ONS-2015-065, TIA 2014-04, Request for Technical Assistance Regarding the Adequacy of the Station Design and Licensing Bases for the Degraded Voltage Relay

TIA 2014-04, Request for Technical Assistance Regarding the Adequacy of the Station Design and Licensing Bases for the Degraded Voltage Relay

ML15154A490
Person / Time
Site:	Oconee
Issue date:	05/22/2015
From:	Batson S Duke Energy Carolinas
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
ONS-2015-065, TIA 2014-04
Download: ML15154A490 (21)

Text

1.

DUKE ENERGY.Vice .to ScottL.President

~ENERGY. Oconee Nuclear Station Duke Energy ONO1VP I 7800 RochesterHwy Seneca, SC 29672 ONS-2015-065 o: 864.873.3274 f 864.873. 4208 Scott.Batson@duke-energy.com May 22, 2015 U.S. Nuclear Regulatory Commission Document Control Desk Washington, D.C. 20555

Subject:

Duke Energy Carolinas, LLC Oconee Nuclear Station, Docket Nos. 50-269, 50-270 and 50-287 TIA 2014-04, Request for Technical Assistance Regarding the Adequacy of the Oconee Station Design and Licensing Bases for the Degraded Voltage Relay Protection Design

References:

1. Oconee Nuclear Station - NRC Component Design Bases Inspection Report 05000269/2014007, 05000270/2014007, and 05000287/2014007, dated June 27, 2014, ADAMS Accession No. ML14178A535.

The 2014 Oconee Component Design Basis Inspection (CDBI) is documented in the Reference 1 NRC Inspection Report. This report initiated Unresolved Item (URI) 05000269,270,287/2014007-04, Degraded Voltage Relay Scheme, which describes NRC concerns related to the Oconee degraded voltage relay scheme. Region II has requested assistance from the Office of Nuclear Reactor Regulation (NRR) via a Task Interface Agreement (TIA) to review the Oconee design with respect to NRC requirements. The TIA is identified as TIA 2014-04.

The NRC staff briefed the Duke Energy staff on October 27, 2014, pertaining to the TIA request contents as required by NRR Procedure COM-106, Task Interface Agreements, Revision 4, Section 6.1.4. Duke Energy subsequently developed Attachment 1, Adequacy of Oconee Nuclear Station Electric Distribution System Undervoltage Protection During Postulated Degraded Grid Voltage Events, which lays out the Oconee design and licensing basis as it pertains to basic premise of the URI. Attachment 1 is provided to aid the NRC in their review of the TIA with regard to the evolution of Oconee's design and licensing basis, including related NRC reviews of the Oconee design and license. Attachment 1 also compares the Oconee design with the requirements of RIS 2011-12, Revision 1, Adequacy of Station Electric Distribution System Voltages. Oconee's degraded grid voltage protection design provides for automatic actions to protect the Class 1 E electrical distribution system, ensuring that bus voltages remain within analyzed limits.

Soo(

www.duke-energy.com

A ONS-2015-065 TIA 2014-04 May 22, 2015 Page 2 There are no new or revised regulatory commitments being made in this submittal.

Please contact Chris Wasik, Oconee Regulatory Affairs Manager, at 864.873.5789 if you have any questions related to this matter.

Sincerely, Scott Batson Vice President Oconee Nuclear Station Attachment 1- Adequacy of Oconee Nuclear Station Electric Distribution System Undervoltage Protection During Postulated Degraded Grid Voltage Events

ONS-2015-065 TIA 2014-04 May 22, 2015 Page 3 xc (with attachment):

Mr. Victor McCree Administrator, Region II U.S. Nuclear Regulatory Commission Marquis One Tower 245 Peachtree Center Ave., NE, Suite 1200 Atlanta, GA 30303-1257 Mr. Eddy Crowe NRC Senior Resident Inspector Oconee Nuclear Station Mr. James R. Hall NRC Senior Project Manager (File via E-mail)

U.S. Nuclear Regulatory Commission One White Flint North, M/S O-8B1 11555 Rockville Pike Rockville, MD 20852-2746 Ms. Holly D. Cruz NRC Project Manager (File via E-mail)

U.S. Nuclear Regulatory Commission One White Flint North, 12E1 11555 Rockville Pike Rockville, MD 20852-2746

ONS-2015-065 TIA 2014-04 Attachment 1 Adequacy of Oconee Nuclear Station Electric Distribution System Undervoltage Protection During Postulated Degraded Grid Voltage Events (18 pages, including cover page)

Adequacy of Oconee Nuclear Station Electric Distribution System Undervoltage Protection During Postulated Degraded Grid Voltage Events

1. Executive Summary During the 2014 NRC Component Design Basis Inspection (CDBI) the NRC team identified an unresolved item (URI) to determine whether a performance deficiency exists with respect to the licensee's degraded voltage relay scheme (Degraded Voltage Relay Scheme [Inspection Report dated June 27, 2014, "Oconee Nuclear Station - NRC Component Design Bases Inspection Report 05000269/2014007, 05000270/20140007 and 05000287/2014007-04 URI Section [R21.2.b.iv]).

This paper will address both the current and historical licensing and technical issues related to the systems that are credited for both the detection and mitigation of a degraded grid event.

The Oconee Nuclear Station (ONS) was originally constructed with two layers of off-site power degraded voltage protection. These layers consisted of the Oconee 4kV Safety Related Power Undervoltage Protection System (4kV UV) and the Oconee External Grid Trouble Protective System (EGTPS).

The Oconee Degraded Grid Undervoltage (DGUV) System was added in the 1990s time frame to correct an issue identified in a License Event Report (LER) to the NRC concerning unanticipated system interactions during an undervoltage condition in the 230kV switchyard. These unanticipated interactions could have caused the Keowee Overhead path to be unavailable during certain postulated degraded grid scenarios and thus result in the failure of one of two power paths (Keowee Overhead and Underground paths) from the onsite emergency AC source (Keowee). This system alerts Oconee Nuclear Station operators and Duke Energy grid system operations to degraded grid voltage conditions prior to the actuation of the 4kV Undervoltage protection system.

This system will also isolate the switchyard and start Keowee in the event of an Engineered Safeguards (ES) system actuation during the degraded grid condition as further explained in this document.

An operating experience (OE) review was performed and it was determined that some nuclear power plants ultimately rely upon manual or administration actions (via their control rooms or their grid operation center) to protect safety related buses from adverse undervoltage effects related to degraded grid conditions.

Ultimately, Oconee relies upon the automatic actions of safety related components to protect Class 1E equipment from adverse impacts due to undervoltage during postulated degraded grid conditions.

The ONS 4kV UV system meets the setpoint requirements of IEEE 741-2007 by utilizing three inverse time trip characteristic relays in a 2 out of 3 logic scheme to both sense and separate the safety related buses during degraded voltage conditions.

Page 1 of 17

2. Overview of ONS Degraded Off-site Voltage Protection

a. Oconee External Grid Trouble Protective System Overview (EGTPS)

The External Grid Trouble Protective System Undervoltage system consists of two redundant channels. Each channel is physically and electrically separated. Each channel consists of six undervoltage relays which are each connected to a phase of both the red and yellow buses. When 2 relays on the same phase of each bus actuate, this will then actuate an auxiliary relay and give a local red light and another event recorder point. If two out of three auxiliary relays are actuated, these two relays will energize four tripping relays which will initiate the operation of the External Grid Trouble Protective System which will emergency start Keowee units. Also, this will actuate a computer point, event recorder point and status alarm.

b. Oconee Degraded Grid Undervoltage (DGUV) System Overview The Degraded Grid Undervoltage relays consists of three undervoltage relays which are connected to the 230 kV Yellow Bus in a 2 out of 3 logic scheme. One relay is connected to each phase to detect any abnormal voltage conditions. When 2 out of 3 relays operate, this will start a 9 second timer. If the UV conditions recover above the relay setpoint, the 9-second timer will de-energize. This is designed to eliminate any nuisance trips from voltage transients that occur during switching and faults external to the Oconee switchyard. If at the end of 9 seconds the undervoltage condition has not recovered, a signal will be sent to the statalarm, OAC, Dispatcher and Event Recorder. If an undervoltage condition is present on 2 out of 3 phases along with an Engineered Safeguards (ES) signal, the 230 kV Yellow Bus will isolate and start Keowee Hydro to energize the startup transformers.

This system was added as an additional degraded voltage protection system to clear the onsite emergency power source overhead path. See section 3.d of this document for additional history regarding this system.

c. Oconee 4kV Safety Related Power Undervoltage Protection System (4kV UV) Overview The 4kV normal incoming breakers provide power during normal operation to the Main Feeder Bus (MFB) from the respective unit's auxiliary transformer (1/2/3T). The normal source of power to the unit auxiliary transformer is the unit generator, although the capability is provided for providing power to 1/2/3T from the switchyard.

If an undervoltage is sensed on two out of three phases of the normal source, the normal breakers will trip and isolate the safety related Main feeder Bus from the grid. The emergency source "E" breakers utilize the same logic.

Page 2 of 17

The 84.77% nominal voltage (3526V) analysis is performed at the "must drop out" value of the 27N & E relays, 97% tap. At the 97% tap value the 27N & E relays will begin to operate the disc and after a time delay will provide a trip to either the normal or startup breakers. This trip will isolate the safety related buses from the degraded source of power.

A Source voltage of 84.77% nominal will bound all degraded conditions due to the following:

1. It has been analyzed that all operating safety related equipment will survive a degraded voltage of 84.77% nominal.

2. Uncertainty associated with the 84.77% (the undervoltage relays must drop out) nominal voltage setting (97% tap) is bounded by testing that is performed at 99% tap (86.6%

nominal (3601 V)) undervoltage relays must operate setpoint.

3. It has been demonstrated that the undervoltage relays will drop out and actuate on 4kV undervoltage at 84.77% nominal.

In a July 21, 1977 letter from Oconee to the NRC regarding the assessment of the susceptibility of safety related equipment to sustained degraded voltage, it was shown analytically that the safety related loads are protected from degraded grid voltage conditions. Attachment 1,Section III "Conclusions" states the following:

"To ensure that the operability of system components is not adversely affected by short term or long term degradation in system grid voltage, the undervoltage relays that monitor the offsite power system are set at 88% (3660V). This ensures that an acceptable voltage level required for continuous operation of non-safety, and safety-related equipment will exist. The time delay inherent in these relays will eliminate spurious trips and ensure that degraded undervoltages are detected and cleared before they can adversely affect safety-related loads.

Figure 5 shows the results of Case 7 which provides the voltage profiles on the safety-related buses under degraded offsite power conditions corresponding to the undervoltage relay setpoint of 88% (3660V).

This case demonstrates that voltages below the continuous operating limits of the safety-related loads cannot exist without causing a separation from the degraded condition."

In a December 20, 1978 letter from the NRC to Oconee, the NRC stated that, "the design affords adequate protection against degraded grid undervoltage conditions in accordance with the NRC letter of June 3, 1977, and therefore is acceptable."

See sections 3.a and b of this document for additional history regarding this system.

Page 3 of 17

3. Licensing, History

a. Original Plant Design for the Class IE Electrical Distribution System Undervoltage Protection No original licensing documentation could be located that explicitly describes and evaluates the undervoltage protection features of the Class 1E electrical distribution system. The Oconee Nuclear Station original undervoltage protection design (4kV UV) was used to protect the Class IE equipment from a loss of voltage or a sustained degradation of grid voltage on the emergency buses. This undervoltage protection design provides for two out of three coincident logic, monitoring the offsite power source voltage on each 4160 volt bus. The undervoltage protection will initiate separation of the onsite emergency buses from the offsite power systems upon complete loss of offsite power or at a time delay depending on the extent of the degraded voltage condition. Due to the inverse time trip characteristics of the undervoltage relays, the lower the voltage, the faster the trip.

b. August 12, 1976 to December 20, 1978 Correspondence Related to the Millstone Event In an August 12, 1976 letter from the NRC to Oconee, the plant operation and equipment failures during a degraded grid voltage condition events that occurred at Millstone Unit No. 2 were described. At that time the NRC requested that Oconee investigate the vulnerability of their facility to similar degraded voltage conditions and provide a response by telephone.

In a June 3, 1977 letter from the NRC to Oconee, the NRC felt that it was necessary for all licensees to conduct a thorough evaluation of the problem and submit formal reports regarding the design of their respective Class 1E electrical distribution systems and their vulnerability to both long and short term degradation in the grid system voltage within the range where the offsite power is relied upon to supply important equipment.

As requested, Oconee provided multiple responses to the NRC describing the operation of our Class I E electrical distribution systems. In a July 21, 1977 letter from Oconee to the NRC, an evaluation performed that showed the Class 1E system is not vulnerable to the same conditions that were experienced during the Millstone event. The letter states the following:

"To ensure that the operability of system components is not adversely affected by short term or long term degradation in system grid voltage, the undervoltage relays that monitor the offsite power system at set at 88% (3660V). This ensures that an acceptable voltage level required for continuous operation of non-safety and safety-related equipment will exist. The time delay inherent in these relays will eliminate spurious trips and ensure that degraded undervoltages are detected and cleared before they can adversely affect safety-related loads."

Page 4 of 17

In a December 20, 1978 letter from the NRC to Oconee, the NRC stated that, "the design affords adequate protection against degraded grid undervoltage conditions in accordance with the NRC letter of June 3, 1977, and therefore is acceptable. The NRC further stated in this letter, "The Oconee Nuclear Station originally had an undervoltage protection design to protect the Class IE equipment from a loss of voltage or a sustained degradation of grid voltage on the emergency buses. The protection system includes undervoltage relays with inverse time characteristics which have a trip setpoint set at 88% of the rated bus voltage, i.e., 4160 volts and with a five second time delay. This undervoltage protection design provides for two out of three coincident logic, monitoring the offsite power voltage on each 4160 volt bus. The undervoltage protection will initiate separation of the onsite emergency buses from the offsite power systems immediately upon complete loss of offsite power or at a time delay depending on the extent of the degraded voltage condition below 88% of nominal voltage. The lower the voltage, the faster the trip."

c. August 8, 1979 to March 21, 1983 Correspondence Related to the Arkansas Nuclear One (ANO) Event In an August 8, 1979 Generic Letter from the NRC to all Power Reactor Licensees, an event was discussed that occurred at the Arkansas Nuclear One (ANO) station on September 16, 1978 that brought into question the conformance of the station electric distribution system to GDC-17, in two separate regards. Specifically, licensees must confirm the acceptability of the voltage conditions on the station electric distribution systems with regard to both (1) potential overloading due to transfers of either safety or non-safety loads, and (2) potential starting transient problems in addition to the concerns expressed in our June 2, 1977 correspondence with regard to degraded voltage conditions due to conditions originating on the grid.

GDC- 17 requires, in part, that (1) electric power from the transmission network for the onsite distribution system shall be supplied by two physically independent circuits (not necessarily on separate-rights of way) designed and located so as to minimize to the extent practical the likelihood of their simultaneous failure under operating and environmental conditions and (2) provision shall be included to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear unit, or the loss of power from the transmission network. The ANO station did not fully meet these requirements.

In a letters from Oconee to the NRC on March 13, 1980 and June 4, 1980, Oconee further described Class 1E electrical distribution system operation and analyses in light of the ANO event and GDC-17.

In a March 21, 1983 letter from the NRC to Oconee, the NRC stated that they had completed their review and determined the following:

Page 5 of 17

"Based on the results of your distribution system voltage verification tests, performed in accordance with our guidelines, for the Unit 3 distribution system, we find your voltage analysis acceptable, Due to the close similarity of the design and loading of the distribution systems for all 3 units, we agree to accept the results of the Unit 3 tests as being valid for Units I and 2 also. Therefore separate verification testing for Units I and 2 will not be necessary. The voltage analysis you submitted, indicates that the distribution voltages at the safety buses were unacceptable when one unit startup transformer is shared between two units. Your staff has agreed to implement Technical Specifications (TSs) to prohibit the connection of more than one unit auxiliary and Class 1E loads to a single startup transformer."

Oconee received a license amendment from the NRC on March 2, 1984, adding this requirement to the Technical Specifications.

NRC Conclusions We have reviewed the EG&G Technical Evaluation Report and concur in the findings that:

1. The voltages are within the operating limits of Class 1E equipment for projected combinations of plant load and offsite power grid conditions provided one startup transformer is used for one unit.

2. Spurious separation from the offsite power system due to the operation of voltage protective relays will not occur (with the offsite grid voltage within its expected limits) as a result of starting safety loads.

3. DPC has determined (by analysis) that no potential for either a simultaneous or consequential loss of both offsite power sources exists.

4. The tests performed by DPC verifies the accuracy of their analysis.

We, therefore, find Oconee Nuclear Units 1, 2 and 3 design to be acceptable with respect to adequacy of station electric distribution system voltages subject to the implementation of technical specifications change prohibiting the use of one startup transformer for more than one unit."

d. April 30, 1990 to November 14, 1999 Correspondence Related to the Oconee License Event Reports In a April 30, 1990 Licensee Event Report (LER) from Oconee to the NRC, it was reported that Oconee Design Engineering, while developing a Design Basis Document, determined that the switchyard voltage could drop below the minimum voltage level (219kV) required for worst case loading during a unit trip and Loss-Of-Coolant-Accident on the tripped unit. Further review of the degraded voltage scenario revealed that one of the two required on-site emergency power paths, the Keowee Overhead, could be unavailable for automatic connection to the Oconee 230 kV switchyard because of Page 6 of 17

the relative setpoints of the under voltage relays serving the startup breaker logic and the external grid trouble protection system. In addition, this same undervoltage condition could prevent the startup transformer 4160 V breakers from closing in causing the 230 kV switchyard and its associated incoming transmission lines to be unavailable to provide their required support function.

These conditions are possible because the 230 kV switchyard bus must be greater than 219 kV in order to adequately supply ES loads while the automatic actuation voltage setpoint that aligns the Keowee Overhead emergency power path 'is less than 160 kV. If a degraded switchyard voltage exists between these relative setpoints, then power to the ES buses may not be automatically available from either source.

Design Engineering also initiated a Station Problem Report which resulted in the later development of Nuclear Station Modification (NSM) 52850. This NSM detailed the installation of an additional two out of three logic arrangement of undervoltage relays which sense the 230 kV input to each units startup transformers. The NSM provided an annunciator, digital computer and events recorder indication to plant operators as well as input to the Operator Aid Computer (OAC) when 230 kV switchyard degraded voltage conditions exist. This modification automatically initiated existing switchyard isolate logic if degraded voltage conditions and an engineered safeguards (ES) signal on any Oconee unit occur concurrently. This system is known today as Oconee Degraded Grid Undervoltage (DGUV) System.

In a November 14, 1990 Safety Evaluation for Oconee Degraded Grid Protection, the NRC concluded the following:

"Your Licensee Event Reports (LERs) 269/90-04 dated April 30, 1990, 269/90-04 dated May 24, 1990, and 269/90-05 dated May 24, 1990, reported situations related to design deficiencies of the degraded grid protection hardware and provided corrective actions.

These deficiencies may leave the station vulnerable to a single failure and/or render safety-related equipment inoperable or damaged during a degraded voltage condition.

However, your letter of May 8, 1990, described conceptually a new permanent degraded grid protection modification to be installed in the near future that would, to a great extent, resolve these design deficiencies. The NRC staff has completed a review of these submittals. Enclosed is the related Safety Evaluation. The staff has concluded that the proposed modifications to the design would provide additional undervoltage protection.

Also, in consideration of the complexity of the plant's existing undervoltage protection system and the on-site electrical distribution system, the staff finds the proposed degraded grid protection modification acceptable."

Page 7 of 17

4. NRC Regulatory Issue Summary 2011-12, Revision 1, Adequacy of Station Electric Distribution System Voltages Criteria a) The selection of voltage and time delay setpoints shall be determined from an analysis of the voltage requirements of the safety-related loads at all station electric power system distribution levels; Note: Voltage requirements of all safety-related loads should be determined based on manufacturers design and operating requirements. For example, safety injection motors have starting and running voltage requirements. Motor operated valves have minimum operating voltage requirements. Motor Control Center contactors have minimum pickup and operating voltages. All voltage requirements for all safety-related loads need to be preserved by the DVR circuit(s) during all operating and accident conditions.

Oconee's Response to Criteria a) The voltage setpoints for the 4kV Safety Related Power Undervoltage Protection System relays were shown via analyses to automatically protect the connected equipment during a postulated degraded grid scenario.

Criteria b) The voltage protection shall include coincidence logic to preclude spurious trips of the offsite power source; Oconee's Response to Criteria b)

The 4kV Safety Related Power System Undervoltage Protection and Degraded Grid Undervoltage (DGUV) Systems utilize 2 out of 3 logic. This requires that 2 out of the 3 phases are in a degraded voltage condition prior to actuation.

Criteria c) The time delay selected shall be based on the following conditions:

Criteria c-I) The allowable time delay, including margin, shall not exceed the maximum time delay that is assumed in the final safety analysis report (FSAR) accident analyses; Note: Time delay condition (1) indicates that the DVR circuits should be designed assuming coincident sustained degraded grid voltage and accident events. Upon the onset of the coincident accident and degraded grid event, the time delay for the DVR circuit should allow for separation of the 1E buses from the offsite circuit(s) and connection to the 1E onsite supplies in time to support safety system functions to mitigate the accident in accordance with the FSAR accident analyses.

Oconee's Response to Criteria c-I)

The DGUV system, as stated in Section 2 of this paper, will actuate if an undervoltage condition is present on 2 out of 3 phases along with an Engineering Safeguard (ES) signal, the tripping relays (94V Channel 1 or 2) located in the External Grid Protection System (EGPS) will operate isolating the 230 kV Yellow Bus from the grid and starting Page 8 of 17

Keowee Hydro to energize the startup transformers. The time delay for this postulated event is well bounded by LOCA/LOOP analyses. The 9 second degraded voltage relay timer + II second (transfer to standby bus) is less than the 23 seconds required by the UFSAR. Keowee will start from an ES signal and not wait for the 9 second timer. The 9 second time delay is designed to eliminate any voltage transients that occur during switching and faults external to the Oconee switchyard.

If an accident signal (ES) is not present, the buses will be protected by the 4kV UV system at each respective unit's 4kV bus. The existing power system analysis shows that the safety related buses can withstand a degraded undervoltage condition of 84.77% of nominal (4.16kV) for many hours without damage to safety related loads. The 4kV UV system will isolate the loads from the degraded voltage condition within a very small fraction of this analyzed time.

Criteria c-2) The time delay shall override the effect of expected short duration grid disturbances, preserving availability of the offsite power source(s).

Oconee's Response to Criteria c-2)

For the DGUV system, a 9 second delay is utilized to override the effect of expected short duration grid disturbances, preserving availability of the offsite power source.

The 4kV UV system voltage setpoints are much lower than the DGUV setpoints.

Expected short duration grid disturbances would not reach the lower setpoints. Due to the inverse time trip characteristics of the undervoltage relays, the lower the voltage, the faster the trip. The existing power system analysis shows that the safety related buses can withstand a degraded undervoltage condition of 84.77% of nominal (4.16kV) for many hours without damage to safety related loads. The 4kV UV system will isolate the loads from the degraded voltage condition within a very small fraction of this analyzed time.

Criteria c-3) The allowable time duration of a degraded voltage condition at all distribution system levels shall not result in failure of safety-related systems or components.

Oconee's Response to Criteria c-3)

Due to the design of the 4kV UV system, during a degraded voltage below 87.33%

nominal it has been demonstrated that all operating equipment will survive and be available if needed for an ES actuation. It has also been demonstrated that a safety related load can be started and survive to be able to perform its safety related function at this degraded voltage. Additionally, it has been shown that the undervoltage relays would actuate at 84.77% nominal to separate the safety related loads from the degraded source of power. This actuation has been shown to occur in less than two minutes. It is also important to note that once the undervoltage relays drop out the voltage has to recover to 100% tap (105 volts) or higher to reset the relay. Although analysis demonstrates that all safety related loads would survive during a sustained degraded Page 9 of 17

voltage condition of 84.77% nominal, the relays would automatically separate the ES buses from the degraded source or the voltage would have to recover to an acceptable level, 100% tap (87.5% nominal) or higher.

Criteria d) The voltage monitors (or DVRs as defined above) shall automatically initiate the disconnection of offsite power source(s) whenever the voltage and time delay limits have been exceeded.

Oconee's Response to Criteria d)

The 4kV UV system undervoltage protection relays would actuate at 84.77% nominal to separate the safety related loads from the degraded source of power.

The Oconee Degraded Grid Undervoltage (DGUV) system will isolate the switchyard and start Keowee in the event of an Engineered Safeguards (ES) system actuation during the degraded grid condition.

Criteria e) The voltage monitors (DVRs) shall be designed to satisfy the requirements of IEEE Standard 279-1971, "Criteria for Protection Systems for Nuclear Power Generating Stations" Oconee's Response to Criteria e)

All relays, timers, and auxiliary relays used in The Oconee Degraded Grid Undervoltage (DGUV) system are Class 1E. Although they are derived from a Class 1E source, the 125 vdc control power are non-Class IE utilizing components similar to Class IE components. The non-Class 1E potential transformers (PTs) are also similar to Class 1E PTs and are seismically mounted.

The 4kV UV system satistfies the requirements of IEEE 279-1971.

Criteria f) The Technical Specifications shall include limiting conditions for operation, surveillance requirements, trip setpoints with minimum and maximum limits, and allowable values for second-level voltage protection DVRs.

Oconee's Response to Criteria f)

On March 11, 1993, Duke Energy submitted a complete rewrite of Section 3.7, Auxiliary Electrical Systems, using a format consistent with standard technical specifications (NUREG 1430). The custom Technical Specifications (CTS) that existed at the time of submittal did not include surveillance requirements for the EPSL (Emergency Power Switching Logic) voltage sensing circuits. As such, Duke Energy proposed to add surveillance requirements (SR) to require a refueling frequency CHANNEL TEST as an additional restriction that was not currently included in Technical Specifications (TS).

The proposed TS Bases for the SR stated that the actual setpoints for the undervoltage relays on the 4kV UV system are verified independently as a prerequisite to the TS SR.

Page 10 of 17

As a result of NRC Requests for Additional Information (RAIs) and associated Duke Energy RAI responses and to make the LAR adhere to the STS Writers Guide and associated NUREG, Duke Energy re-submitted the proposed TS on September 3, 1997.

No changes were made to the proposed TS on EPSL Voltage Sensing Circuits and the NRC issued the TS and Bases as originally proposed (Amendment No. 232, 232, and 231). NRC evaluated proposed TS 3.7.4 for EPSL Voltage Sensing Circuits starting on page 28 of the Safety Evaluation (SE) restating in their summary of proposed SR 3.7.4.1 that the actual setpoint values for the undervoltage relays for the 4kV UV system breakers are to be verified independently as a prerequisite to the this SR.

The NRC concluded based on the bases of the discussion and evaluation provided in Section 4.0 of the SE (safety evaluation) that the technical requirements contained in TS 3.7 are consistent with design requirements, the current Oconee TS with differences justified, the Bases for TS 3.7 and technical requirements contained in the revised STS (refer to Section 5.0 Summary on page 46 of SE). Section 6.0 of the SE addresses ITS Involvement stating that the SE also provides the review for the technical changes that are included in Section 3.8 of the ONS ITS that is currently under review, but are beyond the scope of the ITS program indicating that both sets of specifications (3.7 for this amendment and 3.8 for the ITS conversion) address the same provisions of the electrical TS. As a result the NRC staff determined that it was satisfactory to approve TS 3.7 and delay implementation so that implementation was coincident with the ITS amendments.

Note that EPSL instrumentation was located in the instrumentation Section of Technical Specification during ITS conversion so the TS for EPSL Voltage Sensing circuits is 3.3.18 and for EPSL 230kV Switchyard DGVP is 3.3.19.

The current Oconee Technical Specifications (TS) 3.3.19 include limiting conditions for operation (LCOs) and Surveillance Requirements (SRs). No trip setpoints are included in the TS. TS Surveillance Requirement 3.3.19.2 sets forth the requirements for channel calibration for the DGUV system.

ONS Operating License and Technical Specifications were issued in the early 1970's. 10 CFR 50.36 (c)(2)(iii) states that a licensee is not required to propose to modify technical specifications that are included in any license issued before August 18, 1995, to satisfy the criteria in paragraph (c)(2)(ii) of this section. As such, ONS was not required to modify technical specifications to include items that meet Criterions 1, 2, 3, and 4. Note that 10 CFR 50.36 was modified to include criteria for inclusion of items in Technical Specifications in 1995. See section 5.e of this document for additional background information.

5. NRC CDBI Ouestions/Concerns

a. Do automatic actions of loss of power relays (1st level) meet the intent of DVR scheme (2nd level protection scheme) as stated in 7/22/1977 and 6/18/1990 letters.

Page 11 of 17

ONS Response to 5.a The ONS 4kV UV system utilizes one set of components to provide multiple trip setpoints for both levels of protection by using 3 inverse time trip characteristic undervoltage relays arranged in a 2 out of 3 trip logic configuration. This philosophy is consistent with IEEE Standards 741-2007 and 279-1971.

IEEE Standard 741-2007, IEEE Standard Criteria for the Protection of Class lE Power Systems and Equipment in Nuclear Power Generating Stations, Annex A, Illustration of concepts associated with degraded voltage protection, sets forth various concepts relative to methods of degraded grid protection.

Section A. 1 states, "The annex also provides a description of a protection scheme utilizing solid-state undervoltage relays that meets these requirements, including considerations for determination of the relay voltage set points and their associated time delays. However, it is recognized, because of the diversity of nuclear plant auxiliary system designs, there are other protection schemes that provide the desired level of protection. Also, this annex does not address the capability of various relay types, but rather discusses the philosophy behind the desired actuation times and voltage levels.

Figure A. 1 depicts the significant parameters associated with degraded voltage protection."

The ONS 4kV UV system meets the setpoint requirements of this standard by utilizing three inverse time trip characteristic relays in a 2 out of 3 logic scheme to both sense and separate the safety related buses during degraded voltage conditions. Each single channel (single undervoltage relay) would sense both the "Second Time delay band" and the "Loss-of-Voltage Time Delay Band" and provide a tripping function based on 2 out of 3 "channels" tripping logic to ultimately protect the mutually redundant safety related loads from a degraded grid undervoltage condition. The "Loss-of-Voltage Time Delay Band" would equal the "must trip" value of our 4kV UV system undervoltage relays and the "Second Time Delay Band" is characterized by the "delayed" trip function of the inverse time (voltage verses time) trip characteristic curve. The ONS 4kV Safety Related Power Undervoltage Protection System (4kV UV) is further described in section 2.c of this white paper.

Furthermore, the "Degraded Voltage Relay Band" function for Alarm or Disconnect (on accident signal) as described in IEEE 741-2007, Figure A-I is performed by the ONS Degraded Grid Undervoltage (DGUV) System. The operation of this system is described further in section 2.b of this white paper.

IEEE 279-1971, Criteria for Protection Systems for Nuclear Power Generating Stations, states in Section 2 (Definitions), that, "A protective function is the sensing of one or more variables associated with a particular generating station condition, signal processing, and the initiation and completion of the protective action at values of the variables established Page 12 of 17

in the design basis." The ONS 4kV UV system is designed in a similar method in such that it utilizes a two out of three protective logic scheme to sense a range of degraded voltage values. For instance, a reactor protection system would use multiple channels to detect numerous process variables for reactor protection and each channel would sense multiple process variable levels. For example, one reactor coolant system pressure sensor would sense both high and low pressure variables and then initiate a trip based upon the observed results The ONS 4kV UV system utilizes a 2 out of 3 process channel (with the monitored process being ES power string voltage levels) tripping logic scheme with each channel (single undervoltage relay) tripping faster or slower (inverse trip curve) based upon the magnitude of the 4kV ES power string undervoltage transient.

b. Does scheme meet AEC 39 (UFSAR 3.1.39), 1977 letter?

ONS Response to 5.b Criterion 39 (Emergency Power for Engineered Safety Features) states the following, "Alternate power systems shall be provided and designed with adequate independency, redundancy, capacity, and testability to permit the functioning required of the engineered safety features. As a minimum, the on-site power system and the off-site power system shall each, independently, provide this capacity assuming a failure of a single active component in each power system.

ONS UFSAR section 3.1.39 states:

"The electrical systems meet the intent of the criterion as discussed in UFSAR Chapter 8.

Three alternate emergency electric power supplies are provided for the station from which power to the engineered safety feature buses of each unit can be supplied. These are the 230 KV switching station with multiple off-site interconnections and two on-site independent 87,500 KVA hydroelectric generating units. Each nuclear unit can receive emergency power from the 230 KV switching station through its start-up transformer as a preferred source. Each unit can receive emergency power from one hydroelectric generating unit through a 13.8 KV underground connection to standby transformer CT4.

The other hydroelectric generating unit serves as a standby emergency power source and can supply power to each unit's startup transformer when required. Both on-site hydroelectric generating units will start automatically upon loss of all normal power or upon an engineered safety feature action.

Two additional sources of alternate power are available, as each nuclear unit is capable of supplying any other unit through the 230 KV switching station. In addition, a connection to the 100 KV transmission network is provided as an alternate source of emergency power whenever both hydroelectric generating units are unavailable."

No single active failure could prevent the ability of the on-site power system and the off-site power system, independently, to provide power to the engineered safety features.

Page 13 of 17

c. Do manual actions "after a DG (Degraded Grid) Alarm steps to resolve" -

are these required to protect 4kV,etc.?

ONS Response to 5.c No. As described in sections 2(a-c) of this paper, the degraded voltage relay protection systems provide automatic isolation initiation prior to Class 1E electrical distribution system bus voltages reaching any analyzed limits. Any manual actions by ONS are only conservative and prudent measures taken prior to reaching these limits.

d. Does the automatic systems each meet the requirements (1977, BTP, RIS)? (Analysis vs. set points)

ONS Response to 5.d Yes. Past and current analyses show that the setpoints of the automatic system (4kV UV) are adequate to protect the Class 1E electrical distribution systems during postulated periods of degraded grid voltage. See section 3.b of this document for additional information.

e. Are 4kV set points credible since not in TS, and should they be per 10 CFR 50.36 (c)(2)(iii)?

ONS Response to 5.e ONS Operating License and Technical Specifications were issued in the early 1970's. 10 CFR 50.36 (c)(2)(iii) states that a licensee is not required to propose to modify technical specifications that are included in any license issued before August 18, 1995, to satisfy the criteria in paragraph (c)(2)(ii) of this section. As such, ONS was not required to modify technical specifications to include items that meet Criterions 1, 2, 3, and 4. Note that 10 CFR 50.36 was modified to include criteria for inclusion of items in Technical Specifications in 1995.

The ONS Technical Specifications currently require three channels of each of the following EPSL voltage sensing circuits to be OPERABLE: a) Startup Transformer, b)

Standby Bus 1; c) Standby Bus 2: and d) Auxiliary Transformer in MODES 1, 2, 4, 4, 5, and 6, and during movement of irradiated fuel assemblies. The EPSL voltage sensing circuits are required for the engineered safeguards (ES) equipment to function in any accident with a loss of offsite power. Per the ONS TS 3.3.18 Bases the EPSL voltage sensing circuits satisfy Criterion 3 of 10 CFR 50.36. SR 3.3.18.1 requires a CHANNEL FUNCTIONAL TEST be performed every 24 months (per SFCP). The test is a functional test of the logic and does not verify the setpoint. This verification is performed by testing not controlled by Technical Specifications. The exclusion of the setpoint verification from TSs is addressed below under TS history.

Page 14 of 17

EPSL TS History On March 11, 1993, Duke Energy submitted a complete rewrite of Section 3.7, Auxiliary Electrical Systems, using a format consistent with standard technical specifications (NUREG 1430). The custom Technical Specifications (CTS) that existed at the time of submittal did not include surveillance requirements for the EPSL voltage sensing circuits.

As such, Duke Energy proposed to add surveillance requirements to require a refueling frequency CHANNEL TEST as an additional restriction that was not currently included in Technical Specifications. The proposed TS Bases for the SR very clearly stated that the actual setpoints for the undervoltage relays on the N and E breakers are verified independently as a prerequisite to the TS SR. As a result of NRC Requests for Additional Information (RAIs) and associated Duke Energy RAI responses and to make the LAR adhere to the STS Writers Guide and associated NUREG, Duke Energy re-submitted the proposed TS on September 3, 1997. No changes were made to the proposed TS on EPSL Voltage Sensing Circuits and the NRC issued the TS and Bases as originally proposed (Amendment No. 232, 232, and 231). NRC evaluated proposed TS 3.7.4 for EPSL Voltage Sensing Circuits starting on page 28 of the Safety Evaluation (SE) restating in their summary of proposed SR 3.7.4.1 that the actual setpoint values for the undervoltage relays for the N and E breakers are to be verified independently as a prerequisite to the this SR. The NRC concluded based on the bases of the discussion and evaluation provided in Section 4.0 of the SE that the technical requirements contained in TS 3.7 are consistent with design requirements, the current ONS TS with differences justified, the Bases for TS 3.7 and technical requirements contained in the revised STS (refer to Section 5.0 Summary on page 46 of SE). Section 6.0 of the SE addresses ITS Involvement stating that the SE also provides the review for the technical changes that are included in Section 3.8 of the ONS ITS that is currently under review, but are beyond the scope of the ITS program indicating that both sets of specifications (3.7 for this amendment and 3.8 for the ITS conversion) address the same provisions of the electrical TS. As a result the NRC staff determined that it was satisfactory to approve TS 3.7 and delay implementation so that implementation was coincident with the ITS amendments.

Note that EPSL instrumentation was located in the instrumentation Section of Technical Specification during ITS conversion so the TS for EPSL Voltage Sensing circuits is 3.3.18 and for EPSL 230kV Switchyard DGVP is 3.3.19.

f. Commitments to IEEE-603 / 279 for Emergency Power / Off-site connection ONS Response to 5.f In a July 21, 1977 letter from Oconee to the NRC, regarding the 4kV UV system, it was stated that, "Although designed prior to the issuance of IEEE 279-1971, the undervoltage (4kV UV) protection logic satisfies the requirements of these standards."

All relays, timers, and auxiliary relays used in The Oconee Degraded Grid Undervoltage (DGUV) system are Class IE. Although they are derived from a Class IE source, the 125 vdc control power are non-Class 1E utilizing components similar to Class I E Page 15 of 17

components. The non-Class 1E potential transformers (PTs) are also similar to Class IE PTs and are seismically mounted.

6. Degraded Voltage Protection Industry Precedence and Operating Experience (OE)

Summary: As shown below, due to the reliance on manual and administrative actions (instead of automatic actions) for the protective of safety related buses, the NRC decided to issue a backfit to implement modifications to bring these facilities in compliance with BTP PSB-1, "Adequacy of Station Electric Distribution System Voltages." Per a telephone conservation with Southern Nuclear Operating Company personnel on August 4, 2014, plants Farley and Hatch relied exclusively upon manual actions (either by plant operations or the transmission control department) to protect safety related components from the adverse effects of degraded grid voltage protection. Their argument was primarily based upon the improbability of such a degraded grid voltage condition.

a. Farley Nuclear Plant Backfit Issue Following a July 1976 event at Millstone involving a degraded voltage condition, the NRC staff developed generic positions on power systems for operating reactors. *Since degradation of the offsite power system can lead to or cause the failure of redundant Class 1 E safety-related electrical equipment, the NRC required that licensees install degraded voltage protection as described in NRC letter dated June 2, 1977, "Statement of Staff Positions Relative to Emergency Power Systems for Operating Reactors" (ADAMS Legacy No. 4007002656). The letter states that "the voltage monitors shall automatically initiate the disconnection of offsite power sources whenever the voltage setpoint and time delay limits have been exceeded." The letter further states that "the voltage monitors shall be designed to satisfy the requirements of IEEE Std. 279-1971, "Criteria for Protection Systems for Nuclear Power Generating Stations." This automatic feature ensures the adequacy of the offsite power system and the onsite distribution system and ensures that the electrical system has sufficient capacity and capability to automatically start and operate all required safety loads.

Contrary to the June 2, 1977 letter, an NRC Safety Evaluation Report (SER) for FNP (ADAMS Legacy No. 951211 0043) accepted manual operator actions to compensate for degraded grid conditions.

b. Hatch Nuclear Plant Backfit Issue In a letter dated June 17, 2011, SNC disagreed with the conclusion in the May 25, 2011, report and appealed the NRC's decision to issue the backfit under the "compliance exception" provision of 10 CFR 50.109(a)(4)(i). In your appeal, you stated that a cost justified substantial safety backfit analysis, per 10 CFR 50.109(a)(3), was required. At issue was the reliance on administrative controls and manual actions at HNP, as approved in the 1995 NRC Safety Evaluation Report (SER), for maintaining adequate voltage to protect Class 1E (safety-related) electrical equipment in the event of degraded voltage conditions.

Page 16 of 17

f After review and consideration of SNC's response, the NRC has concluded that the decision to use the "compliance exception" provision as allowed by 10 CFR 50.109(a)(4)(i) was appropriate. The staff maintains its position that SNC's electrical analysis for HNP must show that the existing setpoints and time delays are adequate to ensure that all safety-related loads have the required minimum voltage measured at the component terminal to start and operate safety related equipment necessary to mitigate the consequences of the worst-case design basis event (DBE), without any credit for administratively controlled bus voltage levels. The staff maintains that this position is consistent with regulatory requirements specified in 10 CFR 50.55a(h)(2) and GDC-17.

This staff position is also consistent with the guidance provided in Standard Review Plan, NUREG-0800 (July 1981), Branch Technical Positions (BTPs) of Appendix 8-A (PSB),

containing BTP PSB-l, "Adequacy of Station Electric Distribution System Voltages."

Further, the staff concludes that the NRC change in position, from that in the 1995 SER, regarding the acceptability of relying on manual operator action to demonstrate compliance with SNC 2 the applicable provisions of GDC-17 and 10 CFR 50.55a(h)(2),

constitutes backfitting as defined in 10 CFR 50.109(a)(1). The backfitting action is necessary for compliance with GDC- 17 and 10 CFR 50.55a(h)(2) and is consistent with applicable guidance and practices in effect at the time that the NRC staff erroneously approved the use of manual actions responding to degraded grid voltage condition in 1995.

c. Operating Experience (OE) Summary In summary, the above backfit OE does not apply to Oconee due to the fact that Oconee ultimately relies upon the automatic actions of the undervoltage relays on the incoming breakers for the safety related 4kV buses to protect the Class 1E electrical power distribution system from degraded grid conditions. As described in sections 2(a-c) of this paper, the degraded voltage relay protection system (4kV UV) provide automatic isolation initiation prior to Class IE electrical distribution system bus voltages reaching any analyzed limits. Any manual actions by ONS are only conservative and prudent measures taken prior to reaching these limits.

Page 17 of 17