ML15314A634

NRC-048 - NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition, Chapter 8.2, Offsite Power System, Rev. 5 (May 2010) (ADAMS Accession No.) ML100740246)

ML15314A634
Person / Time
Site:	Turkey Point
Issue date:	05/31/2010
From:	NRC/OGC
To:	Atomic Safety and Licensing Board Panel
SECY RAS
References
50-250-LA, 50-251-LA, ASLBP 15-935-02-LA-BD01, RAS 28502
Download: ML15314A634 (38)

Text

NRC-048 Submitted Nov. 10, 2015 NUREG-0800 U.S. NUCLEAR REGULATORY COMMISSION STANDARD REVIEW PLAN 8.2 OFFSITE POWER SYSTEM REVIEW RESPONSIBILITIES Primary - Organization Responsible for Electrical Engineering Review Secondary - None I. AREAS OF REVIEW The descriptive information, analyses, and referenced documents, including electrical single-line diagrams, electrical schematics, logic diagrams, tables, and physical arrangement drawings for the offsite power systems, presented in the applicant's safety analysis report (SAR), are reviewed. The objective of the review is to determine that this system satisfies the requirements of Title 10 of the Code of Federal Regulations (CFR), Part 50, Appendix A, General Design Criteria (GDCs) 2, 4, 5, 17, and 18, and will perform its design functions during all plant operating and accident conditions. The offsite power system is referred to in industry standards and regulatory guides (RGs) as the "preferred power system.@ The interface of the preferred power supply with an alternate ac (AAC) power source for safe shutdown in the event of a station blackout (SBO) (non-design-basis accident (DBA)) is also reviewed with respect to its adequacy and independence from the offsite and onsite power systems. The AAC source may be a combustion turbine generator, a diesel generator, or other diverse power source. The design, operation, and performance of the alternate ac power source are reviewed in Standard Review Plan (SRP) Section 8.4.

Revision 5 - May 2010 USNRC STANDARD REVIEW PLAN This Standard Review Plan, NUREG-0800, has been prepared to establish criteria that the U.S. Nuclear Regulatory Commission staff responsible for the review of applications to construct and operate nuclear power plants intends to use in evaluating whether an applicant/licensee meets the NRC's regulations. The Standard Review Plan is not a substitute for the NRC's regulations, and compliance with it is not required. However, an applicant is required to identify differences between the design features, analytical techniques, and procedural measures proposed for its facility and the SRP acceptance criteria and evaluate how the proposed alternatives to the SRP acceptance criteria provide an acceptable method of complying with the NRC regulations.

The standard review plan sections are numbered in accordance with corresponding sections in Regulatory Guide 1.70, "Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants (LWR Edition)." Not all sections of Regulatory Guide 1.70 have a corresponding review plan section. The SRP sections applicable to a combined license application for a new light-water reactor (LWR) are based on Regulatory Guide 1.206, "Combined License Applications for Nuclear Power Plants (LWR Edition)."

These documents are made available to the public as part of the NRC's policy to inform the nuclear industry and the general public of regulatory procedures and policies. Individual sections of NUREG-0800 will be revised periodically, as appropriate, to accommodate comments and to reflect new information and experience. Comments may be submitted electronically by email to NRR_SRP@nrc.gov.

Requests for single copies of SRP sections (which may be reproduced) should be made to the U.S. Nuclear Regulatory Commission, Washington, DC 20555, Attention: Reproduction and Distribution Services Section, or by fax to (301) 415-2289; or by email to DISTRIBUTION@nrc.gov. Electronic copies of this section are available through the NRC's public Web site at http://www.nrc.gov/reading-rm/doc-collections/nuregs/staff/sr0800/, or in the NRC's Agencywide Documents Access and Management System (ADAMS), at http://www.nrc.gov/reading-rm/adams.html, under Accession # ML100740246.

It includes two or more physically independent circuits capable of operating independently of the onsite standby power sources and encompasses the grid, transmission lines (overhead or underground), transmission line towers, transformers, switchyard components and control systems, switchyard battery systems, the main generator, generator circuit breakers or load break switches (if provided), disconnect switches, and other switchyard equipment, such as capacitor banks and volt amperes reactive (VAR) compensators, provided to supply electric power to safety-related and other equipment.

The specific areas of review are as follows:

1. The preferred power system arrangement is reviewed to determine that the required minimum of two separate circuits from the transmission network to the onsite distribution system is provided. In determining the adequacy of this system, the independence of the two (or more) circuits is examined to see that both electrical and physical separation exists so as to minimize the chance of simultaneous failure. This includes a review of the assignment of power sources from the grid; location of rights-of-way, transmission lines and towers, transformers, switchyard interconnections (breakers and bus arrangements), switchyard control systems and power supplies; and location of switchgear (in-plant), interconnections between switchgear, cable routings, main generator disconnect, the disconnect control system and power supply, and generator circuit breakers/load break switches.

2. The independence of the preferred power system is evaluated with respect to the onsite power system and any AAC power source provided for SBO. The scope of review extends to the safety-related distribution system buses that are capable of being powered by standby power sources. It does not include the supply breakers of the safety-related distribution system buses. This evaluation will include a review of the electrical protective relaying and breaker control circuits and power supplies to ensure that loss of one preferred system circuit will not cause or result in loss of the redundant counterpart, nor any AAC power source or standby power source.

3. Design information and analyses demonstrating the suitability of the power sources from the grid, including transmission lines, breakers, and transformers used for supplying preferred power from distant sources, are reviewed to ensure that each path has sufficient capacity and capability to perform its intended function. This will require examination of loads required to be powered for each plant operating condition; continuous and fault ratings of breakers, transformers, and transmission lines; and loading, unloading, and transfer effects on equipment; and power capacity available from each source.

4. The instrumentation required for monitoring and indicating the status of the preferred power system is reviewed to ensure that any change in the preferred power system that would prevent it from performing its intended function will be immediately identified by the control room operator. Also, all instrumentation for initiating safety actions associated with the preferred power system is reviewed.

5. The capability to test the preferred power system is reviewed.

6. Environmental conditions such as those resulting from high and low atmospheric temperatures, high wind, rain, lightning discharges, snow, and ice are considered in the review of the preferred power system to determine any effects on function.

7. Quality group classifications of equipment of the preferred power system are reviewed.

8. The interface(s) of the preferred power system with the AAC power source, if provided, is reviewed. The design, operation, and performance of the AAC power source are reviewed in accordance with SRP Section 8.4.

9. Inspections, Tests, Analyses, and Acceptance Criteria (ITAAC). For design certification (DC) and combined license (COL) reviews, the staff reviews the applicant's proposed ITAAC associated with the structures, systems, and components (SSCs) related to this SRP section in accordance with SRP Section 14.3, "Inspections, Tests, Analyses, and Acceptance Criteria." The staff recognizes that the review of ITAAC cannot be completed until after the rest of this portion of the application has been reviewed against acceptance criteria contained in this SRP section. Furthermore, the staff reviews the ITAAC to ensure that all SSCs in this area of review are identified and addressed as appropriate in accordance with SRP Section 14.3.

10. COL Action Items and Certification Requirements and Restrictions. For a DC application, the review will also address COL action items and requirements and restrictions (e.g., interface requirements and site parameters).

For a COL application referencing a DC, a COL applicant must address COL action items (referred to as COL information in certain DCs) included in the referenced DC.

Additionally, a COL applicant must address requirements and restrictions (e.g., interface requirements and site parameters) included in the referenced DC.

Review Interfaces Other SRP sections interface with this section as follows:

1. The organization responsible for electrical engineering reviews the adequacy of the onsite power system, including standby emergency ac power sources, safety-related ac distribution systems, station batteries and associated dc systems, and instrumentation and control power systems, as part of its primary review responsibility for SRP Sections 8.3.1 and 8.3.2.

2. The organization responsible for electrical engineering reviews the overall compliance with 10 CFR 50.63 requirements, as part of its primary review responsibility for SRP Section 8.4, including the adequacy of the SBO analysis, the adequacy of reliability targets for onsite ac sources (diesel generators), the duration for which the plant will be able to withstand or cope with, and recover from, a SBO event.

3. The organization responsible for the review of reactor systems determines those system components requiring electric power as a function of time for each mode of reactor 8.2-3 Revision 5 - May 2010

operation and accident condition as part of its primary review responsibility for SRP Sections 4.6, 5.4.6, 5.4.7, 5.4.12, 6.3, and 9.3.5.

4. The organization responsible for the review of plant systems determines those system components requiring electric power as a function of time for each mode of reactor operation and accident condition as part of its primary review responsibility for SRP Sections 6.5.1, 6.7, 9.1.3, 9.1.4, 9.2.1, 9.2.2, 9.2.4, 9.2.5, 9.2.6, 9.3.1, 9.3.3, 9.4.1 through 9.4.5, 9.5.1, 10.4.5, 10.4.7, and 10.4.9.

5. The organization responsible for the review of plant systems also verifies, on request, the adequacy of those auxiliary systems required for the proper operation of the preferred power system. These include such systems as heating and ventilation systems for switchgear in the circuits from the preferred power sources to the onsite power distribution system buses and main generator auxiliary systems such as the cooling water system, hydrogen cooling system, turbine electro-hydraulic control system, and air supply system.

6. The organization responsible for the review of plant systems verifies, on request, the physical arrangements of components and structures of the preferred power system to ensure that the paths from the preferred power sources to the standby power distribution system buses will not experience simultaneous failure under operating or postulated accident environmental conditions. This includes the effects of floods, missiles, pipe whipping, and discharging fluids that result from equipment failures.

7. The organization responsible for the review of plant systems examines fire detection and firefighting systems in preferred power system areas to ensure that the adverse effects of fire are minimized as part of its primary review responsibility for SRP Section 9.5.1.

The plant systems review includes evaluation of the adequacy of fire protection provided for redundant power supplies and circuits.

8. The organization responsible for the review of materials and chemical engineering determines those system components requiring electric power as a function of time for each mode of reactor operation and accident condition as part of its primary review responsibility for SRP Sections 5.4.8, 9.2.3, 9.3.2, and 9.3.4.

9. The organization responsible for civil engineering and geosciences review provides, on request, the information necessary to assess the effects of environmental conditions (i.e., high and low atmospheric temperature, high winds, rain, ice, and snow) on the preferred power system.

10. The organization responsible for the review of instrumentation and controls determines those system components requiring electric power as a function of time for each mode of reactor operation and accident condition as part of its primary review responsibility for SRP Sections 7.2 through 7.7. The organization responsible for the review of instrumentation and controls also verifies the adequacy of the preferred power system instrumentation and controls.

8.2-4 Revision 5 - May 2010

11. The organization responsible for the review of technical specifications (TS) coordinates and performs reviews of TS as part of its primary review responsibility for SRP Section 16.0.

12. The organization responsible for the review of containment systems and severe accidents determines those system components requiring electric power as a function of time for each mode of reactor operation and accident condition as part of its primary review responsibility for SRP Sections 6.2.2, 6.2.3, 6.2.4, and 6.2.5.

13. The organization responsible for quality assurance review determines the acceptability of the preoperational and initial startup tests and programs as part of its primary review responsibility for SRP Section 14.2.

14. The organization responsible for human factors, reviews the adequacy of administrative, testing, and operating procedure programs as part of its primary review responsibility for SRP Sections 13.5.1.1, 13.5.1.2, 13.5.2.1 and 13.5.2.2.

15. The organizational responsible for quality assurance performs the reviews of design, construction, and operation phase quality assurance programs under SRP Chapter 17.

In addition, while conducting regulatory audits in accordance with Office Instruction NRR-LIC-111 or NRO-REG-108, Regulatory Audits, the technical staff may identify quality-related issues. If this occurs, then the technical staff should contact the organization responsible for quality assurance to determine if an inspection should be conducted.

The specific acceptance criteria and review procedures are contained in the referenced SRP sections.

II. ACCEPTANCE CRITERIA Requirements In general, the preferred power system is acceptable when it can be concluded that two separate circuits from the transmission network to the onsite Class 1E power distribution system are provided, adequate physical and electrical separation exists, and the system has the capacity and capability to supply power to all safety loads and other required equipment.

Table 8-1 of SRP Section 8.1 lists GDCs, RGs, standards, and branch technical positions (BTPs) utilized as the bases for arriving at this conclusion.

Acceptance criteria are based on meeting the relevant requirements of the following Commission regulations:

1. GDC 2, found in Appendix A to 10 CFR Part 50, as it relates to SSCs of the offsite power systems being capable of withstanding the effects of natural phenomena (excluding seismic, tornado, and flood) without the loss of the capability to perform their safety functions.

8.2-5 Revision 5 - May 2010

2. GDC 4 as it relates to SSCs of the offsite power systems being protected against dynamic effects, including the effects of missile that may result from equipment failures during normal operation, maintenance, testing, and postulated accidents.

3. GDC 5 as it relates to sharing of SSCs of the preferred power systems.

4. GDC 17 as it relates to the preferred power system's (i) capacity and capability to permit functioning of SSCs important to safety; (ii) provisions to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit or loss of power from the onsite electric power supplies; (iii) physical independence; (iv) availability.

5. GDC 18 as it relates to inspection and testing of the offsite power systems.

6. GDCs 33, 34, 35, 38, 41, and 44 as they relate to the operation of the offsite electric power system, encompassed in GDC 17, to ensure that the safety functions of the systems described in GDCs 33, 34, 35, 38, 41, and 44 are accomplished.

7. 10 CFR 50.63 as it relates to an AAC power source (as defined in 10 CFR 50.2) provided for safe shutdown (non-DBA) in the event of a SBO.

8. 10CFR 50.65(a)(4) as it relates to the assessment and management of the increase in risk that may result from proposed maintenance activities before performing the maintenance activities. These activities include, but are not limited to, surveillances, post-maintenance testing, and corrective and preventive maintenance. Compliance with the maintenance rule, including verification that appropriate maintenance activities are covered therein, is reviewed under SRP Chapter 17. Programs for incorporation of requirements into appropriate procedures are reviewed under SRP Chapter 13.

9. 10 CFR 52.47(b)(1), which requires that a DC application contain the proposed ITAAC that are necessary and sufficient to provide reasonable assurance that, if the inspections, tests, and analyses are performed and the acceptance criteria met, a plant that incorporates the DC is built and will operate in accordance with the DC, the provisions of the Atomic Energy Act (AEA), and the U.S. Nuclear Regulatory Commissions (NRC's) regulations;

10. 10 CFR 52.80(a), which requires that a COL application contain the proposed inspections, tests, and analyses, including those applicable to emergency planning, that the licensee shall perform, and the acceptance criteria that are necessary and sufficient to provide reasonable assurance that, if the inspections, tests, and analyses are performed and the acceptance criteria met, the facility has been constructed and will operate in conformity with the COL, the provisions of the AEA, and the NRC's regulations.

SRP Acceptance Criteria 8.2-6 Revision 5 - May 2010

Specific SRP acceptance criteria acceptable to meet the relevant requirements of the NRC=s regulations identified above are as follows for the review described in this SRP section. The SRP is not a substitute for the NRC=s regulations, and compliance with it is not required.

However, an applicant is required to identify differences between the design features, analytical techniques, and procedural measures proposed for its facility and the SRP acceptance criteria and evaluate how the proposed alternatives to the SRP acceptance criteria provide acceptable methods of compliance with the NRC regulations.

1. GDC 2 is satisfied as it relates to SSCs of the offsite power system being capable of withstanding the effects of natural phenomena such as high and low atmospheric temperatures, high wind, rain, lightning discharges, ice and snow conditions, and weather events causing regional effects as established in Chapter 3 of the SAR, and reviewed by the organizations with primary responsibility for the reviews of plant systems, civil engineering and geosciences, and mechanical engineering.

2. GDC 4 is satisfied as it relates to structures, systems, and components of the offsite power system being protected against dynamic effects, including the effects of missile that may result from equipment failures during normal operation, maintenance, testing, and postulated accidents, as established in Chapter 3 of the SAR and reviewed by the organizations with primary responsibility for the reviews of plant systems, materials, and chemical engineering.

3. GDC 5 is satisfied as it relates to: sharing of structures, systems, and components of the preferred power systems; guidelines of RG 1.32 as related to its endorsement of Section 7 of IEEE Std 308, relating to sharing of structures, systems, and components of the Class 1E power system at multi-unit stations; and guidance related to the sharing of structures, systems, and components of the offsite power system (preferred power supply) at multi-unit stations, previously addressed in the 1980 and earlier versions of IEEE Std 308, but now covered in the industry standard for preferred power supply (Reference 52).

4. GDC 17 is satisfied as it relates to the preferred power system's (i) capacity and capability to permit functioning of structures, systems, and components important to safety; (ii) provisions to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit, the loss of power from the transmission network, or the loss of power from the onsite electric power supplies; (iii) physical independence; (iv) availability and the guidelines of RG 1.32 (see also IEEE Std 308) as related to the availability and number of immediate access circuits from the transmission network; and (v) capability to meet the guidelines of Appendix A to SRP Section 8.2 as related to acceptability of generator circuit breakers and generator load break switches.

For evolutionary light water reactor design applications, as documented in SECY 94-084 for designs such as the CE-ABB System 80+ and the GE ABWR, the design should provide at least one offsite circuit to each redundant safety division that is supplied directly from an offsite power source with no intervening non-safety buses, thereby permitting the offsite source to supply power for safety buses in the event the non-safety bus(es) fails. The design should also include an alternate power source to non-safety loads, unless it can be demonstrated that existing design margins will ensure that 8.2-7 Revision 5 - May 2010

transients for loss of non-safety power events are no more severe than those associated with the turbine-trip-only event specified in current plant designs (References 33 and 35). These issues are reviewed in detail in SRP Section 8.3.1.

For passive reactor design applications, the passive safety-related systems only require electric power for valves and related instrumentation, which can be supplied from the onsite Class 1E batteries and associated dc and ac distribution systems. The acceptability of this design for the AP 1000 is documented in SECY-05-0227 and FSER NUREG-1793. If no offsite power is available, it is expected that the non-safety-related diesel generators would be available for important plant functions, but this non-safety-related ac power is not relied on to maintain core cooling or containment integrity.

Therefore, this passive reactor design supports an exemption to the requirement of GDC 17 for two physically independent offsite circuits, by providing safety-related passive safety systems for core cooling and containment integrity (see also References 33, 34, 35). However, one offsite power source with sufficient capacity and capability from the transmission network must be provided to power the safety-related systems and all other auxiliary systems under normal, abnormal, and accident conditions. The offsite power source should be designed to minimize to the extent practical the likelihood of its failure under normal, abnormal, and accident conditions.

5. GDC 18 is satisfied as it relates to the inspection and testing of the offsite electric power system.

6. GDCs 33, 34, 35, 38, 41, and 44 are satisfied as they relate to the operation of the offsite electric power system, encompassed in GDC 17, to ensure that the safety functions of the systems described in GDCs 33, 34, 35, 38, 41, and 44 are accomplished, assuming a single failure where applicable.

7. 10 CFR 50.63 is satisfied as it relates to an AAC power source (as defined in 10 CFR 50.2) provided for safe shutdown in the event of a SBO (non-DBA), and the guidelines of RG 1.155 are followed as they relate to the adequacy of the AAC source and the independence of the AAC power source from the offsite power system and onsite power system and sources.

Except for passive reactor designs described in Subsection II(2) above, new applications must provide an adequate AAC source of diverse design (with respect to ac onsite emergency sources) that is consistent with the guidance in RG 1.155 and capable of powering at least one complete set of normal safe shutdown loads. These issues are reviewed in detail in SRP Section 8.4.

8. 10 CFR 50.65, Section 50.65(a)(4), as it relates to the requirements to assess and manage the increase in risk that may result from proposed maintenance activities before performing the maintenance activities. Acceptance is based on meeting the following specific guidelines:

A. RG 1.160, as related to the effectiveness of maintenance activities for onsite emergency ac power sources including grid-risk-sensitive maintenance activities (i.e., activities that tend to increase the likelihood of a plant trip, increase loss of 8.2-8 Revision 5 - May 2010

offsite power (LOOP) frequency, or reduce the capability to cope with a LOOP or SBO).

B. RG 1.182, as related to implementing the provisions of 10 CFR 50.65 (a)(4) by endorsing Section 11 to NUMARC 93-01, ANuclear Energy Institute Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, February 22, 2000.

8.2-9 Revision 5 - May 2010

Technical Rationale The technical rationale for application of these acceptance criteria to the areas of review addressed by this SRP section is discussed in the following paragraphs:

1. Compliance with GDC 2 requires that nuclear power plant structures, systems, and components important to safety be designed to withstand the effects of natural phenomena such as high and low atmospheric temperatures, high wind, rain, lightning discharges, ice and snow conditions, and weather events causing regional effects without loss of capability to perform their intended safety function.

With regard to the offsite power system, this criterion requires that capability for the offsite power system to perform its functions be retained during the most severe natural phenomena that have been historically reported for the site and surrounding area.

Therefore, the offsite power system and its components must normally be located in areas that provide protection from the effects of high and low atmospheric temperatures, high wind, rain, lightning discharges, ice and snow conditions, and weather events causing regional effects Meeting this requirement provides assurance that equipment and structures are designed to withstand the effects associated with natural phenomena, thus decreasing the probability that climatology-related natural phenomena could initiate accidents or prevent equipment from performing its safety function during an accident.

2. Compliance with GDC 4 requires that SSCs associated with offsite power system be appropriately protected against dynamic effects, including the effects of missile that may result from equipment failures.

The offsite power system is required to provide power to systems important to safety during normal, abnormal, accident, and post-accident conditions.

Meeting these requirements provides assurance that the offsite power system supplies electric power required for operation of systems important to safety even if/when subject to adverse dynamic effects.

3. Compliance with GDC 5 requires that SSCs important to safety shall not be shared among nuclear power units, unless it can be shown that such sharing will not significantly impair their ability to perform their safety functions.

This criterion requires that component parts of the offsite power system not be shared among units without sufficient justification, thereby ensuring that an accident in one unit of a multiple-unit facility can be mitigated using an available complement of mitigative features, including required ac power, irrespective of conditions in the other units and without giving rise to conditions unduly adverse to safety in another unit. RG 1.32 is cited to establish acceptable guidance related to the sharing of SSCs of the preferred offsite power system.

8.2-10 Revision 5 - May 2010

Meeting the requirements of GDC 5 provides assurance that an accident within any one unit of a multiple-unit plant may be mitigated irrespective of conditions in other units without affecting the overall operability of the offsite power system.

4. Compliance with GDC 17 requires that onsite and offsite electrical power be provided to facilitate the functioning of SSCs important to safety. Each electric power system, assuming the other system is not functioning, must provide sufficient capacity and capability to ensure that specified acceptable fuel design limits and the design conditions of the reactor coolant pressure boundary are not exceeded as a result of anticipated operational occurrences (AOOs) and that the core is cooled and containment integrity and other vital functions are maintained in the event of postulated accidents.

GDC 17 further requires that electric power from the transmission network to the onsite electric distribution system is supplied by two physically independent circuits designed and located so as to minimize the likelihood of their simultaneous failure under operating, postulated accident, and postulated environmental conditions. Each of these circuits is required to be designed to be available in sufficient time following a loss of all onsite ac power supplies and the other offsite electric power circuit, to assure that specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded. One of these circuits is also required to be designed to be available within a few seconds following a loss-of-coolant accident (LOCA) to assure that core cooling, containment integrity, and other vital safety functions are maintained.

Provisions must also be included to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit, the loss of power from the transmission network, or the loss of power from the onsite electric power supplies. The trip of the nuclear power unit is an AOO that can result in reduced switchyard voltage, potentially actuating the plant=s degraded voltage protection and separating the plant=s safety buses from offsite power. It can also result in grid instability, potential grid collapse, inadequate switchyard voltages, and a subsequent LOOP due to loss of the real and/or reactive power support supplied to the grid from the nuclear unit. Plant TS limiting condition for operations (LCOs) require the offsite power system to be operable. However, since the capability of the offsite power system cannot be tested except when challenged during an actual event, the design bases for the offsite power system can only be assured through analysis of the grid and plant conditions. Plant operators should therefore be aware of:

(1) the capability of the offsite power system to supply power, as required by TS, during operation and (2) situations that can result in a LOOP following a trip of the plant. Plant operators are expected to declare the offsite power system inoperable in the event of degraded grid conditions that can not support adequate post-trip voltages. Additional information on the adequacy of grid voltage, grid stability and grid reliability challenges due to deregulation of the utility industry, and the effect of grid events on NPP performance are provided in References 21, 24, 25, 29, 30, and 43.

GDC 17 also requires that the onsite power supplies and the onsite electrical distribution system have sufficient independence, redundancy, and testability to perform their safety functions assuming a single failure. Therefore, no single failure will prevent the onsite 8.2-11 Revision 5 - May 2010

power system from supplying electric power, thereby permitting safety functions and other vital functions requiring electric power to be performed in the event of any single failure in the power system.

As documented in SECY 94-084, the preferred electrical distribution system for evolutionary light water reactor design plants should include: 1) an alternate offsite power source available for non-safety-related loads, unless the design margins for loss of non-safety-related loads are no more severe than turbine-trip-only events in current plants, and 2) at least one offsite circuit to each redundant safety division supplied directly from offsite power sources, with no intervening non-safety-related buses.

Passive reactor designs incorporate passive safety-related systems for core cooling and containment integrity, and therefore, do not depend on the electric power grid connection and grid stability for safe operation. However, passive reactor designs also include active systems that can provide defense-in-depth capabilities for reactor coolant makeup and decay heat removal. The accident analysis and Probabilistic Risk Analysis (PRA) need to be reviewed to identify these non-safety related systems. Once identified, review of the electrical design of the plant needs to confirm that any offsite power requirements for thses systems are met. The AP1000 safety analyses, for example, assume that the reactor coolant pumps (RCPs) can receive power at 6.9 kV from either the main generator or the grid for a minimum of 3 seconds following a turbine trip assuming no electrical fault. Should a turbine trip occur during power operation, the generator will continue rotating at synchronous speed by acting as a synchronous motor.

Anti-motoring protective relaying for the main generator will open the generator output breaker after a time delay of at least 15 seconds, during which time the rotating generator will provide voltage support for the grid. When the generator output breaker trips, the plant distribution system utilizes backfeed from the grid to maintain power to the RCPs. Therefore, grid stability analyses should verify that the grid remains stable for a minimum of 3 seconds following a turbine trip to support the assumptions made in the safety analyses for the passive reactor designs, such as the AP1000.

IEEE Std 308, as modified/supplemented by the regulatory positions of RG 1.32, establishes acceptable guidance for meeting the requirements of GDC 17.

Meeting the requirements of GDC 17 provides assurance that a reliable electric power supply can be provided for all facility operating modes, including AOOs and DBAs to permit safety functions and other vital functions to be performed, even in the event of a single failure.

5. Compliance with GDC 18 requires that electric power systems important to safety be designed to permit appropriate periodic inspection and testing of key areas and features to assess their continuity and the condition of their components. These systems shall be designed to test periodically: (1) the operability and functional performance of the components of the offsite power systems, such as onsite power sources, relays, switches, circuit breakers, and buses, and (2) the operability of the systems as a whole and, under conditions as close to design as practical, the full operational sequence that brings the systems into operation, including operation of applicable portions of the 8.2-12 Revision 5 - May 2010

protection system, and the transfer of power among the nuclear power unit, the offsite power system, and the onsite power system.

This criterion requires that the ac power system provide the capability to perform integral testing on a periodic basis.

Meeting the requirements of GDC 18 provides assurance that, when required, offsite power systems can be appropriately and unobtrusively accessed for required periodic inspection and testing, enabling verification of important system parameters, performance characteristics, and features and detection of degradation and/or impending failure under controlled conditions.

6. GDCs 33, 34, 35, 38, 41, and 44 set forth requirements for the safety systems for which the access to both offsite and onsite electric power sources must be provided.

Compliance with these criteria requires that capability be provided for reactor coolant makeup during small breaks (GDC 33), residual heat removal (GDC 34), emergency core cooling (GDC 35), containment heat removal (GDC 38), containment atmosphere cleanup (GDC 41), and cooling water for structures, systems, and components important to safety (GDC 44). These systems must be available during normal and accident conditions, as required by the specific system.

GDC 33 requires that the system design shall be such that, for preferred power system operation (if standby power is not available), the system safety function can be accomplished using the piping, pumps, and valves to maintain coolant inventory during normal reactor operations. For the offsite power system, these requirements are met if the minimum design required by GDC 17 is provided. GDCs 34, 35, 38, 41, and 44 require that safety system redundancy shall be such that, for preferred power system operation (if standby power is not available), the system safety function can be accomplished, assuming a single failure.

For passive reactor design applications, such as the AP 1000, the potential risk contribution of design basis event is minimized by not requiring ac power sources for design-basis events (DBEs). Passive reactor designs incorporate passive safety-related systems for core cooling and containment integrity, and therefore, do not depend on the electric power grid connection and grid stability for safe operation. They are designed to automatically establish and maintain safe shutdown conditions after DBEs for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, without operator action, following a loss of both onsite and offsite ac power sources.

Consequently, passive reactor designs are not required to meet the requirements of GDCs 33, 34, 35, 38, 41, and 44 for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

Meeting the requirements of these criteria as encompassed by GDC 17 provides assurance that required electric power can be provided for all facility operating modes, including transients and design basis accidents so that the safety functions required in these criteria may be performed, even in the event of any single failure.

7. Compliance with 10 CFR 50.63 requires that each light-water-cooled nuclear power plant be able to withstand or cope with, and recover from, an SBO. As required by 10 CFR 50.63, electrical systems that are necessary support systems for SBO must be 8.2-13 Revision 5 - May 2010

of sufficient capability and capacity to ensure that core cooling and appropriate containment integrity are maintained in the event of an SBO. An acceptable means of complying with 10 CFR 50.63 requirements involves the provision of an AAC source (as defined in 10 CFR 50.2) of sufficient capacity, capability, and reliability for operation of all systems required for coping with SBO and for the time required to bring and maintain the plant in safe shutdown that will be available on a sufficiently timely basis.

10 CFR 50.63 also requires (through citation of the definition of AAC source in 10 CFR 50.2) minimum potential for common mode failure (i.e., acceptable independence) between any AAC power source used for SBO and the offsite power system or onsite power sources. Electrical ties between these systems, as well as the physical arrangement of their interface equipment, must not prevent the use of any AAC power source during loss of the offsite power system and/or onsite power sources. It is also important that provisions for an AAC source will not adversely affect performance of offsite or onsite power system functions. AAC power sources located at or near the plant should conform to guidance provided in RG 1.155 concerning their capacity, capability, and physical independence from onsite safety-related systems and the preferred power system. See SRP Section 8.4 for details of the review of AAC power sources for SBO.

For passive reactor design applications, such as the AP 1000, the potential risk contribution of an SBO is minimized by not requiring ac power sources for DBEs. The safety-related passive systems in these plants do not need non-safety-related ac power sources to perform safety-related functions. They are designed to automatically establish and maintain safe shutdown conditions after DBEs for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, without operator action, following a loss of both onsite and offsite ac power sources.

Consequently, passive reactor designs meet the requirements of 10 CFR 50.63 for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

Meeting the requirements of 10 CFR 50.63 provides assurance that the nuclear power plant can be able to withstand or cope with, and recover from an SBO and will ensure that core cooling and appropriate containment integrity are maintained.

8. 10 CFR 50.65 (a)(4) requires that licensees assess and manage the increase in risk that may result from proposed maintenance activities before performing the maintenance activities. Grid stability and offsite power availability are examples of emergent conditions that may result in the need for action prior to the conduct of the assessment or that could change the conditions of a previously performed assessment. Accordingly, licensees should perform grid reliability evaluations as part of the maintenance risk assessment before performing Agrid-risk-sensitive@ maintenance activities (such as surveillances, post-maintenance testing, and preventive and corrective maintenance).

Such activities are those which could increase risk under existing or imminent degraded grid reliability conditions, including (1) conditions that could increase the likelihood of a plant trip, (2) conditions that could increase the likelihood of a LOOP or SBO, and (3) conditions that could have an impact on the plant=s ability to cope with a LOOP or SBO, such as out-of-service risk-significant equipment (for example, an EDG, a battery, a steam-driven pump, or an alternate ac power source).

8.2-14 Revision 5 - May 2010

III. REVIEW PROCEDURES The reviewer will select material from the procedures described below, as may be appropriate for a particular case.

These review procedures are based on the identified SRP acceptance criteria. For deviations from these acceptance criteria, the staff should review the applicant=s evaluation of how the proposed alternatives provide an acceptable method of complying with the relevant NRC requirements identified in Subsection II.

1. To verify that the requirements of GDC 17 are satisfied, the following review steps should be taken:

A. The electrical drawings should be examined to ensure that at least two separate circuits from the transmission network to the onsite power distribution system buses are provided (a single switchyard may be common to these paths).

For evolutionary light water reactor design applications, the design should include at least one offsite circuit to each redundant safety division that is supplied directly from an offsite power source with no intervening non-safety buses, thereby permitting the offsite source to supply power for safety buses in the event the non-safety bus(es) fail. The design should also include an alternate power source to non-safety loads, unless it is demonstrated that existing design margins will result in transients for loss of non-safety power events that are no more severe than those associated with the turbine-trip-only event specified in plant designs. See SRP Section 8.3.1 for further details.

For passive reactor design applications, such as the AP 1000, the passive safety-related systems require electric power for valves and related instrumentation which can be supplied from the onsite Class 1E batteries and associated dc and ac distribution systems. If no offsite power is available, it is expected that the non-safety-related diesel generators would be available for important plant functions. However, this non-safety-related ac power is not relied on to maintain core cooling or containment integrity. Therefore, the passive reactor design supports an exemption to the requirements of GDC 17 for two physically independent offsite circuits, by providing safety-related passive safety systems for core cooling and containment integrity.

As documented in SECY 94-084 & SECY-95-132, the staff addressed technical issues associated with the regulatory treatment of non-safety systems (RTNSS) process in passive plant designs. Risk-important, non-safety-related, active systems in passive light water reactors may have a significant role in accident and consequence mitigation by providing defense-in-depth functions to supplement the capability of the safety-related passive systems. For example, in the AP 1000 passive reactor design, ac power from an offsite system is required to power the normal residual heat removal system (RNS) and also to provide a means of supplying power to post-accident monitoring and ac input power for Class 1E dc battery chargers. The RNS provides a non-safety-related means 8.2-15 Revision 5 - May 2010

available to inject water into the reactor coolant system (RCS) for reactor coolant makeup and decay heat removal. The design review should therefore cover the offsite power requirements to support those risk-important, non-safety-related, active systems identified through the RTNSS process.

B. The routing of transmission lines should be examined on the station layout drawings and verified during the site visit to ensure that at least two circuits from the offsite grid to the onsite distribution buses are physically separate and independent. No other lines should cross above these two circuits. Attention should be directed toward ensuring that no single event such as a tower falling or a line breaking can simultaneously affect both circuits in such a way that neither can be returned to service in time to prevent fuel design limits or design conditions of the reactor coolant pressure boundary from being exceeded. In addition, the reviewer should verify that no single-point vulnerability exists whereby a weather-related event could disable any portion of the preferred power sources and simultaneously cause failure to supply AAC power.

C. As the switchyard may be common to both offsite circuits, the electrical schematics of the switchyard breaker control system, its power supply and the breaker arrangement itself should be examined for the possibility of simultaneous failure of both circuits from single events such as a breaker not operating during fault conditions, spurious relay trip, loss of a control circuit power supply, or a fault in a switchyard bus or transformer. An example of a single-failure susceptibility of a transmission line protection scheme that was the primary cause of a cascading blackout and LOOP event is described in Reference 27. In addition, the reviewer should examine the failure modes and effects analysis (FMEA) of the switchyard by the applicant to verify that no single event would simultaneously fail both offsite power circuits and would fail one offsite circuit for passive design.

D. The design is examined to determine that at least one of the two required circuits can, within a few seconds, provide power to safety-related equipment following a LOCA. GDC 17 does not require these circuits in themselves to be single-failure-proof for this accident. However, it is required that each circuit have the capability to be available in sufficient time to prevent fuel design limits and design conditions of the reactor coolant pressure boundary from being exceeded. Therefore, the design is examined to determine that the period of time that the station can remain in a safe condition assuming no ac power is available is greater than the time required to reestablish ac power from the offsite grid to the onsite Class 1E distribution buses for each single failure event.

The switchyard circuit breaker control scheme should be such that any incoming transmission line, switchyard bus, or any path to the onsite safety-related distribution buses can be isolated so that ac power can be reestablished to the onsite Class 1E buses through its redundant counterpart. This should be achieved with separate and redundant breaker tripping and closing devices that are actuated by redundant dc battery supplies. Air stored under pressure in accumulators or spring energy should be used to open and/or close breakers 8.2-16 Revision 5 - May 2010

independent of ac power. Further information for the reviewer on the importance of redundancy in transmission grid protective schemes is provided by operating experience events (Reference 27).

For those designs that utilize a backfeed path through the main generator step-up transformer, the reviewer must first ascertain if this path is required to satisfy the GDC 17 requirement for an immediate or delayed access circuit. If the circuit is for delayed access only, then the same determination (as discussed in the previous paragraph) must be made, i.e., there is sufficient time to make this circuit available (assuming the availability of the grid itself but the unavailability of the immediate access circuit and the onsite power supplies) such that the reactor remains in a safe condition. If the circuit is required for immediate access or utilizes generator circuit breakers or generator load break switches, then the reviewer should use the guidelines contained in Appendix A to this SRP section.

E. Each of the circuits from the offsite system to the onsite distribution buses shall have the capacity and capability to supply the loads assigned to the bus or buses it is connected to during normal or abnormal operating conditions, accident conditions, or plant shutdown conditions. Therefore, the loads to be supplied during these conditions should be determined from information obtained in coordination with other staff. The capacity and electrical characteristics of transformers, circuit breakers, buses, transmission lines, other electrical equipment, and the preferred power source for each path should be evaluated to ensure that there is adequate capability to supply the maximum connected load during all plant conditions. The design should also be examined to ensure that during transfer from one power source to another the design limits of equipment are not exceeded. Industry standards (References 46 & 48) and, for COL applications, RG 1.206 (Section C.I.8.2.2), provide further information for the reviewer regarding power system analytical studies to verify the capability of the offsite power systems and their interfaces with the onsite power system.

F. The results of the grid stability analysis must show that loss of the largest single supply to the grid does not result in the complete loss of preferred power. The analysis should consider the loss, through a single event, of the largest capacity being supplied to the grid, removal of the largest load from the grid, or loss of the most critical transmission line. This could be the total output of the station, the largest station on the grid, or possibly several large stations if these use a common transmission tower, transformer, or a breaker in a remote switchyard or substation. The station layout and the grid system layout drawings are reviewed to determine that all the above events were included in the analysis. BTP 8-6, industry standards (e.g., References 46 & 48), and, for COL applications, RG 1.206 (Section C.I.8.2.2) provide further information for the reviewer regarding stability studies of offsite power systems.

The reviewer verifies that the grid stability analysis considers the effect of grid events on the adequacy of offsite grid voltage available at the plant switchyard.

Operating experience has shown that a variety of factors, such as, power flow 8.2-17 Revision 5 - May 2010

through the transmission grid, reactive power capacity, the plant voltage and frequency protective schemes and setpoints, and weather or temperature conditions in the region can all affect grid voltage levels and overall stability.

BTP 8-6 and References 21, 25, 29, 30, and 43 provide information for the reviewer regarding degraded transmission grid voltage and the effects of grid events on grid voltage at the plant switchyard.

The applicant should include in the grid stability analysis the consideration of failure modes that could result in ac frequency variations exceeding the maximum rate of change determined in the accident analysis for loss of reactor coolant flow. Failure modes that could produce abnormal frequency events and the plant frequency protection schemes are reviewed. Abnormal frequency operating experience from the assessment of grid transient events (Reference

43) and industry standards (Reference 54) provide further information on abnormal frequency considerations at nuclear power plants.

Passive reactor designs incorporate passive safety-related systems for core cooling and containment integrity and therefore, do not depend on the electric power grid connection and grid stability for safe operation. Passive reactor designs also include active systems that can provide defense-in-depth capabilities for reactor coolant makeup and decay heat removal. The accident analysis and Probabilistic Risk Analysis (PRA) need to be reviewed to identify these non-safety related systems. Once identified, review of the electrical design of the plant needs to confirm that any offsite power requirements for thses systems are met. The AP1000 safety analyses, for example, assume that the RCPs can receive power at 6.9 kV from either the main generator or the grid for a minimum of 3 seconds following a turbine trip. Should a turbine trip occur during power operation, the generator will continue rotating at synchronous speed by acting as a synchronous motor. Anti-motoring protective relaying for the main generator will open the generator output breaker after a time delay of at least 15 seconds, during which time the rotating generator will provide voltage support for the grid. When the generator output breaker trips the plant distribution system utilizes backfeed from the grid to maintain power to the RCPs.

Also, the reviewer should verify that the analyses in Chapter 15 do not assume operation of the RCPs following the turbine trip if the initiating event is an electrical system failure (such as failure of the isolated phase bus or transformers). Review of the grid stability analyses should verify that the grid remains stable for a minimum of 3 seconds following a turbine trip to support the assumptions made in the safety analyses for the passive reactor designs such as the AP1000. NUREG-1793 provides additional information on grid stability analyses for the AP1000.

G. During the review of the electrical schematics, it should be determined that loss of standby power will not result in loss of preferred power, loss of one preferred power circuit will not result in loss of the other circuit, loss of the main generator will not result in loss of either preferred power circuit, and loss of any combination of these power sources will not prevent the use of AAC power.

H. The reviewer verifies that the preferred power system is independent of the onsite power system. The basis for acceptance is that no single event, including 8.2-18 Revision 5 - May 2010

a single protective relay, interlock, or switchgear failure, in the event of loss of all standby power sources, will prevent the separation of the preferred power system from the onsite power distribution system or prevent the preferred power system from accomplishing its intended functions. In addition, the preferred and standby power supplies should not have common failure modes. An acceptable design must be capable of restoring the preferred power supply after the loss of either circuit in a time period such that the plant can be safely shut down, taking into account the effects of a single failure in the onsite distribution system. This item is also addressed in SRP Section 8.3.1.

I. The reviewer verifies that adequate provisions are made in the design of the plant and the offsite and onsite power systems for grounding, surge protection, and lightning protection. The reviewer evaluates the plant/station grounding systems, the methods of equipment and structural grounding, ac power system neutral grounding and ground fault current limiting features, surge and lightning protection features for outdoor equipment and circuits, and the measures for isolation of instrumentation grounding systems. RG 1.204 and IEEE Stds 665, 666, 1050, and C62.23, provide acceptable guidelines for the design, installation, and performance of station grounding systems and surge and lightning protection systems.

J. The reviewer should verify that provisions are included in the design to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit, the loss of power from the transmission network, or the loss of power from the onsite electric power supplies. The trip of the nuclear power unit is an anticipated operational occurrence that can result in reduced switchyard voltage, potentially actuating the plant=s degraded voltage protection and separating the plant=s safety buses from offsite power. It can also result in grid instability, potential grid collapse, inadequate switchyard voltages, and a subsequent LOOP due to loss of the real and/or reactive power support supplied to the grid from the nuclear unit. Plant TS LCOs require the offsite power system to be operable.

However, since the capability of the offsite power system cannot be tested except when challenged during an actual event, the design bases for the offsite power system can only be assured through analysis of the grid and plant conditions. Plant operators should, therefore, be aware of: (1) the capability of the offsite power system to supply power, as required by TS, during operation and (2) situations that can result in a LOOP following a trip of the plant. Plant operators are expected to declare the offsite power system inoperable in the event of degraded grid conditions that can not support post-trip voltages. Further, the reviewer should verify that communications (both voice and data) between the NPP and its offsite transmission system operating authorities must be implemented in assessing whether the offsite power sources are operable as required by GDC17 and the plant TS. In addition, the reviewer should verify that grid reliability evaluations, performed as part of the maintenance risk assessment required by 10 CFR 50.65 before conducting Agrid-risk-sensitive@ maintenance activities, are considered when evaluating the operability of the offsite power system.

8.2-19 Revision 5 - May 2010

The applicant=s methods and procedures for confirming the operational readiness of offsite power systems are reviewed to verify that plant operators are aware of the capability of the offsite power system to supply power during operation and situations that can result in a LOOP following a trip of the plant. This includes a review of communication agreements and protocols that exist between the NPP and the transmission system operator (TSO), independent system operator (ISO), or reliability coordinator/authority (RC/RA). The agreements and protocols should be verified to include preferred operating limits for the offsite power system and preferred actions for recovering from a LOOP event. It should also include the use of transmission load flow analysis and real time contingency analysis (RTCA) software tools (analysis tools) (directly or through the TSO) to assist the NPP in monitoring grid conditions and operating status to determine the operability of offsite power systems under plant technical specifications (TS).

The review should verify that the communication protocols are enforced by a formal contract or other means and include notification requirements to inform the NPP when the grid is stressed to the point where a trip of the NPP would result in inadequate post-trip switchyard voltages (less than the design basis voltage) for either actual grid conditions or potential (i.e., anticipatory contingency) grid conditions within any predetermined time limits. Additionally, the reviewer may perform independent calculations using the electronic copy of the model of the onsite distribution system provided by the applicant to ensure that each offsite power circuit has sufficient capacity and capability to provide power to the safety loads. See Section 8.3 for details. The reviewer should also review the description of the analysis tool used by the TSO to determine, in real time, the impact that the loss or unavailability of various transmission system elements will have on the condition of the transmission system to ensure that adequate post-trip voltages are available at the switchyard.

The true capability of the offsite source cannot necessarily be verified through direct readings of plant switchyard or safety bus voltages. Recent operating experience (Reference 43) has shown that analyses of the surrounding grid and plant conditions, based on accurate and timely transmission system data, are needed to evaluate all possible contingencies at a given time. The reviewer should verify that adequate status information, communications, analytical resources, and procedures are provided to determine that the plant is operating within the offsite power grid operability limits required by GDC 17 and the plant=s TS. The information and guidance provided in NRC generic communications (Reference 21), industry standards (Reference 50), and other NRC documents (e.g., References 22, 24, 25, 29, 30, and 43) are useful in the review of the adequacy and reliability of the plant=s interface with the offsite power grid and communication with offsite transmission system operating authorities.

K. The reviewer should verify that adequate procedures, administrative controls, and protocols are in place to ensure that no modifications to the offsite power system circuits credited for satisfying GDC 17 are implemented by offsite transmission system operating authorities, responsible for maintenance, modification, and operation of the offsite transmission grid, without the performance of a proper safety evaluation. The safety evaluation of transmission 8.2-20 Revision 5 - May 2010

system modifications is required to ensure that the transmission grid configuration, stability, and capability remain within the assumptions of the plant safety analyses. Further information on potential unreviewed safety questions associated with modifications to offsite transmission circuits can be found in Reference 45. In addition, the reviewer should verify that grid reliability evaluations are performed for maintenance or modifications to the offsite power system, as part of the maintenance risk assessment required by 10 CFR 50.65 before performing Agrid-risk-sensitive@ maintenance activities.

L. Operating experience has shown that undetected degradation of underground electric cables due to protracted exposure to wetted environments or submergence in water or resulting from pre-existing manufacturing defects could result in multiple equipment failures. Underground or inaccessible power and control cable runs that are susceptible to protracted exposure to wetted environments or submergence as a result of tidal, seasonal, or weather event water intrusion are reviewed. Cables from independent power sources or different safety divisions could be affected by the same condition. Underground or inaccessible power cables connecting offsite power to safety buses or power and control cables to equipment with accident mitigating functions should be considered in the review. Examples of submerged cable failures from the operating experience are provided in Reference 26.

2. To ensure that the requirements of GDC 18 are satisfied, the detailed description of the design should be examined to determine that the design includes provisions for testing the transfer of the source of power feeding the onsite distribution system, e.g., from the main generator supply to the preferred power system, or to any other supply. It should also be established that the circuitry required to perform these transfer functions has the capability of being tested during plant operation. The organization responsible for quality assurance and maintenance should review preoperational and initial startup test procedures. The organization responsible for quality assurance and maintenance should also review the periodic test procedures.

RG 1.204 provides acceptable guidelines for an adequate and acceptable testing and maintenance approach for the reviewer to confirm the proper installation of a lightning protection system and ensure its continued ability to provide the level of protection for which it was designed. The reviewer should verify that new lightning protection systems (LPSs) are inspected following installation, and reinspected at least on a regular, periodic throughout their lifetime. In particular, an LPS should be inspected whenever any alterations or repairs are made to a protected structure, as well as following any known lightning transient to the system. An LPS should be visually inspected at least annually. In areas where severe climatic changes occur, it is advisable to inspect the LPS semiannually or following extreme changes in ambient temperature. The reviewer should verify that testing and maintenance procedures are established for each LPS.

The frequency of testing and maintenance will depend on weather-related degradation of protective features, frequency and severity of damage attributable to lightning transients, and required protection level. The LPS testing and maintenance program is reviewed for the following activities: (1) inspection of all conductors and system components, (2) tightening of all clamps and splices, (3) measurement of the earth grounding resistance, 8.2-21 Revision 5 - May 2010

(4) measurement of the resistance of ground terminals, (5) inspection or testing (or both) of surge protection devices (SPDs) to assess their effectiveness, (6) periodic testing and maintenance of earth grounding systems, (7) refastening and tightening of components and conductors as required, (8) inspection and testing when the LPS has been altered by additions to, or changes in, the structure, and (9) complete records.

3. GDCs 33, 34, 35, 38, 41, and 44 set forth requirements for the safety systems whose source of power is the preferred power system. These criteria state that safety system redundancy shall be such that, for preferred power system operation (assuming standby power is not available), the system safety function can be accomplished assuming a single failure.

To ensure that these requirements of the GDC identified above are satisfied, the electrical schematics of the systems required for reactor coolant makeup, residual heat removal, emergency core cooling, containment heat removal, containment atmosphere cleanup, and cooling water should be examined to ensure that the circuits from the preferred power system can supply redundant portions of these systems. If the minimum design required by GDC 17 is provided, the immediately available preferred circuit must be made available to the redundant portions of these systems.

4. All offsite power system equipment and components in the station switchyard and its connection to the onsite Class 1E system are reviewed to determine that they are appropriately included in the NPP quality assurance program. Safety-related equipment and components, and those required to support systems with accident mitigating functions, should have the appropriate quality classifications. The review should verify that procedures, maintenance, and surveillance tests associated with the equipment and components incorporate the appropriate quality controls. The organization responsible for quality assurance and maintenance should determine the adequacy of the quality assurance program.

5. To verify that the requirements (excluding seismic, tornado, and floods) of GDC 2 are satisfied for the facility being considered, the organization responsible for civil engineering and geosciences review should provide to the organization responsible for electrical engineering review, upon request, information on the design basis, high and low atmospheric temperatures, high wind, rain, lightning discharges, ice and snow conditions, and weather events causing regional effects. This information should be considered during the review to verify that the design minimizes the effects of these conditions in accordance with GDC 17. Items such as switchyard and transformer locations, transformer cooling, overhead transmission lines, underground or inaccessible power and control cables could be affected by these conditions. Operating experience provides additional information on the effects of severe heat and cold on electrical system equipment (References 23 and 28) and on the effects of protracted submergence and wet environments on underground electric cables (Reference 26).

Communication links between the plant operators and local TSO/ISOs serve as a means to obtain timely information on power grid operating conditions and status to verify the operability of the offsite power grid in accordance with the requirements of the plant=s technical specifications. Communications with offsite entities are also important for 8.2-22 Revision 5 - May 2010

restoration of offsite power in the event of a LOOP or SBO. The plant=s offsite communications equipment and protocols, communication contingency procedures, communications circuit routing, and telemetry links used to monitor the power grid and to verify and maintain grid stability and operability should be reviewed to determine that they are secure and will continue to function during severe weather events causing regional effects. Operating experience provides additional information on offsite communications capability and integrity during severe weather events (Reference 22).

6. To ensure that the requirements of GDC 4 are satisfied, the organization responsible for the review of plant systems should review the location of SSCs of the preferred power system to determine the protection provided against dynamic effects, including effects of missiles, pipe whipping, and discharging fluids, that may result from equipment failures and from events and conditions outside the station. This information should be used to determine the possibility of simultaneous loss of both paths of preferred power.

7. To ensure that the requirements of GDC 5 are satisfied, the SSCs of the preferred power systems should be examined to identify any that are shared between units of a multi-unit station. These should be reviewed to ascertain that they have sufficient capacity and capability of performing all required safety functions in the event of an accident in one unit, with a simultaneous orderly shutdown and cooldown of the remaining units. Review of the design criteria should establish that the capacity and capability of incoming lines, power sources, and transformers for each required circuit have margin to achieve this.

Spurious or false accident signals should not overload these circuits. SRP Section 8.3.1 further discusses spurious or false accident signal considerations.

8. The preferred power system instrumentation provided to monitor variables and equipment status should be identified during the electrical schematic and system description review. It should be ascertained that these instruments present status information that can be used to determine the condition of the preferred power system at all times. Review of the electrical schematics should determine that controls (automatic, manual, or remote) are provided to maintain these variables and systems within prescribed operating ranges. It should also be determined during the review of the electrical schematics as to what effects failures of these controls and instruments might have on the preferred power system.

9. The review of any automatic TSO action should ascertain that TSO actions (including normal and postulated failure modes of operation) will not interfere with safety actions that may be required of the reactor protection system. This system should also be reviewed to ensure that no failure mode of the TSO system will cause an incident at the generating station which would require protective action.

10. To verify that the relevant requirements of 10 CFR 50.63 are met, if an AAC source is proposed for safe shutdown in the event of an SBO, the capacity, capability, reliability, and independence of the AAC power source are reviewed in accordance with SRP Section 8.4.

For evolutionary light water reactor design applications, the reviewer verifies, in accordance with SRP Section 8.4, that the AAC for SBO is of diverse design (with 8.2-23 Revision 5 - May 2010

respect to onsite sources), is consistent with guidance in RG 1.155, has adequate capacity, and has capability for powering at least one complete set of normal safe shutdown loads.

11. The Maintenance Rule Section 50.65(a)(4) requires that licensees assess and manage the increase in risk that may result from proposed maintenance activities before performing the maintenance activities. RG 1.182, used as a companion guide to RG 1.160, provides guidance for assessing and managing the increase in risk that may result from maintenance activities and for implementing the optional reduction in scope of SSC=s considered in the assessment. The review should verify that grid reliability evaluations are performed, as part of the maintenance risk assessment required by 10 CFR 50.65 before performing Agrid-risk-sensitive@ maintenance activities, including, but not limited to, surveillances, post-maintenance testing, and corrective and preventive maintenance. Such activities are those which could increase risk under existing or imminent degraded grid reliability conditions, including: (1) conditions that could increase the likelihood of a plant trip, (2) conditions that could increase the likelihood of LOOP or SBO, and (3) conditions that have an impact on the plant=s ability to cope with a LOOP or SBO, such as, out-of-service risk-significant equipment (e.g., an EDG, a battery, a steam-driven pump, and alternate ac power source).

12. For reviews of DC and COL applications under 10 CFR Part 52, the reviewer should follow the above procedures to verify that the design set forth in the safety analysis report, and if applicable, site interface requirements meet the acceptance criteria. For DC applications, the reviewer should identify necessary COL action items. With respect to COL applications, the scope of the review is dependent on whether the COL applicant references a DC, an ESP or other NRC-approved material, applications, and/or reports.

After this review, SRP Section 14.3 should be followed for the review of Tier I information for the design, including the postulated site parameters, interface criteria, and ITAAC.

IV. EVALUATION FINDINGS The reviewer verifies that the applicant has provided sufficient information and that the review and calculations (if applicable) support conclusions of the following type to be included in the staff's safety evaluation report (SER). The reviewer also states the bases for those conclusions.

The offsite power system includes two or more identified circuits from the grid and its transmission lines to the onsite distribution system. The review of the offsite power system for the __________ plant covered single-line diagrams, station layout drawings and schematic diagrams, and descriptive information.

8.2-24 Revision 5 - May 2010

The basis for acceptance of the offsite power system in our review was conformance of the design criteria and bases to the Commission's regulations as set forth in the GDC of Appendix A to 10 CFR Part 50. The staff concludes that the plant design is acceptable and meets the requirements of GDCs 2, 4, 5, 17, and 18 and also meets the requirements of 10 CFR 50.63 with regard to the AAC power source provided for SBO.

This conclusion is based on the following:

1. The applicant has met the requirements of GDC 2, "Design Basis for Protection Against Natural Phenomena," with respect to SSCs of the offsite power systems being capable of withstanding the effects of natural phenomena such as high and low atmospheric temperatures, high wind, rain, lightning discharges, ice and snow conditions, and weather events causing regional effects by locating the offsite power system and components in areas which provide protection from the effects of natural phenomena by adequate plant design.

2. The applicant has met the requirements of GDC 4, "Environmental and Dynamic Effects Design Bases," with respect to SSCs of the offsite power system being capable of withstanding dynamic effects, including effects of missiles, pipe whipping, and discharging fluids that may result from equipment failures and from events and conditions outside the nuclear power unit associated with normal operation, maintenance, testing, and postulated accidents by adequate plant design.

3. The applicant has met the requirements of GDC 5, "Sharing of Structures, Systems, and Components," with respect to sharing of circuits of the preferred power system between units. Each circuit has sufficient capacity to operate the engineered safety features for a design basis accident on one unit and those systems required for concurrent safe shutdown on the remaining units.

4. The applicant has met the requirements of GDC 17, "Electric Power Systems," with respect to the offsite power system's (a) capacity and capability to permit functioning of structures, systems, and components important to safety; (b) provisions to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit or loss of power from the onsite electric power supplies; c) physical independence of circuits; and (d) availability of circuits. The preferred power system consists of at least two physically independent circuits routed from the electrical grid system by transmission lines to the onsite power distribution system. At least one circuit will be available within a few seconds following a loss of coolant accident and is considered an immediate access circuit. Each circuit is designed and located so as to minimize to extent practical the likelihood of their simultaneous failure under operating and postulated accident and environmental conditions. Each circuit has been sized with sufficient capacity to supply all connected loads. Each circuit can be made available to the onsite power system, assuming loss of the onsite ac standby power supplies and loss of the other offsite circuit, to ensure that fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded. The switchyard is arranged such that each offsite circuit can be isolated from other circuits to permit reestablishment of offsite power to the onsite distribution system. The switchyard is also arranged such that single events (e.g.,

a spurious relay trip or a breaker not operating during fault conditions) will not cause 8.2-25 Revision 5 - May 2010

simultaneous failure of all offsite circuits to the switchyard. The results of the applicant's grid stability analysis indicated that loss of the largest generating capacity being supplied to the grid, loss of largest load from the grid, loss of the most critical transmission line, or loss of the unit itself will not cause grid instability.

This meets the guidelines of RG 1.32, "Criteria for Safety-Related Electric Power Systems for Nuclear Power Plants."

5. The applicant has met the requirements of GDC 18, "Inspection and Testing of Electric Power Systems," with respect to the capability to test systems and associated components during normal plant operation and the capability to test the transfer of power from the nuclear power unit, the offsite preferred power system, and the onsite power system.

6. The applicant=s overall compliance with the requirements of 10 CFR 50.63 is discussed in Section 8.4 of the SER. The applicant has met the requirement of 10 CFR 50.63, "Loss of All Alternating Current Power," with respect to the adequacy of the AAC power source provided for safe shutdown (non-DBA) in the event of an SBO and the independence of the AAC source from offsite power systems and onsite power sources.

In compliance with the relevant guidance of RG 1.155, the offsite AAC power source is located at or near the plant, has sufficient capacity, capability, and reliability to achieve and maintain safe shutdown (non-DBA), and is adequately independent from onsite safety-related and preferred power systems, and thus satisfies the definition for an acceptable AAC source as specified in 10 CFR 50.2.

7. The applicant has met the requirements of 10 CFR 50.65(a)(4) with respect to the onsite dc power system. The acceptability is based on meeting the relevant positions of RG 1.182.

For DC and COL reviews, the findings will also summarize the staff's evaluation of requirements and restrictions (e.g., interface requirements and site parameters) and COL action items relevant to this SRP section.

In addition, to the extent that the review is not discussed in other SER sections, the findings will summarize the staff's evaluation of the ITAAC, including design acceptance criteria, as applicable.

V. IMPLEMENTATION The staff will use this SRP section in performing safety evaluations of DC applications and license applications submitted by applicants pursuant to 10 CFR Part 50 or 10 CFR Part 52.

Except when the applicant proposes an acceptable alternative method for complying with specified portions of the Commission=s regulations, the staff will use the method described herein to evaluate conformance with Commission regulations.

The provisions of this SRP section apply to reviews of applications submitted 6 months or more after the date of issuance of this SRP section, unless superseded by a later revision.

8.2-26 Revision 5 - May 2010

VI. REFERENCES

1. 10 CFR Part 50, '50.2, ADefinitions.@

2. 10 CFR Part 50, '50.63, "Loss of All Alternating Current Power.@

3. 10 CFR Part 50, '50.65, "Requirements for monitoring the effectiveness of maintenance at nuclear power plants."

4. 10 CFR Part 50, Appendix A, GDC 2, "Design Bases for Protection Against Natural Phenomena."

5. 10 CFR Part 50, Appendix A, GDC 4, "Environmental and Dynamic Effects Design Bases."

6. 10 CFR Part 50, Appendix A, GDC 5, "Sharing of Structures, Systems, and Components."

7. 10 CFR Part 50, Appendix A, GDC 17, "Electric Power Systems."

8. 10 CFR Part 50, Appendix A, GDC 18, "Inspection and Testing of Electric Power Systems."

9. 10 CFR Part 50, Appendix A, GDC 33, "Reactor Coolant Makeup."

10. 10 CFR Part 50, Appendix A, GDC 34, "Residual Heat Removal.@

11. 10 CFR Part 50, Appendix A, GDC 35, "Emergency Core Cooling.@

12. 10 CFR Part 50, Appendix A, GDC 38, "Containment Heat Removal.@

13. 10 CFR Part 50, Appendix A, GDC 41, "Containment Atmosphere Cleanup.@

14. 10 CFR Part 50, Appendix A, GDC 44, "Cooling Water.@

15. BTP 8-6, "Adequacy of Station Electric Distribution System Voltages.@

16. BTP 8-3, "Stability of Offsite Power Systems.@

17. SRP Section 8.1, Table 8-1, "Acceptance Criteria for Electric Power.@

18. SRP Section 8.1, Appendix 8-A, "General Agenda, Station Site Visits.@

19. Appendix A to SRP Section 8.2, "Guidelines for Generator Circuit Breakers/Load Break Switches.@

20. SRP Section 8.4, "Station Blackout.@

8.2-27 Revision 5 - May 2010

21. NRC Generic Letter 2006-02, AGrid Reliability and the Impact on Plant Risk and the Operability of Offsite Power,@ February 1, 2006.

22. NRC Information Notice 97-05, AOffsite Notification Capabilities,@ February 27, 1997.

23. NRC Information Notice 98-02, ANuclear Power Plant Cold Weather Problems and Protective Measures,@ January 21, 1998.

24. NRC Information Notice 98-07, AOffsite Power Reliability Challenges from Industry Deregulation,@ February 27, 1998.

25. NRC Information Notice 2000-06, AOffsite Power Voltage Inadequacies,@ March 27, 2000.

26. NRC Information Notice 2002-12, ASubmerged Safety-Related Electrical Cables,@

March 21, 2002.

27. NRC Information Notice 2005-15, AThree-Unit Trip and Loss of Offsite Power at Palo Verde Nuclear Generating Station,@ June 1, 2005.

28. NRC Information Notice 2006-06, ALoss of Offsite Power and Station Blackout Are More Probable During Summer Period,@ March 3, 2006.

29. NRC Regulatory Issue Summary 2000-24, AConcerns About Offsite Power Voltage Inadequacies and Grid Reliability Challenges Due to Industry Deregulation,@

December 21, 2000.

30. NRC Regulatory Issue Summary 2004-05, AGrid Reliability and the Impact on Plant Risk and the Operability of Offsite Power,@ April 15, 2004.

31. SECY 90-16, AEvolutionary Light Water Reactor Certification Issues and Their Relationships to Current Regulatory Requirements,@ January 12, 1990. Approved in the SRM of June 26, 1990.

32. SECY 91-078, AEPRI=s Requirements Document and Additional Evolutionary LWR Certification Issues,@ 1991. Approved in the SRM of August 15, 1991.

33. SECY 94-084 APolicy and Technical Issues Associated with the Regulatory Treatment of Non-safety Systems in Passive Plant Designs,@ dated March 28, 1994. Approved in the SRM of June 30, 1994.

34. SECY-95-132 APolicy and Technical Issues Associated with the Regulatory Treatment of Non-safety Systems (RTNSS) in Passive Plant Designs.@ Approved in the SRM of June 28, 1995.

35. NRC Memorandum; From: D. Crutchfield; To: File;

Subject:

Consolidation of SECY 084 and SECY-95-132, July 24, 1995. SECY-94-084 was approved in the SRM of June 30, 1994. SECY-95-132 was approved in the SRM of June 28, 1995.

8.2-28 Revision 5 - May 2010

36. SECY-05-0227, AFinal Rule B AP1000 Design Certification,@ dated December 14, 2005.

Approved in the SRM of December 30, 2005.

37. RG 1.32, "Criteria for Safety-Related Electric Power Systems for Nuclear Power Plants."

38. RG 1.155, "Station Blackout.@

39. RG 1.160, AMonitoring the Effectiveness of Maintenance at Nuclear Power Plants,@

Revision 2, March 1997. (Revision 2, ADAMS accession no. ML003761662)

40. RG 1.182, AAssessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants,@ Revision 0, May 2000.

41. RG 1.204, AGuidelines for Lightning Protection of Nuclear Power Plants,@ Revision 0, November 2005.

42. RG 1.206, ACombined License Applications for Nuclear Power Plants (LWR Edition),@

June 30, 2006.

43. NUREG-1784, AOperating Experience Assessment - Effects of Grid Events on Nuclear Power Plant Performance,@ December 2003.

44. NUREG-1793, AFinal Safety Evaluation Report Related to Certification of the AP1000 Standard Design,@ September 2004.

45. Region IV Task Interface Agreement (TIA) No. 2002-03; Evaluation of Potential Unreviewed Safety Questions Associated with Modifications Made to Offsite Power at Cooper Nuclear Station (TAC No. MB5768).

46. IEEE Std. 242-2001, ARecommended Practice for Protection and Coordination of Industrial and Commercial Power Systems,@ (Buff Book).

47. IEEE Std. 308-2001, "IEEE Standard Criteria for Class 1E Power Systems for Nuclear Power Generating Stations.@

48. IEEE Std. 399-1997, ARecommended Practice for Power Systems Analysis,@ (Brown Book).

49. IEEE Std. 665-1995 (Reaffirmed 2001), AGuide for Generating Station Grounding.@

50. IEEE Std. 666-1991 (Reaffirmed 1996), ADesign Guide for Electric Power Service Systems for Generating Stations.@

51. IEEE Std. 741-1997, AIEEE Standard Criteria for the Protection of Class 1E Power Systems and Equipment in Nuclear Power Generating Stations.@

52. IEEE Std. 765-1983, AIEEE Standard for Preferred Power Supply (PPS) for Nuclear Power Generating Stations.@ (2002 is latest revision) 8.2-29 Revision 5 - May 2010

53. IEEE Std. 1050-1996, AGuide for Instrumentation and Control Equipment Grounding in Generating Stations@

54. IEEE Std. C37.106 -2003, AGuide for Abnormal Frequency Protection for Power Generating Plants.@

55. IEEE Std. C62.23-1995 (Reaffirmed 2001), AApplication Guide for Surge Protection of Electric Generating Plants.@

56. EPRI ALWR Utility Requirements Document, Volume II, "Evolutionary Plants,@ Chapter 11, "Electric Power Systems,@ Revision 6, December 1993, Electric Power Research Institute.

57. NUMARC 93-01, AIndustry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants," Section 11. Nuclear Energy Institute, February 11, 2000.

58. NRC Information Notice 2006-18, ASignificant Loss of Safety-Related Electrical Power at Forsmark, Unit 1, in Sweden,@ August 17, 2006.

PAPERWORK REDUCTION ACT STATEMENT 8.2-30 Revision 5 - May 2010

The information collections contained in the Standard Review Plan are covered by the requirements of 10 CFR Part 50 and 10 CFR Part 52, and were approved by the Office of Management and Budget, approval number 3150-0011 and 3150-0151.

PUBLIC PROTECTION NOTIFICATION The NRC may not conduct or sponsor, and a person is not required to respond to, a request for information or an information collection requirement unless the requesting document displays a currently valid OMB control number.

8.2-31 Revision 5 - May 2010

APPENDIX A GUIDELINES FOR GENERATOR CIRCUIT BREAKERS/LOAD BREAK SWITCHES

1. Background Generator circuit breakers have been used in nuclear generating station designs (McGuire, Catawba) as a means of providing immediate access of the onsite ac power systems to the offsite circuits by isolating the unit generator from the main step-up and unit auxiliary transformers and allowing backfeeding of power through these circuits to the onsite ac power system. Generator load break switches can also be used as a means of providing access to the offsite circuits as described above, but only on a delayed basis. Since this is a new design feature, the staff made the use of generator circuit breakers and load break switches a generic safety issue (NUREG-0933, Item B-53). In the case of McGuire and Catawba, References 1, 2, and 3, an expert consultant was retained to evaluate the generator circuit breaker verification testing program and its results. These guidelines are formalization of the results of that extensive work. Also guidelines for the load break switches are incorporated, as these devices have some common functional requirements as generator breakers as described above.

The staff has made a determination that only devices that have the capability of interrupting the system maximum available fault current, i.e., circuit breakers, will be approved as a means of isolating the unit generators from the offsite power system in order to provide immediate access in accordance with GDC 17. This is necessary because a non fault current interrupting device, i.e., load break switch, must delay its trip for electrical faults until the switchyard circuit breakers have interrupted the current.

Following opening of the load break switch, the switchyard circuit breakers must then be reclosed to establish offsite power to the unit. A generator circuit breaker, however, could interrupt the fault current and isolate the unit generator at the same time, maintaining continuous power to the onsite ac power system.

IEEE Std. C37-013 (Reference K) was issued to cover the ratings and required capabilities for ac high-voltage generator circuit breakers rated on a symmetrical current basis that are installed between the generator and the transformer terminals. Guidance for the application of generator circuit breakers is also given.

2. Specific Guidelines A. Only devices which have maximum fault current interrupting capability, i.e., circuit breakers, can be used to isolate the unit generator from the offsite and onsite ac power systems in order to provide immediate access for the onsite ac power system to the offsite source. Generator load break switches can only be used for isolating the unit generator for the purpose of providing a delayed access offsite source.

8.2-32 Revision 5 - May 2010

B. Generator circuit breakers should be designed to perform their intended function during steady-state operation, power system transients and major faults. The ratings and required capabilities of a generator circuit breaker are the designated limits of operating characteristics based on definite conditions as defined in IEEE Std C37.013 (Reference K). This standard describes design test procedures and methods that should be performed to demonstrate the ability of a generator circuit breaker to meet the assigned ratings when operating at rated maximum voltage and power frequency. As a minimum, the following performance tests and capabilities from IEEE Std C37.013 should be demonstrated:

(i) Rated Dielectric Strength. The dielectric strength of a generator circuit breaker should be demonstrated by subjecting it to high voltages, both rated power frequency withstand voltage and rated full wave impulse withstand voltage based on its rated maximum voltage.

(ii) Load Current Switching. Tests are made to determine the ability of the generator circuit breaker to switch load current up to the rated continuous current of the generator, such as load currents that may be encountered in normal service. When switching the generator from the system, both generator circuit breaker terminals remain energized. The power frequency recovery voltage appearing across the generator circuit breaker is equal to the sum of voltage drops on the reactances of the generator and transformer and the corresponding short-circuit reactance of the high-voltage system.

For applications which use only one generator circuit breaker, the circuit breaker should be cycled through 40 load interruption operations (a lesser number requires suitable justification) at a current equal to the normal full load continuous current rating of the circuit breaker. For applications which utilize two generator circuit breakers in a parallel circuit, the circuit breaker should be given 40 load interruption operations (a lesser number requires suitable justification) at a current equal to twice the normal full load continuous current rating of the circuit breakers. The procedures and acceptance criteria utilized for this test should be based upon those given in IEEE Std C37.013.

(iii) Short Circuit Current Rating. The rated short-circuit current is demonstrated by a series of symmetrical and asymmetrical tests, and close-open tests described in the standard. The rated symmetrical current shall be the rated current value with the power frequency voltage associated with the rated maximum voltage and with a rated inherent transient recovery voltage as described in IEEE Std C37.013 for system-source faults and generator-source faults. The rated asymmetrical current-interrupting capability is demonstrated within the same conditions as the symmetrical current.

8.2-33 Revision 5 - May 2010

The circuit breaker should have, as a minimum, the capability of interrupting the maximum asymmetrical and symmetrical fault current available at the instant of primary arcing contact separation. This current should be calculated by assuming a bolted three phase fault at a point on the system which causes the maximum amount of fault current flowing through the generator circuit breaker. The fault current interrupting capability (short circuit current rating) of the circuit breaker should be demonstrated by performing a series of tests similar to those called for in IEEE Std C37.013. The tests should include close/open (CO) operations and should be performed at the circuit breaker minimum rated air pressure and control voltage and with a rated transient recovery voltage as described in the standard for system-source faults and generator-source faults.

(iv) Rated Transient Recovery Voltage (TRV). The ability to withstand rated TRVs, as specified in IEEE Std C37.013 for rated symmetrical and asymmetrical currents, is demonstrated during short-circuit tests. Both inherent circuit transient recovery voltage and power frequency recovery voltage must be considered when demonstrating the rating of a generator circuit breaker. Additional information and guidance on TRV is provided in IEEE Std C37.011 (Reference J).

(v) Short-Time Current-Carrying Capability. The generator circuit breaker shall be capable of carrying for a period of time Ts equals 1 second, any short-circuit current determined from the envelope of the current wave at the time of the maximum crest, whose value does not exceed 2.74 times the rated short-circuit current, and whose rms value I determined over the complete 1 second period does not exceed the rated short circuit current considered above.

The fault current chosen should be that due to a fault on the system at a point which causes the largest I2t heating of the circuit breaker. The short-time current-carrying capability should be demonstrated with a current-carrying test as described in IEEE Std C37.013. It is not to be inferred that the generator circuit breaker is to be capable of interrupting after the required short-time current-carrying capability duty until it has cooled down to normal heat run temperature.

(vi) Duty Cycle Capability. The duty cycle capability of the generator circuit breaker should be demonstrated by a series of symmetrical and asymmetrical close-open cycle tests as specified in IEEE Std C37.013.

The time between two operations to interrupt short circuit current shall be the rated value of 30 minutes specified in the standard.

(vii) Transformer Excitation Current Switching Tests. The circuit breaker interruption of an unloaded station main and/or auxiliary transformer excitation current should not generate excessively high surge voltages 8.2-34 Revision 5 - May 2010

which could damage the connected bus and transformer insulation. This should be verified by test.

(viii) Rated Continuous Current-Carrying Test. The thermal capability of the circuit breaker should be demonstrated by a test at its continuous current rating. The test should be in accordance with the requirements and ratings contained in IEEE Std C37.013. For applications which use two generator circuit breakers in a parallel circuit, a test should be conducted to determine the time to reach the maximum permissible temperature on the most limiting component of the breaker when going from the rated continuous current to twice rated continuous current.

(ix) Mechanical Endurance Life Test. No-load mechanical operation tests are made on a complete generator circuit breaker or on a single pole of the generator circuit breaker if all three poles are identical to ensure its satisfactory operation in normal service without excessive maintenance.

In practical applications, the generator circuit breaker is connected to the bus duct by means of flexible copper or aluminum connections. The enclosure of the generator circuit breaker may be welded to the enclosure of the bus duct. These conditions should be taken into account during the tests.

A sufficient number of no-load mechanical operations should be performed by the circuit breaker to provide a reasonable indication of its mechanical reliability and life. The demonstrated life should be adequate for the plant life expectancy.

(x) Rated Interrupting Time. The rated interrupting time of the generator circuit breaker is the maximum permissible interval between the energizing of the trip circuit at rated control voltage and rated fluid pressure of the operating mechanism and the interruption of the main circuit in all poles on an opening operation. Typical values are approximately 60B90 ms with the actual time being dependent on the rated short-circuit current. For generator circuit breakers equipped with resistors, the interrupting time for the resistor current may be longer.

The interrupting time of a generator circuit breaker is demonstrated for different currents by the test duties cycles specified in IEEE Std C37.013.

Interrupting times of test results, when expressed in cycles, shall be in cycles of the power frequency.

(xi) Short Circuit Current with Delayed Current Zero. It is generally accepted that the generator circuit breaker will be required, during its life, to interrupt short-circuit currents from the generator-source with delayed current zeros. It is also recognized that the magnitudes of these short circuit currents are considerably lower than the magnitudes of the rated short-circuit currents. The capability of the generator circuit breaker to interrupt the delayed current zeros can be ascertained by computations 8.2-35 Revision 5 - May 2010

that consider the effect of the arc voltage on the prospective short-circuit current. The determining arc voltage model is derived from tests with comparable magnitudes of current.

If this computation entails too many assumptions on the behavior of the generator circuit breaker during interruption under the most severe conditions, short-circuit tests shall be required. If tests are carried out, it must be recognized that, normally, the required current waveshape cannot be simulated accurately in test stations. Tests shall include a predetermined nonzero current waveform associated with the rated maximum voltage and an inherent circuit transient recovery voltage, and an approximate waveform obtained either by calculation or by measurement at the generator circuit breaker=s particular application.

C. The availability of offsite power to the onsite loads for designs utilizing generator circuit breakers should be no less than comparable designs which utilize separate offsite power transformers to supply offsite power to the station loads.

In this regard the trip selectivity between the generator circuit breakers and the switchyard high voltage generator circuit breakers should insure against unnecessary tripping of the switchyard generator circuit breakers during abnormal events in order to maintain offsite power to the station loads.

D. Load break switches should be designed to perform their intended function during steady-state operation, power system transients, and major faults. Except for item 2.C, the switches should have the same capabilities as defined in guideline 2 for generator circuit breakers. In addition, the symmetrical interrupting capability of the load break switch should be at least equal to the maximum identified peak loading capability of the station generator.

3. References for Appendix A to SRP Section 8.2 A. Safety Evaluation Report related to operation of McGuire Nuclear Station, Units 1 and 2, NUREG-0442, dated March 1978.

B. FSAR McGuire Nuclear Station Docket 50-396/370.

C. FSAR Catawba Nuclear Station Docket 50-413/414.

D. IEEE Standard C37.04-1999, Standard Rating Structure for AC High-Voltage Circuit Breakers.

E. IEEE Standard C37.04a-2003, Standard Rating Structure for AC High-Voltage Circuit Breakers rated on a Symmetrical Current Basis - Amendment 1:

Capacitance Switching Current.

F. ANSI Standard C37.06-2000, AC High-Voltage Circuit Breakers Rated on a Symmetrical Current Basis--Preferred Ratings and Related Required Capabilities.

8.2-36 Revision 5 - May 2010

G. IEEE Standard C37.09-1999, Standard Test Procedure for AC High-Voltage Circuit Breakers Rated on a Symmetrical Current Basis.

H. IEEE Standard C37.09a-2005, Standard Test Procedure for AC High-Voltage Circuit Breakers Rated on a Symmetrical Current Basis - Amendment 1:

Capacitance Switching Current.

I. IEEE Standard C37.010-1999, Application Guide for AC High-voltage Circuit Breakers Rated on a Symmetrical Current Basis.

J. IEEE Standard C37.011-2005, Application Guide for Transient Recovery Voltage for AC High-Voltage Circuit Breakers.

K. IEEE Standard C37.013-1997, Standard for AC High-Voltage Generator Circuit Breakers Rated on a Symmetrical Current Basis.

8.2-37 Revision 5 - May 2010

SRP Section 8.2 "Offsite Power System" Description of Changes Revision 5 to SRP Section 8.2 updates Revision 4 of this section, dated March 2007, to reflect the following changes:

1. This SRP section is administratively updated by the Office of New Reactors, per request from Juan D. Peralta, Branch Chief, Quality and Vendor Branch 1, Division of Construction, Inspection, and Operational Programs, memorandum dated February 17, 2010 (ADAMS Accession No. ML10090148).

8.2-38 Revision 5 - May 2010

NRC-048 Submitted Nov. 10, 2015 NUREG-0800 U.S. NUCLEAR REGULATORY COMMISSION STANDARD REVIEW PLAN 8.2 OFFSITE POWER SYSTEM REVIEW RESPONSIBILITIES Primary - Organization Responsible for Electrical Engineering Review Secondary - None I. AREAS OF REVIEW The descriptive information, analyses, and referenced documents, including electrical single-line diagrams, electrical schematics, logic diagrams, tables, and physical arrangement drawings for the offsite power systems, presented in the applicant's safety analysis report (SAR), are reviewed. The objective of the review is to determine that this system satisfies the requirements of Title 10 of the Code of Federal Regulations (CFR), Part 50, Appendix A, General Design Criteria (GDCs) 2, 4, 5, 17, and 18, and will perform its design functions during all plant operating and accident conditions. The offsite power system is referred to in industry standards and regulatory guides (RGs) as the "preferred power system.@ The interface of the preferred power supply with an alternate ac (AAC) power source for safe shutdown in the event of a station blackout (SBO) (non-design-basis accident (DBA)) is also reviewed with respect to its adequacy and independence from the offsite and onsite power systems. The AAC source may be a combustion turbine generator, a diesel generator, or other diverse power source. The design, operation, and performance of the alternate ac power source are reviewed in Standard Review Plan (SRP) Section 8.4.

Revision 5 - May 2010 USNRC STANDARD REVIEW PLAN This Standard Review Plan, NUREG-0800, has been prepared to establish criteria that the U.S. Nuclear Regulatory Commission staff responsible for the review of applications to construct and operate nuclear power plants intends to use in evaluating whether an applicant/licensee meets the NRC's regulations. The Standard Review Plan is not a substitute for the NRC's regulations, and compliance with it is not required. However, an applicant is required to identify differences between the design features, analytical techniques, and procedural measures proposed for its facility and the SRP acceptance criteria and evaluate how the proposed alternatives to the SRP acceptance criteria provide an acceptable method of complying with the NRC regulations.

The standard review plan sections are numbered in accordance with corresponding sections in Regulatory Guide 1.70, "Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants (LWR Edition)." Not all sections of Regulatory Guide 1.70 have a corresponding review plan section. The SRP sections applicable to a combined license application for a new light-water reactor (LWR) are based on Regulatory Guide 1.206, "Combined License Applications for Nuclear Power Plants (LWR Edition)."

These documents are made available to the public as part of the NRC's policy to inform the nuclear industry and the general public of regulatory procedures and policies. Individual sections of NUREG-0800 will be revised periodically, as appropriate, to accommodate comments and to reflect new information and experience. Comments may be submitted electronically by email to NRR_SRP@nrc.gov.

Requests for single copies of SRP sections (which may be reproduced) should be made to the U.S. Nuclear Regulatory Commission, Washington, DC 20555, Attention: Reproduction and Distribution Services Section, or by fax to (301) 415-2289; or by email to DISTRIBUTION@nrc.gov. Electronic copies of this section are available through the NRC's public Web site at http://www.nrc.gov/reading-rm/doc-collections/nuregs/staff/sr0800/, or in the NRC's Agencywide Documents Access and Management System (ADAMS), at http://www.nrc.gov/reading-rm/adams.html, under Accession # ML100740246.

It includes two or more physically independent circuits capable of operating independently of the onsite standby power sources and encompasses the grid, transmission lines (overhead or underground), transmission line towers, transformers, switchyard components and control systems, switchyard battery systems, the main generator, generator circuit breakers or load break switches (if provided), disconnect switches, and other switchyard equipment, such as capacitor banks and volt amperes reactive (VAR) compensators, provided to supply electric power to safety-related and other equipment.

The specific areas of review are as follows:

1. The preferred power system arrangement is reviewed to determine that the required minimum of two separate circuits from the transmission network to the onsite distribution system is provided. In determining the adequacy of this system, the independence of the two (or more) circuits is examined to see that both electrical and physical separation exists so as to minimize the chance of simultaneous failure. This includes a review of the assignment of power sources from the grid; location of rights-of-way, transmission lines and towers, transformers, switchyard interconnections (breakers and bus arrangements), switchyard control systems and power supplies; and location of switchgear (in-plant), interconnections between switchgear, cable routings, main generator disconnect, the disconnect control system and power supply, and generator circuit breakers/load break switches.

2. The independence of the preferred power system is evaluated with respect to the onsite power system and any AAC power source provided for SBO. The scope of review extends to the safety-related distribution system buses that are capable of being powered by standby power sources. It does not include the supply breakers of the safety-related distribution system buses. This evaluation will include a review of the electrical protective relaying and breaker control circuits and power supplies to ensure that loss of one preferred system circuit will not cause or result in loss of the redundant counterpart, nor any AAC power source or standby power source.

3. Design information and analyses demonstrating the suitability of the power sources from the grid, including transmission lines, breakers, and transformers used for supplying preferred power from distant sources, are reviewed to ensure that each path has sufficient capacity and capability to perform its intended function. This will require examination of loads required to be powered for each plant operating condition; continuous and fault ratings of breakers, transformers, and transmission lines; and loading, unloading, and transfer effects on equipment; and power capacity available from each source.

4. The instrumentation required for monitoring and indicating the status of the preferred power system is reviewed to ensure that any change in the preferred power system that would prevent it from performing its intended function will be immediately identified by the control room operator. Also, all instrumentation for initiating safety actions associated with the preferred power system is reviewed.

5. The capability to test the preferred power system is reviewed.

6. Environmental conditions such as those resulting from high and low atmospheric temperatures, high wind, rain, lightning discharges, snow, and ice are considered in the review of the preferred power system to determine any effects on function.

7. Quality group classifications of equipment of the preferred power system are reviewed.

8. The interface(s) of the preferred power system with the AAC power source, if provided, is reviewed. The design, operation, and performance of the AAC power source are reviewed in accordance with SRP Section 8.4.

9. Inspections, Tests, Analyses, and Acceptance Criteria (ITAAC). For design certification (DC) and combined license (COL) reviews, the staff reviews the applicant's proposed ITAAC associated with the structures, systems, and components (SSCs) related to this SRP section in accordance with SRP Section 14.3, "Inspections, Tests, Analyses, and Acceptance Criteria." The staff recognizes that the review of ITAAC cannot be completed until after the rest of this portion of the application has been reviewed against acceptance criteria contained in this SRP section. Furthermore, the staff reviews the ITAAC to ensure that all SSCs in this area of review are identified and addressed as appropriate in accordance with SRP Section 14.3.

10. COL Action Items and Certification Requirements and Restrictions. For a DC application, the review will also address COL action items and requirements and restrictions (e.g., interface requirements and site parameters).

For a COL application referencing a DC, a COL applicant must address COL action items (referred to as COL information in certain DCs) included in the referenced DC.

Additionally, a COL applicant must address requirements and restrictions (e.g., interface requirements and site parameters) included in the referenced DC.

Review Interfaces Other SRP sections interface with this section as follows:

1. The organization responsible for electrical engineering reviews the adequacy of the onsite power system, including standby emergency ac power sources, safety-related ac distribution systems, station batteries and associated dc systems, and instrumentation and control power systems, as part of its primary review responsibility for SRP Sections 8.3.1 and 8.3.2.

2. The organization responsible for electrical engineering reviews the overall compliance with 10 CFR 50.63 requirements, as part of its primary review responsibility for SRP Section 8.4, including the adequacy of the SBO analysis, the adequacy of reliability targets for onsite ac sources (diesel generators), the duration for which the plant will be able to withstand or cope with, and recover from, a SBO event.

3. The organization responsible for the review of reactor systems determines those system components requiring electric power as a function of time for each mode of reactor 8.2-3 Revision 5 - May 2010

operation and accident condition as part of its primary review responsibility for SRP Sections 4.6, 5.4.6, 5.4.7, 5.4.12, 6.3, and 9.3.5.

4. The organization responsible for the review of plant systems determines those system components requiring electric power as a function of time for each mode of reactor operation and accident condition as part of its primary review responsibility for SRP Sections 6.5.1, 6.7, 9.1.3, 9.1.4, 9.2.1, 9.2.2, 9.2.4, 9.2.5, 9.2.6, 9.3.1, 9.3.3, 9.4.1 through 9.4.5, 9.5.1, 10.4.5, 10.4.7, and 10.4.9.

5. The organization responsible for the review of plant systems also verifies, on request, the adequacy of those auxiliary systems required for the proper operation of the preferred power system. These include such systems as heating and ventilation systems for switchgear in the circuits from the preferred power sources to the onsite power distribution system buses and main generator auxiliary systems such as the cooling water system, hydrogen cooling system, turbine electro-hydraulic control system, and air supply system.

6. The organization responsible for the review of plant systems verifies, on request, the physical arrangements of components and structures of the preferred power system to ensure that the paths from the preferred power sources to the standby power distribution system buses will not experience simultaneous failure under operating or postulated accident environmental conditions. This includes the effects of floods, missiles, pipe whipping, and discharging fluids that result from equipment failures.

7. The organization responsible for the review of plant systems examines fire detection and firefighting systems in preferred power system areas to ensure that the adverse effects of fire are minimized as part of its primary review responsibility for SRP Section 9.5.1.

The plant systems review includes evaluation of the adequacy of fire protection provided for redundant power supplies and circuits.

8. The organization responsible for the review of materials and chemical engineering determines those system components requiring electric power as a function of time for each mode of reactor operation and accident condition as part of its primary review responsibility for SRP Sections 5.4.8, 9.2.3, 9.3.2, and 9.3.4.

9. The organization responsible for civil engineering and geosciences review provides, on request, the information necessary to assess the effects of environmental conditions (i.e., high and low atmospheric temperature, high winds, rain, ice, and snow) on the preferred power system.

10. The organization responsible for the review of instrumentation and controls determines those system components requiring electric power as a function of time for each mode of reactor operation and accident condition as part of its primary review responsibility for SRP Sections 7.2 through 7.7. The organization responsible for the review of instrumentation and controls also verifies the adequacy of the preferred power system instrumentation and controls.

8.2-4 Revision 5 - May 2010

11. The organization responsible for the review of technical specifications (TS) coordinates and performs reviews of TS as part of its primary review responsibility for SRP Section 16.0.

12. The organization responsible for the review of containment systems and severe accidents determines those system components requiring electric power as a function of time for each mode of reactor operation and accident condition as part of its primary review responsibility for SRP Sections 6.2.2, 6.2.3, 6.2.4, and 6.2.5.

13. The organization responsible for quality assurance review determines the acceptability of the preoperational and initial startup tests and programs as part of its primary review responsibility for SRP Section 14.2.

14. The organization responsible for human factors, reviews the adequacy of administrative, testing, and operating procedure programs as part of its primary review responsibility for SRP Sections 13.5.1.1, 13.5.1.2, 13.5.2.1 and 13.5.2.2.

15. The organizational responsible for quality assurance performs the reviews of design, construction, and operation phase quality assurance programs under SRP Chapter 17.

In addition, while conducting regulatory audits in accordance with Office Instruction NRR-LIC-111 or NRO-REG-108, Regulatory Audits, the technical staff may identify quality-related issues. If this occurs, then the technical staff should contact the organization responsible for quality assurance to determine if an inspection should be conducted.

The specific acceptance criteria and review procedures are contained in the referenced SRP sections.

II. ACCEPTANCE CRITERIA Requirements In general, the preferred power system is acceptable when it can be concluded that two separate circuits from the transmission network to the onsite Class 1E power distribution system are provided, adequate physical and electrical separation exists, and the system has the capacity and capability to supply power to all safety loads and other required equipment.

Table 8-1 of SRP Section 8.1 lists GDCs, RGs, standards, and branch technical positions (BTPs) utilized as the bases for arriving at this conclusion.

Acceptance criteria are based on meeting the relevant requirements of the following Commission regulations:

1. GDC 2, found in Appendix A to 10 CFR Part 50, as it relates to SSCs of the offsite power systems being capable of withstanding the effects of natural phenomena (excluding seismic, tornado, and flood) without the loss of the capability to perform their safety functions.

8.2-5 Revision 5 - May 2010

2. GDC 4 as it relates to SSCs of the offsite power systems being protected against dynamic effects, including the effects of missile that may result from equipment failures during normal operation, maintenance, testing, and postulated accidents.

3. GDC 5 as it relates to sharing of SSCs of the preferred power systems.

4. GDC 17 as it relates to the preferred power system's (i) capacity and capability to permit functioning of SSCs important to safety; (ii) provisions to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit or loss of power from the onsite electric power supplies; (iii) physical independence; (iv) availability.

5. GDC 18 as it relates to inspection and testing of the offsite power systems.

6. GDCs 33, 34, 35, 38, 41, and 44 as they relate to the operation of the offsite electric power system, encompassed in GDC 17, to ensure that the safety functions of the systems described in GDCs 33, 34, 35, 38, 41, and 44 are accomplished.

7. 10 CFR 50.63 as it relates to an AAC power source (as defined in 10 CFR 50.2) provided for safe shutdown (non-DBA) in the event of a SBO.

8. 10CFR 50.65(a)(4) as it relates to the assessment and management of the increase in risk that may result from proposed maintenance activities before performing the maintenance activities. These activities include, but are not limited to, surveillances, post-maintenance testing, and corrective and preventive maintenance. Compliance with the maintenance rule, including verification that appropriate maintenance activities are covered therein, is reviewed under SRP Chapter 17. Programs for incorporation of requirements into appropriate procedures are reviewed under SRP Chapter 13.

9. 10 CFR 52.47(b)(1), which requires that a DC application contain the proposed ITAAC that are necessary and sufficient to provide reasonable assurance that, if the inspections, tests, and analyses are performed and the acceptance criteria met, a plant that incorporates the DC is built and will operate in accordance with the DC, the provisions of the Atomic Energy Act (AEA), and the U.S. Nuclear Regulatory Commissions (NRC's) regulations;

10. 10 CFR 52.80(a), which requires that a COL application contain the proposed inspections, tests, and analyses, including those applicable to emergency planning, that the licensee shall perform, and the acceptance criteria that are necessary and sufficient to provide reasonable assurance that, if the inspections, tests, and analyses are performed and the acceptance criteria met, the facility has been constructed and will operate in conformity with the COL, the provisions of the AEA, and the NRC's regulations.

SRP Acceptance Criteria 8.2-6 Revision 5 - May 2010

Specific SRP acceptance criteria acceptable to meet the relevant requirements of the NRC=s regulations identified above are as follows for the review described in this SRP section. The SRP is not a substitute for the NRC=s regulations, and compliance with it is not required.

However, an applicant is required to identify differences between the design features, analytical techniques, and procedural measures proposed for its facility and the SRP acceptance criteria and evaluate how the proposed alternatives to the SRP acceptance criteria provide acceptable methods of compliance with the NRC regulations.

1. GDC 2 is satisfied as it relates to SSCs of the offsite power system being capable of withstanding the effects of natural phenomena such as high and low atmospheric temperatures, high wind, rain, lightning discharges, ice and snow conditions, and weather events causing regional effects as established in Chapter 3 of the SAR, and reviewed by the organizations with primary responsibility for the reviews of plant systems, civil engineering and geosciences, and mechanical engineering.

2. GDC 4 is satisfied as it relates to structures, systems, and components of the offsite power system being protected against dynamic effects, including the effects of missile that may result from equipment failures during normal operation, maintenance, testing, and postulated accidents, as established in Chapter 3 of the SAR and reviewed by the organizations with primary responsibility for the reviews of plant systems, materials, and chemical engineering.

3. GDC 5 is satisfied as it relates to: sharing of structures, systems, and components of the preferred power systems; guidelines of RG 1.32 as related to its endorsement of Section 7 of IEEE Std 308, relating to sharing of structures, systems, and components of the Class 1E power system at multi-unit stations; and guidance related to the sharing of structures, systems, and components of the offsite power system (preferred power supply) at multi-unit stations, previously addressed in the 1980 and earlier versions of IEEE Std 308, but now covered in the industry standard for preferred power supply (Reference 52).

4. GDC 17 is satisfied as it relates to the preferred power system's (i) capacity and capability to permit functioning of structures, systems, and components important to safety; (ii) provisions to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit, the loss of power from the transmission network, or the loss of power from the onsite electric power supplies; (iii) physical independence; (iv) availability and the guidelines of RG 1.32 (see also IEEE Std 308) as related to the availability and number of immediate access circuits from the transmission network; and (v) capability to meet the guidelines of Appendix A to SRP Section 8.2 as related to acceptability of generator circuit breakers and generator load break switches.

For evolutionary light water reactor design applications, as documented in SECY 94-084 for designs such as the CE-ABB System 80+ and the GE ABWR, the design should provide at least one offsite circuit to each redundant safety division that is supplied directly from an offsite power source with no intervening non-safety buses, thereby permitting the offsite source to supply power for safety buses in the event the non-safety bus(es) fails. The design should also include an alternate power source to non-safety loads, unless it can be demonstrated that existing design margins will ensure that 8.2-7 Revision 5 - May 2010

transients for loss of non-safety power events are no more severe than those associated with the turbine-trip-only event specified in current plant designs (References 33 and 35). These issues are reviewed in detail in SRP Section 8.3.1.

For passive reactor design applications, the passive safety-related systems only require electric power for valves and related instrumentation, which can be supplied from the onsite Class 1E batteries and associated dc and ac distribution systems. The acceptability of this design for the AP 1000 is documented in SECY-05-0227 and FSER NUREG-1793. If no offsite power is available, it is expected that the non-safety-related diesel generators would be available for important plant functions, but this non-safety-related ac power is not relied on to maintain core cooling or containment integrity.

Therefore, this passive reactor design supports an exemption to the requirement of GDC 17 for two physically independent offsite circuits, by providing safety-related passive safety systems for core cooling and containment integrity (see also References 33, 34, 35). However, one offsite power source with sufficient capacity and capability from the transmission network must be provided to power the safety-related systems and all other auxiliary systems under normal, abnormal, and accident conditions. The offsite power source should be designed to minimize to the extent practical the likelihood of its failure under normal, abnormal, and accident conditions.

5. GDC 18 is satisfied as it relates to the inspection and testing of the offsite electric power system.

6. GDCs 33, 34, 35, 38, 41, and 44 are satisfied as they relate to the operation of the offsite electric power system, encompassed in GDC 17, to ensure that the safety functions of the systems described in GDCs 33, 34, 35, 38, 41, and 44 are accomplished, assuming a single failure where applicable.

7. 10 CFR 50.63 is satisfied as it relates to an AAC power source (as defined in 10 CFR 50.2) provided for safe shutdown in the event of a SBO (non-DBA), and the guidelines of RG 1.155 are followed as they relate to the adequacy of the AAC source and the independence of the AAC power source from the offsite power system and onsite power system and sources.

Except for passive reactor designs described in Subsection II(2) above, new applications must provide an adequate AAC source of diverse design (with respect to ac onsite emergency sources) that is consistent with the guidance in RG 1.155 and capable of powering at least one complete set of normal safe shutdown loads. These issues are reviewed in detail in SRP Section 8.4.

8. 10 CFR 50.65, Section 50.65(a)(4), as it relates to the requirements to assess and manage the increase in risk that may result from proposed maintenance activities before performing the maintenance activities. Acceptance is based on meeting the following specific guidelines:

A. RG 1.160, as related to the effectiveness of maintenance activities for onsite emergency ac power sources including grid-risk-sensitive maintenance activities (i.e., activities that tend to increase the likelihood of a plant trip, increase loss of 8.2-8 Revision 5 - May 2010

offsite power (LOOP) frequency, or reduce the capability to cope with a LOOP or SBO).

B. RG 1.182, as related to implementing the provisions of 10 CFR 50.65 (a)(4) by endorsing Section 11 to NUMARC 93-01, ANuclear Energy Institute Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, February 22, 2000.

8.2-9 Revision 5 - May 2010

Technical Rationale The technical rationale for application of these acceptance criteria to the areas of review addressed by this SRP section is discussed in the following paragraphs:

1. Compliance with GDC 2 requires that nuclear power plant structures, systems, and components important to safety be designed to withstand the effects of natural phenomena such as high and low atmospheric temperatures, high wind, rain, lightning discharges, ice and snow conditions, and weather events causing regional effects without loss of capability to perform their intended safety function.

With regard to the offsite power system, this criterion requires that capability for the offsite power system to perform its functions be retained during the most severe natural phenomena that have been historically reported for the site and surrounding area.

Therefore, the offsite power system and its components must normally be located in areas that provide protection from the effects of high and low atmospheric temperatures, high wind, rain, lightning discharges, ice and snow conditions, and weather events causing regional effects Meeting this requirement provides assurance that equipment and structures are designed to withstand the effects associated with natural phenomena, thus decreasing the probability that climatology-related natural phenomena could initiate accidents or prevent equipment from performing its safety function during an accident.

2. Compliance with GDC 4 requires that SSCs associated with offsite power system be appropriately protected against dynamic effects, including the effects of missile that may result from equipment failures.

The offsite power system is required to provide power to systems important to safety during normal, abnormal, accident, and post-accident conditions.

Meeting these requirements provides assurance that the offsite power system supplies electric power required for operation of systems important to safety even if/when subject to adverse dynamic effects.

3. Compliance with GDC 5 requires that SSCs important to safety shall not be shared among nuclear power units, unless it can be shown that such sharing will not significantly impair their ability to perform their safety functions.

This criterion requires that component parts of the offsite power system not be shared among units without sufficient justification, thereby ensuring that an accident in one unit of a multiple-unit facility can be mitigated using an available complement of mitigative features, including required ac power, irrespective of conditions in the other units and without giving rise to conditions unduly adverse to safety in another unit. RG 1.32 is cited to establish acceptable guidance related to the sharing of SSCs of the preferred offsite power system.

8.2-10 Revision 5 - May 2010

Meeting the requirements of GDC 5 provides assurance that an accident within any one unit of a multiple-unit plant may be mitigated irrespective of conditions in other units without affecting the overall operability of the offsite power system.

4. Compliance with GDC 17 requires that onsite and offsite electrical power be provided to facilitate the functioning of SSCs important to safety. Each electric power system, assuming the other system is not functioning, must provide sufficient capacity and capability to ensure that specified acceptable fuel design limits and the design conditions of the reactor coolant pressure boundary are not exceeded as a result of anticipated operational occurrences (AOOs) and that the core is cooled and containment integrity and other vital functions are maintained in the event of postulated accidents.

GDC 17 further requires that electric power from the transmission network to the onsite electric distribution system is supplied by two physically independent circuits designed and located so as to minimize the likelihood of their simultaneous failure under operating, postulated accident, and postulated environmental conditions. Each of these circuits is required to be designed to be available in sufficient time following a loss of all onsite ac power supplies and the other offsite electric power circuit, to assure that specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded. One of these circuits is also required to be designed to be available within a few seconds following a loss-of-coolant accident (LOCA) to assure that core cooling, containment integrity, and other vital safety functions are maintained.

Provisions must also be included to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit, the loss of power from the transmission network, or the loss of power from the onsite electric power supplies. The trip of the nuclear power unit is an AOO that can result in reduced switchyard voltage, potentially actuating the plant=s degraded voltage protection and separating the plant=s safety buses from offsite power. It can also result in grid instability, potential grid collapse, inadequate switchyard voltages, and a subsequent LOOP due to loss of the real and/or reactive power support supplied to the grid from the nuclear unit. Plant TS limiting condition for operations (LCOs) require the offsite power system to be operable. However, since the capability of the offsite power system cannot be tested except when challenged during an actual event, the design bases for the offsite power system can only be assured through analysis of the grid and plant conditions. Plant operators should therefore be aware of:

(1) the capability of the offsite power system to supply power, as required by TS, during operation and (2) situations that can result in a LOOP following a trip of the plant. Plant operators are expected to declare the offsite power system inoperable in the event of degraded grid conditions that can not support adequate post-trip voltages. Additional information on the adequacy of grid voltage, grid stability and grid reliability challenges due to deregulation of the utility industry, and the effect of grid events on NPP performance are provided in References 21, 24, 25, 29, 30, and 43.

GDC 17 also requires that the onsite power supplies and the onsite electrical distribution system have sufficient independence, redundancy, and testability to perform their safety functions assuming a single failure. Therefore, no single failure will prevent the onsite 8.2-11 Revision 5 - May 2010

power system from supplying electric power, thereby permitting safety functions and other vital functions requiring electric power to be performed in the event of any single failure in the power system.

As documented in SECY 94-084, the preferred electrical distribution system for evolutionary light water reactor design plants should include: 1) an alternate offsite power source available for non-safety-related loads, unless the design margins for loss of non-safety-related loads are no more severe than turbine-trip-only events in current plants, and 2) at least one offsite circuit to each redundant safety division supplied directly from offsite power sources, with no intervening non-safety-related buses.

Passive reactor designs incorporate passive safety-related systems for core cooling and containment integrity, and therefore, do not depend on the electric power grid connection and grid stability for safe operation. However, passive reactor designs also include active systems that can provide defense-in-depth capabilities for reactor coolant makeup and decay heat removal. The accident analysis and Probabilistic Risk Analysis (PRA) need to be reviewed to identify these non-safety related systems. Once identified, review of the electrical design of the plant needs to confirm that any offsite power requirements for thses systems are met. The AP1000 safety analyses, for example, assume that the reactor coolant pumps (RCPs) can receive power at 6.9 kV from either the main generator or the grid for a minimum of 3 seconds following a turbine trip assuming no electrical fault. Should a turbine trip occur during power operation, the generator will continue rotating at synchronous speed by acting as a synchronous motor.

Anti-motoring protective relaying for the main generator will open the generator output breaker after a time delay of at least 15 seconds, during which time the rotating generator will provide voltage support for the grid. When the generator output breaker trips, the plant distribution system utilizes backfeed from the grid to maintain power to the RCPs. Therefore, grid stability analyses should verify that the grid remains stable for a minimum of 3 seconds following a turbine trip to support the assumptions made in the safety analyses for the passive reactor designs, such as the AP1000.

IEEE Std 308, as modified/supplemented by the regulatory positions of RG 1.32, establishes acceptable guidance for meeting the requirements of GDC 17.

Meeting the requirements of GDC 17 provides assurance that a reliable electric power supply can be provided for all facility operating modes, including AOOs and DBAs to permit safety functions and other vital functions to be performed, even in the event of a single failure.

5. Compliance with GDC 18 requires that electric power systems important to safety be designed to permit appropriate periodic inspection and testing of key areas and features to assess their continuity and the condition of their components. These systems shall be designed to test periodically: (1) the operability and functional performance of the components of the offsite power systems, such as onsite power sources, relays, switches, circuit breakers, and buses, and (2) the operability of the systems as a whole and, under conditions as close to design as practical, the full operational sequence that brings the systems into operation, including operation of applicable portions of the 8.2-12 Revision 5 - May 2010

protection system, and the transfer of power among the nuclear power unit, the offsite power system, and the onsite power system.

This criterion requires that the ac power system provide the capability to perform integral testing on a periodic basis.

Meeting the requirements of GDC 18 provides assurance that, when required, offsite power systems can be appropriately and unobtrusively accessed for required periodic inspection and testing, enabling verification of important system parameters, performance characteristics, and features and detection of degradation and/or impending failure under controlled conditions.

6. GDCs 33, 34, 35, 38, 41, and 44 set forth requirements for the safety systems for which the access to both offsite and onsite electric power sources must be provided.

Compliance with these criteria requires that capability be provided for reactor coolant makeup during small breaks (GDC 33), residual heat removal (GDC 34), emergency core cooling (GDC 35), containment heat removal (GDC 38), containment atmosphere cleanup (GDC 41), and cooling water for structures, systems, and components important to safety (GDC 44). These systems must be available during normal and accident conditions, as required by the specific system.

GDC 33 requires that the system design shall be such that, for preferred power system operation (if standby power is not available), the system safety function can be accomplished using the piping, pumps, and valves to maintain coolant inventory during normal reactor operations. For the offsite power system, these requirements are met if the minimum design required by GDC 17 is provided. GDCs 34, 35, 38, 41, and 44 require that safety system redundancy shall be such that, for preferred power system operation (if standby power is not available), the system safety function can be accomplished, assuming a single failure.

For passive reactor design applications, such as the AP 1000, the potential risk contribution of design basis event is minimized by not requiring ac power sources for design-basis events (DBEs). Passive reactor designs incorporate passive safety-related systems for core cooling and containment integrity, and therefore, do not depend on the electric power grid connection and grid stability for safe operation. They are designed to automatically establish and maintain safe shutdown conditions after DBEs for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, without operator action, following a loss of both onsite and offsite ac power sources.

Consequently, passive reactor designs are not required to meet the requirements of GDCs 33, 34, 35, 38, 41, and 44 for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

Meeting the requirements of these criteria as encompassed by GDC 17 provides assurance that required electric power can be provided for all facility operating modes, including transients and design basis accidents so that the safety functions required in these criteria may be performed, even in the event of any single failure.

7. Compliance with 10 CFR 50.63 requires that each light-water-cooled nuclear power plant be able to withstand or cope with, and recover from, an SBO. As required by 10 CFR 50.63, electrical systems that are necessary support systems for SBO must be 8.2-13 Revision 5 - May 2010

of sufficient capability and capacity to ensure that core cooling and appropriate containment integrity are maintained in the event of an SBO. An acceptable means of complying with 10 CFR 50.63 requirements involves the provision of an AAC source (as defined in 10 CFR 50.2) of sufficient capacity, capability, and reliability for operation of all systems required for coping with SBO and for the time required to bring and maintain the plant in safe shutdown that will be available on a sufficiently timely basis.

10 CFR 50.63 also requires (through citation of the definition of AAC source in 10 CFR 50.2) minimum potential for common mode failure (i.e., acceptable independence) between any AAC power source used for SBO and the offsite power system or onsite power sources. Electrical ties between these systems, as well as the physical arrangement of their interface equipment, must not prevent the use of any AAC power source during loss of the offsite power system and/or onsite power sources. It is also important that provisions for an AAC source will not adversely affect performance of offsite or onsite power system functions. AAC power sources located at or near the plant should conform to guidance provided in RG 1.155 concerning their capacity, capability, and physical independence from onsite safety-related systems and the preferred power system. See SRP Section 8.4 for details of the review of AAC power sources for SBO.

For passive reactor design applications, such as the AP 1000, the potential risk contribution of an SBO is minimized by not requiring ac power sources for DBEs. The safety-related passive systems in these plants do not need non-safety-related ac power sources to perform safety-related functions. They are designed to automatically establish and maintain safe shutdown conditions after DBEs for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, without operator action, following a loss of both onsite and offsite ac power sources.

Consequently, passive reactor designs meet the requirements of 10 CFR 50.63 for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

Meeting the requirements of 10 CFR 50.63 provides assurance that the nuclear power plant can be able to withstand or cope with, and recover from an SBO and will ensure that core cooling and appropriate containment integrity are maintained.

8. 10 CFR 50.65 (a)(4) requires that licensees assess and manage the increase in risk that may result from proposed maintenance activities before performing the maintenance activities. Grid stability and offsite power availability are examples of emergent conditions that may result in the need for action prior to the conduct of the assessment or that could change the conditions of a previously performed assessment. Accordingly, licensees should perform grid reliability evaluations as part of the maintenance risk assessment before performing Agrid-risk-sensitive@ maintenance activities (such as surveillances, post-maintenance testing, and preventive and corrective maintenance).

Such activities are those which could increase risk under existing or imminent degraded grid reliability conditions, including (1) conditions that could increase the likelihood of a plant trip, (2) conditions that could increase the likelihood of a LOOP or SBO, and (3) conditions that could have an impact on the plant=s ability to cope with a LOOP or SBO, such as out-of-service risk-significant equipment (for example, an EDG, a battery, a steam-driven pump, or an alternate ac power source).

8.2-14 Revision 5 - May 2010

III. REVIEW PROCEDURES The reviewer will select material from the procedures described below, as may be appropriate for a particular case.

These review procedures are based on the identified SRP acceptance criteria. For deviations from these acceptance criteria, the staff should review the applicant=s evaluation of how the proposed alternatives provide an acceptable method of complying with the relevant NRC requirements identified in Subsection II.

1. To verify that the requirements of GDC 17 are satisfied, the following review steps should be taken:

A. The electrical drawings should be examined to ensure that at least two separate circuits from the transmission network to the onsite power distribution system buses are provided (a single switchyard may be common to these paths).

For evolutionary light water reactor design applications, the design should include at least one offsite circuit to each redundant safety division that is supplied directly from an offsite power source with no intervening non-safety buses, thereby permitting the offsite source to supply power for safety buses in the event the non-safety bus(es) fail. The design should also include an alternate power source to non-safety loads, unless it is demonstrated that existing design margins will result in transients for loss of non-safety power events that are no more severe than those associated with the turbine-trip-only event specified in plant designs. See SRP Section 8.3.1 for further details.

For passive reactor design applications, such as the AP 1000, the passive safety-related systems require electric power for valves and related instrumentation which can be supplied from the onsite Class 1E batteries and associated dc and ac distribution systems. If no offsite power is available, it is expected that the non-safety-related diesel generators would be available for important plant functions. However, this non-safety-related ac power is not relied on to maintain core cooling or containment integrity. Therefore, the passive reactor design supports an exemption to the requirements of GDC 17 for two physically independent offsite circuits, by providing safety-related passive safety systems for core cooling and containment integrity.

As documented in SECY 94-084 & SECY-95-132, the staff addressed technical issues associated with the regulatory treatment of non-safety systems (RTNSS) process in passive plant designs. Risk-important, non-safety-related, active systems in passive light water reactors may have a significant role in accident and consequence mitigation by providing defense-in-depth functions to supplement the capability of the safety-related passive systems. For example, in the AP 1000 passive reactor design, ac power from an offsite system is required to power the normal residual heat removal system (RNS) and also to provide a means of supplying power to post-accident monitoring and ac input power for Class 1E dc battery chargers. The RNS provides a non-safety-related means 8.2-15 Revision 5 - May 2010

available to inject water into the reactor coolant system (RCS) for reactor coolant makeup and decay heat removal. The design review should therefore cover the offsite power requirements to support those risk-important, non-safety-related, active systems identified through the RTNSS process.

B. The routing of transmission lines should be examined on the station layout drawings and verified during the site visit to ensure that at least two circuits from the offsite grid to the onsite distribution buses are physically separate and independent. No other lines should cross above these two circuits. Attention should be directed toward ensuring that no single event such as a tower falling or a line breaking can simultaneously affect both circuits in such a way that neither can be returned to service in time to prevent fuel design limits or design conditions of the reactor coolant pressure boundary from being exceeded. In addition, the reviewer should verify that no single-point vulnerability exists whereby a weather-related event could disable any portion of the preferred power sources and simultaneously cause failure to supply AAC power.

C. As the switchyard may be common to both offsite circuits, the electrical schematics of the switchyard breaker control system, its power supply and the breaker arrangement itself should be examined for the possibility of simultaneous failure of both circuits from single events such as a breaker not operating during fault conditions, spurious relay trip, loss of a control circuit power supply, or a fault in a switchyard bus or transformer. An example of a single-failure susceptibility of a transmission line protection scheme that was the primary cause of a cascading blackout and LOOP event is described in Reference 27. In addition, the reviewer should examine the failure modes and effects analysis (FMEA) of the switchyard by the applicant to verify that no single event would simultaneously fail both offsite power circuits and would fail one offsite circuit for passive design.

D. The design is examined to determine that at least one of the two required circuits can, within a few seconds, provide power to safety-related equipment following a LOCA. GDC 17 does not require these circuits in themselves to be single-failure-proof for this accident. However, it is required that each circuit have the capability to be available in sufficient time to prevent fuel design limits and design conditions of the reactor coolant pressure boundary from being exceeded. Therefore, the design is examined to determine that the period of time that the station can remain in a safe condition assuming no ac power is available is greater than the time required to reestablish ac power from the offsite grid to the onsite Class 1E distribution buses for each single failure event.

The switchyard circuit breaker control scheme should be such that any incoming transmission line, switchyard bus, or any path to the onsite safety-related distribution buses can be isolated so that ac power can be reestablished to the onsite Class 1E buses through its redundant counterpart. This should be achieved with separate and redundant breaker tripping and closing devices that are actuated by redundant dc battery supplies. Air stored under pressure in accumulators or spring energy should be used to open and/or close breakers 8.2-16 Revision 5 - May 2010

independent of ac power. Further information for the reviewer on the importance of redundancy in transmission grid protective schemes is provided by operating experience events (Reference 27).

For those designs that utilize a backfeed path through the main generator step-up transformer, the reviewer must first ascertain if this path is required to satisfy the GDC 17 requirement for an immediate or delayed access circuit. If the circuit is for delayed access only, then the same determination (as discussed in the previous paragraph) must be made, i.e., there is sufficient time to make this circuit available (assuming the availability of the grid itself but the unavailability of the immediate access circuit and the onsite power supplies) such that the reactor remains in a safe condition. If the circuit is required for immediate access or utilizes generator circuit breakers or generator load break switches, then the reviewer should use the guidelines contained in Appendix A to this SRP section.

E. Each of the circuits from the offsite system to the onsite distribution buses shall have the capacity and capability to supply the loads assigned to the bus or buses it is connected to during normal or abnormal operating conditions, accident conditions, or plant shutdown conditions. Therefore, the loads to be supplied during these conditions should be determined from information obtained in coordination with other staff. The capacity and electrical characteristics of transformers, circuit breakers, buses, transmission lines, other electrical equipment, and the preferred power source for each path should be evaluated to ensure that there is adequate capability to supply the maximum connected load during all plant conditions. The design should also be examined to ensure that during transfer from one power source to another the design limits of equipment are not exceeded. Industry standards (References 46 & 48) and, for COL applications, RG 1.206 (Section C.I.8.2.2), provide further information for the reviewer regarding power system analytical studies to verify the capability of the offsite power systems and their interfaces with the onsite power system.

F. The results of the grid stability analysis must show that loss of the largest single supply to the grid does not result in the complete loss of preferred power. The analysis should consider the loss, through a single event, of the largest capacity being supplied to the grid, removal of the largest load from the grid, or loss of the most critical transmission line. This could be the total output of the station, the largest station on the grid, or possibly several large stations if these use a common transmission tower, transformer, or a breaker in a remote switchyard or substation. The station layout and the grid system layout drawings are reviewed to determine that all the above events were included in the analysis. BTP 8-6, industry standards (e.g., References 46 & 48), and, for COL applications, RG 1.206 (Section C.I.8.2.2) provide further information for the reviewer regarding stability studies of offsite power systems.

The reviewer verifies that the grid stability analysis considers the effect of grid events on the adequacy of offsite grid voltage available at the plant switchyard.

Operating experience has shown that a variety of factors, such as, power flow 8.2-17 Revision 5 - May 2010

through the transmission grid, reactive power capacity, the plant voltage and frequency protective schemes and setpoints, and weather or temperature conditions in the region can all affect grid voltage levels and overall stability.

BTP 8-6 and References 21, 25, 29, 30, and 43 provide information for the reviewer regarding degraded transmission grid voltage and the effects of grid events on grid voltage at the plant switchyard.

The applicant should include in the grid stability analysis the consideration of failure modes that could result in ac frequency variations exceeding the maximum rate of change determined in the accident analysis for loss of reactor coolant flow. Failure modes that could produce abnormal frequency events and the plant frequency protection schemes are reviewed. Abnormal frequency operating experience from the assessment of grid transient events (Reference

43) and industry standards (Reference 54) provide further information on abnormal frequency considerations at nuclear power plants.

Passive reactor designs incorporate passive safety-related systems for core cooling and containment integrity and therefore, do not depend on the electric power grid connection and grid stability for safe operation. Passive reactor designs also include active systems that can provide defense-in-depth capabilities for reactor coolant makeup and decay heat removal. The accident analysis and Probabilistic Risk Analysis (PRA) need to be reviewed to identify these non-safety related systems. Once identified, review of the electrical design of the plant needs to confirm that any offsite power requirements for thses systems are met. The AP1000 safety analyses, for example, assume that the RCPs can receive power at 6.9 kV from either the main generator or the grid for a minimum of 3 seconds following a turbine trip. Should a turbine trip occur during power operation, the generator will continue rotating at synchronous speed by acting as a synchronous motor. Anti-motoring protective relaying for the main generator will open the generator output breaker after a time delay of at least 15 seconds, during which time the rotating generator will provide voltage support for the grid. When the generator output breaker trips the plant distribution system utilizes backfeed from the grid to maintain power to the RCPs.

Also, the reviewer should verify that the analyses in Chapter 15 do not assume operation of the RCPs following the turbine trip if the initiating event is an electrical system failure (such as failure of the isolated phase bus or transformers). Review of the grid stability analyses should verify that the grid remains stable for a minimum of 3 seconds following a turbine trip to support the assumptions made in the safety analyses for the passive reactor designs such as the AP1000. NUREG-1793 provides additional information on grid stability analyses for the AP1000.

G. During the review of the electrical schematics, it should be determined that loss of standby power will not result in loss of preferred power, loss of one preferred power circuit will not result in loss of the other circuit, loss of the main generator will not result in loss of either preferred power circuit, and loss of any combination of these power sources will not prevent the use of AAC power.

H. The reviewer verifies that the preferred power system is independent of the onsite power system. The basis for acceptance is that no single event, including 8.2-18 Revision 5 - May 2010

a single protective relay, interlock, or switchgear failure, in the event of loss of all standby power sources, will prevent the separation of the preferred power system from the onsite power distribution system or prevent the preferred power system from accomplishing its intended functions. In addition, the preferred and standby power supplies should not have common failure modes. An acceptable design must be capable of restoring the preferred power supply after the loss of either circuit in a time period such that the plant can be safely shut down, taking into account the effects of a single failure in the onsite distribution system. This item is also addressed in SRP Section 8.3.1.

I. The reviewer verifies that adequate provisions are made in the design of the plant and the offsite and onsite power systems for grounding, surge protection, and lightning protection. The reviewer evaluates the plant/station grounding systems, the methods of equipment and structural grounding, ac power system neutral grounding and ground fault current limiting features, surge and lightning protection features for outdoor equipment and circuits, and the measures for isolation of instrumentation grounding systems. RG 1.204 and IEEE Stds 665, 666, 1050, and C62.23, provide acceptable guidelines for the design, installation, and performance of station grounding systems and surge and lightning protection systems.

J. The reviewer should verify that provisions are included in the design to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit, the loss of power from the transmission network, or the loss of power from the onsite electric power supplies. The trip of the nuclear power unit is an anticipated operational occurrence that can result in reduced switchyard voltage, potentially actuating the plant=s degraded voltage protection and separating the plant=s safety buses from offsite power. It can also result in grid instability, potential grid collapse, inadequate switchyard voltages, and a subsequent LOOP due to loss of the real and/or reactive power support supplied to the grid from the nuclear unit. Plant TS LCOs require the offsite power system to be operable.

However, since the capability of the offsite power system cannot be tested except when challenged during an actual event, the design bases for the offsite power system can only be assured through analysis of the grid and plant conditions. Plant operators should, therefore, be aware of: (1) the capability of the offsite power system to supply power, as required by TS, during operation and (2) situations that can result in a LOOP following a trip of the plant. Plant operators are expected to declare the offsite power system inoperable in the event of degraded grid conditions that can not support post-trip voltages. Further, the reviewer should verify that communications (both voice and data) between the NPP and its offsite transmission system operating authorities must be implemented in assessing whether the offsite power sources are operable as required by GDC17 and the plant TS. In addition, the reviewer should verify that grid reliability evaluations, performed as part of the maintenance risk assessment required by 10 CFR 50.65 before conducting Agrid-risk-sensitive@ maintenance activities, are considered when evaluating the operability of the offsite power system.

8.2-19 Revision 5 - May 2010

The applicant=s methods and procedures for confirming the operational readiness of offsite power systems are reviewed to verify that plant operators are aware of the capability of the offsite power system to supply power during operation and situations that can result in a LOOP following a trip of the plant. This includes a review of communication agreements and protocols that exist between the NPP and the transmission system operator (TSO), independent system operator (ISO), or reliability coordinator/authority (RC/RA). The agreements and protocols should be verified to include preferred operating limits for the offsite power system and preferred actions for recovering from a LOOP event. It should also include the use of transmission load flow analysis and real time contingency analysis (RTCA) software tools (analysis tools) (directly or through the TSO) to assist the NPP in monitoring grid conditions and operating status to determine the operability of offsite power systems under plant technical specifications (TS).

The review should verify that the communication protocols are enforced by a formal contract or other means and include notification requirements to inform the NPP when the grid is stressed to the point where a trip of the NPP would result in inadequate post-trip switchyard voltages (less than the design basis voltage) for either actual grid conditions or potential (i.e., anticipatory contingency) grid conditions within any predetermined time limits. Additionally, the reviewer may perform independent calculations using the electronic copy of the model of the onsite distribution system provided by the applicant to ensure that each offsite power circuit has sufficient capacity and capability to provide power to the safety loads. See Section 8.3 for details. The reviewer should also review the description of the analysis tool used by the TSO to determine, in real time, the impact that the loss or unavailability of various transmission system elements will have on the condition of the transmission system to ensure that adequate post-trip voltages are available at the switchyard.

The true capability of the offsite source cannot necessarily be verified through direct readings of plant switchyard or safety bus voltages. Recent operating experience (Reference 43) has shown that analyses of the surrounding grid and plant conditions, based on accurate and timely transmission system data, are needed to evaluate all possible contingencies at a given time. The reviewer should verify that adequate status information, communications, analytical resources, and procedures are provided to determine that the plant is operating within the offsite power grid operability limits required by GDC 17 and the plant=s TS. The information and guidance provided in NRC generic communications (Reference 21), industry standards (Reference 50), and other NRC documents (e.g., References 22, 24, 25, 29, 30, and 43) are useful in the review of the adequacy and reliability of the plant=s interface with the offsite power grid and communication with offsite transmission system operating authorities.

K. The reviewer should verify that adequate procedures, administrative controls, and protocols are in place to ensure that no modifications to the offsite power system circuits credited for satisfying GDC 17 are implemented by offsite transmission system operating authorities, responsible for maintenance, modification, and operation of the offsite transmission grid, without the performance of a proper safety evaluation. The safety evaluation of transmission 8.2-20 Revision 5 - May 2010

system modifications is required to ensure that the transmission grid configuration, stability, and capability remain within the assumptions of the plant safety analyses. Further information on potential unreviewed safety questions associated with modifications to offsite transmission circuits can be found in Reference 45. In addition, the reviewer should verify that grid reliability evaluations are performed for maintenance or modifications to the offsite power system, as part of the maintenance risk assessment required by 10 CFR 50.65 before performing Agrid-risk-sensitive@ maintenance activities.

L. Operating experience has shown that undetected degradation of underground electric cables due to protracted exposure to wetted environments or submergence in water or resulting from pre-existing manufacturing defects could result in multiple equipment failures. Underground or inaccessible power and control cable runs that are susceptible to protracted exposure to wetted environments or submergence as a result of tidal, seasonal, or weather event water intrusion are reviewed. Cables from independent power sources or different safety divisions could be affected by the same condition. Underground or inaccessible power cables connecting offsite power to safety buses or power and control cables to equipment with accident mitigating functions should be considered in the review. Examples of submerged cable failures from the operating experience are provided in Reference 26.

2. To ensure that the requirements of GDC 18 are satisfied, the detailed description of the design should be examined to determine that the design includes provisions for testing the transfer of the source of power feeding the onsite distribution system, e.g., from the main generator supply to the preferred power system, or to any other supply. It should also be established that the circuitry required to perform these transfer functions has the capability of being tested during plant operation. The organization responsible for quality assurance and maintenance should review preoperational and initial startup test procedures. The organization responsible for quality assurance and maintenance should also review the periodic test procedures.

RG 1.204 provides acceptable guidelines for an adequate and acceptable testing and maintenance approach for the reviewer to confirm the proper installation of a lightning protection system and ensure its continued ability to provide the level of protection for which it was designed. The reviewer should verify that new lightning protection systems (LPSs) are inspected following installation, and reinspected at least on a regular, periodic throughout their lifetime. In particular, an LPS should be inspected whenever any alterations or repairs are made to a protected structure, as well as following any known lightning transient to the system. An LPS should be visually inspected at least annually. In areas where severe climatic changes occur, it is advisable to inspect the LPS semiannually or following extreme changes in ambient temperature. The reviewer should verify that testing and maintenance procedures are established for each LPS.

The frequency of testing and maintenance will depend on weather-related degradation of protective features, frequency and severity of damage attributable to lightning transients, and required protection level. The LPS testing and maintenance program is reviewed for the following activities: (1) inspection of all conductors and system components, (2) tightening of all clamps and splices, (3) measurement of the earth grounding resistance, 8.2-21 Revision 5 - May 2010

(4) measurement of the resistance of ground terminals, (5) inspection or testing (or both) of surge protection devices (SPDs) to assess their effectiveness, (6) periodic testing and maintenance of earth grounding systems, (7) refastening and tightening of components and conductors as required, (8) inspection and testing when the LPS has been altered by additions to, or changes in, the structure, and (9) complete records.

3. GDCs 33, 34, 35, 38, 41, and 44 set forth requirements for the safety systems whose source of power is the preferred power system. These criteria state that safety system redundancy shall be such that, for preferred power system operation (assuming standby power is not available), the system safety function can be accomplished assuming a single failure.

To ensure that these requirements of the GDC identified above are satisfied, the electrical schematics of the systems required for reactor coolant makeup, residual heat removal, emergency core cooling, containment heat removal, containment atmosphere cleanup, and cooling water should be examined to ensure that the circuits from the preferred power system can supply redundant portions of these systems. If the minimum design required by GDC 17 is provided, the immediately available preferred circuit must be made available to the redundant portions of these systems.

4. All offsite power system equipment and components in the station switchyard and its connection to the onsite Class 1E system are reviewed to determine that they are appropriately included in the NPP quality assurance program. Safety-related equipment and components, and those required to support systems with accident mitigating functions, should have the appropriate quality classifications. The review should verify that procedures, maintenance, and surveillance tests associated with the equipment and components incorporate the appropriate quality controls. The organization responsible for quality assurance and maintenance should determine the adequacy of the quality assurance program.

5. To verify that the requirements (excluding seismic, tornado, and floods) of GDC 2 are satisfied for the facility being considered, the organization responsible for civil engineering and geosciences review should provide to the organization responsible for electrical engineering review, upon request, information on the design basis, high and low atmospheric temperatures, high wind, rain, lightning discharges, ice and snow conditions, and weather events causing regional effects. This information should be considered during the review to verify that the design minimizes the effects of these conditions in accordance with GDC 17. Items such as switchyard and transformer locations, transformer cooling, overhead transmission lines, underground or inaccessible power and control cables could be affected by these conditions. Operating experience provides additional information on the effects of severe heat and cold on electrical system equipment (References 23 and 28) and on the effects of protracted submergence and wet environments on underground electric cables (Reference 26).

Communication links between the plant operators and local TSO/ISOs serve as a means to obtain timely information on power grid operating conditions and status to verify the operability of the offsite power grid in accordance with the requirements of the plant=s technical specifications. Communications with offsite entities are also important for 8.2-22 Revision 5 - May 2010

restoration of offsite power in the event of a LOOP or SBO. The plant=s offsite communications equipment and protocols, communication contingency procedures, communications circuit routing, and telemetry links used to monitor the power grid and to verify and maintain grid stability and operability should be reviewed to determine that they are secure and will continue to function during severe weather events causing regional effects. Operating experience provides additional information on offsite communications capability and integrity during severe weather events (Reference 22).

6. To ensure that the requirements of GDC 4 are satisfied, the organization responsible for the review of plant systems should review the location of SSCs of the preferred power system to determine the protection provided against dynamic effects, including effects of missiles, pipe whipping, and discharging fluids, that may result from equipment failures and from events and conditions outside the station. This information should be used to determine the possibility of simultaneous loss of both paths of preferred power.

7. To ensure that the requirements of GDC 5 are satisfied, the SSCs of the preferred power systems should be examined to identify any that are shared between units of a multi-unit station. These should be reviewed to ascertain that they have sufficient capacity and capability of performing all required safety functions in the event of an accident in one unit, with a simultaneous orderly shutdown and cooldown of the remaining units. Review of the design criteria should establish that the capacity and capability of incoming lines, power sources, and transformers for each required circuit have margin to achieve this.

Spurious or false accident signals should not overload these circuits. SRP Section 8.3.1 further discusses spurious or false accident signal considerations.

8. The preferred power system instrumentation provided to monitor variables and equipment status should be identified during the electrical schematic and system description review. It should be ascertained that these instruments present status information that can be used to determine the condition of the preferred power system at all times. Review of the electrical schematics should determine that controls (automatic, manual, or remote) are provided to maintain these variables and systems within prescribed operating ranges. It should also be determined during the review of the electrical schematics as to what effects failures of these controls and instruments might have on the preferred power system.

9. The review of any automatic TSO action should ascertain that TSO actions (including normal and postulated failure modes of operation) will not interfere with safety actions that may be required of the reactor protection system. This system should also be reviewed to ensure that no failure mode of the TSO system will cause an incident at the generating station which would require protective action.

10. To verify that the relevant requirements of 10 CFR 50.63 are met, if an AAC source is proposed for safe shutdown in the event of an SBO, the capacity, capability, reliability, and independence of the AAC power source are reviewed in accordance with SRP Section 8.4.

For evolutionary light water reactor design applications, the reviewer verifies, in accordance with SRP Section 8.4, that the AAC for SBO is of diverse design (with 8.2-23 Revision 5 - May 2010

respect to onsite sources), is consistent with guidance in RG 1.155, has adequate capacity, and has capability for powering at least one complete set of normal safe shutdown loads.

11. The Maintenance Rule Section 50.65(a)(4) requires that licensees assess and manage the increase in risk that may result from proposed maintenance activities before performing the maintenance activities. RG 1.182, used as a companion guide to RG 1.160, provides guidance for assessing and managing the increase in risk that may result from maintenance activities and for implementing the optional reduction in scope of SSC=s considered in the assessment. The review should verify that grid reliability evaluations are performed, as part of the maintenance risk assessment required by 10 CFR 50.65 before performing Agrid-risk-sensitive@ maintenance activities, including, but not limited to, surveillances, post-maintenance testing, and corrective and preventive maintenance. Such activities are those which could increase risk under existing or imminent degraded grid reliability conditions, including: (1) conditions that could increase the likelihood of a plant trip, (2) conditions that could increase the likelihood of LOOP or SBO, and (3) conditions that have an impact on the plant=s ability to cope with a LOOP or SBO, such as, out-of-service risk-significant equipment (e.g., an EDG, a battery, a steam-driven pump, and alternate ac power source).

12. For reviews of DC and COL applications under 10 CFR Part 52, the reviewer should follow the above procedures to verify that the design set forth in the safety analysis report, and if applicable, site interface requirements meet the acceptance criteria. For DC applications, the reviewer should identify necessary COL action items. With respect to COL applications, the scope of the review is dependent on whether the COL applicant references a DC, an ESP or other NRC-approved material, applications, and/or reports.

After this review, SRP Section 14.3 should be followed for the review of Tier I information for the design, including the postulated site parameters, interface criteria, and ITAAC.

IV. EVALUATION FINDINGS The reviewer verifies that the applicant has provided sufficient information and that the review and calculations (if applicable) support conclusions of the following type to be included in the staff's safety evaluation report (SER). The reviewer also states the bases for those conclusions.

The offsite power system includes two or more identified circuits from the grid and its transmission lines to the onsite distribution system. The review of the offsite power system for the __________ plant covered single-line diagrams, station layout drawings and schematic diagrams, and descriptive information.

8.2-24 Revision 5 - May 2010

The basis for acceptance of the offsite power system in our review was conformance of the design criteria and bases to the Commission's regulations as set forth in the GDC of Appendix A to 10 CFR Part 50. The staff concludes that the plant design is acceptable and meets the requirements of GDCs 2, 4, 5, 17, and 18 and also meets the requirements of 10 CFR 50.63 with regard to the AAC power source provided for SBO.

This conclusion is based on the following:

1. The applicant has met the requirements of GDC 2, "Design Basis for Protection Against Natural Phenomena," with respect to SSCs of the offsite power systems being capable of withstanding the effects of natural phenomena such as high and low atmospheric temperatures, high wind, rain, lightning discharges, ice and snow conditions, and weather events causing regional effects by locating the offsite power system and components in areas which provide protection from the effects of natural phenomena by adequate plant design.

2. The applicant has met the requirements of GDC 4, "Environmental and Dynamic Effects Design Bases," with respect to SSCs of the offsite power system being capable of withstanding dynamic effects, including effects of missiles, pipe whipping, and discharging fluids that may result from equipment failures and from events and conditions outside the nuclear power unit associated with normal operation, maintenance, testing, and postulated accidents by adequate plant design.

3. The applicant has met the requirements of GDC 5, "Sharing of Structures, Systems, and Components," with respect to sharing of circuits of the preferred power system between units. Each circuit has sufficient capacity to operate the engineered safety features for a design basis accident on one unit and those systems required for concurrent safe shutdown on the remaining units.

4. The applicant has met the requirements of GDC 17, "Electric Power Systems," with respect to the offsite power system's (a) capacity and capability to permit functioning of structures, systems, and components important to safety; (b) provisions to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit or loss of power from the onsite electric power supplies; c) physical independence of circuits; and (d) availability of circuits. The preferred power system consists of at least two physically independent circuits routed from the electrical grid system by transmission lines to the onsite power distribution system. At least one circuit will be available within a few seconds following a loss of coolant accident and is considered an immediate access circuit. Each circuit is designed and located so as to minimize to extent practical the likelihood of their simultaneous failure under operating and postulated accident and environmental conditions. Each circuit has been sized with sufficient capacity to supply all connected loads. Each circuit can be made available to the onsite power system, assuming loss of the onsite ac standby power supplies and loss of the other offsite circuit, to ensure that fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded. The switchyard is arranged such that each offsite circuit can be isolated from other circuits to permit reestablishment of offsite power to the onsite distribution system. The switchyard is also arranged such that single events (e.g.,

a spurious relay trip or a breaker not operating during fault conditions) will not cause 8.2-25 Revision 5 - May 2010

simultaneous failure of all offsite circuits to the switchyard. The results of the applicant's grid stability analysis indicated that loss of the largest generating capacity being supplied to the grid, loss of largest load from the grid, loss of the most critical transmission line, or loss of the unit itself will not cause grid instability.

This meets the guidelines of RG 1.32, "Criteria for Safety-Related Electric Power Systems for Nuclear Power Plants."

5. The applicant has met the requirements of GDC 18, "Inspection and Testing of Electric Power Systems," with respect to the capability to test systems and associated components during normal plant operation and the capability to test the transfer of power from the nuclear power unit, the offsite preferred power system, and the onsite power system.

6. The applicant=s overall compliance with the requirements of 10 CFR 50.63 is discussed in Section 8.4 of the SER. The applicant has met the requirement of 10 CFR 50.63, "Loss of All Alternating Current Power," with respect to the adequacy of the AAC power source provided for safe shutdown (non-DBA) in the event of an SBO and the independence of the AAC source from offsite power systems and onsite power sources.

In compliance with the relevant guidance of RG 1.155, the offsite AAC power source is located at or near the plant, has sufficient capacity, capability, and reliability to achieve and maintain safe shutdown (non-DBA), and is adequately independent from onsite safety-related and preferred power systems, and thus satisfies the definition for an acceptable AAC source as specified in 10 CFR 50.2.

7. The applicant has met the requirements of 10 CFR 50.65(a)(4) with respect to the onsite dc power system. The acceptability is based on meeting the relevant positions of RG 1.182.

For DC and COL reviews, the findings will also summarize the staff's evaluation of requirements and restrictions (e.g., interface requirements and site parameters) and COL action items relevant to this SRP section.

In addition, to the extent that the review is not discussed in other SER sections, the findings will summarize the staff's evaluation of the ITAAC, including design acceptance criteria, as applicable.

V. IMPLEMENTATION The staff will use this SRP section in performing safety evaluations of DC applications and license applications submitted by applicants pursuant to 10 CFR Part 50 or 10 CFR Part 52.

Except when the applicant proposes an acceptable alternative method for complying with specified portions of the Commission=s regulations, the staff will use the method described herein to evaluate conformance with Commission regulations.

The provisions of this SRP section apply to reviews of applications submitted 6 months or more after the date of issuance of this SRP section, unless superseded by a later revision.

8.2-26 Revision 5 - May 2010

VI. REFERENCES

1. 10 CFR Part 50, '50.2, ADefinitions.@

2. 10 CFR Part 50, '50.63, "Loss of All Alternating Current Power.@

3. 10 CFR Part 50, '50.65, "Requirements for monitoring the effectiveness of maintenance at nuclear power plants."

4. 10 CFR Part 50, Appendix A, GDC 2, "Design Bases for Protection Against Natural Phenomena."

5. 10 CFR Part 50, Appendix A, GDC 4, "Environmental and Dynamic Effects Design Bases."

6. 10 CFR Part 50, Appendix A, GDC 5, "Sharing of Structures, Systems, and Components."

7. 10 CFR Part 50, Appendix A, GDC 17, "Electric Power Systems."

8. 10 CFR Part 50, Appendix A, GDC 18, "Inspection and Testing of Electric Power Systems."

9. 10 CFR Part 50, Appendix A, GDC 33, "Reactor Coolant Makeup."

10. 10 CFR Part 50, Appendix A, GDC 34, "Residual Heat Removal.@

11. 10 CFR Part 50, Appendix A, GDC 35, "Emergency Core Cooling.@

12. 10 CFR Part 50, Appendix A, GDC 38, "Containment Heat Removal.@

13. 10 CFR Part 50, Appendix A, GDC 41, "Containment Atmosphere Cleanup.@

14. 10 CFR Part 50, Appendix A, GDC 44, "Cooling Water.@

15. BTP 8-6, "Adequacy of Station Electric Distribution System Voltages.@

16. BTP 8-3, "Stability of Offsite Power Systems.@

17. SRP Section 8.1, Table 8-1, "Acceptance Criteria for Electric Power.@

18. SRP Section 8.1, Appendix 8-A, "General Agenda, Station Site Visits.@

19. Appendix A to SRP Section 8.2, "Guidelines for Generator Circuit Breakers/Load Break Switches.@

20. SRP Section 8.4, "Station Blackout.@

8.2-27 Revision 5 - May 2010

21. NRC Generic Letter 2006-02, AGrid Reliability and the Impact on Plant Risk and the Operability of Offsite Power,@ February 1, 2006.

22. NRC Information Notice 97-05, AOffsite Notification Capabilities,@ February 27, 1997.

23. NRC Information Notice 98-02, ANuclear Power Plant Cold Weather Problems and Protective Measures,@ January 21, 1998.

24. NRC Information Notice 98-07, AOffsite Power Reliability Challenges from Industry Deregulation,@ February 27, 1998.

25. NRC Information Notice 2000-06, AOffsite Power Voltage Inadequacies,@ March 27, 2000.

26. NRC Information Notice 2002-12, ASubmerged Safety-Related Electrical Cables,@

March 21, 2002.

27. NRC Information Notice 2005-15, AThree-Unit Trip and Loss of Offsite Power at Palo Verde Nuclear Generating Station,@ June 1, 2005.

28. NRC Information Notice 2006-06, ALoss of Offsite Power and Station Blackout Are More Probable During Summer Period,@ March 3, 2006.

29. NRC Regulatory Issue Summary 2000-24, AConcerns About Offsite Power Voltage Inadequacies and Grid Reliability Challenges Due to Industry Deregulation,@

December 21, 2000.

30. NRC Regulatory Issue Summary 2004-05, AGrid Reliability and the Impact on Plant Risk and the Operability of Offsite Power,@ April 15, 2004.

31. SECY 90-16, AEvolutionary Light Water Reactor Certification Issues and Their Relationships to Current Regulatory Requirements,@ January 12, 1990. Approved in the SRM of June 26, 1990.

32. SECY 91-078, AEPRI=s Requirements Document and Additional Evolutionary LWR Certification Issues,@ 1991. Approved in the SRM of August 15, 1991.

33. SECY 94-084 APolicy and Technical Issues Associated with the Regulatory Treatment of Non-safety Systems in Passive Plant Designs,@ dated March 28, 1994. Approved in the SRM of June 30, 1994.

34. SECY-95-132 APolicy and Technical Issues Associated with the Regulatory Treatment of Non-safety Systems (RTNSS) in Passive Plant Designs.@ Approved in the SRM of June 28, 1995.

35. NRC Memorandum; From: D. Crutchfield; To: File;

Subject:

Consolidation of SECY 084 and SECY-95-132, July 24, 1995. SECY-94-084 was approved in the SRM of June 30, 1994. SECY-95-132 was approved in the SRM of June 28, 1995.

8.2-28 Revision 5 - May 2010

36. SECY-05-0227, AFinal Rule B AP1000 Design Certification,@ dated December 14, 2005.

Approved in the SRM of December 30, 2005.

37. RG 1.32, "Criteria for Safety-Related Electric Power Systems for Nuclear Power Plants."

38. RG 1.155, "Station Blackout.@

39. RG 1.160, AMonitoring the Effectiveness of Maintenance at Nuclear Power Plants,@

Revision 2, March 1997. (Revision 2, ADAMS accession no. ML003761662)

40. RG 1.182, AAssessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants,@ Revision 0, May 2000.

41. RG 1.204, AGuidelines for Lightning Protection of Nuclear Power Plants,@ Revision 0, November 2005.

42. RG 1.206, ACombined License Applications for Nuclear Power Plants (LWR Edition),@

June 30, 2006.

43. NUREG-1784, AOperating Experience Assessment - Effects of Grid Events on Nuclear Power Plant Performance,@ December 2003.

44. NUREG-1793, AFinal Safety Evaluation Report Related to Certification of the AP1000 Standard Design,@ September 2004.

45. Region IV Task Interface Agreement (TIA) No. 2002-03; Evaluation of Potential Unreviewed Safety Questions Associated with Modifications Made to Offsite Power at Cooper Nuclear Station (TAC No. MB5768).

46. IEEE Std. 242-2001, ARecommended Practice for Protection and Coordination of Industrial and Commercial Power Systems,@ (Buff Book).

47. IEEE Std. 308-2001, "IEEE Standard Criteria for Class 1E Power Systems for Nuclear Power Generating Stations.@

48. IEEE Std. 399-1997, ARecommended Practice for Power Systems Analysis,@ (Brown Book).

49. IEEE Std. 665-1995 (Reaffirmed 2001), AGuide for Generating Station Grounding.@

50. IEEE Std. 666-1991 (Reaffirmed 1996), ADesign Guide for Electric Power Service Systems for Generating Stations.@

51. IEEE Std. 741-1997, AIEEE Standard Criteria for the Protection of Class 1E Power Systems and Equipment in Nuclear Power Generating Stations.@

52. IEEE Std. 765-1983, AIEEE Standard for Preferred Power Supply (PPS) for Nuclear Power Generating Stations.@ (2002 is latest revision) 8.2-29 Revision 5 - May 2010

53. IEEE Std. 1050-1996, AGuide for Instrumentation and Control Equipment Grounding in Generating Stations@

54. IEEE Std. C37.106 -2003, AGuide for Abnormal Frequency Protection for Power Generating Plants.@

55. IEEE Std. C62.23-1995 (Reaffirmed 2001), AApplication Guide for Surge Protection of Electric Generating Plants.@

56. EPRI ALWR Utility Requirements Document, Volume II, "Evolutionary Plants,@ Chapter 11, "Electric Power Systems,@ Revision 6, December 1993, Electric Power Research Institute.

57. NUMARC 93-01, AIndustry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants," Section 11. Nuclear Energy Institute, February 11, 2000.

58. NRC Information Notice 2006-18, ASignificant Loss of Safety-Related Electrical Power at Forsmark, Unit 1, in Sweden,@ August 17, 2006.

PAPERWORK REDUCTION ACT STATEMENT 8.2-30 Revision 5 - May 2010

The information collections contained in the Standard Review Plan are covered by the requirements of 10 CFR Part 50 and 10 CFR Part 52, and were approved by the Office of Management and Budget, approval number 3150-0011 and 3150-0151.

PUBLIC PROTECTION NOTIFICATION The NRC may not conduct or sponsor, and a person is not required to respond to, a request for information or an information collection requirement unless the requesting document displays a currently valid OMB control number.

8.2-31 Revision 5 - May 2010

APPENDIX A GUIDELINES FOR GENERATOR CIRCUIT BREAKERS/LOAD BREAK SWITCHES

1. Background Generator circuit breakers have been used in nuclear generating station designs (McGuire, Catawba) as a means of providing immediate access of the onsite ac power systems to the offsite circuits by isolating the unit generator from the main step-up and unit auxiliary transformers and allowing backfeeding of power through these circuits to the onsite ac power system. Generator load break switches can also be used as a means of providing access to the offsite circuits as described above, but only on a delayed basis. Since this is a new design feature, the staff made the use of generator circuit breakers and load break switches a generic safety issue (NUREG-0933, Item B-53). In the case of McGuire and Catawba, References 1, 2, and 3, an expert consultant was retained to evaluate the generator circuit breaker verification testing program and its results. These guidelines are formalization of the results of that extensive work. Also guidelines for the load break switches are incorporated, as these devices have some common functional requirements as generator breakers as described above.

The staff has made a determination that only devices that have the capability of interrupting the system maximum available fault current, i.e., circuit breakers, will be approved as a means of isolating the unit generators from the offsite power system in order to provide immediate access in accordance with GDC 17. This is necessary because a non fault current interrupting device, i.e., load break switch, must delay its trip for electrical faults until the switchyard circuit breakers have interrupted the current.

Following opening of the load break switch, the switchyard circuit breakers must then be reclosed to establish offsite power to the unit. A generator circuit breaker, however, could interrupt the fault current and isolate the unit generator at the same time, maintaining continuous power to the onsite ac power system.

IEEE Std. C37-013 (Reference K) was issued to cover the ratings and required capabilities for ac high-voltage generator circuit breakers rated on a symmetrical current basis that are installed between the generator and the transformer terminals. Guidance for the application of generator circuit breakers is also given.

2. Specific Guidelines A. Only devices which have maximum fault current interrupting capability, i.e., circuit breakers, can be used to isolate the unit generator from the offsite and onsite ac power systems in order to provide immediate access for the onsite ac power system to the offsite source. Generator load break switches can only be used for isolating the unit generator for the purpose of providing a delayed access offsite source.

8.2-32 Revision 5 - May 2010

B. Generator circuit breakers should be designed to perform their intended function during steady-state operation, power system transients and major faults. The ratings and required capabilities of a generator circuit breaker are the designated limits of operating characteristics based on definite conditions as defined in IEEE Std C37.013 (Reference K). This standard describes design test procedures and methods that should be performed to demonstrate the ability of a generator circuit breaker to meet the assigned ratings when operating at rated maximum voltage and power frequency. As a minimum, the following performance tests and capabilities from IEEE Std C37.013 should be demonstrated:

(i) Rated Dielectric Strength. The dielectric strength of a generator circuit breaker should be demonstrated by subjecting it to high voltages, both rated power frequency withstand voltage and rated full wave impulse withstand voltage based on its rated maximum voltage.

(ii) Load Current Switching. Tests are made to determine the ability of the generator circuit breaker to switch load current up to the rated continuous current of the generator, such as load currents that may be encountered in normal service. When switching the generator from the system, both generator circuit breaker terminals remain energized. The power frequency recovery voltage appearing across the generator circuit breaker is equal to the sum of voltage drops on the reactances of the generator and transformer and the corresponding short-circuit reactance of the high-voltage system.

For applications which use only one generator circuit breaker, the circuit breaker should be cycled through 40 load interruption operations (a lesser number requires suitable justification) at a current equal to the normal full load continuous current rating of the circuit breaker. For applications which utilize two generator circuit breakers in a parallel circuit, the circuit breaker should be given 40 load interruption operations (a lesser number requires suitable justification) at a current equal to twice the normal full load continuous current rating of the circuit breakers. The procedures and acceptance criteria utilized for this test should be based upon those given in IEEE Std C37.013.

(iii) Short Circuit Current Rating. The rated short-circuit current is demonstrated by a series of symmetrical and asymmetrical tests, and close-open tests described in the standard. The rated symmetrical current shall be the rated current value with the power frequency voltage associated with the rated maximum voltage and with a rated inherent transient recovery voltage as described in IEEE Std C37.013 for system-source faults and generator-source faults. The rated asymmetrical current-interrupting capability is demonstrated within the same conditions as the symmetrical current.

8.2-33 Revision 5 - May 2010

The circuit breaker should have, as a minimum, the capability of interrupting the maximum asymmetrical and symmetrical fault current available at the instant of primary arcing contact separation. This current should be calculated by assuming a bolted three phase fault at a point on the system which causes the maximum amount of fault current flowing through the generator circuit breaker. The fault current interrupting capability (short circuit current rating) of the circuit breaker should be demonstrated by performing a series of tests similar to those called for in IEEE Std C37.013. The tests should include close/open (CO) operations and should be performed at the circuit breaker minimum rated air pressure and control voltage and with a rated transient recovery voltage as described in the standard for system-source faults and generator-source faults.

(iv) Rated Transient Recovery Voltage (TRV). The ability to withstand rated TRVs, as specified in IEEE Std C37.013 for rated symmetrical and asymmetrical currents, is demonstrated during short-circuit tests. Both inherent circuit transient recovery voltage and power frequency recovery voltage must be considered when demonstrating the rating of a generator circuit breaker. Additional information and guidance on TRV is provided in IEEE Std C37.011 (Reference J).

(v) Short-Time Current-Carrying Capability. The generator circuit breaker shall be capable of carrying for a period of time Ts equals 1 second, any short-circuit current determined from the envelope of the current wave at the time of the maximum crest, whose value does not exceed 2.74 times the rated short-circuit current, and whose rms value I determined over the complete 1 second period does not exceed the rated short circuit current considered above.

The fault current chosen should be that due to a fault on the system at a point which causes the largest I2t heating of the circuit breaker. The short-time current-carrying capability should be demonstrated with a current-carrying test as described in IEEE Std C37.013. It is not to be inferred that the generator circuit breaker is to be capable of interrupting after the required short-time current-carrying capability duty until it has cooled down to normal heat run temperature.

(vi) Duty Cycle Capability. The duty cycle capability of the generator circuit breaker should be demonstrated by a series of symmetrical and asymmetrical close-open cycle tests as specified in IEEE Std C37.013.

The time between two operations to interrupt short circuit current shall be the rated value of 30 minutes specified in the standard.

(vii) Transformer Excitation Current Switching Tests. The circuit breaker interruption of an unloaded station main and/or auxiliary transformer excitation current should not generate excessively high surge voltages 8.2-34 Revision 5 - May 2010

which could damage the connected bus and transformer insulation. This should be verified by test.

(viii) Rated Continuous Current-Carrying Test. The thermal capability of the circuit breaker should be demonstrated by a test at its continuous current rating. The test should be in accordance with the requirements and ratings contained in IEEE Std C37.013. For applications which use two generator circuit breakers in a parallel circuit, a test should be conducted to determine the time to reach the maximum permissible temperature on the most limiting component of the breaker when going from the rated continuous current to twice rated continuous current.

(ix) Mechanical Endurance Life Test. No-load mechanical operation tests are made on a complete generator circuit breaker or on a single pole of the generator circuit breaker if all three poles are identical to ensure its satisfactory operation in normal service without excessive maintenance.

In practical applications, the generator circuit breaker is connected to the bus duct by means of flexible copper or aluminum connections. The enclosure of the generator circuit breaker may be welded to the enclosure of the bus duct. These conditions should be taken into account during the tests.

A sufficient number of no-load mechanical operations should be performed by the circuit breaker to provide a reasonable indication of its mechanical reliability and life. The demonstrated life should be adequate for the plant life expectancy.

(x) Rated Interrupting Time. The rated interrupting time of the generator circuit breaker is the maximum permissible interval between the energizing of the trip circuit at rated control voltage and rated fluid pressure of the operating mechanism and the interruption of the main circuit in all poles on an opening operation. Typical values are approximately 60B90 ms with the actual time being dependent on the rated short-circuit current. For generator circuit breakers equipped with resistors, the interrupting time for the resistor current may be longer.

The interrupting time of a generator circuit breaker is demonstrated for different currents by the test duties cycles specified in IEEE Std C37.013.

Interrupting times of test results, when expressed in cycles, shall be in cycles of the power frequency.

(xi) Short Circuit Current with Delayed Current Zero. It is generally accepted that the generator circuit breaker will be required, during its life, to interrupt short-circuit currents from the generator-source with delayed current zeros. It is also recognized that the magnitudes of these short circuit currents are considerably lower than the magnitudes of the rated short-circuit currents. The capability of the generator circuit breaker to interrupt the delayed current zeros can be ascertained by computations 8.2-35 Revision 5 - May 2010

that consider the effect of the arc voltage on the prospective short-circuit current. The determining arc voltage model is derived from tests with comparable magnitudes of current.

If this computation entails too many assumptions on the behavior of the generator circuit breaker during interruption under the most severe conditions, short-circuit tests shall be required. If tests are carried out, it must be recognized that, normally, the required current waveshape cannot be simulated accurately in test stations. Tests shall include a predetermined nonzero current waveform associated with the rated maximum voltage and an inherent circuit transient recovery voltage, and an approximate waveform obtained either by calculation or by measurement at the generator circuit breaker=s particular application.

C. The availability of offsite power to the onsite loads for designs utilizing generator circuit breakers should be no less than comparable designs which utilize separate offsite power transformers to supply offsite power to the station loads.

In this regard the trip selectivity between the generator circuit breakers and the switchyard high voltage generator circuit breakers should insure against unnecessary tripping of the switchyard generator circuit breakers during abnormal events in order to maintain offsite power to the station loads.

D. Load break switches should be designed to perform their intended function during steady-state operation, power system transients, and major faults. Except for item 2.C, the switches should have the same capabilities as defined in guideline 2 for generator circuit breakers. In addition, the symmetrical interrupting capability of the load break switch should be at least equal to the maximum identified peak loading capability of the station generator.

3. References for Appendix A to SRP Section 8.2 A. Safety Evaluation Report related to operation of McGuire Nuclear Station, Units 1 and 2, NUREG-0442, dated March 1978.

B. FSAR McGuire Nuclear Station Docket 50-396/370.

C. FSAR Catawba Nuclear Station Docket 50-413/414.

D. IEEE Standard C37.04-1999, Standard Rating Structure for AC High-Voltage Circuit Breakers.

E. IEEE Standard C37.04a-2003, Standard Rating Structure for AC High-Voltage Circuit Breakers rated on a Symmetrical Current Basis - Amendment 1:

Capacitance Switching Current.

F. ANSI Standard C37.06-2000, AC High-Voltage Circuit Breakers Rated on a Symmetrical Current Basis--Preferred Ratings and Related Required Capabilities.

8.2-36 Revision 5 - May 2010

G. IEEE Standard C37.09-1999, Standard Test Procedure for AC High-Voltage Circuit Breakers Rated on a Symmetrical Current Basis.

H. IEEE Standard C37.09a-2005, Standard Test Procedure for AC High-Voltage Circuit Breakers Rated on a Symmetrical Current Basis - Amendment 1:

Capacitance Switching Current.

I. IEEE Standard C37.010-1999, Application Guide for AC High-voltage Circuit Breakers Rated on a Symmetrical Current Basis.

J. IEEE Standard C37.011-2005, Application Guide for Transient Recovery Voltage for AC High-Voltage Circuit Breakers.

K. IEEE Standard C37.013-1997, Standard for AC High-Voltage Generator Circuit Breakers Rated on a Symmetrical Current Basis.

8.2-37 Revision 5 - May 2010

SRP Section 8.2 "Offsite Power System" Description of Changes Revision 5 to SRP Section 8.2 updates Revision 4 of this section, dated March 2007, to reflect the following changes:

1. This SRP section is administratively updated by the Office of New Reactors, per request from Juan D. Peralta, Branch Chief, Quality and Vendor Branch 1, Division of Construction, Inspection, and Operational Programs, memorandum dated February 17, 2010 (ADAMS Accession No. ML10090148).

8.2-38 Revision 5 - May 2010