Text

Technical Specification Bases
	ML15135A224
Person / Time
Site:	Monticello
Issue date:	05/12/2015
From:	Imholte M; Northern States Power Co, Xcel Energy
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	Download: ML15135A224 (42)
	v • d • e

QF0212, Revision 5 (FP-SC-RSI-04) Page 1 of 1 XcelEnergyv SHIPPING DOCUMENT NORTHERN STATES POWER -MN D/B/A Xcel Energy Monticello Nuclear Plant, 2807 W Hwy. 75, Monticello, MN 55362 Shipping Document Date: 5-12-15 Tracking Number:

Ship To:

USNRC 11555 Rockville Pike Rockville, MD 20852-2738 Attention Of: Document Control Desk (103)

Carrier: UPS - Standard Overnight RMA No:

Pro I Tracking No: PO / Contract No:

Packaging: Number of Packages: 1 Weight:

Dangerous Goods/ UNINA No: Insurance Est. Value Hazardous Materials? Required?

Reason for Shipment: Overnight Shipment to USNRC Melody lmholte - Please ensure tracking number is communicated to me - melody.imholte@xenuclear.com Item No. Qty. Unit Description Catalog IDIQ 1 1 Env Submittal to NRC Requestor Date/

By signing tri iipnt you are dec aring, to the best of your knowledge, that the materi/einslhpped is in compliance with cel er Corporate Policies. Pleaseprint and sign your name legibly.

SWIP Making Shipment: Date:

Received By: Date:

For will-call use only Use of this form as a procedural aid does not require retention as a quality record.

AxI,{

TECHNICAL SPECIFICATION BASES UPDATING INSTRUCTIONS MNGP TECHNICAL SPECIFICATION BASES REMOVE Page(s) Revision Document Type Table 1 34 List of Effective Sections I Specifications Table 2 34 Record of Revisions B 3.8.1-1 through 33 Bases B 3.8.1-25 Spec. 3.8.1 B 3.8.3-1 through 33 Bases B 3.8.3-8 Spec. 3.8.3 Destroy removed pages.

Revision 35

TABLE 1 (Page 1 of 1)

MONTICELLO NUCLEAR GENERATING PLANT BASES LIST OF EFFECTIVE SECTIONS/SPECIFICATIONS Section/Specification Revision No. Section/Specification Revision No.

B 2.1.1 34 B 3.6.1.4 0 B 2.1.2 6 B 3.6.1.5 25 B 3.0 27 B 3.6.1.6 0 B 3.1.1 0 B 3.6.1.7 0 B 3.1.2 0 B 3.6.1.8 29 B 3.1.3 11 B 3.6.2.1 30 B 3.1.4 19 B 3.6.2.2 0 B 3.1.5 0 B 3.6.2.3 0 B 3.1.6 29 B 3.6.3.1 0 B 3.1.7 4 B 3.6.4.1 0 B 3.1.8 4 B 3.6.4.2 0 B 3.2.1 29 B 3.6.4.3 31 B 3.2.2 0 B 3.7.1 29 B 3.2.3 0 B 3.7.2 0 B 3.3.1.1 32 B 3.7.3 17 B 3.3.1.2 0 B 3.7.4 31 B 3.3.2.1 26 B 3.7.5 8 B 3.3.2.2 29 B 3.7.6 4 B 3.3.3.1 3 B 3.7.7 29 B 3.3.3.2 3 B 3.7.8 0 B 3.3.4.1 0 B 3.8.1 35 B 3.3.5.1 29 B 3.8.2 35 27 B 3.3.5.2 0 B 3.8.3 B 3.3.6.1 34 B 3.8.4 7 B 3.3.6.2 0 B 3.8.5 4 B 3.3.6.3 3 B 3.8.6 0 B 3.3.7.1 4 B 3.8.7 0 B 3.3.7.2 4 B 3.8.8 4 B 3.3.8.1 22 B 3.3.8.2 0 B 3.9.1 0 B 3.4.1 32 B 3.9.2 0 B 3.4.2 0 B 3.9.3 0 B 3.4.3 25 B 3.9.4 0 B 3.4.4 0 B 3.9.5 0 B 3.4.5 0 B 3.9.6 0 B 3.4.6 4 B 3.9.7 21 B 3.4.7 0 B 3.9.8 0 B 3.4.8 0 B 3.10.1 28 B 3.4.9 25 B 3.10.2 0 B 3.4.10 0 B 3.10.3 3 B 3.5.1 34 B 3.10.4 0 B 3.5.2 0 B 3.10.5 0 B 3.5.3 0 B 3.10.6 0 B 3.6.1.1 29 B 3.10.7 0 B 3.6.1.2 29 B 3.10.8 0 B 3.6.1.3 29 Rev. 35

TABLE 2 (Page 1 of 6)

TECHNICAL SPECIFICATION BASES RECORD OF REVISIONS Revision Affected Description of Revision Number Section/

Specification 0 All Amendment 146 - Original ITS Revision 1 B 3.8.3 SR 3.8.3.3, Diesel Fuel Oil Testing Description 2 B 3.5.1 LCO 3.5.1, ACTION D, changed description of LPCI injection pathway.

3 B 3.3.3.1, Miscellaneous ITS Bases B 3.3.3.2, Clarifications/Corrections B 3.3.6.3, B 3.10.3 4 B 2.1.1, Amendment 148 - Bases Changes B 2.1.2, implementing Full Scope AST.

B 3.1.6, B 3.1.7, B 3.1.8, B 3.3.6.1, B 3.3.7.1, B 3.3.7.2, B 3.4.6, B 3.6.1.3, B 3.7.4, B 3.7.5, B 3.7.6, B 3.8.2, B 3.8.5, B 3.8.8 5 B 3.3.5.1 Amendment 151 - Extend Surveillance Interval B 3.8.1(1) and AV for the LPCI Loop Select TD Relays.

6 B 2.1.2 Clarify RCS Safety Limit values.

B 3.3.2.1 Correct that initial MCPR values are specified in the COLR.

7 B.3.8.1, Clarify that the 2R and 1AR transformers are B 3.8.2 considered as a single off-site source when 1AR is supplied from 345 kV Bus 1.

1. Replaces page B 3.8.1-25 in Sharepoint version of the TS. Page inadvertently deleted during implementation of Amendment 148 (CAP 01095053).

Rev. 35

TABLE 2 (Page 2 of 6)

TECHNICAL SPECIFICATION BASES RECORD OF REVISIONS Revision Affected Description of Revision Number Section/

Specification 7 (con't) B.3.8.4 Correct the float voltage for the 125 VDC batteries in SR 3.8.4.1.

B.3.8.4 Amendment 153 - Specify in SR 3.8.4.2 that the Division 2 battery charger supplies

> 110 amps.

8 B.3.5.1 Amendment 155 - Revise SR 3.5.1.3 to correct Alternate Nitrogen System supply pressure to ADS and clarify OPERABILITY during bottle changeout.

B.3.7.4, Amendment 154 - Revise Bases for B.3.7.5 Specification 3.7.5 to reflect adoption of TSTF-477, which allows both CRV subsystems to be inoperable for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . Clarify the OPERABILITY requirements of certain CRV fans currently required to support CREF subsystem operation.

9 B 3.5.1 Clarify RHR intertie discussion.

B 3.5.1 Clarify Action M to indicate that the plant may not be in a condition outside the accident analysis but is in a condition not specifically justified for continued operation.

B 3.6.1.3 Add Action E to describe actions for when the MSIVs are not within leakage limits and re-label subsequent actions.

10 B 3.5.1 Add HPCI "Keep-fill" discussion.

B 3.9.7 Clarify Action A.1 for what is meant by inoperable.

11 B 3.1.3, Amendment 158 - Change control rod notch B 3.1.4 testing frequency from every 7 days to only once per 31 days in accordance with TSTF-475, Revision 1.

Rev. 35

TABLE 2 (Page 3 of 6)

TECHNICAL SPECIFICATION BASES RECORD OF REVISIONS Revision Affected Description of Revision Number Section/

Specification 12 B 3.3.1.1, Amendment 159- PRNMS.

B 3.3.2.1, B 3.4.1 B 3.3.5.1 Amendment 161 - LPCI Recirculation Riser Differential Pressure - High (Break Size) allowable value and channel calibration interval change.

13 B 3.0 Amendment 157 - Add Bases for new LCO 3.0.9 for the unavailability of barriers, reflecting adoption of TSTF-427.

B 3.4.9 Clarify that the shift in Figure 3.4.9-1 includes both delta RTNDT and margin.

B 3.5.1 Amendment 162 - Add new Conditions to Specification 3.5.1 for restoration of various low-pressure ECGS subsystem out-of-service combinations.

14 B 3.0 Section B 3.0 reissued in entirety. Page numbers at end of LCO Applicability over-lapped SR Applicability page numbers (CAP 01192534).

15 B 3.7.4 Amendment 160 - Revise Bases for the specification reflecting adoption of a Control Room Envelope Habitability program in accordance with TSTF-448.

16 B 3.3.1.1 Replace IRM - Neutron Flux - High High (1.a) for calibrating IRMs by a heat balance by referring to IRM/APRM overlap and APRM Setdown Scram meeting reactivity requirements.

B 3.7.7 Correct Turbine Bypass Valve capacity.

17 B 3.7.3 Correct EDG-ESW Background description.

Rev. 35

TABLE 2 (Page 4 of 6)

TECHNICAL SPECIFICATION BASES RECORD OF REVISIONS Revision Affected Description of Revision Number Section/

Specification 18 B 3.6.1.3 Clarify PCIV definition.

19 B 3.1.4 Clarify spacing requirements of adjacent slow control rods.

B 3.8.1, Revise Bases to reflect separation of MARS B 3.8.2 Transformer and Bus 1.

20 B 3.5.1 Reissue section, missing text on HPCI keep-fill discussion. (CAP 01328422) 21 B 3.9.7 Correct prior clarification to Action A.1 for what is meant by inoperable. (CAP 01257096) 22 B 3.3.8.1 Amendment 169 - Revise licensing basis to reflect removal of the capability to automatically transfer to the 1AR Transformer as a source of power to the essential buses on degraded voltage and instead directly transfer to the EDGs.

23 B 3.3.5.1 Amendment 170 - Revised to reflect ancillary change related to ADS 20-minute Bypass Timer.

24 B 3.3.1.1 Amendment 171 - Revised to provide restoration period before declaring the APRMs inoperable when SR 3.3.1.1.2 is not met.

25 B 3.4.3, Amendment 168 - Revised surveillance B 3.5.1, requirements within these specifications to B 3.6.1.5 allow crediting overlapping testing rather than requiring a lift-test during plant startup.

B 3.4.9 Amendment 172- Revised specification to adopt PTLR.

26 B 3.1.6 Amendment 173- Revised to reflect B 3.3.2.1 incorporation of TSTF-476 for improved BPWS.

Rev. 35

TABLE 2 (Page 5 of 6)

TECHNICAL SPECIFICATION BASES RECORD OF REVISIONS Revision Affected Description of Revision Number Section/

Specification 27 B 3.0 Clarify application of SR 3.0.2 and SR 3.0.3 to IST tests to clarify compliance to Enforcement Guidance Memorandum (EGM) 12-001 (CAP 01389604).

B 3.8.2 Correct referenced SR number from SR 3.8.1.8 to SR 3.8.1.6.

28 B 3.10.1 Amendment 174- Revised specification to incorporate TSTF-484, to allow scram time testing in conjunction with hydrostatic testing.

29 B 3.1.6 Amendment 177- Implement Extended Power B 3.2.1 Uprate.

B 3.3.1.1 B 3.3.2.2 B 3.3.5.1 B 3.4.1 B 3.5.1 B 3.6.1.1 B 3.6.1.2 B 3.6.1.3 B 3.6.1.8 B 3.7.1 B 3.7.7 30 B 3.6.2.1 Revised TS Bases to indicate local Suppression Pool temperature limits were eliminated with Amendment 126.

B 3.8.3 Amendment 178 - Revised specification to relocate stored fuel and lube oil volumes to TS bases and replace with duration requirements in accordance with TSTF-501.

31 B 3.6.4.3 Amendment 181 - Revised specifications to B 3.7.4 reflect reduced runtime for SBGT and CREF from 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months to 15 minutes in accordance with TSTF-522.

Rev. 35

TABLE 2 (Page 6 of 6)

TECHNICAL SPECIFICATION BASES RECORD OF REVISIONS Revision Affected Description of Revision Number Section/

Specification 32 B 3.3.1.1, Amendment 180 - Implement Maximum B 3.4.1 Extended Load Line Limit Analysis, Plus (MELLLA+)

33 B 3.8.1, Add EDG Fuel Oil Transfer System train B 3.8.3 description for each EDG.

34 B 2.1.1, Amendment 185 - Reduce the Reactor Steam B 3.3.6.1 Dome Pressure specified in the Reactor Core Safety Limits, resolved GE Part 21 condition for a potential to violate the safety limit during a Pressure Regulator Failure Downscale event.

B 3.5.1 Amendment 184 - Removes former Condition F which allowed both Core Spray subsystems to be inoperable for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

35 B 3.8.1, Revise to reflect EDG Fuel Oil Transfer System B 3.8.3 separation modifications.

Rev. 35

AC Sources - Operating B 3.8.1 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.1 AC Sources - Operating BASES BACKGROUND AC sources to the Class 1E AC Electrical Power Distribution System consist of the offsite power sources (primary station auxiliary (2R),

reserve (1R), and reserve auxiliary (1AR) transformers) and the onsite standby power sources (emergency diesel generators (EDGs) 11 and 12). As required by USAR, Section 1.2.6 (Ref. 1), the design of the AC electrical power system provides independence and redundancy to ensure an available source of power to the Engineered Safety Feature (ESF) systems.

The Class 1E AC distribution system is divided into redundant divisions (Divisions I and 2), so loss of any one division does not prevent the minimum safety functions from being performed. Each division has connections to three offsite power sources and a single EDG.

Offsite power is supplied to the Monticello switchyard via two 345 kV and three 115 kV transmission line connections. From the switchyard, independent and redundant circuits provide AC power to the 4.16 kV auxiliary buses and essential buses. The 4.16 kV essential buses 15 and 16 are capable of being supplied from the 345 kV bus via transformer 2R, from the 115 kV substation via transformer 1 R, and from either the 345 kV or 115 kV system via transformer 1AR. A detailed description of the offsite power network and circuits to the onsite Class 1E 4.16 kV essential buses is found in USAR, Section 8.2 (Ref. 2).

A qualified offsite circuit consists of all breakers, transformers, switches, interrupting devices, cabling, and controls required to transmit power from the offsite transmission network to the onsite Class 1E 4.16 kV essential bus.

Transformer 2R provides the normal source of power to the 4.16 kV auxiliary buses and essential buses 15 and 16. If normal power from transformer 2R is lost, transformer 1 R will automatically energize all plant buses, including 4.16 kV essential buses 15 and 16. If power from transformer 1 R is lost, transformer 1AR will automatically energize only the 4.16 kV essential buses 15 and 16.

The onsite standby power source for 4.16 kV essential buses 15 and 16 consists of two EDGs. EDGs 11 and 12 are dedicated to 4.16 kV essential buses 15 and 16, respectively. An EDG starts automatically on a loss of coolant accident (LOCA) signal (i.e., a Core Spray System Reactor Vessel Water Level - Low Low or Drywell Pressure - High signal) or on a 4.16 kV Essential Bus Loss of Voltage or 4.16 kV Essential Bus Degraded Voltage signal. After the EDG has started, it automatically ties Monticello B 3.8. 1-1 Revision No. 35

AC Sources - Operating B 3.8.1 BASES BACKGROUND (continued) to its respective bus after offsite power is tripped as a consequence of a 4.16 kV Essential Bus Loss of Voltage or Degraded Voltage signal, independent of or coincident with a LOCA signal. The EDGs also start and operate in the standby mode without tying to the 4.16 kV essential bus on a LOCA signal alone. Following the trip of offsite power, transfer relays strip nonpermanent loads from the 4.16 kV essential bus. When the EDG is tied to the 4.16 kV essential bus, loads are then sequentially connected to its respective 4.16 kV essential bus by individual time delay relays. The individual time delay relays control the starting signals to motor breakers to prevent overloading the EDG.

In the event of a loss of offsite power, the ESF electrical loads are automatically connected to the EDGs in sufficient time to provide for safe reactor shutdown and to mitigate the consequences of a Design Basis Accident (DBA) such as a LOCA.

Certain required plant loads are returned to service in a predetermined sequence in order to prevent overloading of the EDGs in the process.

Within 42 seconds after the initiating signal is received, all automatic and permanently connected loads needed to recover the unit or maintain it in a safe condition are returned to service.

Ratings for the EDGs are consistent with the requirements of Regulatory Guide 1.9 (Ref. 3). EDGs 11 and 12 have the following ratings:

a. 2500 kW - continuous;

b. 2750 kW - 2000 hours0.0231 days 0.556 hours 0.00331 weeks 7.61e-4 months ; and

c. 3050 kW - 30 minutes.

Each EDG has its own day tank and base tank. Both EDGs utilize a common fuel oil storage tank. The EDG fuel oil transfer system includes a separate fuel oil transfer subsystem for each EDG. Each fuel oil transfer subsystem automatically transfers fuel oil from the common fuel oil storage tank to the associated EDG day tank. The fuel oil transfer pump arrangement for each subsystem during and after completion of the modifications associated with EC 23085 is the following:

Table 1 Post Div. II Post Div. I Current Div. II Return Div. I Return Diesel Config. Isolation To Service Isolation To Service 11 EDG (T-45A) P-77 P-77 P-77 P-160A/C 12 EDG (T-45B) P-1I1 P-160B/D P-160B/D P-160B/D Monticello B 3.8.1-2 Revision No. 35

AC Sources - Operating B 3.8.1 BASES BACKGROUND (continued)

One fuel oil transfer pump in each subsystem operates continuously to maintain level in the EDG day tank for that subsystem. After the installation of two pumps in each subsystem, a loss of fuel oil flow to the associated EDG is annunciated in the control room and the second fuel oil transfer pump in the subsystem is manually started locally (Ref. 14).

After completion of the required modifications, overflow from each EDG day tank will be returned by separate return lines to the fuel oil storage tank. The EDG fuel oil transfer system design provides sufficient separation and redundancy such that no single active or passive component failure can prevent operation of one EDG. One fuel oil transfer pump has sufficient capacity to maintain the associated EDG day tank full with the EDG operating at full load.

The fuel oil transfer system also includes two day tank fuel oil transfer subsystems. Each day tank fuel oil transfer subsystem is capable of automatically transferring fuel oil from the day tank to the associated base tank. Each day tank fuel oil transfer subsystem includes two pumps, and each pump starts automatically on a level signal from one base tank level switch. One pump starts when the level in the base tank drops below the normal level and the second pump starts when the base tank level drops to the low level.

APPLICABLE The initial conditions of DBA and transient analyses in USAR, Chapter 5 SAFETY (Ref. 4) and Chapter 14 (Ref. 5), assume ESF systems are OPERABLE.

ANALYSES The AC electrical power sources are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System (RCS), and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.5, Emergency Core Cooling System (ECCS) and Reactor Core Isolation Cooling (RCIC) System; and Section 3.6, Containment Systems.

The OPERABILITY of the AC electrical power sources is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit. This includes maintaining the onsite or offsite AC sources OPERABLE during accident conditions in the event of:

a. An assumed loss of all offsite power or all onsite AC power; and

b. A worst case single failure.

AC Sources - Operating satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

Revision No. 35 B 3.8.1-3 Monticello Monticello B 3.8.1-3 Revision No. 35

AC Sources - Operating B 3.8.1 BASES LCO Two qualified circuits between the offsite transmission network and the onsite Class 1 E Distribution System and two separate and independent EDGs (11 and 12) ensure availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an anticipated operational occurrence (AOO) or a postulated DBA.

Each offsite circuit must be capable of maintaining rated frequency and voltage, and accepting required loads during an accident, while connected to the 4.16 kV essential buses. One offsite circuit consists of incoming disconnects to the 2R transformer, associated 2R transformer, and the respective circuit path including buses and feeder breakers to both 4.16 kV essential buses. The second circuit consists of incoming disconnects to the 1R transformer, associated 1R transformer, and the respective circuit path including buses and feeder breakers to both 4.16 kV essential buses. The third qualified offsite circuit consists of incoming disconnects to the 1AR transformer, associated 1AR transformer, and the respective circuit path including feeder breakers to both 4.16 kV essential buses.

Each EDG must be capable of starting, accelerating to rated speed and voltage, and connecting to its respective 4.16 kV essential bus on detection of bus undervoltage. This sequence must be accomplished within 10 seconds. Each EDG must also be capable of accepting required loads within the assumed loading sequence intervals, and must continue to operate until offsite power can be restored to the 4.16 kV essential buses. These capabilities are required to be met from a variety of initial conditions, such as EDG in standby with the engine hot and EDG in standby with the engine at ambient condition. Additional EDG capabilities must be demonstrated to meet required Surveillances, e.g.,

capability of the EDG to reject the single largest post-accident load while maintaining a specified margin to the overspeed trip.

Proper sequencing of loads, including tripping of nonessential loads, is a required function for EDG OPERABILITY.

The AC sources must be separate and independent (to the extent possible) of other AC sources. For the EDGs, the separation and independence are complete. For the offsite AC sources, the separation and independence are to the extent practical. A circuit may be connected to more than one 4.16 kV essential bus, with automatic transfer capability to the other circuit OPERABLE, and not violate separation criteria. A circuit that is not connected to a 4.16 kV essential bus is required to have OPERABLE automatic transfer interlock mechanisms to the 4.16 kV essential buses to support OPERABILITY of that circuit.

Revision No. 35 B 3.8.1-4 Monticello Monticello B 3.8.1-4 Revision No. 35

AC Sources - Operating B 3.8.1 BASES LCO (continued) In addition, fuel oil level in the day tank and base tank must be met for each EDG. For each fuel oil transfer subsystem, one of the two* fuel oil transfer pumps in each subsystem must be capable of transferring fuel oil from the common fuel oil storage tank to the associated EDGs day tank.

Table 1 provides the transfer pump configurations during and after EC 23085 (see BACKGROUND Section of this specification).

In each subsystem one fuel oil transfer pump operates continuously to maintain level in the associated EDG day tank. If both fuel oil transfer pumps in a subsystem operate simultaneously, with the associated EDG running, level in the common fuel oil storage tank will ultimately decrease to a level precluding pump operation (due to gas coming out of solution) above the level required to operate the EDG for the required 7-day duration. Prior to entering two fuel oil transfer pump operation in a subsystem, if planned, or upon discovery, the associated EDG is declared inoperable. Following securing one of the two fuel oil transfer pumps the associated EDG is restored to OPERABLE status.

For each day tank fuel oil transfer subsystem, only one of the two transfer pumps must be capable of transferring fuel from the day tank to the associated base tank.

APPLICABILITY The AC sources are required to be OPERABLE in MODES 1, 2, and 3 to ensure that:

a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and

b. Adequate core cooling is provided and containment OPERABILITY and other safety functions are maintained in the event of a postulated DBA.

The AC power requirements for MODES 4 and 5 and other conditions in which AC sources are required are covered in LCO 3.8.2, "AC Sources -

Shutdown."

ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable EDG.

There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable EDG and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.

Monticello B 3.8.1-5 Revision No. 35

AC Sources - Operating B 3.8.1 BASES ACTIONS (continued)

A.1 To ensure a highly reliable power source remains with one required offsite circuit inoperable, it is necessary to verify the availability of the remaining required offsite circuit on a more frequent basis. Since the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action not met.

However, if a second required circuit fails SR 3.8.1.1, the second required offsite circuit is inoperable, and Condition C, for two required offsite circuits inoperable, is entered.

A.2 Required Action A.2, which only applies if the division cannot be powered from an offsite source, is intended to provide assurance that an event with a coincident single failure of the associated EDG does not result in a complete loss of safety function of critical systems. These features are designed with redundant safety related divisions (i.e., single division systems are not included). Redundant required features failures consist of inoperable features associated with a division redundant to the division that has no offsite power.

The Completion Time for Required Action A.2 is intended to allow time for the operator to evaluate and repair any discovered inoperabilities. This Completion Time also allows an exception to the normal "time zero" for beginning the allowed outage time "clock." In this Required Action the Completion Time only begins on discovery that both:

a. The division has no offsite power supplying its loads; and

b. A redundant required feature on the other division is inoperable.

If, at any time during the existence of this condition (one required offsite circuit inoperable) a redundant required feature subsequently becomes inoperable, this Completion Time would begin to be tracked.

Discovering no offsite power to one 4.16 kV essential bus of the onsite Class 1 E AC Electrical Power Distribution System coincident with one or more inoperable redundant required support or supported features, or both, that are associated with the other 4.16 kV essential bus that has offsite power, results in starting the Completion Time for the Required Action. Twenty-four hours is acceptable because it minimizes risk while allowing time for restoration before the unit is subjected to transients associated with shutdown.

Monticello B 3.8.1-6 Revision No. 35

AC Sources - Operating B 3.8.1 BASES ACTIONS (continued)

The remaining OPERABLE required offsite circuit and EDGs are adequate to supply electrical power to the onsite Class 1 E AC Electrical Power Distribution System. Thus, on a component basis, single failure protection may have been lost for the required feature's function; however, function is not lost. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time takes into account the component OPERABILITY of the redundant counterpart to the inoperable required feature. Additionally, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

A.3 Consistent with Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition A for a period that should not exceed 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . With one required offsite circuit inoperable, the reliability of the offsite system is degraded, and the potential for a loss of offsite power is increased, with attendant potential for a challenge to the plant safety systems. In this condition, however, the remaining OPERABLE required offsite circuit and EDGs are adequate to supply electrical power to the onsite Class 1 E Distribution System.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and the low probability of a DBA occurring during this period.

B..1 To ensure a highly reliable power source remains with one EDG inoperable, it is necessary to verify the availability of the required offsite circuits on a more frequent basis. Since the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action being not met. However, if a required offsite circuit fails to pass SR 3.8.1.1, it is inoperable. Upon required offsite circuit inoperability, additional Conditions must then be entered.

B.2 Required Action B.2 is intended to provide assurance that a loss of offsite power, during the period that an EDG is inoperable, does not result in a complete loss of safety function of critical systems. These features are designed with redundant safety related divisions (i.e., single division Monticello B 3.8.1-7 Revision No. 35

AC Sources - Operating B 3.8.1 BASES ACTIONS (continued) systems are not included). Redundant required features failures consist of inoperable features associated with a division redundant to the division that has an inoperable EDG.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." In this Required Action the Completion Time only begins on discovery that both:

a. An inoperable EDG exists; and

b. A redundant required feature on the other division (Division 1 or 2) is inoperable.

If, at any time during the existence of this condition (one EDG inoperable), a redundant required feature subsequently becomes inoperable, this Completion Time begins to be tracked.

Discovering one EDG inoperable coincident with one or more inoperable redundant required support or supported features, or both, that are associated with the OPERABLE EDG, results in starting the Completion Time for the Required Action. Four hours from the discovery of these events existing concurrently is acceptable because it minimizes risk while allowing time for restoration before subjecting the unit to transients associated with shutdown.

The remaining OPERABLE EDG and required offsite circuits are adequate to supply electrical power to the onsite Class 1 E AC Electrical Power Distribution System. Thus, on a component basis, single failure protection for the required feature's function may have been lost; however, function has not been lost. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time takes into account the component OPERABILITY of the redundant counterpart to the inoperable required feature. Additionally, the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and low probability of a DBA occurring during this period.

B.3.1 and B.3.2 Required Action B.3.1 provides an allowance to avoid unnecessary testing of the OPERABLE EDG. If it can be determined that the cause of the inoperable EDG does not exist on the OPERABLE EDG, SR 3.8.1.2 does not have to be performed. Ifthe cause of inoperability exists on the other EDG, it is declared inoperable upon discovery, and Condition E of Monticello B 3.8.1-8 Revision No. 35

AC Sources - Operating B 3.8.1 BASES ACTIONS (continued)

LCO 3.8.1 is entered. Once the failure is repaired, and the common cause failure no longer exists, Required Action B.3.1 is satisfied. If the cause of the initial inoperable EDG cannot be confirmed not to exist on the remaining EDG, performance of SR 3.8.1.2 suffices to provide assurance of continued OPERABILITY of that EDG.

In the event the inoperable EDG is restored to OPERABLE status prior to completing either B.3.1 or B.3.2, the plant corrective action program will continue to evaluate the common cause possibility. This continued evaluation, however, is no longer under the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months constraint imposed while in Condition B.

According to Generic Letter 84-15 (Ref. 7), 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is a reasonable time to confirm that the OPERABLE EDG is not affected by the same problem as the inoperable EDG.

B.4 In Condition B, the remaining OPERABLE EDG and required offsite circuits are adequate to supply electrical power to the onsite Class 1 E AC Electrical Power Distribution System. The 7 day Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

C.1 and C.2 Required Action C. I addresses actions to be taken in the event of inoperability of redundant required features concurrent with inoperability of two required offsite circuits. Required Action C.1 reduces the vulnerability to a loss of function. The Completion Time for taking these actions is reduced to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months from that allowed with one division without offsite power (Required Action A.2). The rationale for the reduction to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is that Regulatory Guide 1.93 (Ref. 6) allows a Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for two required offsite circuits inoperable, based upon the assumption that two complete safety divisions are OPERABLE. When a concurrent redundant required feature failure exists, this assumption is not the case, and a shorter Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is appropriate.

These features are designed with redundant safety related divisions, (i.e.,

single division systems are not included in the list). Redundant required features failures consist of any of these features that are inoperable because any inoperability is on a division redundant to a division with inoperable offsite circuits.

Monticello B 3.8.1-9 Revision No. 35

AC Sources - Operating B 3.8.1 BASES ACTIONS (continued)

The Completion Time for Required Action C.1 is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." In this Required Action, the Completion Time only begins on discovery that both:

a. All required offsite circuits are inoperable; and

b. A redundant required feature is inoperable.

If, at any time during the existence of this condition (two required offsite circuits inoperable), a redundant required feature subsequently becomes inoperable, this Completion Time begins to be tracked.

According to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition C for a period that should not exceed 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . This level of degradation means that the offsite electrical power system does not have the capability to affect a safe shutdown and to mitigate the effects of an accident; however, the onsite AC sources have not been degraded. This level of degradation generally corresponds to a total loss of the immediately accessible offsite power sources.

Because of the normally high availability of the offsite sources, this level of degradation may appear to be more severe than other combinations of two AC sources inoperable that involve one or more EDGs inoperable.

However, two factors tend to decrease the severity of this degradation level:

a. The configuration of the redundant AC electrical power system that remains available is not susceptible to a single bus or switching failure; and

b. The time required to detect and restore an unavailable offsite power source is generally much less than that required to detect and restore an unavailable onsite AC source.

With both of the required offsite circuits inoperable, sufficient onsite AC sources are available to maintain the unit in a safe shutdown condition in the event of a DBA or transient. In fact, a simultaneous loss of offsite AC sources, a LOCA, and a worst case single failure were postulated as a part of the design basis in the safety analysis. Thus, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time provides a period of time to effect restoration of one of the offsite circuits commensurate with the importance of maintaining an AC electrical power system capable of meeting its design criteria.

Monticello B 3.8.1-10 Revision No. 35

AC Sources - Operating B 3.8.1 BASES ACTIONS (continued)

According to Regulatory Guide 1.93 (Ref. 6), with the available offsite AC sources two less than required by the LCO, operation may continue for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . If two required offsite sources are restored within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , unrestricted operation may continue. If only one required offsite source is restored within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , power operation continues in accordance with Condition A.

D.1 and D.2 Pursuant to LCO 3.0.6, the Distribution Systems - Operating ACTIONS would not be entered even if all AC sources to it were inoperable, resulting in de-energization. Therefore, the Required Actions of Condition D are modified by a Note to indicate that when Condition D is entered with no AC source to any 4.16 kV essential bus (i.e., the bus is de-energized), ACTIONS for LCO 3.8.7, "Distribution Systems -

Operating," must be immediately entered. This allows Condition D to provide requirements for the loss of the required offsite circuit and one EDG without regard to whether a division is de-energized. LCO 3.8.7 provides the appropriate restrictions for a de-energized division.

According to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition D for a period that should not exceed 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . In Condition D, individual redundancy is lost in both the offsite electrical power system and the onsite AC electrical power system. Since power system redundancy is provided by two diverse sources of power, however, the reliability of the power systems in this Condition may appear higher than that in Condition C (loss of both required offsite circuits). This difference in reliability is offset by the susceptibility of this power system configuration to a single bus or switching failure. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and the low probability of a DBA occurring during this period.

E. 1 With two EDGs inoperable, there is no remaining standby AC source.

Thus, with an assumed loss of offsite electrical power, insufficient standby AC sources are available to power the minimum required ESF functions.

Since the offsite electrical power system is the only source of AC power for the majority of ESF equipment at this level of degradation, the risk associated with continued operation for a very short time could be less than that associated with an immediate controlled shutdown. (The immediate shutdown could cause grid instability, which could result in a total loss of AC power.) Since any inadvertent unit generator trip could Monticello B 3.8.1-11 Revision No. 35

AC Sources - Operating B 3.8.1 BASES ACTIONS (continued) also result in a total loss of offsite AC power, however, the time allowed for continued operation is severely restricted. The intent here is to avoid the risk associated with an immediate controlled shutdown and to minimize the risk associated with this level of degradation. According to Regulatory Guide 1.93 (Ref. 6), with both EDGs inoperable, operation may continue for a period that should not exceed 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

F.1 and F.2 If the inoperable AC electrical power sources cannot be restored to OPERABLE status within the associated Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

G.__

Condition G corresponds to a level of degradation in which all redundancy in the AC electrical power supplies has been lost. At this severely degraded level, any further losses in the AC electrical power system will cause a loss of function. Therefore, no additional time is justified for continued operation. The unit is required by LCO 3.0.3 to commence a controlled shutdown.

SURVEILLANCE The AC sources are designed to permit inspection and testing of all REQUIREMENTS important areas and features, especially those that have a standby function, in accordance with USAR, Chapter 8 (Ref. 8). Periodic component tests are supplemented by extensive functional tests during refueling outages (under simulated accident conditions). The SRs for demonstrating the OPERABILITY of the EDGs are consistent with the recommendations of Regulatory Guide 1.9 (Ref. 3), Regulatory Guide 1.108 (Ref. 9), and Regulatory Guide 1.137 (Ref. 10).

Where the SRs discussed herein specify voltage and frequency tolerances, the following summary is applicable. The minimum steady state output voltage of 3975 V is based on the degraded voltage setpoint.

It also allows for voltage drops to motors and other equipment down through the 120 V level where minimum operating voltage is also usually specified as 90% of name plate rating. The specified maximum steady state output voltage of 4400 V is equal to the maximum operating voltage Monticello B 3.8.1-12 Revision No. 35

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) specified for 4000 V motors. It ensures that for a lightly loaded distribution system, the voltage at the terminals of 4000 V motors is no more than the maximum rated operating voltages. The specified minimum and maximum frequencies of the EDG are 58.8 Hz and 61.2 Hz, respectively. These values are equal to +/- 2% of the 60 Hz nominal frequency and are derived from the recommendations found in Regulatory Guide 1.9 (Ref. 3).

SR 3.8.1.1 This SR ensures proper circuit continuity for the offsite AC electrical power supply to the onsite distribution network and availability of offsite AC electrical power. The breaker alignment verifies that each breaker is in its correct position to ensure that distribution buses and loads are connected to their preferred power source and that appropriate independence of offsite circuits is maintained. The 7 day Frequency is adequate since breaker position is not likely to change without the operator being aware of it and because its status is displayed in the control room.

SR 3.8.1.2 This SR helps to ensure the availability of the standby electrical power supply to mitigate DBAs and transients and maintain the unit in a safe shutdown condition.

To minimize the wear on moving parts that do not get lubricated when the engine is not running, this SR has been modified by a Note (Note 1) to indicate that all EDG starts for this Surveillance may be preceded by an engine prelube period and followed by a warmup prior to loading.

For the purposes of this testing, the EDGs are started from standby conditions. Standby conditions for a EDG mean that the diesel engine coolant and oil are being continuously circulated and temperature is being maintained consistent with manufacturer recommendations.

In order to reduce stress and wear on diesel engines, the manufacturer has recommended a modified start in which the starting speed of EDGs is limited, warmup is limited to this lower speed, and the EDGs are gradually accelerated to synchronous speed prior to loading. These start procedures are the intent of Note 2.

The 31 day Frequency is consistent with Regulatory Guide 1.9 (Ref. 3).

This Frequency provides adequate assurance of EDG OPERABILITY, while minimizing degradation resulting from testing.

Monticello B 3.8.1-13 Revision No. 35

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.8.1.3 Consistent with Regulatory Guide 1.9 (Ref. 3), this Surveillance verifies that the EDGs are capable of synchronizing and accepting loads 90% to 100% of the continuous rating of the EDG. A minimum run time of 60 minutes is required to stabilize engine temperatures, while minimizing the time that the EDG is connected to the offsite source.

Although no power factor requirements are established by this SR, the EDG is normally operated at a power factor between 0.8 lagging and 1.0.

The 0.8 power factor value is the design rating of the machine, while the 1.0 power factor value is an operational limitation to ensure circulating currents are minimized. The load band is provided to avoid routine overloading of the EDG. Routine overloading may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain EDG OPERABILITY.

The 31 day Frequency for this Surveillance is consistent with Regulatory Guide 1.9 (Ref. 3).

Note 1 modifies this Surveillance to indicate that diesel engine runs for this Surveillance may include gradual loading, as recommended by the manufacturer, so that mechanical stress and wear on the diesel engine are minimized.

Note 2 modifies this Surveillance by stating that momentary transients because of changing bus loads do not invalidate this test. Similarly, momentary power factor transients above the limit do not invalidate the test.

Note 3 indicates that this Surveillance should be conducted on only one EDG at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations.

Note 4 stipulates a prerequisite requirement for performance of this SR.

A successful EDG start must precede this test to credit satisfactory performance.

SR 3.8.1.4 Microbiological fouling is a major cause of fuel oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Removal of water from the fuel oil day and base tanks once every 31 days eliminates the necessary environment for bacterial survival. This is the most effective means of Monticello B 3.8.1-14 Revision No. 35

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during EDG operation. Water may come from any of several sources, including condensation, ground water, rain water, contaminated fuel oil, and breakdown of the fuel oil by bacteria. Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. The Surveillance Frequencies are established by Regulatory Guide 1.137 (Ref. 10). This SR is for preventive maintenance. The presence of water does not necessarily represent a failure of this SR provided that accumulated water is removed during performance of this Surveillance.

SR 3.8.1.5 This Surveillance demonstrates that each fuel oil transfer subsystem can transfer fuel oil from the common fuel oil storage tank to the associated EDG day tank with one pump.* This Surveillance also demonstrates that each day tank fuel oil transfer subsystem can transfer fuel oil from its associated day tank to its associated base tank with one pump. It is required to support continuous operation of standby power sources. This Surveillance provides assurance that the required fuel oil transfer pumps are OPERABLE, the fuel oil piping system is intact, the fuel delivery piping is not obstructed, and the controls and control systems for automatic fuel transfer systems are OPERABLE.

Table I provides the transfer pump configurations during and after EC 23085 (see BACKGROUND Section of this specification).

The Frequency for this SR is consistent with the Frequency for testing the EDGs in SR 3.8.1.2.

SR 3.8.1.6 Transfer of each 4.16 kV essential bus power supply from the normal offsite circuit (i.e., either transformer 2R or 1 R) to the alternate offsite circuit (i.e., either transformer 1 R or 1AR) demonstrates the OPERABILITY of the alternate circuit distribution network to power the shutdown loads. The 24 month on a STAGGERED TEST BASIS for each division Frequency of the Surveillance is based on engineering judgment taking into consideration the plant conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually Monticello B 3.8.1-15 Revision No. 35

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) pass the SR when performed on the 24 month on a STAGGERED TEST BASIS for each division Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

This SR is modified by a Note. The reason for the Note is that, during operation with the reactor critical, performance of this SR could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, plant safety systems.

This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when the Surveillance is performed in MODE 1 or 2. Risk insights or deterministic methods may be used for this assessment.

Credit may be taken for unplanned events that satisfy this SR.

SR 3.8.1.7 Each EDG is provided with an engine overspeed trip to prevent damage to the engine. Recovery from the transient caused by the loss of a large load could cause diesel engine overspeed, which, if excessive, might result in a trip of the engine. This Surveillance demonstrates the EDG load response characteristics and capability to reject the largest single load while maintaining a specified margin to the overspeed trip. The largest single load for each EDG is a core spray pump (800 hp). This Surveillance may be accomplished by either:

a. Tripping the EDG output breaker with the EDG carrying greater than or equal to its associated single largest post-accident load while paralleled to offsite power, or while solely supplying the bus; or

b. Tripping its associated single largest post-accident load with the EDG solely supplying the bus.

Consistent with Regulatory Guide 1.9 (Ref. 3), the load rejection test is acceptable if the diesel speed does not exceed the normal (synchronous)

Monticello B 3.8.1-16 Revision No. 35

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) speed plus 75% of the difference between nominal speed and the overspeed trip setpoint, or 115% of nominal speed, whichever is lower.

For EDGs 11 and 12, this represents 67.5 Hz, equivalent to 75% of the difference between nominal speed and the overspeed trip setpoint.

The 24 month Frequency is based on engineering judgment, taking into consideration plant conditions required to perform the Surveillance and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the SR when performed at the 24 month Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.

This SR is modified by two Notes. The reason for Note 1 is that, during operation with the reactor critical, performance of this SR could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, plant safety systems.

This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when the Surveillance is performed in MODE 1 or 2. Risk insights or deterministic methods may be used for this assessment.

Credit may be taken for unplanned events that satisfy this SR. Note 2 ensures that the EDG is tested under load conditions that are as close to design basis conditions as possible. When synchronized with offsite power, testing should be performed within the power factor limit. This power factor is representative of the actual inductive loading an EDG would see under design basis accident conditions. The power factor limit is < 0.85 for Division 1 and < 0.88 for Division 2. Under certain conditions, however, Note 2 allows the surveillance to be conducted outside the power factor limit. These conditions occur when grid voltage may be such that the EDG excitation levels needed to obtain a power factor within limit are not achievable and may be in excess of those recommended for the EDG. In such cases, the power factor shall be maintained as close as practicable to the power factor limit without exceeding the EDG excitation limits.

Monticello B 3.8.1-17 Revision No. 35

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.8.1.8 Consistent with Regulatory Guide 1.9 (Ref. 3), paragraph c.2.2.5, this Surveillance demonstrates that permanently connected loads remain energized from the offsite circuit and emergency loads are auto-connected through the time delay relays from the offsite electrical power system on a LOCA signal without loss of offsite power.

The requirement to verify the connection and power supply of permanent and auto-connected loads is intended to satisfactorily show the relationship of these loads to the loading logic for loading onto offsite power. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation. For instance, ECCS injection valves are not desired to be stroked open, high pressure injection systems are not capable of being operated at full flow, or RHR systems performing a decay heat removal function are not desired to be realigned to the ECCS mode of operation.

In lieu of actual demonstration of the connection and loading of these loads, testing that adequately shows the capability of the EDG system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The Frequency of 24 months is based on engineering judgment, taking into consideration plant conditions required to perform the Surveillance and is intended to be consistent with the expected fuel cycle lengths.

Operating experience has shown that these components usually pass the SR when performed at the 24 month Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.

This SR is modified by a Note. The reason for the Note is that during operation with the reactor critical, performance of this Surveillance could potentially cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, plant safety systems. This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow portions of the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes.

Monticello B 3.8.1-18 Revision No. 35

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)

These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1 or 2. Risk insights or deterministic methods may be used for the assessment.

Credit may be taken for unplanned events that satisfy this SR.

SR 3.8.1.9 This Surveillance demonstrates the EDGs can start and run continuously at full load capability (90% to 100% of the EDG continuous rating) for an interval of not less than 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months - 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months of which is at a load equivalent to 90% to 100% of the continuous rating of the EDG, and 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months of which is at a load equivalent to 105% to 110% of the continuous rating of the EDG. The run duration of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months and the load ranges and duration are consistent with IEEE Standard 387-1995 (Ref. 13). The EDG starts for this Surveillance can be performed either from standby or hot conditions. The provisions for prelube and warmup, discussed in SR 3.8.1.2, and for gradual loading, discussed in SR 3.8.1.3, are applicable to this SR.

A load band is provided to avoid routine overloading of the EDG. Routine overloading may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain EDG OPERABILITY.

The 24 month Frequency is based on engineering judgment, taking into consideration plant conditions required to perform the Surveillance and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the SR when performed at the 24 month Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.

This Surveillance has been modified by three Notes. Note I states that momentary transients due to changing bus loads do not invalidate this test. Similarly, momentary power factor transients above the limit do not invalidate the test. The reason for Note 2 is that during operation with the reactor critical, performance of this Surveillance could cause perturbations to the electrical distribution systems that would challenge continued steady state operation and, as a result, plant safety systems.

This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or Monticello B 3.8.1-19 Revision No. 35

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when the Surveillance is performed in MODE 1 or 2. Risk insights or deterministic methods may be used for this assessment.

Credit may be taken for unplanned events that satisfy this SR. When an EDG is tested at a load equivalent to 90% to 100% of the continuous rating, Note 3 ensures that the EDG is tested under load conditions that are as close to design basis conditions as possible. When synchronized with offsite power, testing should be performed within the power factor limit. This power factor is representative of the actual inductive loading an EDG would see under design basis accident conditions. The power factor limit is s 0.85 for Division 1 and < 0.88 for Division 2. Under certain conditions, however, Note 3 allows the surveillance to be conducted outside of the power factor limit. These conditions occur when grid voltage may be such that the EDG excitation levels needed to obtain a power factor within limit are not achievable and may be in excess of those recommended for the EDG. In such cases, the power factor shall be maintained as close as practicable to the power factor limit without exceeding the EDG excitation limits. During EDG testing at a load equivalent to 105% to 110% of the EDG continuous rating the power factor limit does not have to be met since the EDGs are not required to mitigate the consequences of an accident at these loads.

SR 3.8.1.10 This Surveillance demonstrates that the diesel engine can restart from a hot condition, such as subsequent to shutdown from normal Surveillances, and achieve the required voltage and frequency within 10 seconds. The 10 second time is derived from the requirements of the accident analysis to respond to a design basis large break LOCA. The 24 month Frequency is based on engineering judgment, taking into consideration plant conditions required to perform the Surveillance, and is intended to be consistent with the expected fuel cycle lengths. Operating experience has shown that these components usually pass the SR when performed at the 24 month Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.

Revision No. 35 B 3.8.1-20 Monticello B 3.8.1-20 Revision No. 35

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)

This SR is modified by two Notes. Note 1 ensures that the test is performed with the diesel sufficiently hot. The requirement that the diesel has operated for at least 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months at approximately full load conditions prior to performance of this Surveillance is based on manufacturer recommendations for achieving hot conditions. The load band is provided to avoid routine overloading of the EDG. Routine overloads may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain EDG OPERABILITY. Momentary transients due to changing bus loads do not invalidate this test. Note 2 allows all EDG starts to be preceded by an engine prelube period to minimize wear and tear on the diesel during testing.

SR 3.8.1.11 Consistent with Regulatory Guide 1.9 (Ref. 3), paragraph c.2.2.11, this Surveillance ensures that the manual synchronization and load transfer from the EDG to the offsite source can be made and that the EDG can be returned to ready-to-load status when offsite power is restored. It also ensures that the auto-start logic is reset to allow the EDG to reload if a subsequent loss of offsite power occurs. The EDG is considered to be in ready-to-load status when the EDG is at rated speed and voltage, the output breaker is open and can receive an auto-close signal on bus undervoltage, and the associated individual time delay relays are reset.

The Frequency of 24 months is based on engineering judgment, taking into consideration plant conditions required to perform the Surveillance, and is intended to be consistent with the expected fuel cycle lengths.

Operating experience has shown that these components usually pass the SR when performed at the 24 month Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.

This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems.

This restriction from normally performing the Surveillance in MODE 1, 2, or 3 is further amplified to allow the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance; as well as the operator procedures available to cope with Monticello B 3.8.1-21 Revision No. 35

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when the Surveillance is performed in MODE 1, 2, or 3. Risk insights or deterministic methods may be used for this assessment.

Credit may be taken for unplanned events that satisfy this SR.

SR 3.8.1.12 In the event of a DBA coincident with a loss of offsite power, the EDGs are required to supply the necessary power to ESF systems so that the fuel, RCS, and containment design limits are not exceeded.

This Surveillance verifies all actions encountered from a loss of offsite power actuation test signal in conjunction with an ECCS initiation signal, including de-energization of emergency buses, load shedding from emergency buses, and energization of the emergency buses and respective loads from the EDG. It further demonstrates the capability of the EDG to automatically achieve the required voltage and frequency within the specified time.

The EDG auto-start and energization of permanently connected loads time of 10 seconds is derived from requirements of the accident analysis for responding to a design basis large break LOCA (Ref. 12). The Surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability has been achieved.

The requirement to verify the connection and power supply of permanent and auto-connected loads is intended to satisfactorily show the relationship of these loads to the EDG loading logic. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation. For instance, Emergency Core Cooling Systems (ECCS) injection valves are not desired to be stroked open, or systems are not capable of being operated at full flow, or RHR systems performing a decay heat removal function are not desired to be realigned to the ECCS mode of operation.

In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the EDG system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

Revision No. 35 B 3.8.1-22 Monticello Monticello B 3.8.1-22 Revision No. 35

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)

The Frequency of 24 months is based on engineering judgment, taking into consideration plant conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

Operating experience has shown that these components usually pass the SR when performed at the 24 month Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.

This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the EDGs during testing. For the purpose of this testing, the EDGs must be started from standby conditions, that is, with the engine coolant and oil being continuously circulated and temperature maintained consistent with manufacturer recommendations. The reason for Note 2 is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally performing the Surveillance in MODE 1, 2, or 3 is further amplified to allow portions of the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes.

These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1, 2, or 3. Risk insights or deterministic methods may be used for the assessment.

Credit may be taken for unplanned events that satisfy this SR.

SR 3.8.1.13 Under accident conditions loads are sequentially connected to the bus by the individual time delay relays. The sequencing logic controls the permissive and starting signals to motor breakers to prevent overloading of the EDGs and offsite circuits due to high motor starting currents. The minimum load sequence time interval tolerance ensures that sufficient time exists for the EDGs and offsite circuits to restore frequency and voltage prior to applying the next load and that safety analysis assumptions regarding ESF equipment time delays are not violated.

Revision No. 35 B 3.8.1-23 Monticello Monticello B 3.8.1-23 Revision No. 35

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)

The Frequency of 24 months is based on engineering judgment, taking into consideration plant conditions required to perform the Surveillance and is intended to be consistent with expected fuel cycle lengths.

Operating experience has shown that these components usually pass the SR when performed at the 24 month Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.

This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems.

This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when the Surveillance is performed in MODE 1 or 2. Risk insights or deterministic methods may be used for this assessment.

Credit may be taken for unplanned events that satisfy this SR.

REFERENCES 1. USAR, Section 1.2.6.

2. USAR, Section 8.2.

3. Regulatory Guide 1.9.

4. USAR, Chapter 5.

5. USAR, Chapter 14.

6. Regulatory Guide 1.93.

7. Generic Letter 84-15.

8. USAR, Chapter 8.

9. Regulatory Guide 1.108.

Monticello B 3.8.1-24 Revision No. 35

AC Sources - Operating B 3.8.1 BASES REFERENCES (continued)

10. Regulatory Guide 1.137.

11. ANSI C84.1, 1982.

12. USAR, Section 14.7.2.

13. IEEE Standard 387-1995.

14. EC 23085, EDG Fuel Oil Train Separation Monticello B 3.8.1 Last Revision No. 35

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.3 Diesel Fuel Oil, Lube Oil, and Starting Air BASES BACKGROUND The emergency diesel generators (EDGs) are provided with a common fuel oil storage tank having a fuel oil capacity sufficient to operate one EDG for a period of 7 days while the EDG is supplying full load (2500 kW) as discussed in USAR, Section 8.4.1.1 (Ref. 1) and Regulatory Guide 1.137 (Ref. 2). This onsite fuel oil capacity is sufficient to operate the EDGs for longer than the time to replenish the onsite supply from outside sources.

The EDG fuel oil transfer system includes two separate fuel oil transfer subsystems. Fuel oil is transferred from the common fuel oil storage tank to the respective EDG day tank by the subsystem associated with that EDG. Redundancy of the fuel oil transfer pumps* and piping precludes the failure of one fuel oil transfer pump, or the rupture of any pipe or valve to result in the loss of more than one EDG. The outside common fuel oil storage tank and piping are located underground. The Division 1 fuel oil transfer pumps* are located in the fuel oil pump house. The Division 2 fuel oil transfer pumps* are located in the 12 EDG day tank room.

Table 1 provides the transfer pump configurations during and after EC 23085 (see BACKGROUND Section of Specification 3.8.1).

For proper operation of the standby EDGs, it is necessary to ensure the proper quality of the fuel oil. Regulatory Guide 1.137 (Ref. 2) addresses the recommended fuel oil practices as supplemented by ANSI N195 (Ref. 3) and the ASTM standards provided in Reference 5. The fuel oil properties governed by these SRs are the water and sediment content, API gravity, and impurity level.

The EDG lubrication system is designed to provide sufficient lubrication to permit proper operation of its associated EDG under all loading conditions. The system is required to circulate the lube oil to the diesel engine working surfaces and to remove excess heat generated by friction during operation. 'Each engine oil sump contains an inventory capable of supporting a minimum of 7 days of operation. This supply is sufficient to allow the operator to replenish lube oil from outside sources.

Each EDG includes two independent air start subsystems. Each EDG air start subsystem has adequate capacity with air receiver pressure at

> 165 psig for two successive start attempts on the EDG without recharging the air start receivers. Each EDG air start subsystem includes three starting air receivers. The automatic start logic for each EDG will provide a cranking sequence to ensure two start attempts from each subsystem staggered such that there are a total of three start attempts on Revision No. 35 B 3.8.3-1 Monticello Monticello B 3.8.3-1 .Revision No. 35

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES BACKGROUND (continued) the EDG. The first attempt will use the selected air start subsystem, the second attempt will use both air start subsystems, while the third attempt will use the air start subsystem that is not selected or not used on the first attempt. The third start attempt may not occur within enough time for the engine to be ready to accept load within 10 seconds of a demand requirement.

APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient SAFETY analyses in USAR, Chapter 14 (Ref. 4), assume Engineered Safety ANALYSES Feature (ESF) systems are OPERABLE. The EDGs are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that fuel, Reactor Coolant System, and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.5, Emergency Core Cooling Systems (ECCS) and Reactor Core Isolation Cooling (RCIC)

System; and Section 3.6, Containment Systems.

Since Diesel Fuel Oil, Lube Oil, and Starting Air supports the operation of the standby AC power sources, it satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO Stored diesel fuel oil is required to have sufficient supply for 7 days of full load operation for one EDG. It is also required to meet specific standards for quality. Additionally, sufficient lube oil supply must be available to ensure the capability to operate both EDGs at full load for 7 days. This requirement, in conjunction with an ability to obtain replacement supplies within 7 days, supports the availability of EDGs required to shut down the reactor and to maintain it in a safe condition for an anticipated operational occurrence (AOO) or a postulated DBA with loss of offsite power. EDG fuel oil transfer capability from the storage tank to the day tank and from the day tank to the base tank are addressed in LCO 3.8.1, "AC Sources -

Operating," and LCO 3.8.2, "AC Sources - Shutdown."

Each starting air subsystem is required to have a minimum capacity for two successive EDG start attempts without recharging the air start receivers.

APPLICABILITY The AC sources (LCO 3.8.1 and LCO 3.8.2) are required to ensure the availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an AOO or a postulated DBA.

Because stored diesel fuel oil, lube oil, and starting air subsystem support LCO 3.8.1 and LCO 3.8.2, stored diesel fuel oil, lube oil, and starting air are required to be within limits when the associated EDG is required to be OPERABLE.

Monticello B 3.8.3-2 Revision No. 35

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES ACTIONS The ACTIONS Table is modified by a Note indicating that separate Condition entry is allowed for each EDG. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable EDG subsystem. Complying with the Required Actions for one inoperable EDG subsystem may allow for continued operation, and subsequent inoperable EDG subsystem(s) governed by separate Condition entry and application of associated Required Actions.

A..1 In this Condition, the 7 day fuel oil supply for an EDG is not available.

The fuel oil equivalent to a 7-day supply is specified in SR 3.8.3.1.

However, the Condition is restricted to fuel oil level reductions that maintain at least a 6 day supply. The fuel oil equivalent to a 6-day supply is 47,673 gallons. These circumstances may be caused by events such as either:

a. Full load operation required for an inadvertent start while at minimum required level; or

b. Feed and bleed operations that may be necessitated by increasing particulate levels or any number of other oil quality degradations.

This restriction allows sufficient time for obtaining the requisite replacement volume and performing the analyses required prior to addition of the fuel oil to the tank. A period of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is considered sufficient to complete restoration of the required level prior to declaring both EDGs inoperable. This period is acceptable based on the remaining capacity (> 6 days), the fact that procedures will be initiated to obtain replenishment, and the low probability of an event during this brief period.

B..1 In this condition the 7-day lube oil inventory i.e., sufficient lube oil to support 7 days of continuous EDG operation at full load conditions is not available. However, the Condition is restricted to lube oil volume reductions that maintain at least a 6 day supply. The lube oil equivalent volume to a 6-day supply is 142 gallons for each EDG. This restriction allows sufficient time for obtaining the requisite replacement volume. A period of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is considered sufficient to complete restoration of the required volume prior to declaring the EDG inoperable. This period is acceptable based on the remaining capacity (> 6 days), the low rate of usage, the fact that procedures will be initiated to obtain replenishment, and the low probability of an event during this brief period.

Monticello B 3.8.3-3 Revision No. 35

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES ACTIONS (continued)

C.I1 This Condition is entered as a result of a failure to meet the acceptance criterion for particulates. Normally, trending of particulate levels allows sufficient time to correct high particulate levels prior to reaching the limit of acceptability. Poor sample procedures (bottom sampling),

contaminated sampling equipment, and errors in laboratory analysis can produce failures that do not follow a trend. Since the presence of particulates does not mean failure of the fuel oil to burn properly in the diesel engine, since particulate concentration is unlikely to change significantly between Surveillance Frequency intervals, and since proper engine performance has been recently demonstrated (within 31 days), it is prudent to allow a brief period prior to declaring the associated EDG inoperable. The 7 day Completion Time allows for further evaluation, resampling, and re-analysis of the EDG fuel oil.

D.1 With the new fuel oil properties defined in the Bases for SR 3.8.3.3 not within the required limits, a period of 30 days is allowed for restoring the stored fuel oil properties. This period provides sufficient time to test the stored fuel oil to determine that the new fuel oil, when mixed with previously stored fuel oil, remains acceptable, or to restore the stored fuel oil properties. This restoration may involve feed and bleed procedures, filtering, or combination of these procedures. Even if a EDG start and load was required during this time interval and the fuel oil properties were outside limits, there is high likelihood that the EDG would still be capable of performing its intended function.

E._1 With starting air receiver pressure < 165 psig in one air starting subsystem, sufficient capacity for three successive EDG start attempts does not exist. However, as long as the other starting air receiver subsystem pressure is >_165 psig, there is adequate capacity for two start attempts, and the EDG can be considered OPERABLE while the air receiver pressure is restored to the required limit. A period of 7 days is considered sufficient to complete restoration to the required pressure prior to declaring the EDG inoperable. This period is acceptable based on the remaining air start capacity in the other starting air subsystem, the fact that most EDG starts are accomplished on the first attempt, and the low probability of an event during the 7 day period.

Monticello B 3.8.3-4 Revision No. 35

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES ACTIONS (continued)

F. 1 With starting air receiver pressure < 165 psig in both starting air subsystems, sufficient capacity for three successive EDG start attempts does not exist. However, as long as the receiver pressure is > 125 psig in at least one starting air subsystem, there is adequate capacity for at least one start attempt, and the EDG can be considered OPERABLE while the air receiver pressure is restored to the required limit. A period of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is considered sufficient to complete restoration to the required pressure prior to declaring the EDG inoperable. This period is acceptable based on the remaining air start capacity, the fact that most EDG starts are accomplished on the first attempt, and the low probability of an event during this brief period.

G.*1 With a Required Action and associated Completion Time not met, or the stored diesel fuel oil, lube oil, or starting air subsystem not within limits for reasons other than addressed by Conditions A through F, the associated EDG may be incapable of performing its intended function and must be immediately declared inoperable.

SURVEILLANCE SR 3.8.3.1 REQUIREMENTS This SR provides verification that there is an adequate inventory of fuel oil in the storage tank to support one EDG's operation for 7 days at full load.

The fuel oil level equivalent to a 7 day supply is 52,401 gallons (Ref. 7) when calculated in accordance with RG 1.137 (Ref. 2) and ANSI N195 (Ref. 3). The required fuel storage volume is determined using the most limiting energy content of the stored fuel that meets the plant design basis requirements. Using the most limiting energy content as verified by direct energy content measurement or the known correlation of diesel fuel oil absolute specific gravity or API gravity to energy content, the required diesel generator output, and the corresponding fuel consumption rate, the onsite fuel storage volume required for 7 days of operation can be determined. SR 3.8.3.3 requires that new and stored fuel oil properties are verified and maintained within the limits of the Diesel Fuel Oil Testing Program. The 7 day period is sufficient time to place the unit in a safe shutdown condition and to bring in replenishment fuel from an offsite location.

The 31 day Frequency is adequate to ensure that a sufficient supply of fuel oil is available, since low level alarms are provided and unit operators would be aware of any large uses of fuel oil during this period.

Monticello B 3.8.3-5 Revision No. 35

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.8.3.2 This Surveillance ensures that sufficient lubricating oil inventory is available to support at least 7 days of full load operation for each EDG.

The lube oil volume equivalent to a 7-day supply is 165 gallons and is based on the EDG manufacturer's consumption values for the run time of the EDG. Implicit in this SR is the requirement to verify the capability to transfer the lube oil from its storage location to the EDG, if the EDG lube oil sump does not hold adequate inventory for 7 days of full load operation without the level reaching the manufacturer's recommended minimum level.

A 31 day Frequency is adequate to ensure that a sufficient lube oil supply is onsite, since EDG starts and run time are closely monitored by the plant staff.

SR 3.8.3.3 The tests of new fuel oil prior to addition to the storage tank are a means of determining whether new fuel oil is of the appropriate grade and has not been contaminated with substances that would have an immediate detrimental impact on diesel engine combustion. If results from these tests are within acceptable limits, the fuel oil may be added to the storage tanks without concern for contaminating the entire volume of fuel oil in the storage tank. These tests are to be conducted prior to adding the new fuel that is in the diesel oil receiving tank to the storage tank. The tests, limits, and applicable ASTM Standards are as follows:

a. Sample the new fuel oil:

1) in accordance with ASTM D4057-88 (Ref. 5); or

2) by recirculating fuel oil to avoid tank stratification and allowing a single point representative sample;

b. Verify that the new fuel oil sample has: (1) an API gravity at 60°F of

> 28 and < 38 when tested in accordance with ASTM D287-92 (Ref. 5); (2) a saybolt viscosity at 100°F of_> 32.6 and *<40.1 seconds universal when tested in accordance with ASTM D445-96 (Ref. 5);

and (3) a flash point of - 125 0 F when tested in accordance with ASTM D93-97 (Ref. 5); and

c. Verify water and sediment content within limits when tested in accordance with ASTM D1796-90 (Ref. 5).

Monticello B 3.8.3-6 Revision No. 35

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES SURVEILLANCE REQUIREMENTS (continued)

Failure to meet any of the above limits is cause for rejecting the new fuel oil, but does not represent a failure to meet the LCO concern since the fuel oil is not added to the storage tanks.

Following the initial analysis of the new fuel oil sample, further analysis is completed prior to or within 31 days following addition of the new fuel oil to the fuel oil storage tank to establish that the other properties specified in Table 1 of ASTM D975-91 (Ref. 5) are met for new fuel oil when tested in accordance with ASTM D975-91 (Ref. 5), except that the analysis for sulfur may be performed in accordance with ASTM D1552-95 (Ref. 5).

The 31 day period is acceptable because the fuel oil properties of interest, even if they were not within stated limits, would not have an immediate effect on EDG operation. This Surveillance ensures the availability of high quality fuel oil for the EDGs.

Fuel oil degradation during long term storage shows up as an increase in particulate, mostly due to oxidation. The presence of particulate does not mean that the fuel oil will not burn properly in a diesel engine. The particulate can cause fouling of filters and fuel oil injection equipment, however, which can cause engine failure.

Particulate concentrations should be determined in accordance with ASTM D6217-98 (Ref. 5). This method involves a gravimetric determination of total particulate concentration in the fuel oil and has a limit of 10 mg/l. It is acceptable to obtain a field sample for subsequent laboratory testing in lieu of field testing.

The Frequency of this test takes into consideration fuel oil degradation trends that indicate that particulate concentration is unlikely to change significantly between Frequency intervals.

SR 3.8.3.4 This Surveillance ensures that, without the aid of the refill compressor, sufficient air start capacity for each EDG is available. The system design requirements provide for a minimum of three engine start cycles without recharging. A start cycle is up to three seconds of cranking. The pressure specified in this SR is intended to reflect the lowest value at which the three starts can be accomplished.

The 31 day Frequency takes into account the capacity, capability, redundancy, and diversity of the AC sources and other indications available in the control room, including alarms, to alert the operator to below normal air start pressure.

Monticello B 3.8.3-7 Revision No. 35

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.8.3.5 Microbiological fouling is a major cause of fuel oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Removal of water from the fuel storage tanks once every 31 days eliminates the necessary environment for bacterial survival. This is the most effective means of controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during EDG operation. Water may come from any of several sources, including condensation, ground water, rain water, contaminated fuel oil, and from breakdown of the fuel oil by bacteria. Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. The Surveillance Frequencies are established by Regulatory Guide 1.137 (Ref. 2). This SR is for preventive maintenance.

The presence of water does not necessarily represent failure of this SR, provided the accumulated water is removed during performance of the Surveillance.

REFERENCES 1. USAR, Section 8.4.1.1.

2. Regulatory Guide 1.137, Revision 1.

3. ANSI N195, 1976.

4. USAR, Chapter 14.

5. ASTM Standards: D4057-88; D287-92; D445-96; D93-97; D1796-90; D975-91; D1552-95; D6217-98.

6. Calculation 90-023, "Minimum Allowable Fuel Oil Storage Tank Level."

7. Calculation 03-026, "Instrument Setpoint Calculation, Diesel Oil Storage Tank Level."

Monticello B 3.8.3 Last Revision No. 35

ML15135A224

Text

Navigation menu

Search