ML12132A101

Supplemental Information on Diesel Fuel Oil Test Program Amendment

ML12132A101
Person / Time
Site:	Millstone
Issue date:	05/07/2012
From:	Elmaghrabi M Dominion Nuclear Connecticut
To:	James Kim Plant Licensing Branch 1
References
TAC ME8454
Download: ML12132A101 (20)

Text

Kim, James From: Mohamed A Elmaghrabi [mohamed.a.elmaghrabi@dom.com]

Sent: Monday, May 07, 2012 10:53 AM To: Kim, James Cc: William D Bartron; Wanda D Craft; William E Brown; MaryLou L Calderone

Subject:

FW: Outgoing NRC Correspondence Serial No. 11-669: LAR Regarding the Diesel Fuel Oil Test Program Technical Specification - MPS Unit 2 Attachments: Pages from MP-PROC-OPS-U2-14-OPS-BAP05, REV=359.pdf Jim In response to your e-mail I am providing the following answers:

1- I have reviewed NUREG-1432, Rev. 3 and found it to be consistent with the discussion in the LAR wherever NUREG-1432, Rev. 3.1 is referenced. Therefore, the reference in the LAR to NUREG-1432, Rev. 3.1 can be replaced with a reference to NUREG-1432, Rev. 3.

2- In response to the second item, please find attached a PDF file containing Bases pages for entire Bases section 3/4.8.

If you have any other questions, please let me know.

Thanks Mohamed A. Elmaghrabi Millstone Licensing Ph: 860-444-4353 Tie: 8-759-4353 Fax: 860-437-5901 E-mail: Mohamed.A.Elmaghrabi@DOM.com From: Kim, James [1]

Sent: Friday, May 04, 2012 12:11 PM To: William D Bartron (Generation - 4)

Cc: Wanda D Craft (Generation - 6)

Subject:

FW: Outgoing NRC Correspondence Serial No. 11-669: LAR Regarding the Diesel Fuel Oil Test Program Technical Specification - MPS Unit 2

Bill, During the acceptance review of the subject amendment request, the NRC tech. staff has requested the following supplemental information in order to complete the acceptance review:

1. The LAR has referenced "NUREG-1432, Rev. 3.1" but Rev. 3.1 has not been endorsed by the NRC.

Please clarify whether it was meant to be NUREG-1432, Rev. 3.

2. The LAR contains only one page (B 3/4 8-7) of marked-up Bases Pages. Please provide the entire relevant Bases Pages for section 3/4 8.

Please let me know if you want to discuss the above issues with the tech. staff.

1

Thanks Jim Kim From: Vicki Hull dom.com

Sent: Monday, April 16, 2012 9:42 AM To: Kim, James

Subject:

Outgoing NRC Correspondence Serial No. 11-669: LAR Regarding the Diesel Fuel Oil Test Program Technical Specification - MPS Unit 2 FYI -

CONFIDENTIALITY NOTICE: This electronic message contains information which may be legally confidential and/or privileged and does not in any case represent a firm ENERGY COMMODITY bid or offer relating thereto which binds the sender without an additional express written confirmation to that effect. The information is intended solely for the individual or entity named above and access by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, distribution, or use of the contents of this information is prohibited and may be unlawful. If you have received this electronic transmission in error, please reply immediately to the sender that you have received the message in error, and delete it. Thank you.

2

LBDCR 07-MP2-009 March 29, 2007 3/4.8 ELECTRICAL POWER SYSTEMS BASES The OPERABILITY of the A.C. and D.C. power sources and associated distribution systems during operation ensures that sufficient power will be available to supply the safety related equipment required for 1) the safe shutdown of the facility and 2) the mitigation and control of accident conditions within the facility. The minimum specified independent and redundant A.C. and D.C. power sources and distribution systems satisfy the requirements of General Design Criteria 17 of Appendix "A" to 10 CFR 50.

The required circuits between the offsite transmission network and the onsite Class 1E distribution system (Station Busses 24C, 24D, and 24E) that satisfy Technical Specification 3.8. 1. I.a (MODES 1,2, 3, and 4) consist of the following circuits from the switchyard to the onsite electrical distribution system:

a. Station safeguards busses 24C and 24D via the Unit 2 Reserve Station Service Transformer and bus 24G; and

b. Station bus 24E via the Unit 3 Reserve Station Service Transformer or Unit 3 Normal Station Service Transformer (energized with breaker 15G- 13T-2 (13T) and associated disconnect switches open) and bus 34A or 34B.

When taking credit for the Unit 3 Normal Station Service Transformer as a second offsite circuit, breaker 13T and its associated disconnect switches are required to be open. This removes the potential for a single failure (that of breaker 13T) to cause a simultaneous loss of both offsite circuits. Should the other offsite circuit (i.e., the Unit 2 Reserve Station Service Transformer) already be inoperable, the requirement for maintaining breaker 13T and its associated disconnect switches open is no longer applicable.

If the plant configuration will not allow Unit 3 to supply power to Unit 2 from the Unit 3 Reserve Station Service Transformer or Unit 3 Normal Station Service Transformer within 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, Unit 2 must consider the second offsite source inoperable and enter the appropriate ACTION statement of Technical Specification 3.8. 1.1 for an inoperable offsite circuit.

This is consistent with the GDC 17 requirement for two offsite sources. Each offsite circuit is required to be available in sufficient time following a loss of all onsite alternating current power supplies and the other offsite electric power circuit to assure that specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded.

The first source is required to be available within a few seconds to supply power to safety related equipment following a loss of coolant accident. The second source is not required to be available immediately and no accident is assumed to occur concurrently with the need to use the second source. However, the second source is required to be available in sufficient time to assure the reactor remains in a safe condition The 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> time period is based on the Millstone Unit No. 2 Appendix R analysis. This analysis has demonstrated that the reactor will remain in a safe condition (i.e., the pressurizer will not empty) if charging is restored within 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />.

MILLSTONE - UNIT 2 B 3/4 8-1 Amendment No. 4-88, 4-92, 23+,

LBDCR 07-MP2-009 March 29, 2007 3/4.8 ELECTRICAL POWER SYSTEMS BASES In MODES 1 through 4 (Technical Specification 3.8. I. 1), the Unit 2 Normal Station Service Transformer can be used as the second offsite source after the main generator disconnect links have been removed and the backfeed lineup established.

The required circuit between the offsite transmission network and the onsite Class 1E distribution system (Station Busses 24C, 24D, and 24E) that satisfies Technical Specification 3.8.1.2.a (MODES 5 and 6) consists of the following circuit from the switchyard to the onsite electrical distribution system:

a. Station safeguards bus 24C or 24D via the Unit 2 Reserve Station Service Transformer and bus 24G; or

b. Station safeguards bus 24C or 24D via the Unit 2 Normal Station Service Transformer and bus 24A or 24B after the main generator disconnect links have been removed and the backfeed lineup established; or

c. Station bus 24E via the Unit 3 Reserve Station Service Transformer or Unit 3 Normal Station Service Transformer and bus 34A or 34B.

When the plant is operating with the main generator connected to the grid, the output of the main generator will normally be used to supply the onsite Class 1E distribution system.

During this time the required offsite circuits will be in standby, ready to supply power to the onsite Class 1E distribution system if the main generator is not available. When shut down, only one of the offsite circuits will normally be used to supply the onsite Class 1E distribution system.

The other offsite circuit, if required, will be in standby. Verification of the required offsite circuits consists of checking control power to the breakers (breaker indicating lights), proper breaker position for the current plant configuration, and voltage indication as appropriate for the current plant configuration.

The ACTION requirements specified for the levels of degradation of the power sources provide restriction upon continued facility operation commensurate with the level of degradation.

The OPERABILITY of the power sources are consistent with the initial condition assumptions of the accident analyses and are based upon maintaining at least one of each of the onsite A.C. and D.C. power sources and associated distribution systems OPERABLE during accident conditions coincident with an assumed loss of offsite power and single failure of the other onsite A.C.

source.

MILLSTONE - UNIT 2 B 3/4 8-2 Amendment No. l-&8, -- 92, 2--,

LBDCR 07-MP2-009 March 29, 2007 3/4.8 ELECTRICAL POWER SYSTEMS BASES Technical Specification 3.8. I. 1ACTION Statements b and c provide an allowance to avoid unnecessary testing of the other OPERABLE diesel generator. If it can be determined that the cause of the inoperable diesel generator does not exist on the OPERABLE diesel generator, Surveillance Requirement 4.8.1 . 1.2.a.2 does not have to be performed. If the cause of inoperability exists on the other OPERABLE diesel generator, the other OPERABLE diesel generator would be declared inoperable upon discovery, ACTION Statement e would be entered, and appropriate ACTIONS will be taken. Once the failure is corrected, the common cause failure no longer exists, and the required ACTION Statements (b, c, and e) will be satisfied.

If it cannot be determined that the cause of the inoperable diesel generator does not exist on the remaining diesel generator, performance of Surveillance Requirement 4.8.1.1.2.a.2, within the allowed time period, suffices to provide assurance of continued OPERABILITY of the diesel generator. If the inoperable diesel generator is restored to OPERABLE status prior to the determination of the impact on the other diesel generator, evaluation will continue of the possible common cause failure. This continued evaluation is no longer under the time constraint imposed while in ACTION Statement b or c.

The determination of the existence of a common cause failure that would affect the remaining diesel generator will require an evaluation of the current failure and the applicability to the remaining diesel generator. Examples that would not be a common cause failure include, but are not limited to:

1. Preplanned preventive maintenance or testing, or

2. An inoperable support system with no potential common mode failure for the remaining diesel generator, or

3. An independently testable component with no potential common mode failure for the remaining diesel generator.

If one Millstone Unit No. 2 diesel generator is inoperable in MODES 1 though 4, ACTION Statements b.3 and c.3 require verification that the steam-driven auxiliary feedwater pump is OPERABLE (MODES 1, 2, and 3 only). If the steam-driven auxiliary feedwater pump is inoperable, restoration within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> is required or a plant shutdown to MODE 4 will be necessary. This requirement is intended to provide assurance that a loss of offsite power event will not result in degradation of the auxiliary feedwater safety function to below accident mitigation requirements during the period one of the diesel generators is inoperable. The term verify, as used in this context, means to administratively check by examining logs or other information to determine if the steam-driven auxiliary feedwater pump is out of service for maintenance or other reasons. It does not mean to perform Surveillance Requirements needed to demonstrate the OPERABILITY of the steam-driven auxiliary feedwater pump.

MILLSTONE - UNIT 2 B 3/4 8-3 Amendment No. 4-49, 4-92, 23-1-, 248, 2-64,

LBDCR 07-MP2-009 March 29, 2007 3/4.8 ELECTRICAL POWER SYSTEMS BASES If one Millstone Unit No. 2 diesel generator is inoperable in MODES 1 through 4, a 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> allowed outage time is provided by ACTION Statement b.5 to allow restoration of the diesel generator, provided the requirements of ACTION Statements b. 1, b.2, and b.3 are met. This allowed outage time can be extended to 14 days if the additional requirements contained in ACTION Statement b.4 are also met. ACTION Statement b.4 requires verification that the Millstone Unit No. 3 diesel generators are OPERABLE as required by the applicable Millstone Unit No. 3 Technical Specification (2 diesel generators in MODES 1 through 4, and 1 diesel generator in MODES 5 and 6) and the Millstone Unit No. 3 SBO diesel generator is available.

The term verify, as used in this context, means to administratively check by examining logs or other information to determine if the required Millstone Unit No. 3 diesel generators and the Millstone Unit No. 3 SBO diesel generator are out of service for maintenance or other reasons. It does not mean to perform Surveillance Requirements needed to demonstrate the OPERABILITY of the required Millstone Unit No. 3 diesel generators or availability of the Millstone Unit No. 3 SBO diesel generator.

When using the 14 day allowed outage time provision and the Millstone Unit No. 3 diesel generator and/or the Millstone Unit No. 3 SBO diesel generator requirements are not met, 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> is allowed for restoration of the required Millstone Unit No. 3 diesel generators and the Millstone Unit No. 3 SBO diesel generator. If any of the required Millstone Unit No. 3 diesel generators and/or the Millstone Unit No. 3 SBO diesel generator are not restored within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, and one Millstone Unit No. 2 diesel generator is still inoperable, Millstone Unit No. 2 is required to shut down.

The 14 day allowed outage time for one inoperable Millstone Unit No. 2 diesel generator will allow performance of extended diesel generator maintenance and repair activities (e.g., diesel inspections) while the plant is operating. To minimize plant risk when using this extended allowed outage time the following additional requirements must be met:

1. The extended diesel generator maintenance outage shall not be scheduled when adverse or inclement weather conditions and/or unstable grid conditions are predicted or present.

2. The availability of the Millstone Unit No. 3 SBO DG shall be verified by test performance within the previous 30 days prior to allowing a Millstone Unit No. 2 diesel generator to be inoperable for greater than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

3. All activity in the switchyard shall be closely monitored and controlled. No elective maintenance within the switchyard that could challenge offsite power availability shall be scheduled.

MILLSTONE - UNIT 2 B 3/4 8-4 Amendment No. 489, 4-9-2, 2-3, ,

-16+, 2--7,

LBDCR 07-MP2-009 March 29, 2007 3/4.8 ELECTRICAL POWER SYSTEMS BASES In addition, the plant configuration shall be controlled during the diesel generator maintenance and repair activities to minimize plant risk consistent with a Configuration Risk Management Program, as required by 10 CFR 50.65(a)(4).

Diesel Generator Testing An engine prelube period is allowed prior to engine start for all diesel generator testing.

This will minimize wear on moving parts that do not get lubricated when the engine is not running.

When specified in the surveillance tests, the diesel generators must be started from a standby condition. Standby condition for a diesel generator means the diesel engine coolant and oil are being circulated and temperature is being maintained consistent with manufacturer recommendations.

SR 4.8.1.1 .2.a.2 This surveillance helps to ensure the availability of the standby electrical power supply to mitigate design basis accidents and transients and to maintain the unit in a safe shutdown condition. It verifies the ability of the diesel generator to start from a standby condition and achieve steady state voltage and frequency conditions. The time for voltage and speed (frequency) to stabilize is periodically monitored and the trend evaluated to identify degradation of governor or voltage regulator performance when testing in accordance with the requirements of the surveillance.

This surveillance is modified by two notes. Note 1 allows the use of a modified start based on recommendations of the manufacturer to reduce stress and wear on diesel engines.

When using a modified start, the starting speed of the diesel generators is limited, warmup is limited to this lower speed, and the diesel generators are gradually accelerated to synchronous speed prior to loading. If a modified start is not used, the 15 second start requirement of SR 4.8.1 .1.2.d applies. Note 2 states that SR 4.8. I 1.2.d, a more rigorous test, may be performed in lieu of 4.8. 1.1 .2.a.

During performance of SR 4.8.1.1 .2.a.2, the diesel generator shall be started by using one of the following signals:

1. Manual;

2. Simulated loss of offsite power in conjunction with a safety injection actuation signal;

3. Simulated safety injection actuation signal alone; or

4. Simulated loss of power alone.

MILLSTONE - UNIT 2 B 3/4 8-5 Amendment No. 2-74, 1

LBDCR 07-MP2-009 March 29, 2007 3/4.8 ELECTRICAL POWER SYSTEMS BASES The 31 day frequency for SR 4.8.1.1.2.a.2 is consistent with standard industry guidelines.

SR 4.8.1.1.2.a.3 This surveillance verifies that the diesel generators are capable of synchronizing with the offsite electrical system and accepting loads greater than or equal to the equivalent of the maximum expected accident loads. A minimum run time of 60 minutes is required to stabilize engine temperatures, while minimizing the time that the diesel generator is connected to the offsite source. Although no power factor requirements are established by this surveillance, the diesel generator is normally operated at a power factor between 0.8 lagging and 1.0. The 0.8 value is the design rating of the machine, while 1.0 is an operational limitation.

This surveillance is modified by five Notes. Note I indicates that diesel engine runs for this surveillance may include gradual loading, as recommended by the manufacturer, so that mechanical stress and wear on the diesel engine are minimized. Note 2 states that momentary transients because of changing bus loads do not invalidate this test. Similarly, momentary power factor transients above the limit will not invalidate the test. Note 3 indicates that this surveillance should be conducted on only one diesel generator at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations. Note 4 stipulates a prerequisite requirement for performance of this surveillance. A successful diesel generator start must precede this test to credit satisfactory performance. Note 5 states that SR 4.8. I. 1.2.d, a more rigorous test, may be performed in lieu of 4.8.1.1.2.a.

The 31 day frequency for SR 4.8. 1.1.2.a.3 is consistent with standard industry guidelines.

SR.4.8.1.1.2.b.I Microbiological fouling is a major cause of fuel oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Removal of water from the three fuel storage tanks once every 92 days eliminates the necessary environment for bacterial survival. This is the most effective means of controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during EDG operation. Water may come from any of several sources, including condensation, rain water, contaminated fuel oil, and from breakdown of the fuel oil by bacteria.

Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. This surveillance is for preventative maintenance. The presence of water does not necessarily represent failure of this surveillance provided the accumulated water is removed during performance of the surveillance.

MILLSTONE - UNIT 2 B 3/4 8-6 Amendment No. 2-77, 1

LBDCR 07-MP2-009 March 29, 2007 3/4.8 ELECTRICAL POWER SYSTEMS BASES SR 4.8.1.1.2.b.2 This surveillance requires testing of the new and stored fuel oil in accordance with the Diesel Fuel Oil Testing Program, as defined in Section 6 of the Technical Specifications.

The tests listed below are a means of determining whether new fuel oil is of the appropriate grade and has not been contaminated with substances that would have an immediate, detrimental impact on diesel engine combustion. If results from these tests are within acceptable limits, the fuel oil may be added to the storage tanks without concern for contaminating the entire volume of fuel oil in the storage tanks. These tests are to be conducted prior to adding the new fuel to the storage tank(s), but in no case is the time between receipt of new fuel and conducting the tests to exceed 31 days. The tests, limits, and applicable ASTM Standards are as follows (more restrictive State of Connecticut and/or equipment limits may apply):

a. Sample the new fuel oil in accordance with ASTM D4057,

b. Verify in accordance with the tests specified in ASTM D975-81 that the sample has an absolute specific gravity at 60/600 F of _ 0.83 and 4D.89, or an API gravity at 60'F of>_ 270 and !9°, a kinematic viscosity at 40'C of_> 1.9 centistokes and _

4.1 centistokes (alternatively, Saybolt viscosity, SUS at 100°F of_Ž 32.6 but *40.1) and a flash point >_ 125°F, and

c. Verify that the new fuel oil has water and sediment 4105% when tested in accordance with ASTM D1796-83.

Failure to meet any of the above limits is cause for rejecting the new fuel'oil, but does not represent a failure to meet the LCO concern since the fuel oil is not added to the storage tanks.

Within 31 days following the initial new fuel oil sample, the fuel oil is analyzed to establish that the other properties specified in Table I of ASTM D975-81 are met for new fuel oil when tested in accordance with ASTM D975-8 1, except that the analysis for sulfur may be performed in accordance with ASTM D 1552 or ASTM D2622. The 31 day period is acceptable because the fuel oil properties of interest, even if they were not within stated limits, would not have an immediate effect on DG operation.

This surveillance ensures the availability of high quality fuel oil for the diesel generators.

Fuel oil degradation during long term storage shows up as an increase in particulate, due mostly to oxidation. The presence of particulate does not mean the fuel oil will not buum properly in a diesel engine. The particulate can cause fouling of filters and fuel oil injection equipment, however, which can cause engine failure. Particulate concentrations should be determined in accordance with ASTM D2276-78, Method A, every 92 days. This method involves a gravimetric MILLSTONE - UNIT 2 B 3/4 8-7 Amendment No. 2-7-7,

LBDCR 07-MP2-009 March 29, 2007 3/4.8 ELECTRICAL POWER SYSTEMS BASES determination of total particulate concentration in the fuel oil and has a limit of 10 mg/l. It is acceptable to obtain a field sample for subsequent laboratory testing in lieu of field testing.

The frequency of this test takes into consideration fuel oil degradation trends that indicate that particulate concentration is unlikely to change significantly between surveillance intervals.

SR 4.8.1.1.2.c.2 Under accident and loss of offsite power conditions, loads are sequentially connected to the bus by the automatic load sequencer. The sequencing logic controls the permissive and starting signals to motor breakers to prevent overloading of the diesel generators due to high motor starting currents. The load sequence time interval tolerances ensure that sufficient time exists for the diesel generator to restore frequency and voltage prior to applying the next load and that safety analysis assumptions regarding Engineered Safety Features (ESF) equipment time delays are not violated.

The 18 month frequency is based on engineering judgment, taking into consideration unit conditions required to perform the surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the surveillance when performed at the 18 month frequency. Therefore, the frequency is acceptable from a reliability standpoint.

This surveillance is modified by a Note. The reason for the Note is that performing the surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally performing the surveillance in MODE 1, 2, 3, or 4 is further amplified to allow the surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed surveillance, a successful surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and start up to determine that plant safety is maintained or enhanced when the surveillance is performed in MODE 1, 2, 3, or 4. Risk insights or deterministic methods may be used for this assessment.

MILLSTONE - UNIT 2 B 3/4 8-8 Amendment No. 277,

LBDCR 07-MP2-009 March 29, 2007 3/4.8 ELECTRICAL POWER SYSTEMS BASES SR 4.8.1.3.2.c.3 Each diesel generator is provided with an engine overspeed trip to prevent damage to the engine. Recovery from the transient caused by the loss of a large load could cause diesel engine overspeed, which, if excessive, might result in a trip of the engine. This surveillance demonstrates the diesel generator load response characteristics and capability to reject the largest single load without exceeding a predetermined frequency limit. The single largest load for each diesel generator is identified in the FSAR (Tables 8.3-2 and 8.3-3).

This surveillance maybe accomplished by either:

a. Tripping the diesel generator output breaker with the diesel generator carrying greater than or equal to its associated single largest post-accident load while paralleled to offsite power or while solely supplying the bus; or

b. Tripping the equivalent of the single largest post-accident load with the diesel generator solely supplying the bus.

The time, voltage, and frequency tolerances specified in this surveillance are based on the response during load sequence intervals. The 2.2 seconds specified is equal to 40% of the 5.5 second load sequence interval associated with sequencing of the largest load (Safety Guide 9).

The voltage and frequency specified are consistent with the design range of the equipment powered by the diesel generator. SR 4.8.1.1. 1 .c.3.a corresponds to the maximum frequency excursion, while SR 4.8.1.1.2.c.3.b and SR 4.8. I. 1.2.c.3.c are steady state voltage and frequency values to which the system must recover following load rejection.

The 18 month frequency is based on engineering judgment, taking into consideration unit conditions required to perform the surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the surveillance when performed at the 18 month frequency. Therefore, the frequency is acceptable from a reliability standpoint.

This surveillance is modified by a Note to ensure that the diesel generator is tested under load conditions that are as close to design basis conditions as practical. When synchronized with offsite power, testing should be performed at a power factor of4.9 lagging. This power factor is representative of the inductive loading a diesel generator would see based on the motor rating of the single largest load. It is within the adjustment capability of the Control Room Operator based on the use of reactive load indication to establish the desired power factor. Under certain conditions, however, the note allows the surveillance to be conducted at a power factor other than 5.9. These conditions occur when grid voltage is high, and the additional field excitation needed to get the power factor to 4.9 results in voltages on the emergency buses that are too MILLSTONE - UNIT 2 B 3/4 8-9 Amendment No. 27-7, 1

LBDCR 07-MP2-009 March 29, 2007 3/4.8 ELECTRICAL POWER SYSTEMS BASES high. Under these conditions, the power factor should be maintained as close as practicable to 0.9 while still maintaining acceptable voltage limits on the emergency buses. In other circumstances, the grid voltage may be such that the diesel generator excitation levels needed to obtain a power factor of 0.9 may not cause unacceptable voltages on the emergency buses, but the excitation levels are in excess of those recommended for the diesel generator. In such cases, the power factor shall be maintained as close as practicable to 0.9 lagging without exceeding the diesel generator excitation limits.

SR 4.8. [. I.2.c.4 This surveillance demonstrates the diesel generator capability to reject a rated load without overspeed tripping. A diesel generator rated load rejection may occur because of a system fault or inadvertent breaker tripping. This surveillance ensures proper engine generator load response under the simulated test conditions. This test simulates the loss of the total connected load that the diesel generator experiences following a rated load rejection and verifies that the diesel generator will not trip upon loss of the load. While the diesel generator is not expected to experience this transient during an event, this response ensures that the diesel generator is not degraded for future application, including reconnection to the bus if the trip initiator can be corrected or isolated.

This surveillance is performed by tripping the diesel generator output breaker with the diesel generator carrying the required load while paralleled to offsite power.

The 18 month frequency is based on engineering judgment, taking into consideration unit conditions required to perform the surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the surveillance when performed at the 18 month frequency. Therefore, the frequency is acceptable from a reliability standpoint.

This surveillance is modified by a Note to ensure that the diesel generator is tested under load conditions that are as close to design basis conditions as practical. When synchronized with offsite power, testing should be performed at a power factor of *3.83 lagging. This power factor is representative of the inductive loading a diesel generator would see under design basis accident conditions. Under certain conditions, however, the note allows the surveillance to be conducted at a power factor other than 5.83. These conditions occur when grid voltage is high, and the additional field excitation needed to get the power factor to *ý.83 results in voltages on the emergency buses that are too high. Under these conditions, the power factor should be maintained as close as practicable to 0.83 while still maintaining acceptable voltage limits on the emergency buses. In other circumstances, the grid voltage may be such that the diesel generator excitation levels needed to obtain a power factor of 0.83 may not cause unacceptable voltages on the emergency buses, but the excitation levels are in excess of those recommended for the diesel MILLSTONE - UNIT 2 B 3/4 8-10 Amendment No. 2-77, 1

LBDCR 07-MP2-009 March 29, 2007 3/4.8 ELECTRICAL POWER SYSTEMS BASES generator. In such cases, the power factor shall be maintained as close as practicable to 0.83 lagging without exceeding the diesel generator excitation limits.

SR 4.8.1.1.2.c.5 In the event of a design basis accident coincident with a loss of offsite power, the diesel generators are required to supply the necessary power to ESF systems so that the fuel, RCS, and containment design limits are not exceeded. This surveillance demonstrates the diesel generator operation during a loss of offsite power actuation test signal in conjunction with an ESF actuation signal, including shedding of the nonessential loads and energization of the emergency buses and respective loads from the diesel generator. It further demonstrates the capability of the diesel generator to automatically achieve the required voltage and speed (frequency) within the specified time. The diesel generator auto-start time of 15 seconds is derived from requirements of the accident analysis to respond to a design basis large break LOCA. The surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability has been achieved. The requirement to verify the connection of permanent and auto-connected loads is intended to satisfactorily show the relationship of these loads to the diesel generator loading logic. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the diesel generator system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The 18 month frequency is based on engineering judgment, taking into consideration unit conditions required to perform the surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the surveillance when performed at the 18 month frequency. Therefore, the frequency is acceptable from a reliability standpoint.

For the purpose of this testing, the diesel generators must be started from a standby condition. Standby condition for a diesel generator means the diesel engine coolant and oil are being circulated and temperature is being maintained consistent with manufacturer recommendations.

This surveillance is modified by a Note. The reason for the Note is that performing the surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally performing the surveillance in MODE 1 2, 3, or 4 is further amplified to allow portions of the surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and MILLSTONE - UNIT 2 B 3/4 8-11 Amendment No. 2-74, 1

LBDCR 07-MP2-009 March 29, 2007 3/4.8 ELECTRICAL POWER SYSTEMS BASES other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial surveillance, a successful partial surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and start up to determine that plant safety is maintained or enhanced when portions of the surveillance are performed in MODE 1, 2, 3, or 4. Risk insights or deterministic methods may be used for the assessment.

SR 4.8. .1 .2. c. 6 This surveillance demonstrates that diesel generator noncritical protective functions (e.g.,

high jacket water temperature) are bypassed on a loss of voltage signal concurrent with an ESF actuation test signal. During this time, the critical protective functions (engine overspeed, generator differential current, low lube oil pressure [2 out of 3 logic], and voltage restraint overcurrent) remain available to trip the diesel generator and/or output breaker to avert substantial damage to the diesel generator unit. An EDG Emergency Start Signal (Loss of Power signal or SIAS) bypasses the EDG mechanical trips in the EDG control circuit, except engine overspeed, and switches the low lube oil trip to a 2 of 3 coincidence. The loss of power to the emergency bus, based on supply breaker position (A302, A304, and A505 for Bus 24C; A410, A41 1, and A505 for Bus 24D), bypasses the EDG electrical trips in the breaker control circuit except generator differential current and voltage restraint over current. The noncritical trips are bypassed during design basis accidents and provide an alarm on an abnormal engine condition. This alarm provides the operator with sufficient time to react appropriately. The diesel generator availability to mitigate the design basis accident is more critical than protecting the engine against minor problems that are not immediately detrimental to emergency operation of the diesel generator.

The 18 month frequency is based on engineering judgment, taking into consideration unit conditions required to perform the surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the surveillance when performed at the 18 month frequency. Therefore, the frequency is acceptable from a reliability standpoint.

This surveillance is modified by a Note. The reason for the Note is that performing the surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally performing the surveillance in MODE 1, 2, 3, or 4 is further amplified to allow portions of the surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is MILLSTONE - UNIT 2 B 3/4 8-12 Amendment No. 2-77,

LBDCR 07-MP2-009 March 29, 2007 3/4.8 ELECTRICAL POWER SYSTEMS BASES maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial surveillance, a successful partial surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the surveillance are performed in MODE 1, 2, 3, or 4. Risk insights or deterministic methods may be used for the assessment.

SR 4.8. 1. 1.2.c.7 This surveillance demonstrates the as designed operation of the standby power sources during loss of the offsite source. This test verifies all actions encountered from the loss of offsite power, including shedding of the nonessential loads and energization of the emergency buses and respecti(,e loads from the diesel generator. It further demonstrates the capability of the diesel generator to automatically achieve the required voltage and speed (frequency) within the specified time. The diesel generator auto-start time of 15 seconds is derived from requirements of the accident analysis to respond to a design basis large break LOCA. The surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability has been achieved. The requirement to verify the connection and power supply of permanent and auto-connected loads is intended to satisfactorily show the relationship of these loads to the diesel generator loading logic. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the diesel generator system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The 18 month frequency is based on engineering judgment, taking into consideration unit conditions required to perform the surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the surveillance when performed at the 18 month frequency. Therefore, the frequency is acceptable from a reliability standpoint.

This surveillance is modified by two Notes. The reason for Note 1 is that performing the surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally performing the surveillance in MODE 1, 2, 3, or 4 is further amplified to allow portions of the surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is MILLSTONE - UNIT 2 B 3/4 8-13 Amendment No. 2-77,

LBDCR 07-MP2-009 March 29, 2007 3/4.8 ELECTRICAL POWER SYSTEMS BASES maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial surveillance, a successful partial surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and start up to determine that plant safety is maintained or enhanced when portions of the surveillance are performed in MODE 1, 2, 3, or 4. Risk insights or deterministic methods may be used for the assessment.

Surveillance Note 2 specifies that the start of the diesel generator from a standby condition is not required if this surveillance is performed in conjunction with SR 4.S. I. I.2.c.5.

Since this test is normally performed in conjunction with SR 4.8. 1. 1.2.c.5, the proposed note will exclude the requirement to start from a standby condition to minimize the time to perform this test. This will reduce shutdown risk since plant restoration, and subsequent equipment availability will occur sooner. In addition, it is not necessary to test the ability of the EDG to auto start from a standby condition for this test since that ability will have already been verified by SR 4.8.1.1.2.c.5, which will have just been performed if the note's exclusion is to be utilized. If this test is to be performed by itself, the EDG is required to start from a standby condition.

SR 4.8.1. 1.2.c.8 This surveillance demonstrates that the diesel generator automatically starts and achieves the required voltage and speed (frequency) within the specified time (15 seconds) from the design basis actuation signal (Safety Injection Actuation Signal) and operates for _>5 minutes. The 5 minute period provides sufficient time to demonstrate stability. Since the specified actuation signal (ESF signal without loss of offsite power) will not cause the emergency bus loads to be shed, and will not cause the diesel generator to load, the surveillance ensures that permanently connected loads and autoconnected loads remain energized from the offsite electrical power system (Unit 2 RSST or NSST, or Unit 3 RSST or NSST). In certain circumstances, many of these loads cannot actually be connected without undue hardship or potential for undesired operation. It is not necessary to verify all autoconnected loads remain connected. A representative sample is acceptable.

The 18 month frequency is based on engineering judgment, taking into consideration unit conditions required to perform the surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the surveillance when performed at the 18 month frequency. Therefore, the frequency is acceptable from a reliability standpoint.

MILLSTONE - UNIT 2 B 3/4 8-14 Amendment No. 2-77, 1

LBDCR 07-MP2-009 March 29, 2007 3/4.8 ELECTRICAL POWER SYSTEMS BASES For the purpose of this testing, the diesel generators must be started from a standby condition. Standby condition for a diesel generator means the diesel engine coolant and oil are being circulated and temperature is being maintained consistent with manufacturer recommendations.

SR 4.8.1.1.2.c.9 This surveillance demonstrates that the diesel engine can restart from a hot condition, such as subsequent to shutdown from a normal surveillance, and achieve the required voltage and speed within 15 seconds. The 15 second time is derived from the requirements of the accident analysis to respond to a design basis large break LOCA.

The 18 month frequency is based on engineering judgment, taking into consideration unit conditions required to perform the surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the surveillance when performed at the 18 month frequency. Therefore, the frequency is acceptable from a reliability standpoint.

This surveillance is modified by a Note. The Note ensures that the test is performed with the diesel sufficiently hot. The load band is provided to avoid routine overloading of the diesel generator. Routine overloads may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain diesel generator OPERABILITY. The requirement that the diesel has operated for at least 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> at rated load conditions prior to performance of this surveillance is based on manufacturer recommendations for achieving hot conditions. Momentary transients due to changing bus loads do not invalidate this test.

SRs 4.8.1.1 .2.d. I and 4.8.1.1 .2.d.2 SR 4.3.1.1.2.d.l verifies that, at a 184 day frequency, the diesel generator starts from standby conditions and achieves required voltage and speed (frequency) within 15 seconds. The 15 second start requirement supports the assumptions of the design basis LOCA analysis in the FSAR. Diesel generator voltage and speed will continue to increase to rated values, and then should stabilize. SR 4.8. I. 1.2.d.2 verifies the ability of the diesel generator to achieve steady state voltage and frequency conditions. The time for voltage and speed (frequency) to stabilize is periodically monitored and the trend evaluated to identify degradation of governor or voltage regulator performance when besting in accordance with the requirements of this surveillance.

The 184 day frequency for this surveillance is a reduction in cold testing consistent with Generic Letter 84-15. This frequency provides adequate assurance of diesel generator OPERABILITY, while minimizing degradation resulting from testing. In addition, SR 4.8.1.1 .2.d may be performed in lieu of 4.8.1.1 .2.a.

MILLSTONE - UNIT 2 B 3/4 8-15 Amendment No. 2-77, 1

LBDCR 07-MP2-009 March 29, 2007 3/4.8 ELECTRICAL POWER SYSTEMS BASES For the purpose of this testing, the diesel generators must be started from a standby condition. Standby condition for a diesel generator means the diesel engine coolant and oil are being circulated and temperature is being maintained consistent with manufacturer recommendations.

During performance of SR 4.8.1.1 .2.d. I, the diesel generators shall be started by using one of the following signals:

1. Manual;

2. Simulated loss of offsite power in conjunction with a safety injection actuation signal;

3. Simulated safety injection actuation signal alone; or

4. Simulated loss of power alone.

SR 4.8. 1. .2.d.3 This surveillance verifies that the diesel generators are capable of synchronizing with the offsite electrical system and accepting loads greater than or equal to the equivalent of the maximum expected accident loads. A minimum run time of 60 minutes is required to stabilize engine temperatures, while minimizing the time that the diesel generator is connected to the offsite source. Although no power factor requirements are established by this surveillance, the diesel generator is normally operated at a power factor between 0.8 lagging and 1.0. The 0.8 value is the design rating of the machine, while 1.0 is an operational limitation.

The 184 day frequency for this surveillance is a reduction in cold testing consistent with Generic Letter 84-15. This frequency provides adequate assurance of diesel generator OPERABILITY, while minimizing degradation resulting from testing.

This SR is modified by four Notes. Note 1 indicates that diesel engine runs for this surveillance may include gradual loading, as recommended by the manufacturer, so that mechanical stress and wear on the diesel engine are minimized. Note 2 states that momentary transients because of changing bus loads do not invalidate this test. Similarly, momentary power factor transients above the limit will not invalidate the test. Note 3 indicates that this surveillance should be conducted on only one diesel generator at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations. Note 4 stipulates a prerequisite requirement for performance of this surveillance. A successful diesel generator start must precede this test to credit satisfactory performance.

MILLSTONE - UNIT 2 B 3/4 8-16 Amendment No. 4-9 J 2, -248-,

26+-, 27-, 2-79, 2-93,

February 19, 2009 LBDCR 09-MP2-002 3/4.8 ELECTRICAL POWER SYSTEMS BASES The OPERABILITY of the minimum specified A.C. and D.C. power sources and associated distribution systems during shutdown.and refueling ensures that 1) the facility can be maintained in the shutdown or REFUELING condition for extended time periods and 2) sufficient instrumentation and control capability is available for monitoring and maintaining the facility status. If the required power sources or distribution systems are not OPERABLE in MODES 5 and 6, operations involving CORE ALTERATIONS, positive reactivity additions, or movement of recently irradiated fuel assemblies are required to be suspended. Suspending positive reactivity additions that could result in failure to meet the minimum SDM or boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that what would be required in the RCS for minimum SDM or refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation.

Introduction of temperature changes including temperature increases when operating with a positive MTC must also be evaluated to ensure they do not result in a loss of required SDM. The movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 300 hours0.00347 days <br />0.0833 hours <br />4.960317e-4 weeks <br />1.1415e-4 months <br />), is also required to be suspended.

Suspension of these activities does not preclude completion of actions to establish a safe conservative condition. These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required AC and DC electrical power source or distribution subsystems and to continue this action until restoration is accomplished in order to provide the necessary power to the unit safety systems.

Each 125-volt D.C. bus train consists of its associated 125-volt D.C. bus, a 125-volt D.C.

battery bank, and a battery charger with at least 400 ampere charging capacity. To demonstrate OPERABILITY of a 125-volt D.C. bus train, these components must be energized and capable of performing their required safety functions. Additionally, in MODES 1 through 4 at least one tie breaker between the 125-volt D.C. bus trains must be open for a 125-volt D.C. bus train to be considered OPERABLE.

For MODES 5 and 6, each battery is sized to supply the total connected vital loads (one battery connected to both buses) for one hour without charger support. Therefore, in MODES 5 and 6 with at least one 125-volt D.C. bus train OPERABLE and the 125-volt D.C. buses cross-tied, the 125-volt D.C. support system operability requirements for both buses are satisfied.

Footnote (a) to Technical Specification Tables 4.8-I and 4.8-2 permits the electrolyte level to be above the specified maximum level for the Category A limits during equalizing charge, provided it is not overflowing. Because of the internal gas generation during the performance of an equalizing charge, specific gravity gradients and artificially elevated electrolyte levels are produced which may exist for several days following completion of the equalizing charge. These limits ensure that the plates suffer no physical damage, and that adequate electron transfer capability is maintained in the event of transient conditions. In accordance with the recommendations of IEEE 450-1980, electrolyte level readings should be taken only after the battery has been at float charge for at least 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

MILLSTONE - UNIT 2 B 3/4 8-17 Amendment No. 89, 4-92, 234, 248, 2-64-, 2-7-7, 22-79, 29-3,

March 29, 2007 LBDCR 07-MP2-009 3/4.8 ELECTRICAL POWER SYSTEMS BASES Based on vendor recommendations and past operating experience, seven (7) days has been determined a reasonable time frame for the 125-volt D.C. batteries electrolyte level to stabilize and to provide sufficient time to verify battery electrolyte levels are with in the Category A limits.

Footnote (b) to Technical Specification Tables 4.8-I and 4.8-2 requires that level correction is not required when battery charging current is < 5 amps on float charge. This current provides, in general, an indication of overall battery condition.

Footnote (c) to Technical Specification Tables 4.8-1 and 4.8-2 states that level correction is not required when battery charging current is < 5 amps on float charge. This current provides, in general, an indication of overall battery condition. Because of specific gravity gradients that are produced during the recharging process, delays of several days may occur while waiting for the specific gravity measurement for determining the state of charge. This footnote allows the float charge current to be used as an alternative to specific gravity to show OPERABILITY of a battery for up to seven (7) days following the completion of a battery equalizing charge. Each connected cells specific gravity must be measured prior to expiration of the 7 day allowance.

Surveillance Requirements 4.8.2.3.2.c. I and 4.8.2.5.2.c.1 provide for visual inspection of the battery cells, cell plates, and battery racks to detect any indication of physical damage or abnormal deterioration that could potentially degrade battery performance.

The non-safety grade 125V D.C. Turbine Battery is required for accident mitigation for a main steam line break within containment with a coincident loss of a vital D.C. bus. The Turbine Battery provides the alternate source of power for Inverters 1 & 2 respectively via non-safety grade Inverters 5 & 6. For the loss of a D.C. event with a coincident steam line break within containment, the feedwater regulating valves are required to close to ensure containment design pressure is not exceeded.

The Turbine Battery D.C. electrical power subsystem consists of 125-volt D.C. bus 201D and 125-volt D.C. battery bank 201D. To demonstrate OPERABILITY of this subsystem, these components must be energized and capable of performing their required safety functions.

The feedwater regulating valves require power to close. On loss of a vital D.C. bus, the alternate source of power to the vital A.C. bus via the Turbine Battery ensures power is available to the affected feedwater regulating valve such that the valve will isolate feed flow into the faulted generator. The Turbine Battery is considered inoperable when bus voltage is less than 125 volts D.C., thereby ensuring adequate capacity for isolation functions via the feedwater regulating valves during the onset of a steam line break.

The Turbine Battery Charger is not required to be included in Technical Specifications even though the Turbine Battery is needed to power backup Inverters 5 & 6 for a main steam line break inside containment coincident with a loss of a Class 1E D.C. bus. This is due to the fact that feedwater isolation occurs within seconds from the onset of the event.

MILLSTONE - UNIT 2 B 3/4 8-18 Amendment No. 88, 4-92, 248,