perform instantaneous primary injection testing on protection data table, the neutral line per the attached test data table. CC#3 VVTP-042181-2, Revision 2 Page 1 of 7

Item Verification Plan Verification Plan # VVTP-042181-2, Revision 2 Manuf./Model: Square D (Schneider Electric) / Micrologic 6.OP Programmer Identification: Digital trip device for Square D Masterpact NT and NW low voltage switchgear circuit breakers Safety Function: To maintain low voltage power circuits during normal operation and interrupt circuits during fault conditions. Note: This verification plan is a supplement to VVTP-042181-1 and is used in order to test the 4-wire ground fault/neutral protection configuration. The 3-wire ground fault configuration and ground fault trip times have previously been validated. Critical Characteristic Sample Acceptance Size Criteria Ref Method Neutral CT signal 1 Acceptance criteria is per the attached test 2, 6 Verify the ground fault logic accounts for the communicates with data table. neutral CT signal by primary injection testing per ground-fault logic of the attached test data table. The neutral current programmer must be the opposite polarity of the phase current. CC#4 Apply the test current for at least 5 seconds or until the breaker trips. Return the breaker to its original configuration upon completion of testing.

References:

1. NLI Drawing No. 04218 1-WD1-AC-SR-2N, Revision 3 (attached).

2. Schneider Electric Class 0613 Manual, "Masterpact NT and NW Universal Power Circuit Breakers", dated 2004.

3. Square D Curve No. 0613TC0004, dated 6/01 (attached).

4. Square D Curve No. 0613TC0005, dated 6/01 (attached).

5. Square D Curve No. 0613TC0007, dated 6/01 (attached).

6. Square D Curve No. 0613TC0001, dated 6/01 (attached).

Approval PreparedGK9.'&** / I A'pprrovd glb!!ý date date Uate VVTP-042181-2, Revision 2 Page 2 of 7

LT LT ST ST Inst. GF pickup delay pickup delay pickup pickup test current / Trip setting setting setting setting setting setting GF time i2t setting Neutral trip time Actual trip time of Function (Ir) (tr) (Isd) (tsd) (11) (1g) delay (tg) (ST, GF) setting acceptance criteria breaker (sec) CC#1 Neutral 768A Protection 0.4 0.5 10 0.4 Off J 0.4 off, off 1.6N 1.6 - 2.2 sec (LT @ 300%) CC#1 Neutral 864A 0.45 1 10 0.4 Off J 0.4 Off, Off 1.6N 355s Protection @3.5 - 5 sec (LT @ (LT 300%) CC#I Neutral 960A Protection 0.5 2 10 0.4 Off J 0.4 off, off 1.6N 60A (LT @ 6.8 - 9.2 sec 300%) CC#1 Neutral 720A Protection 0.6 4 10 0.4 Off J 0.4 off, off 1N 720A (LT @12 - 18 sec (LT @ 300%) CC#l Neutral 756A Protection 0.63 8 10 0.4 Off J 0.4 off, off 1IN 27 - 37 sec (LT @ 300%) CC# 1 Neutral 41 840As Protection 0.7 12 10 0.4 Off J 0.4 off, off 1N (LT @ 41 - 51 sec 300%) C C# I Neutral 480A Protection 0.8 16 10 0.4 Off J 0.4 off, off 1/2N 5-5s (LT @51 - 65 sec (LT @ 300%) CC#l Neutral 540A Protection 0.9 20 10 0.4 Off J 0.4 off, off 1/2N 5-3s (LT @ 65 - 83 sec 300%) - - VVTP-042181-2, Revision 2 Page 3 of 7

LT LT ST ST Inst. GF pickup delay pickup delay pickup pickup 12 test current I Trip setting setting setting setting setting setting GF time i t setting Neutral trip time Actual trip time of Function (1r) (tr) (Isd) (tsd) (li) (1g) delay (tg) (ST, GF) setting acceptance criteria breaker (sec) Cc#l Neutral 600A Protection 1 24 10 0.4 Off J 0.4 off, off 1/2N 83-130sec (LT @ 300%) CC#2 Neutral 3840A Protection 1 24 1.5 0 Off J 0.4 off, off 1.6N 0.02-O.O8sec (ST @ 400%) CC#2 Neutral 4608A Protection 0.9 24 2 0.1 Off 0.4 off, off 1.6N 0.08-0.14sec (ST @ 400%) CC#2 Neutral 5120A Protection 0.8 24 2.5 0.2 Off J 0.4 off, off 1.6N 0.14-0.20sec (ST @ 400%) CC#2 Neutral 3360A Protection 0.7 24 3 0.3 Off J 0.4 off, off 1N 0.22-0.32sec (ST @ 400%) CC#2 Neutral 4032A Protection 0.63 24 4 0.4 Off J 0.4 off, off 1N 0.35-0.50sec (ST @ 400%) CC#2 Neutral 1500A Protection 0.6 24 5 0.4 Off J 0.4 on, off 1N 0.9-1.7sec (ST @ 125%) CC#2 Neutral 750A Protection 0.5 24 6 0.3 Off J 0.4 on, off 1/2N 0.3-0.6sec (ST @ 125%) VVTP-042181-2, Revision 2 Page 4 of 7

LT LT ST ST Inst. GF pickup delay pickup delay pickup pickup test current / Trip setting setting setting setting setting setting GF time iýt setting Neutral trip time Actual trip time of Function (Ir) (tr) (Isd) (tsd) (li) (1g) delay (tg) (ST, GF) setting acceptance criteria breaker (sec) CC#2 Neutral 900A Protection 0.45 24 8 0.2 Off J 0.4 on, off 1/2N 0.14-0.20sec (ST @ 125%) CC#2 Neutral 1000A Protection 0.4 24 10 0.1 Off J 0.4 on, off 1/2N 000 c (ST @ 0.08-0.14sec 125%) CC#3 Neutral Protection 1 24 10 0.4 2 J 0.4 off, off 1.6N 2560A (Inst. @ < 0.06sec 2o0%) CC#3 Neutral Protection 1 24 10 0.4 3 J 0.4 Off, off 1.6N 3840A (Inst. @ <0.06see 200%) CC#3 Neutral 5120A Protection 1 24 10 0.4 4 J 0.4 off, off 1.6N < (Inst. @ 0.06sec 200%) CC#3 Neutral Protection 1 24 10 0.4 6 J 0.4 off, off 1N (Inst. @ _<0.06sec 200%) CC#3 Neutral Protection 1 24 10 0.4 8 J 0.4 off, off 1N 6,400A (Inst. @ <0.06sec 200%) VVTP-042181-2, Revision 2 Page 5 of 7

LT LT ST ST Inst. GF pickup delay pickup delay pickup pickup test current I Trip setting setting setting setting setting setting GF time i t setting Neutral trip time Actual trip time of Function (Ir) (tr) (Isd) (tsd) (li) (Lg) delay (tg) (ST, GF) setting acceptance criteria breaker (sec) CC#3 Neutral 8000A Protection 1 24 10 0.4 10 J 0.4 off, off 1N <N (Inst. @ 0.06sec 200%) CC#3 Neutral 4800A Protection 1 24 10 0.4 12 J 0.4 off, off 1/2N < (Inst. @ 0.06sec 200%) CC#3 Neutral 6000A Protection 1 24 10 0.4 15 J 0.4 off, off 1/2N (Inst. @ < 0.06see 200%) CC#3 Neutral 4000A Protection 1 24 10 0.4 off J 0.4 off, off 1/2N 0.35-O.50sec (Inst. defeated) CC#3 Neutral Neutral 0.4 0.5 1.5 0.1 40 o 6osec 0e off J 0.4 off, off off 400Asfor Protection (should not trip) Defeated _____ ____ _____ ______________ _____ ___________ __________ _______ ___ VVTP-042181-2, Revision 2 Page 6 of 7

CC#4 VVTP-042181-2, Revision 2 Page 7 of 7

IILI COMPf7

                                                                                                                         )

TO SWITCH"R. XE (A82)j

      ~L~I    _TCURRENT TI 1R,~

be "1T ToW hIS (A87)

                                                                                                                                                                                                            '1 TO 14tl X0              SHUNTTRI                                                                                               5I5'JT TI P Cot.                                                                                                    coM TO LOAD NOTES:

I. BREAKER' SHOWN IN OPEN POSITION.

2. THE SO-A. SD-B, AND SO-C SECONDARY CONNECTIONS MATCH AUXILIARYSWITCH ISAFETY RELATED I EXISTING PSEG GE AKO-6 SWITCHGEAR. (TYPICAL)

3. SEE REFERENCE 2 FOR TRIP DEVICE RATING AND OVERLOAD SETTINGS.

4. SEE REFERENCE 3 FOR LISTING OF PSEG BREAKER NUMBERS AND PROJECT:GE AKR REPLACEMENT BREAKER PROJECT ORIGINAL GE WIRING DIAGRAMS FOR EXTERNAL CONNECTIONS FOR HOPE CREEK GENERATING STATION ASSOCIATED WITH THIS WIRING SCHEMATIC.

5. NOT ALL AUXILIARYSWITCH CONTACTS ARE SHOWN ON DRAWING. IT*-** '

SEE SHEET 1 FOR ALL POSITIONS. CLENT: PUBLIC SERVICE ELECTRIC AND GAS (PSE&G)

6. THE SOUARE-D NEUTRAL CT WILL BE INSTALLED ON THE BUS IN THE EXISTING CUBICLE. THE WIRING WILL BE FIELD WIRED AND INSTALLED.

INSTALLATION OF THIS NEUTRAL CT REOUIRES DE-ENERGIZATION OF Ciommon BLANXET CONTRACT: 4600001373 THE SWITCHGHEAR BUS. LEGEND RELEASE CONTRACT: 4500282514. 4500303261

7. JUMPER OF THE DISCONNECT POSITION SWITCH WILL BE INSTALLED OF = AUXILIARYCONTACT (T4 TO 814 AND 73 AND 811) AND EXISTING JUMPER BETWEEN SD - SECONDARY DISCONNECT z._ - rouani raccrnaoaV Ti AND T2 WILL BE REMOVED.

8. THE NEUTRAL CURRENT TRANSFORMER USES THE FOLLOWING WIRE:

VC AND VN: 14AWG INSULATED. TYPE SIS, 600V. 90 DEG. C. STRANDED WIRE Ti THRU T4 AND GND: ALPHA TFE SHIELDED WIRE, 20AWG, P/N: 45464 OR i I III - NLI TliLE, NUCLEAR LOGISTICS INC. INTERNAL WIRING DIAGRAM FOR EOUIVALENT. NO: (-R - CONTROL WIRING RFFRERNCL CHCCK: D I~t ifIILo SDS AC MASTERPACT NW LGSB2 SAFETY REL.ATEO BREAKERS I. SOUARE 0 SERVICES DRAWIh IC NO: AHR89201 (NLI INTERNAL USE ONLY) This drow;ng iS the proprietory property 2. PSEG DRAWING: E-1465-O. ELECTRICAL PROTECTIVE DEVICE SETTINGS. of Nuclear Log;stics Inc. Use. disclosure 3. NLI DRAWING 042181-ACBRI KR-LIST- IA WSOPtROE-.p, BL D0RAWNG NO. 042181-WD1-AC-SR-2N I3 or reproduction without written permission 4. PSEG DCP# 80078163 of Nuclear Logisti.c Inc is prohibited. I ;wdR NTS Iv*cto N/A I SHT 2 oF 3

MASTERPACTI NTINW Universal Power Circuit Breakers Section 7: Trip Curves CURRENT INMULTIPLES OF f" (It =LONG-TIME SETTING x In) MICROLOGIC 5.016.0 AJP/H Trip Units

                                                               . . S . S..                                     Characteristic Trip Curve No. 613-4
   ,,,- F-               *"4                                                                                     Long-time Pickup and Delay Lhong-time Pickup andOF Delay it......
                           .i......L...  ......                     :I 4

t4-

                                       . ..                       .           .                     The time-current curve information is to be used for
                         , .-                                                                            application and coordination purposes only.

4 Curves apply from -30°C to +60°C (-22°F to +140°F)

                                                   ..                                                                 ambient temperature.
                              ,f:f-                                           I-                 Notes:
                                              -_-i *-. .i.-....  .1.                                  There is a thermal-imaging effect that can act to
                                       ,J 4.--4H.                                  il                 shorten the long-time delay. The thermal-imaging effect comes into play ifa current above the long-time
                                                                 .4-                                  delay pickup value exists for a time and then is cleared by the tripping of a downstream device or the circuit breaker itself. A subsequent overload will cause the circuit breaker to trip in a shorter time than normal. The amount of time delay reduction is

• inverse to the amount of time that has elapsed since 4 EC- ROSAA¶the previous overload. Approximately twenty minutes

                                                                        .....                         isrequired between overloads to completely reset,ý S- i                                    thermal-imaging.

k4- F 2. The end of the curve Is determined by the

                                                                +;-                j,                 interrupting rating of the circuit breaker.
    "                                                                   L-         ~"            3. With zone-selective interlocking ON, short-time delay I                  utilized, and no restraining signal, the maximum unrestrained short-time delay time band applies i-i. ].-.                                                                                       regardless of the setting.
                                                                                   .             4. Total clearing times shown include the response times of the trip unit, the circuit breaker opening, and the extinction of the current.

HEY 5. For a withstand circuit breaker, instantaneous can be

                    -- T                                                             2turned                   OFF. See trip,curve 613-7 on page 150 for instantaneous trip curve. See trip curve 613-10 on page 153 for instantaneous override values.

6. Overload indicator illuminates at 100%.

1_...........

                 ý-!                                                               -.-
               +/-               .L.                                      Ii--.

L*..Li LJ.L _,.L n* L_ I: U. CURRENT IN MULTIPLES OF Ir CreNo.O013%C o4 (Ir = LONG-TIME SETTING x In) .SC9541-o 4 I.7ni 6/01 @ 1999-2001 Schneider Electric AMRights Reserved 147

MASTERPACTI NT/NW Universal Power Circuit Breakers Section 7: Trip Curves CURRENT IN MULTIPLES OF Ir (It = LONG-TIME SETTINGx In) MICROLOGIC 5.016.0 AIPIH Trip Units

                ~ ~~

A~~~ .. aI a 2281 Characteristic Trip Curve No. 613-5 I T]

                          ..... . +/--
                                            '77_17777~J*

2 Short-time Pickup and 1 t ON Delay _ '~14 .... ... ..

           *1.                          K ij j..;j.~

The time-current curve information is to be used for application and coordination purposes only. F. Curves apply from -30°C to +60°C (-220F to +140°F) ambient temperature. Notes:

1. There is a thermal-imaging effect that can act to shorten the long-time delay. The thermal-imaging effect comes Into play if a current above the long-time delay pickup value exists for a time and then is cleared by the tripping of a downstream device or the circuit breaker itself. A subsequent overload will cause the circuit breaker to trip in a shorter time than normal. The amount of time delay reduction is inverse to the amount of time that has elapsed since the previous overload.

Approximately twenty minutes is required between 0 overloads to completely reset thermal-imaging. zW

  'A                                                                                  2. The end of the curve is determined by the interrupting Ca                                                                                         rating of the circuit breaker.

3. With zone-selective interlocking ON, short-time delay utilized, and no restraining signal, the maximum unrestrained short-time delay time band applies regardless of the setting.

4. Total clearing times shown include the response times of the trip unit, the circuit breaker opening, and the extinction of current.

5. For withstand circuit breaker, instantaneous can be turned OFF. See trip curve 613-7 on page 150 for instantaneous trip curve. See trip curve 613-10 on page 153 for instantaneous override values.

6. See Trip Curve 613-4 on page 147 for long-time pickup and delay trip curve.

4 L 2 Va 3 1! ag CURRENT IN MULTIPLES OF Ir Con. No. 061=30005 (Ir - LONG-TIME SETTINGx In) D-ng No.848095-813-OS 6/01 143

                                                       @ 1999-2001
                                                       @             Schneider Electiic 1990-2001 Schneider All Rights Reserved Electric All Rights Reserved 6/01 ID__1

MASTERPACTr NTINW Universal Power Circuit Breakers Section 7: Trip Curves MULTIPLES OF SENSOR RATING (In) MICROLOGIC 5.016.0 Trip Units I 12 . . a X: a a aga31 Characteristic Trip Curve No. 613-7 Instantaneous Pickup, 2X to I5X and OFF

        -- T           rr~4z1
                                  .. ..- .. ....                    4 .....
            -. -      44 4..+ftLI ..............               ~                -

The time-current curve information is to be used for application and coordination purposes only. T'.- Curves apply from -30°C to +60°C (-22°F to +140°F) ambient temperature. Notes:

1. The end of the curve is determined by the interrupting rating of the circuit breaker.

2. Total clearing times shown include the response times

                                                                'A H ()0 of the trip unit, the circuit breaker opening, and the llk*,ýW            3                       extinction of current.
                                                                      'T"                  3. The instantaneous region of the trip curve shows maximum total clearing times. Actual clearing times in!!

1- 7:7 this region can vary depending on the circuit breaker

                                                                 +

T- mechanism design and other factors. The actual clearing time can be considerably faster than

• indicated. Contact your local sales office for additional T information.

4. For a withstand circuit breaker, instantaneous can be

                                                   ........                                      turned OFF See trip curve 613-7 on page 150 for the 4-                                    ......
                                                           ...                                   instantaneous trip curve. See trip curve 613-10 on z                                                                                               page 153 for the instantaneous override values.

0 ...

5. See trip curve 613-4 on page 147 and trip curve IF, 1 613-5 on page 148 for long-time pickup, long-time delay, short-time pickup and short-time delay trip curves.

L 1r ... . ... ..... 1-ta t

           .4-                                              -LU             11-7+ 1 4:

F CNO. C..q 0613TC0007 NO. O4O913TO07 150 Thu 0 1999-2001 Schneider (D fidlRights Electric All Schneider Electric Reserved Rights Reserved 6/01 6101 15

MASTERPACTO NTINW Universal Power Circuit Breakers Section 7: Trip Curves MULTIPLES OF SENSORRATING(in) MICROLOGIC 6.0 AIP/H Trip Units with Adjustable Ground-fault Pickup and Delay I I ,~I ~..........

                                                    .... ~~i.   .... I,  .......~ .. .....
                                                                                                                                  .                             Characteristic Trip Curve No. 613-1 2

Ground Fault 1 t OFF and ON I 0 _400 A A. --- 4 ..

      .'T....
        ...i
                        ~~_*,* i. ~
              ,,,.........                              ~: ,--"v~       ------   -......

T ......

                   *~
                   ....     =-*"*.*

-*.J

                  . ..... *'-P
                                   *"*r--:
                                                                                     ..._ !,    -i.-fF:T_. -
                                                                                .................... F..,-.-i .......- .
                               ..,. . ......     ..........................i. .* . .i.. ..* .... ,..* . .* .
            ...,--.   -...-. .- ..- ... .T...:.
                  .. -...                            .... 4_"                      ..

The time-current curve information is to be used for L application and coordination purposes only. r............ ..*'" : : : I::::::

                                                                   .............                                    i L I
                                                                                                                          .4:*::::::::::
                             , , :                                                                                     .l    i                     Curves apply from -30°C to +601C (-22°F to +140°F) ambient temperature.
         ....    ..                       .. 4......i.
                *~~~~~                  '"."                          ~.........................

I ... t H ..... ...T .. ~ . ..... Z_z 641 dYCLE ---

                                                                                                      . ~                            ....

I,J ~Jij1 ... ........ CU_0 NO. 61TC00001 D*-1.g No. 846095-"13-01 MULTIPLES OF SENSOR RATING (In) 144 ...

                                                                                               @ 1999-2001 Schneider Electric AllRights Reserved nnA VIU I FDN

MASTERPACTr NTINW Universal Power Circuit Breakers Section 7: Trip Curves MULTIPLES OF SENSOR RATING (Ia) MICROLOGIC 6.0 AIP/H Trip Units R *m_7-T-'PT'T,,'r ";-*---T'--f

                    ..-          : : :    ;  , , T'TT*                           luN m

with Adjustable Ground-fault Pickup and Delay Characteristic Trip Curve No. 613-2 m sou Ground Fault 12t OFF and ON 7i 400 A < In5<1200 A

                           ~...   .~..  ..  ....
                                               .i V                          J-4 It              7-11.: ...

ill The time-current curve information is to be used for application and coordination purposes only. 1J Curves apply from -30*C to +60°C (-22°F to +140'F) ambient temperature.

            ~111i2~

Fr-A .. 0 CF) z IiI i ,

                      'a.       diE              -_

A MULTIPLES OF SENSOR RATING (In) c-*7 NO. 4063TCUiM Ova**' No.8480115.013-02 FD] 6/01 6101 00 1999-2001 Schneider Electric All Rights Reserved 1999-2001 Schneider Electric All Rights Reserved 145

LT LT ST ST Inst. GF pickup delay pickup delay pickup pickup test current / Trip setting setting setting setting setting setting GF time i2t setting Neutral trip time Actual trip time of Function 00r (tr) (Isd) (tsd) li) (1g) delay (tg) (ST. GF) setting acceptance criteria breaker (sec) CC#1 Neutral 768A Protection 0.4 0.5 10 0.4 Off J 0.4 off, off 1.6N 1.6 - 2.2 sec / 7 A/ (LT @ en 300%) Neutral 864A Protection 0.45 1 10 0.4 Off J 0.4 off, off 1.6N 3.5 - 5 sec 5(C, N/z. (LT@ 300%) cc#1 Neutral 960A Protection 0.5 2 10 0.4 Off J 0.4 off, off 1.6N' 6.8 - 9.2 sec 7,,0 Sec. (LT @ 300%) CC#1 Neutral 720A Protection 0.6 4 10 0.4 Off J 0.4 off, off 1N 12A- 18 sec 13. tiec. (LT @ 300%) CC#1 Neutral 756A Protection 0.63 8 10 0.4 Off J 0.4 off, off 1N 27- 37 sec (LT @ 300%) CC# I Neutral 840A Protection 0.7 12 10 0.4 Off J 0.4 Off, Off 1N 41 - 51s-'sec , 7,5,Z." (LT @4 300%) Cc#1 Neutral 480A Protection 0.8 16 10 0.4 Off J 0.4 off, off 1/2N 5 60A (LT @

*3oo%)    ____

CC#1 Neutral 540A Protection 0.9 20 10 0.4 Off J 0.4 off, off 1/2N 65--83 sec (LT @ T 300%) VVTP-042181-2, Revision 2 Page 3 of 7 7 I 9~J

LT LT ST ST Inst. GF pickup delay pickup delay pickup pickup test current I Trip setting setting setting setting setting setting GF time e2t setting Neutral trip time Actual trip time of Function (Ir) (tr) (Isd) (tsd) (0) (1g) delay (tg) (ST, GF) setting acceptance criteria breaker (sec) CC#1 Neutral 600A Protection 1 24 10 0.4 Off J 0.4 Off, off 1/2N 83-130sec 5'5 -55 see. (LT @O 300%) CC#2 Neutral 3840A Protection 1 24 1.5 0 Off J 0.4 off, off 1.6N 0.02-0.A8sec O.O 5ec-. (ST @ 400%) CC#2 Neutral 4608A Protection 0.9 24 2 0.1 Off J 0.4 off, off 1.6N 0.08-0.l4sec C * (ST @ 400%) CC#2 Neutral 5120A Protection 0.8 24 2.5 0,2 Off J 0.4 off, off 1.6N 0.14-0.20sec IL sSec. (ST @ 400%) CC#2 Neutral 3360A Protection 0.7 24 3 0.3 Off J 0.4 off, off IN 0.22-0.32sec (ST @ 400%) CC#2 Neutral 4032A Protection 0.63 24 4 0.4 Off J 0.4 off, off IN 0.35-0.50sec .ec. (ST @ 400%) CC#2 Neutral 1500A Protection 0.6 24 5 0.4 Off J 0.4 on, off 1N 0.9-1.7sec 30A 5e-(ST @ 125%) CC#2 Neutral 750A Protection 0.5 24 6 0.3 Off J 0.4 on, off 1/2N 0.3-0.6sec . :2-Sec. (ST @ 125%).. . VVTP-042181-2, Revision 2 Page 4 of 7

LT LT ST ST Inst. GF pickup delay pickup delay pickup pickup test current! Trip setting setting setting setting setting setting GF time i2t setting Neutral trip time Actual trip time of Function (10 (tr) (Isd) (tsd) (11) (Ig) delay (tg) (ST, GF) setting acceptance criteria breaker (sec) CC#2 Neutral 900A Protection 0.45 24 8 0.2 Off J 0.4 on, off 1/2N 0.14-0.20sec 0 .I SEC. (ST @ 125%) , , CC#2 Neutral I000A Protection 0.4 24 10 0.1 Off J 0.4 on, off 1/2N 0.08-0.14sec 0 o\se. (ST @ 125%) CC#3 Neutral Protection 1 24 10 0.4 2 J 0.4 off, off 1.6N 2560A ec. (Inst. @ *0.06sec 200%) CC#3 Neutral 3840A Protection 1 24 10 0.4 3 J 0.4 Off, off 1.6N *<

• es-e (Inst. @ 0.06sec 200%)

CC#3 Neutral Protection 1 24 10 0.4 4 J 0.4 off, Off 1.6N 5120A (Inst. @ <_0.06sec O. e* c. 200%) CC#3 Neutral Protection 1 24 10 0.4 6 J 0.4 off, off 1N 4800A (Inst. @ _ 0.06sec 0 s35ec. 200%) CC#3" Neutral Protection 1 24 10 0.4 8 J 0.4 off, off 1N 6,400A (Inst. @

• 0.o6sec o35ec.

200%) VVTP-042181-2, Revision 2 Page 5 of 7 3

LT LT ST ST Inst. GF pickup delay pickup delay pickup pickup test current / Trip setting setting setting setting setting setting GF time i2t setting Neutral trip time Actual trip time of Function (1r) (tr) (Isd) (tsd) (li) (IQ) delay(tg) (ST, GF) setting acceptance criteria breaker (sec) CC#3 Neutral Protection 1 24 10 0.4 10 J 0.4 off, off 1N 8000A (Inst. @ :5 0.06sec O" 3 - " 200%) CC#3 Neutral 4800 Protection 1 24 10 0.4 12 J 0.4 off, off 1/2N 4800A (Inst. @ _*0.06sec 0. 09 5c. i)"2I-VII 200%) CC#3 Neutral Protection 1 24 10 0.4 15 J 0.4 off, off 1/2N 6000A se Y (Inst.@ _<0.06sec 0- [ SE'C, 0 f.'li'V..l 200%) CC#3 Neutral 4000A Protection 1 24 10 0.4 off J 0.4 off, off 1/2N (Inst. o.3-0.5osec sec. defeated) NCC#3 eutral4 0 Af r 6 e co - " t' Protection 0.4 0.5 1.5 0.1 Off J 0.4 off, off Off 400A(for 6osec tirip) No e Defeated ___.C- I 5ec. VVTP-042181-2, Revision 2 Page 6 of 7

CC#4 LT ST ST Insti GF pickup LT delay pickup delay pickup pickup GF time i2t setting setting setting setting setting setting delay setting Neutral Test Current for 10 seconds OIr). (tr) (Isd) (tsd) (11) (I g)f (ST, GF) setting A4, B4, C4, N Trip time: MCS -,re- i p 1 24 10 0.4 off A 0 off, off off +180A, 0, 0, -180A (acceptance (0.3)(acpne criteria is no trip) 1 24 10 0.4 off A 0 off, off off 0, +180A, 0, -180A * (0.3) (acceptance criteria is no trip) 1 24 10 0.4 off (0.3) 0 off, off off 0, 0, +180A, -180A(acceptance ___criteria Is no trip) 1 24 10 0.4 off A 0 off, off off 0, 0, +180A, 0 (acceptance (0.3) criteria Is 0.02-1 0.11 sec) ZD-o) A 1 24 10 0.4 off (0.3) 0 off, off off 0, +180A, 0, 0 (acceptance criteria is 0.02-0.11 sec) C. =3.. *T'c-1 24 10 0.4 off A 0 off, off off +180A, 0, 0,0 (acceptance (0.3) criteria is 0.02-0.11 sec) VVTP-042181-2, Revision 2 Page 7 of 7 O/f/4 3

L~ -Check off appror .te tests:

  .           I       e TEST DATA SHEET N*UCLEAR LOGIMTCS INC OPRE-SEISMIC 0 POST-SEISMIC IMVERIFICATION [-OTHER                                                           -

Test Data for: VP- VVTrP- Oq2-TI -2 91 ,.?2 Job Number: oqz, II P.E. T Catalog ID #: AJ[A Item

Description:

Ki,7LjA CT Manufacturer: . 4ke. Model/Part No.: f,3 L13 . - l Provide Summary of Test Results (/4?cralwc 6.'w) Check pdropriate boxes: DAII Items Passed. Discrepancy Report(s): If yes, identify below: 5(yes ONo ON/A List S/N or ID passed below, Qty passed: 0 S/Ns orID# PM

 ,2o[L(-coot-oo                                04 2- Irri-W -I         WAccptable      ONot Acceptable         Initials/Date by PE; QAcceptable    ONot Acceptable          Initials/Date by PE:

QAcceptable [Not Acceptable Initials/Date by PE: OAcceptable ONot Acceptable Initials/Date by PE: DAcceptable oNot Acceptable Initials/Date by PE: Other (where aplicable) Record All M&TE Used:; NLI MTE# Description Cal. Due Date NLI MTE# Description Cal. Due Date 5ý 2 Bzec~.k C___ FcTT_______ ___________ &UTpdate M&TE log on computer -rm. If RIOS-Initials & Date Performed By: Date: 1/7/O " NOTES: Verified by: Date: Approved by: _________________Date: Page .. ~. 9f .. (9.. Form No. T-1 OO4,Rev. 4

DISCREPANCY REPORT A. IDENTIFICATION DR#: 042181-VV-1

Description:

VVTP-042181-2, rev. 2, CC#3 specifies the trip time to be

• 0.06 seconds while testing instantaneous protection. The actual trip times when the neutral protection was set to 1/2 N were 0.09 sec. and 0.10 sec.

Affected Hardware/Dociunent/M&TE: VVTP-042181-2, rev. 2; Micrologic trip unit V&V Initial Evaluation/ Tagging 0 Conditional Release L] Material Hold Preparedby:date: ' "Approved by:. date:__ B. RESOLUTION (Attach additional pages. if reauired.) Evaluation: see attached evaluation Disposition 0l Acceptable/use as is 2Acceptable with -ewerle 0 Acceptable with limitations noted 0 Reject/do not use Code 1 30 Code 2 See NLI-QUAL-06, Rev. 11, Table 3.2 Prepared by: Date: 6/0or Reviewed by: Date: C.oJ10 Approved by: Date: 712-o ' Page 1 of 3 NLI QUAL 06, R12 Attachment I

DISCREPANCY REPORT Continuation of B. (RESOLUTION) DR#: 042181-VV-1 Per Square D, the neutral protection instantaneous pickup is only a function of the circuit breaker sensor plug rating and the instantaneous pickup setting. The neutral setting only affects long-time and short-time pickup, not instantaneous pickup. Therefore the currentI applied while testing instantaneous protection with 1/2 N neutral setting is equal to 100% of the instantaneous pickup, not 200% as was intended. The circuit breaker tripped within the tolerances of the trip curve. Additional testing per the attached table will be performed to properly test the neutral instantaneous protection at 200%. The V&V testing is acceptable with additional testing. T1ie etA111e0 I(A j~ lar1l("I'ed/f~5f 9W#~Ft, Page 2 of 3 NLI QUAL 06, R12 Attachment I

DR-042181-VV-t Page 3 of 3 LT LT ST ST Inst. GF pickup delay pickup delay pickup pickup i2t test current / Trip setting setting setting setting setting setting GF time setting Neutral trip time Actual trip time of Function (Ir) (tr) (Isd) (tsd) () Ig) delay (tg) (ST, GF) setting acceptance criteria breaker (sec) CC#3 Neutral 1600A Protection 1 24 10 0.4 2 J 0.4 off, off 1.6N (Inst. @ -<0.06sec o.o3 5ec- -200%) CC#3 Neutral 2400A Protection 1 24 10 0.4 3 J 0.4 off, off 1.6N * . O-{ $CC _0.06sec (Inst. @ 200%) CC#3 Neutral 3200A Protection 1 24 10 0.4 4 J 0.4 off, off 1.6N (Inst., @ 200%) CC#3 Neutral 9600A Protection 1 24 10 0.4 12 J 0.4 Off, Off 1/2N < _0.06sec (Inst. @ -200%) CC#3 Neutral 12 000A Protection 1 24 10 0.4 15 J 0.4 off, off 1/2N d _0.06sec - (Inst. @ 200%) ,. ModelNo.: ccT,." S. 3*'o, MTE## - Calib. Due Date:-o /3 0o Ser.No.: ,02O11 -, oI-ooo/ MTE # Calib. Due Date: Date: /12L /05S Date: ./;2 /6L Date:-C> NLI QUAL 06, R12 Attachment I

MASTERPACT' NT/NW Universal Power Circuit Breakers Section 7: Trip Curves CURRENT IN MULTIPLES OF Ir (Ir- LONG-TIME SETTING x In) MICROLOGIC 5.0/6-0 A/P1H Trip Units 1t Characteristic Trip Curve No. 613-4 I . ..... I....

                                  ..                                      .           .......... - .....                                          Long-time Pickup and Delay 4 -T
                                                              . ...                                                                            Short-time Pickup and 12t OFF Delay LJ                                                              .. . ..........
                                                                                         . t . ..,.. '..' "
                                                                --  4 .........              ....i...
                                                                         ..... . ....!...-.I....        .. ..i . i The time-current curve information is to be used for application and coordination purposes only.
                       *....~..                           ! i... ...........
                                                                 .......... ....... *.. ......G...*......         ..!

Curves apply from -30*C to +60*C (-22*F to +140'F) ambient temperature.

           ........                ..                                    . . ..          i. i
                                                         .. ...........     ..... .           .                . I. e Notes:
                                      ..                                               'j - I . -
                                                                                      ..                                          1. There is a thermal-imaging effect that can act to shorten the long-time delay. The thermal-imaging
                                                                     .......                        . .      .                         effect comes into play if a current above the long-time delay pickup value exists for a time and then is cleared by the tripping of a downstream device or the circuit breaker itself. A subsequent overload will A                                                                                                                                 cause the circuit breaker to trip in a shorter time than normal. The amount of time delay reduction is inverse to the amount of time that has elapsed since the previous overload. Approximately twenty minutes is required between overloads to completely reset LU                                                                                                                                   thermal-imaging.

2. The end of the curve is determined by the 2_

interrupting rating of the circuit breaker.

3. With zone-selective interlocking ON, short-time delay utilized, and no restraining signal, the maximum unrestrained short-time delay time band applies regardless of the setting.

4. Total clearing times shown include the response times of the trip unit, the circuit breaker opening, and the extinction of the current,

5. For a withstand circuit breaker, instantaneous can be turned OFF. See trip curve 613-7 on page 150 for instantaneous trip curve. See trip curve 613-10 on page 153 for instantaneous override values.

6. Overload Indicator illuminates at 100%.

               ..   .....         ....                  >   1 L..                   -
                                                  .. ~~ -T
                               = J14   ....

C_ 6.0613Tcaou CURRENT IN MULTIPLES OF Ir DrowhigNo.84809MI3.04 (Ir a LONG-TIME SETTING x In) 147 15 6/01 @ 1999-2001 Schneider Electric All Rights Reserved

MASTERPAC'I NT/NW Universal Power Circuit Breakers Section 7: Trip Curves CURRENT IN MULTIPLES OF Ir (Ir - LONG-TIME SETTING x In) MICROLOGIC 5.0/6.0 AIP/H Trip Units

    ., 4 .. ",. -   :  .              . . .       ..        . a       1       8 1 2 t                                                                                                                 Characteristic Trip Curve No. 613-5 i                                                                             ..

Short-time Pickup and 12t ON Delay i.I J. ir The time-current curve information is to be used for application and coordination purposes only Curves apply from -30*C to +60*C (-22'F to +140*F) ambient temperature. Notes:

1. There is a thermal-imaging effect that can act to shorten the long-time delay. The thermal-imaging effect comes into play if a current above the long-time delay pickup value exists for a time and then is cleared by the tripping of a downstream device or the circuit breaker itself. A subsequent overload will cause the circuit breaker to trip in a shorter time than normal. The amount of time delay reduction is inverse to the amount of time that has elapsed since the previous overload.

Approximately twenty minutes is required between

                                                         ...........                a                   overloads to completely reset thermal-imaging.

0_ V ......... ........ . ....... 2. The end of the curve is determined by the interrupting rating of the circuit breaker.

3. With zone-selective interlocking ON, short-time delay utilized, and no restraining signal, the maximum I ~ ...........

unrestrained short-time delay time band applies S~bR.,...IS......%. . . . . . regardless of the setting.

4. Total clearing times shown include the response times of the trip unit, the circuit breaker opening, and the extinction of current.

5. For withstand circuit breaker, instantaneous can be turned OFF, See trip curve 613-7 on page 150 for instantaneous trip curve. Seetrip curve 613-10 on page 153 for Instantaneous override values.

1:ja :1.1 6. See Trip Curve 613-4 on page 147 for long-time pickup J delay trip curve. IV11

                                       ~~ ..

CURRENT !N MULTIPLES OF Ir C- N.. 0613TC0005 (Ir - LONG TIME SETTING x In) D-Ing N. 8480"13.05 1AR

                                                                      @ 1999-2001 Schneider Electric AllRights Reserved                                    6101 nn

MASTERPACTO NT/NW Universal Power Circuit Breakers Section 7: Trip Curves MULTIPLES OF SENSOR RATING (In) MICROLOGIC 5.0(6.0 Trip Units a I S.. ......

                              "     :=7
                                                   ....      9.

I a I I Characteristic Trip Curve No. 613-7 Instantaneous Pickup, 2X to 15X and OFF i_ __.T........

                                 -.4
                             ....... .... J
                                                                          .I
                                                                                              ..                        The time-current curve information is to be used for t.........

4-- application and coordination purposes only. Curves apply from -30°C to +60°C (-22°F to +140°F) T

                                                                                ............                                              ambient temperature.

T 7.

                                          . ..   ..... 4-jr-1
                                                   . ....                                                          Notes:
                                     ..      .711,-....

I. The end of the curve is determined by the interrupting nf4 j .... II rating of the circuit breaker.

                                                                                              ..... =N tx

2. Total clearing times shown include the response times of the trip unit, the circuit breaker opening, and the IKIIITýNfAý110U!li extinction of current H .........

                                                                                     ..                            3. The instantaneous region of the trip curve shows maximum total clearing times. Actual clearing times in this region can vary depending on the circuit breaker' mechanism design and other factors. The actual clearing time can be considerably faster than indicated. Contact your local sales office for additional information.

4. For a withstand circuit breaker, instantaneous can be turned OFF. See trip curve 613-7 on page 150 for the instantaneous trip curve. See trip curve 613-10 on page 153 for the instantaneous override values.

_z 0= 5. See trip curve 613-4 on page 147 and trip curve 613-5 on page 148 for long-time pickup, long-time delay, short-time pickup and short-time delay trip curves. At

           .1....
                                 .------                                -~

CorveNo. 0613TCOD07 MULTIPLES OF SENSOR RATING (In) D0w.*g N. B146095-013.07 A..n

                                                                                © 1999-2001 Schneider Electric All Rights Reserved                                        61- 1  33

MASTERPACTO NT/NW Universal Power Circuit Breakers Section 7: Trip Curves n) MICROLOGIC 6.0 AJPIH Trip Units MULTIPLES OF SENSOR RATING (In I 4 with Adjustable Ground-fault Pickup and Delay

                                                              =Characteristic                           Trip Curve No. 613-2 j-.                        Ground Fault 12t OFF and ON
                                                ..r                                                400 A<1,:51200 A 7

t...

                                                         -    Se The time-current curve information is to be used for application and coordination purposes only.

Curves apply from -30'C to +600C (-22°F to +140TF) ambient temperature.

                                                                                              *i:

2 P U, 2= EL ADIA1:: .. 1OFF .. I-4 MULTIPLES OF SENSOR RATING (I n)cu oe O63Tcom koo. In)~n DkNo. 4809M.13.O2 145 1999-2001 Schneider Electric All Rights Reserved a 6/01 6101 00 1999-2001 Schneider Electric All Rights Reserved}}