ML16180A162

Revision 26 to the Updated Final Safety Analysis Report, Chapter 8, Electric Power

ML16180A162
Person / Time
Site:	Ginna
Issue date:	05/05/2016
From:	Exelon Generation Co
To:	Office of Nuclear Reactor Regulation
Shared Package
ML16180A174	List: ML16180A127 ML16180A128 ML16180A130 ML16180A131 ML16180A132 ML16180A134 ML16180A136 ML16180A137 ML16180A138 ML16180A139 ML16180A140 ML16180A141 ML16180A142 ML16180A143 ML16180A144 ML16180A145 ML16180A146 ML16180A147 ML16180A148 ML16180A149 ML16180A150 ML16180A156 ML16180A157 ML16180A158 ML16180A159 ML16180A160 ML16180A161 ML16180A162 ML16180A163 ML16180A164 ML16180A165 ML16180A166 ML16180A167 ML16180A168 ML16180A169 ML16180A170 ML16180A171 ML16180A172 ML16180A173 ML16180A180 ML16180A181 ML16180A182 ML16180A183 ML16180A184 ML16180A185 ML16180A186 ML16180A214 ML16180A215 ML16180A216
References
Download: ML16180A162 (62)

Text

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER 8 ELECTRIC POWER Page 1 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER

8.1 INTRODUCTION

8.1.1 GENERAL The electrical power system for the R. E. Ginna Nuclear Power Plant is shown in Figure 8.1-

1. The system has three basic power sources:

I. Offsite power (from the transmission system through the station auxiliary transformers 12A and 12B).

II. Onsite power (from the main generator through the station unit auxiliary transformer 11).

III. Emergency onsite power (from the diesel generators).

The electrical power system was initially designed with a single station auxiliary transformer (12A) but a spare transformer (12B) was added after the beginning of commercial operation.

The station auxiliary transformers are used to supply the normal auxiliary power during plant startup and shutdown. During normal power operation, the station auxiliary transformers remain energized, essentially unloaded (except for supplying 1E loads), and plant auxiliary power is supplied from the main generator via the station unit transformer. With the plant not operating, and offsite power not available, the principal source of power for vital electrical loads is from the emergency diesel generators. For long-term outages of offsite power a backup source of power for the diesel generators is from the normally outgoing power feeder.

Power can be brought in over this feeder to the station unit transformer by removing the flex-ible generator bus disconnects (links) to disconnect the main generator.

The overall reliability of the plant electrical system design has been well established by the following features:

• Providing alternate and emergency power sources.

• Providing two independent offsite power sources.

• Bringing in power from offsite via normal outgoing power feeder by disconnecting the gen-erator from its isolated phase bus.

• Isolation and separation of components, buses, feeders, etc.

• Designing the emergency power system to permit outage of one diesel-generator unit and still maintain ability to carry emergency load on the system.

• Redundancy in system where required for plant safety.

• Protective features to isolate faults without damage to other components and systems.

• Onsite and reserve fuel supplies for diesel generators to permit uninterrupted operation for the duration of any emergency.

• Use of reliable equipment.

8.1.2 OFFSITE POWER DESCRIPTION The Rochester Gas and Electric Corporation transmission system provides two basic and interrelated functions for Ginna Station. It supplies all auxiliary power for startup and normal shutdown and Class 1E auxiliary loads during MODES 1 and 2 via the station auxiliary Page 2 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER transformers, and it delivers the output of the station to the grid. During normal startup and operation, the station auxiliary transformers are supplied from two separate offsite feeders.

Each of these feeders is capable of supplying the entire auxiliary power load. During normal shutdown, all auxiliary loads are transferred to the station auxiliary transformers prior to securing the main generator.

The offsite power system is described in detail in Section 8.2.

8.1.3 ONSITE POWER DESCRIPTION The function of the electrical power system is to provide reliable power to those auxiliaries required during any normal or emergency mode of plant operation. The design of the system is such that sufficient independence or isolation between the various sources of electrical power is provided in order to guard against concurrent loss of all auxiliary power.

The main generator feeds electrical power at 19 kV through an isolated phase bus to the gen-erator step-up transformer, which steps this voltage up to 115 kV for distribution offsite. The bulk of the power required for station auxiliaries when the main generator is online is nor-mally supplied by a station unit transformer connected to the isolated phase bus. The Class 1E auxiliary loads are supplied by the station auxiliary transformers connected to offsite power sources.

The station unit transformer 11 is capable of supplying the entire auxiliary load under nor-mal operating conditions. If power from the main generator is interrupted, auxiliary loads necessary for plant shutdown are transferred automatically to one or both of the station auxil-iary transformers 12A and 12B depending on the lineup at the time. Referring to Figure 8.1-1, breakers 12AX, 12AY, 12BX and 12BY can be lined up so that the load is split between transformers 12A and 12B or the entire load is aligned to transformer 12A or 12B (see Sec-tion 8.2.1.2).

When the reactor trips concurrent with an outage of offsite power, the emergency diesel gen-erators will automatically assume vital station auxiliary loads necessary for safe shutdown as described in Section 8.3.1.2.6. These loads will be transferred to the diesel generators when the last source of voltage decreases to a preset value and the diesel generators come up to speed and voltage.

The onsite power system is described in detail in Section 8.3.

8.1.4 PRINCIPAL DESIGN CRITERIA 8.1.4.1 Performance Standards The following electrical design criteria were used during the licensing of Ginna Station. They represent the Atomic Industrial Forum version of proposed criteria issued by the AEC for comment on July 10, 1967. Conformance with the General Design Criteria (GDC) of 10 CFR 50, Appendix A, is discussed in Section 8.1.4.3.

CRITERION: Those systems and components of reactor facilities which are essential to the prevention or to the mitigation of the consequences of nuclear accidents which Page 3 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER could cause undue risk to the health and safety of the public shall be designed, fabricated, and erected to performance standards that will enable such systems and components to withstand, without undue risk to the health and safety of the public, the forces that might reasonably be imposed by the occurrence of an extraordinary natural phenomenon such as earthquake, tornado, flooding condi-tion, high wind, or heavy ice. The design bases so established shall reflect: (a) appropriate consideration of the most severe of these natural phenomena that have been officially recorded for the site and the surrounding area and (b) an appropriate margin for withstanding forces greater than those recorded to reflect uncertainties about the historical data and their suitability as a basis for design.

(AIF-GDC 1)

All electrical systems and components vital to plant safety, including the emergency diesel generators, are designed as Seismic Category I and designed so that their integrity is not impaired by the maximum potential earthquake, wind storms, floods, or disturbances on the external electrical system. Power, control and instrument cabling, motors, and other electrical equipment required for operation of the engineered safety features are suitably protected against the effects of either a nuclear system accident or of severe external environmental phenomena. Such protection ensures a high degree of confidence in the operability of such components in the event that their use is required.

Specific operability requirements for electrical systems and components are provided in the Technical Specifications.

8.1.4.2 Emergency Power CRITERION: An emergency power source shall be provided and designed with adequate independence, redundancy, capacity, and testability to permit the functioning of the engineered safety features and protection systems required to avoid undue risk to the health and safety of the public. This power source shall provide this capacity assuming a failure of a single active component. (AIF-GDC 39)

Independent alternate power systems are provided with adequate capacity and testability to supply the required engineered safety features and protection systems.

The plant is supplied with normal, standby, and emergency power sources as follows:

A. The normal source of auxiliary power during plant operation is the main generator. Power is supplied via the station unit transformer (11) which is connected to the main leads of the generator, except for safeguards loads required during MODES 1 and 2, which are supplied from transformers 12A and 12B and the offsite sources.

B. Standby power required during plant startup, shutdown, and after reactor trip is supplied from the Rochester Gas and Electric Corporation (RG&E) 115-kV system by two indepen-dent 34.5-kV lines to the station auxiliary transformers 12A and 12B.

C. Two diesel-generator sets are connected to the engineered safety features buses to supply emergency shutdown power in the event of loss of all other ac auxiliary power.

Page 4 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER D. Emergency power supply for vital instruments, for control, and for emergency lighting is supplied from the two 125-V dc station batteries.

The diesel-generator sets are located adjacent to the turbine building and are connected to separate 480-V auxiliary system buses. Each set will be started automatically on a safety injection signal or upon undervoltage on its corresponding 480-V auxiliary buses. Each die-sel is adequate to supply the engineered safety features for the design-basis accident concur-rent with loss of offsite power. This capacity is adequate to provide a safe and orderly plant shutdown in the event of loss of offsite electrical power.

The starting of the diesel-generator sets can be tested from the control room. The ability of the units to start within the prescribed time and to carry intended loads is periodically tested in accordance with the Technical Specifications to demonstrate that they will provide power for operation of equipment. Diesel-generator testing ensures that the emergency generator system controls and the control systems for safeguards equipment will function automatically in the event of a loss of all normal 480-V ac station service power or in the event of a safety injection signal. Diesel-generator trips are also tested periodically.

The testing frequency specified is often enough to identify and correct any mechanical or electrical deficiency before it can result in a system failure. The control components are in enclosures. The fuel supply and starting circuits and controls are continuously monitored and any faults are alarm indicated. An abnormal condition in these systems would be sig-naled without having to place the diesel generators on test.

8.1.4.3 Adequacy of Electrical Design Relative to 1972 Criteria The adequacy of the Ginna Station electrical design relative to the following General Design Criteria (GDC) is discussed in Section 3.1.2:

• GDC 2, Design Bases for Protection Against Natural Phenomena.

• GDC 4, Environmental and Missile Design Bases.

• GDC 5, Sharing of Structures, Systems, and Components.

• GDC 17, Electrical Power Systems.

• GDC 18, Inspection and Testing of Electrical Power Systems.

• GDC 50, Containment Design Basis.

The conformance with the following Safety and Regulatory Guides and IEEE Standards is discussed in Section 1.8.

• Safety Guide 6, Independence Between Redundant Standby (Onsite) Power Sources and Between Their Distribution Systems.

• Safety Guide 9, Selection of Diesel-Generator Set Capacity for Standby Power Supplies.

• Regulatory Guide 1.32; Use of IEEE Standard 308-1971, Criteria for Class 1E Electric Sys-tems for Nuclear Power Generating Stations.

• Regulatory Guide 1.47, Bypassed and Inoperable Status Indication for Nuclear Power Plant Safety Systems.

Page 5 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER

• IEEE 308-1971, Class 1E Electrical Systems for Nuclear Power Generating Stations.

• IEEE 317-1971, Electrical Penetration Assemblies in Containment Structures for Nuclear Fueled Power Generating Stations.

• IEEE 323-1971, Qualifying Class I Electric Equipment for Nuclear Power Generating Sta-tions.

• IEEE 336-1971, Installation, Inspection, and Testing Requirements for Instrumentation and Electric Equipment During the Construction of Nuclear Power Generating Stations.

• IEEE 344-1971, Seismic Qualification of Class I Electric Equipment for Nuclear Power Generating Stations.

Routing and separation standards applicable to existing cables are those that were invoked at the time of cable installation. For more information, see Section 8.3.1.4.

8.1.4.4 Potential Risk of Station Blackout The likelihood of a station blackout event at Ginna Station is very low, in part because of the high reliability of the emergency diesel generators. The calculated diesel-generator reliability is 0.990 and is supported by an Electric Power Research Institute study (EPRI Data Base on Diesel Generator Reliability), which shows that for the 1983-1985 time period the reliability was 0.991.

Although severe weather increases the probability of a loss of offsite power, it has only a slight effect on the risk of a station blackout. The emergency power systems at Ginna Station were thoroughly reviewed for operability in the instances of severe and extreme natural phe-nomena such as floods, tornadoes, and snowstorms as part of the Systematic Evaluation Pro-gram (SEP). The Ginna Station design basis, therefore, already includes the system design features and procedures to ensure that no unacceptable loss of emergency onsite power will occur during severe weather events.

Additional safety features independent of the emergency ac power distribution system are available at Ginna Station. In addition to the 200%-capacity turbine-driven auxiliary feedwa-ter system (TDAFW), Ginna Station has (a) a diesel-driven air compressor, which can charge the instrument air and service air systems, (b) a diesel-driven fire pump taking suction from Lake Ontario, which can provide an inexhaustible source of secondary cooling water to the steam generators, and (c) a technical support center battery system, with 2880 amp-hr capac-ity, which can be cross-connected to either station battery to supply vital loads on one train for much longer than 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.

An evaluation has been performed against the requirements of the station blackout rule (10 CFR 50.63) using guidance from NUMARC 87-00 (Reference 1) and Regulatory Guide 1.155 (Reference 2) except for the analyses for the effects of loss of ventilation where a plant-spe-cific analysis was used. Using NUMARC 87-00, Section 3, 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> was determined to be the Ginna Station blackout coping duration. Ginna Station is able to cope with a station blackout of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. (References 3, 4, and 5).

The station blackout rule requires that the following issues be addressed: station blackout duration, condensate inventory for decay heat removal, Class 1E battery capacity, compressed Page 6 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER air, effects of loss of ventilation, containment isolation, reactor coolant inventory, procedures and training, quality assurance and Technical Specifications, and the emergency diesel gener-ator reliability program. The NRC safety evaluation (Reference 6) and supplemental safety evaluation (Reference 7) concluded that the following station blackout issues were acceptably resolved: condensate inventory for decay heat removal, Class 1E battery capacity, contain-ment isolation, and reactor coolant inventory.

8.1.4.5 Station Blackout Program A station blackout program has been developed for Ginna Station. The Station Blackout Pro-gram manual (Reference 8) is a comprehensive document that presents the history, regulatory commitments, calculations, bases, procedure changes, and modifications that were imple-mented to reduce the risk of consequences during a station blackout. Contained in the manual is the documentation required to substantiate Ginnas submittals to the NRC pursuant to 10 CFR 50.63 (References 3, 4, and 9). Regulatory commitments for station blackout are also listed in the program manual with an implementation summary.

8.1.4.5.1 Assumptions The NUMARC 87-00 general criteria and baseline assumptions for the Station Blackout Pro-gram are the following: general criteria, initial plant conditions, initiating event, station black-out transient, reactor coolant inventory loss, operator action, effects of the loss of ventilation, system cross-tie capability, instrumentation and controls, containment isolation valves, and hurricane preparations.

As established in the baseline assumptions contained in Section 2 of NUMARC 87-00, the station blackout event is assumed to occur while the reactor is normally operating at 100%

power after having been in that mode for 100 days. The initiating event is the loss of offsite power resulting from either a switchyard related event due to random faults, an external event such as grid disturbance, or a weather event that affects the offsite power either throughout the grid or at the plant. Following the loss of offsite power event, if neither of the emergency diesel generators start on demand to provide onsite AC power, the plant operators will imple-ment the emergency contingency action procedure which addresses the loss of all AC power.

Loss of offsite power events caused by fire, flood or seismic activity are not expected to occur with sufficient frequency to require explicit criteria and therefore are not required to be addressed. No design basis accidents or other events are assumed to occur immediately prior to or during the station blackout.

Station blackout transient assumptions as presented in NUMARC 87-00 stipulate that follow-ing the loss of all offsite power the reactor is assumed to automatically trip with sufficient shutdown margin to maintain subcriticality at MODE 3 (Hot Shutdown) or MODE 4 (Hot Standby). Based on the Ginna configuration, an automatic reactor trip will not necessarily result from the loss of offsite power. However, Ginna Station emergency procedures specify operator action to manually trip the reactor in the event of a loss of all AC power.

In NUMARC 87-00, it is also assumed that throughout the station blackout transient the main steam system valves (such as main steam isolation valves, turbine stops, atmospheric dumps, Page 7 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER etc.) necessary to maintain decay heat removal functions operate properly. In addition, it is assumed that safety/relief valves or Pressurizer Power Operated Relief Valves (PORV) oper-ate properly which includes the assumption that the valves reseat normally. The event is pre-sumed to end when AC power is restored to the safety-related 480-v buses from any source.

The potential for mechanistic failures resulting from the loss of HVAC in a station blackout event has been addressed. No independent failures, other than those causing the station blackout event, are assumed to occur in the course of the transient. Within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> of the start of the event, AC power is assumed to become available to necessary safe shutdown equip-ment from either the onsite supply or the emergency diesel generators.

Sources of reactor coolant system leakage during a station blackout at Ginna are presumed to include normal system leakage (11 gpm) and reactor coolant pump seal leakage (25 gpm) for a total leakage of 61 gpm. Under these conditions, the reactor core will remain covered with the reactor coolant inventory for the 4-hour duration of a station blackout.

8.1.4.5.2 Ventilation An evaluation of expected room temperature during a station blackout was performed. The main dominant areas of concern for loss of ventilation failures were determined to be the areas near the Atmospheric Relief Valves (ARV) and the turbine driven auxiliary feedwater pump (TDAFW) in the intermedate building. The control room, battery rooms, and relay room were also identified as containing station blackout coping equipment. The following conservative maximum temperatures for a 4-hour coping period were determined: Atmo-spheric Relief Valve (ARV) area, 117F - 122F turbine driven auxiliary feedwater pump (TDAFW) area, 110F - 115F provided doors S37F, ramped entrance to intermediate build-ing clean side basement; S44F, intermediate building to turbine building interior door to steam header area; SD/55, intermediate building top floor overhead door S55 are opened within 30 minutes of the station blackout onset (Reference 10); control room area, 116F, pro-vided the doors to the turbine building are opened within 30 minutes; battery rooms, 108.2F; and relay room, 103F (Reference 8). These temperatures demonstrated that reasonable assurance of equipment operability was provided in accordance with NUMARC 87-00.

8.1.4.5.3 Plant Classification Under the NUMARC 87-00 guidelines, Ginna Station is classified as a P2 plant, with P1 plants being least susceptible and P3 plants being most susceptible to extended offsite power losses.

8.1.4.5.4 Diesel Generator Reliability An emergency diesel generator reliability target of 0.975 is required to achieve a 4-hour cop-ing duration when a NUMARC 87-00 EAC Group C site classification is used in conjunction with the P2 plant classification. Exceedance trigger values are utilized to support emer-gency diesel generator reliability and unavailabilty performance. Should the specified trigger values be exceeded, appropriate remedial actions are taken. The target emergency diesel gen-erator trigger values are specified in the Emergency Diesel Generator Reliability and Unavail-ability Performance Criteria Program.

Page 8 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER 8.1.4.5.5 Diesel Generator Cold Starts NUMARC station blackout Initiative 3 was structured to provide utility attention toward reducing, as much as possible, cold starting of emergency diesel generators during test condi-tions. A cold start is defined as an attempt to start an emergency diesel generator from ambi-ent conditions without the presence of pre-warmed circulating water or pre-warmed pre-lubrication. The diesel generators are maintained continuously pre-warmed and therefore are not expected to have cold starts. Each emergency diesel generator is provided with jacket water and lube oil heating devices to maintain the engine coolant and lube oil temperature at an operable level for fast and reliable starting. A motor-driven lube oil circulating pump runs continuously until the engine is started resulting in bearings which are always lubricated and ready for operation.

8.1.4.6 Fukushima - Diverse and Flexible Coping Strategies (FLEX) 8.1.4.6.1 Regulatory Requirements The NRC issued Order EA-12-049 on March 12, 2012 to implement mitigation strategies for Beyond Design Basis External Events (BDBEEs), as a result of the effects of an earthquake-induced tsunami at the Fukushima Dai-ichi Nuclear Power Station in Japan. The Nuclear Energy Institute (NEI) developed NEI 12-06, which provides guidelines for nuclear stations to assess extreme external event hazards and implement the mitigation strategies specified in NRC Order EA-12-049. The NRC issued Interim Staff Guidance JLD-ISG-2012-01, dated August 29, 2012, which endorsed NEI 12-06 with clarifications on determining baseline coping capability and equipment quality.

NEI 12-02 provides guidance for compliance with Order EA-12-051. The NRC determined that, with the exceptions and clarifications provided in JLD-ISG-2012-03, conformance with the guidance in NEI 12-02 is an acceptable method for satisfying the requirements in Order EA-12-051.

The order specifies a three-phase approach for strategies to mitigate BDBEEs:

Phase 1 - Initially cope relying on installed equipment and on-site resources.

Phase 2 - Transition from installed plant equipment to on-site portable BDB equipment Phase 3 - Obtain additional capability and redundancy from off-site equipment and resources until power, water, and coolant injection systems are restored or commissioned.

8.1.4.6.2 Site Responses to NRC Orders Ginna Station has developed a FLEX Program Document for FLEX strategies (CC-GI-118) that complies with NRC Order EA-12-049. This is achieved by the development, implementation, and maintenance of guidance and strategies to maintain or restore core cooling, containment, and SFP cooling capabilities following a BDBEE. These strategies are capable of mitigating a simultaneous loss of all AC power and loss of normal access to the ultimate heat sink and have adequate capacity to address challenges to core cooling, containment and SFP cooling capabilities. Reasonable protection is provided for the equipment relied upon for the implementation of these strategies from external events. The strategies are capable of being implemented in all plant operating modes. The strategies are supported by the development, implementation, and maintenance of procedures, guidance, and training. The strategies are supported by the acquisition, staging or installation of equipment needed.

Page 9 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER 8.1.4.6.3 Summary of the FLEX Strategies This section provides summary discussions of the primary strategies implemented at Ginna to satisfy the capabilities required by NRC Order EA-12-049. More detailed information on the implementation strategies and basis is described in CC-GI-118.

8.1.4.6.3.1 Reactor Core Cooling and Heat Removal A. Phase 1 Verify Turbine Driven Auxiliary Feedwater (TDAFW) pump is providing feedwater to the steam generators (SGs), if available.

In the event the TDAFW pump is not available, actions will be taken to provide feedwater to the SGs by powering Standby Auxiliary Feedwater (SAFW) from the SAFW DG aligned with suction from the DI Water Storage Tank.

Instrumentation will be maintained available by performing DC bus load shedding. Load shedding is expected to extend 125V DC battery life to eight (8) hours.

Perform a cooldown and depressurization with manual/local operation of the SG Atmospheric Relief Valves (ARVs). SG feed will be controlled with remote or local operation of Auxiliary Feedwater system valves.

B. Phase 2 A medium pressure portable FLEX pump will be used to take suction on Lake Ontario and discharge hose routed to a connection at the SAFW DI Water Storage Tank. Lake Ontario will serve as the long term source of water to the SGs via SAFW or via the medium pressure portable FLEX pump.

The SAFW DG and the medium pressure portable FLEX pump fuel oil levels will be monitored and the tanks refilled using a Diesel Fuel Trailer.

C. Phase 3 Phase 3 will utilize Phase 2 connections and National SAFER Recovery Center (NSRC) equipment as spares.

8.1.4.6.3.2 RCS Inventory and Reactivity Control A. Phase 1

1. Perform a cooldown and depressurization at approximately 75°F/hour to approximately 419°F (cold leg temperature). The cooldown will be initiated within approximately two (2) hours of event initiation to achieve a RCS cold leg temperature of less than Page 10 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER 450°F in four (4) hours from event initiation.

2. Reactor Coolant System (RCS) temperature will be maintained at approximately 419°F by controlling SG pressure at approximately 290 psig in order to ensure maximum SI Accumulator injection while preventing nitrogen injection.

B. Phase 2

1. Following SI Accumulator injection or implementation of Alternate RCS Injection, the SI Accumulators will be isolated or vented and RCS cooldown will be initiated to achieve a RCS temperature and pressure less than 350°F and 400 psig within twenty-four (24) hours of event initiation.

2. Alternate RCS Injection capability will be maintained in a standby condition and operated as required to provide RCS makeup and boration.

RCS boration will be initiated in 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> to ensure subcritical conditions are maintained.

C. Phase 3

1. The strategies in Phase 3 are a continuation of the Phase 2 strategies with additional flexibility and capabilities provided through the following equipment from the NSRC:

(1) NSRC generators (2) NSRC pumps (3) Portable Boration Skid for borated water makeup.

(4) Water filtration skid including a pre-filter and reverse osmosis capability to provide clean water.

8.1.4.6.3.3 Containment Integrity A. Phase 1:

Monitor containment status. Containment temperature and pressure are expected to remain below design limits for at least 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

B. Phase 2:

Monitor containment status. Containment temperature and pressure are expected to remain below design limits for at least 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

C. Phase 3 Phase 3 will utilize NSRC equipment to power one or more Containment Recirculation Fans (CRFs) and supply cooling water from Lake Ontario to one or more CRF Coolers to reduce Containment temperature and pressure. FSG-12, Alternate CNMT Page 11 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER Cooling, provides the actions to restore Containment cooling to maintain Containment temperature and pressure below limits.

8.1.4.6.3.4 Spent Fuel Pool Cooling A. Phase 1

1. Monitor Spent Fuel Pool level and temperature.

2. A Spent Fuel Pool vent path, to maintain suitable ambient conditions in the Auxiliary Building, will be provided by opening Auxiliary Building and Canister Preparation Building overhead doors. The site plans to perform these manual actions prior to the onset of SFP boiling. The actions are directed by FSG-5, Initial Assessment and FLEX Equipment Staging, and FSG-11, Alternate SFP Makeup and Cooling.

B. Phase 2

1. Monitor Spent Fuel Pool level and temperature.

2. The primary SFP makeup strategy will be accomplished using a medium pressure portable FLEX pump with water supply from Lake Ontario discharging into the SFP. If necessary, an alternate makeup flow path to the SFP can be established by spraying the SFP with Blitz fire nozzles located within 75 feet of the SFP.

3. The same portable FLEX pump used to refill the SAFW DI Water Storage Tank, or used for feeding the S/Gs, will be used for SFP makeup.

C. Phase 3

1. The same strategies employed in Phase 2 can be employed in Phase 3.

2. Phase 3 will utilize Phase 2 connections and NSRC equipment as spares.

8.1.4.6.3.5 Electric Power Load shedding and battery conservation are employed to extend the use of installed DC sources to maintain essential instruments and controls until FLEX equipment is operating and capable of carrying required loads and charging installed DC batteries.

FLEX DG will be aligned to supply 480V AC power to the battery chargers for 125 VDC Vital Batteries A and B. The primary strategy will be to power one or more of the protected battery chargers for the 125 VDC batteries from the 1 MW SAFW D/G to ensure vital instrumentation remains powered. Temporary cables will be run from the 1 MW SAFW D/G connections in the SAFW Annex to a portable distribution panel and/or to a distribution panel in the Waste Gas Page 12 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER Compressor (WGC) Room. From the portable distribution panel, cable can be routed to one battery charger on each train. From the distribution panel in the WGC Room cable can be routed to breakers on MCC C and MCC D to power one battery charger for each train. There are two battery chargers available to each of the station batteries, both with a capacity of 200 amps at 132 Volts DC and requiring up to 58 amps at 480 Volts AC.

The alternate strategy will be implemented in the event that the 1 MW SAFW D/G cannot be used to provide power to the battery chargers. A FLEX 100 KW FLEX D/G capable of delivering 150 amps at 480 Volts 3-phase will be connected to the protected battery chargers for the 125 VDC batteries to ensure vital instrumentation remains powered. This alternate strategy will use two methods similar to the 1 MW SAFW D/G. To power the distribution panel in the WGC Room, the 100 KW FLEX D/G will be transported to outside the SAFW Annex overhead door. Temporary cables will be routed from the 100 KW FLEX D/G to a junction box in the SAFW Annex to feed the distribution panel in the WGC Room and from the distribution panel in the WGC Room to battery charger breakers for each train on MCC C and MCC D. To power the portable distribution panel the 100 KW FLEX D/G will be transported to the TSC area.

Temporary cables will be routed from the 100 KW FLEX D/G to the portable distribution panel and from the portable distribution panel to one battery charger on each train.

Page 13 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER REFERENCES FOR SECTION 8.1

1. Nuclear Management and Resources Council, Guidelines and Technical Bases for NUMARC Initiatives Addressing Station Blackout at Light Water Reactors, NUMARC 87-00, November 23, 1987.

2. U.S. Nuclear Regulatory Commission, "Station Blackout," Regulatory Guide 1.155, August 1988.

3. Letter from R. C. Mecredy, RG&E, to T. E. Murley, NRC,

Subject:

10 CFR 50.63 Sta-tion Blackout, dated April 17, 1989.

4. Letter from R. C. Mecredy, RG&E, to T. E. Murley, NRC,

Subject:

10 CFR 50.63 Sta-tion Blackout, dated July 10, 1990.

5. Letter from R. C. Mecredy, RG&E, to A. R. Johnson, NRC,

Subject:

10 CFR 50.63, Loss of All Alternating Current Power, dated April 22, 1991.

6. Letter from A. R. Johnson, NRC, to R. C. Mecredy, RG&E,

Subject:

Station Blackout Safety Evaluation, dated January 30, 1992.

7. Letter from A. R. Johnson, NRC, to R. C. Mecredy, RG&E,

Subject:

Station Blackout Rule Supplemental Safety Evaluation, dated September 23, 1992.

8. Station Blackout Program, Progplan, Ginna Station.

9. Letter from R.C. Mecredy, RG&E, to A.R. Johnson, NRC,

Subject:

Station Blackout, dated September 26, 1994.

10. ECPCN-11-00023, Revision 0 to ECP-10-000301, Revision 0, "Evaluate the heat up of the imtermediate building under a Station Blackout Scenario."

Page 14 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER 8.2 OFFSITE POWER SYSTEM 8.

2.1 DESCRIPTION

A single-line diagram showing the connections of the main generator and off-site power sup-plies to the power system grid is shown in Figure 8.2-1.

8.2.1.1 Transmission System 8.2.1.1.1 Step-up Transformers Electric energy, generated at 19 kV, is raised to 115 kV by the generator step-up transformer and delivered from Ginna to station 13A (switchyard) via four 115-kV underground pipe type cables through 115-kV, 3000-amp circuit breakers. The remaining breakers at the station are 115 kV, 1600 amp, and 2000 amp. Six 115-kV transmission circuits emanate from the sta-tion; circuits 911 and 913 connect into the main Rochester Gas and Electric Corporation (RG&E) transmission network via station 42; circuits 908, 909, 912 and 937 connect to the 115-kV transmission network at RG&E stations 121, 135, 122 and 135, respectively.

8.2.1.1.2 Transmission Lines Six 115-kV lines (908, 909, 911, 912, 913 and 937 described above) connect to station 13A through the "breaker-and-a-half" technique of switching (Figure 8.1-1). As they leave station 13A toward station 204, four of the six lines are supported on two separate rows of structures.

Specifically, circuits 908 and 913 are on one set of structures and circuits 911 and 912 are on a second set of structures. Circuits 909 and 937 have their own sets of structures on the east side of the right-of-way. Circuits 909 and 937 terminate at station 135 (Rt 104 and Slocum Road). Circuit 929 ties station 135 to station 121. The structures for the two pairs of lines are spaced sufficiently far apart on the right-of-way so that a structure carrying one pair of lines cannot fall on a structure carrying the other pair. Structural anchoring is installed on the structures for the fifth line to minimize transverse collapse. For all lines, except for the steel structures used at corners in the line, the transmission is on multiple cross-arm wooden poles.

South of station 204 for approximately 4 miles, each of the five lines (908, 929, 911, 912, and 913) is located on its own wood structure on a right-of-way. Three lines extend south from this point to RG&E stations 121 and 122 and two lines extend west to RG&E station 42 on separate rights-of-way. Transverse cascading of these structures is remote.

Different span lengths are employed on the four main circuits with structural anchoring uti-lized at regular intervals along the right-of-way. In addition, the capacity of any single 115-kV line greatly exceeds (1) the power requirements of engineered safety features, which are satisfied by two 2500-kVA diesel generators, (2) the auxiliary plant load, which is about 29 MVA, and (3) the capacities of circuits 7T or 767, which deliver power at 34.5 kV to the plant. Circuit 767, one 34.5-kV offsite source, is fed from the 115-kV/34.5-kV transformer 6 at station 13A and is routed underground to 34.5-kV/4.16-kV transformer 12B at Ginna Sta-tion. A voltage regulator was installed on circuit 767 in 1996. Circuit 7T , the second 34.5-kV offsite source, is fed from the 115-kV/34.5-kV transformer 7 at station 13A and is routed underground to 34.5-kV/4.16-kV transformer 12A. Transformer 7 is a load tap changing Page 15 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER (LTC) design. Circuits 767 and 7T are run over different routes than the four 115-kV lines to substation 13A.

8.2.1.1.3 Circuit Breakers The generator, its isolated phase bus, the generator step-up transformer, the station unit trans-former (11), and the four oil pipe type cables that deliver the output to the station 13A are protected by circuit breakers as a unit. Protection through differential and pilot wire relaying will provide for isolation of the unit within six cycles in the event of a fault within the pro-tected zones. Additional protection in the form of negative sequence, loss of excitation, phase protection, stator ground, and reverse power relaying provides adequate protection for faults within the unit. Any one of the pipe type cables can be electrically disconnected after deenergizing the pipe type cables and then the remaining pipe type cables can be reenergized and the unit returned to service at reduced output. During deenergization of the pipe type cables, auxiliary power would be available to the plant from the 115-kV /34.5-kV transformer 6 at station 13A via circuit 767, and/or the 115-kV/34.5-kV transformer 7 at station 13A via circuit 7T to supply normal shutdown power.

The breaker-and-a-half layout (seen in Figure 8.1-1) of station 13A consists of twelve break-ers, six rated at 3000 amp, one at 2000 amp, and five at 1600 amp. One 3000-amp-rated breaker is used to feed one bus section from the generator and two in series are used to feed the other bus section with circuit 911 tapped between the breakers. The breaker-and-a-half layout provides the versatility of dual feed for each line and the ability to remove any breaker or transmission line without deenergizing any other part of the station.

Station 13A has a thirteenth circuit breaker (rated at 2000 amp) to supply transformer 7 and circuit 7T. This breaker is fed from bus section #1. The station also has two 75 MVAR capacitor banks fed by two 2000 amp zero crossing breakers from bus section #2. The breaker-and-a-half design is not used on these circuit/capacitors.

Failure of either primary breaker for the generator, transformer, and oil pipe type cables to open would be backed up by a secondary breaker operation. Operation of the secondary breaker backing up one of the primary breakers (9X13A72) would result in loss of circuit 911. Operation of the four breakers backing up the other primary breaker (1G13A72) would result in the loss of circuit 7T.

Administrative procedures are utilized to ensure Ginna generation does not exceed the capa-bility of the output circuits when output breakers and/or transmission lines are out of service.

8.2.1.1.4 Protective Relay Circuits The basic transmission system buses at all the stations are protected with high-speed differen-tial protection with primary and secondary relay circuits. Breaker backup protection is obtained by operating adjacent and remote breakers. Backup tripping is initiated after a five-cycle delay circuit has found the breaker has failed to clear. Total elapsed time between a fault and the isolation of the stuck breaker should not exceed 10.1 cycles.

The six 115-kV transmission lines are each protected by primary and secondary relays, which function independently of one another. These relays initiate tripping operation by operating Page 16 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER their associated tripping relays, which in turn trip the associated breakers and initiate their breaker backup schemes. The primary relays are connected for permissive overreaching transfer tripping (permissive tripping) by utilizing fiber optic cable and multiplex devices.

Separate current transformers and separate potential transformer windings from a two sec-ondary winding transformer are used for primary and secondary relays. Separately fused dc control circuits are used from separate battery systems so that a short circuit in the primary relay control circuits will not incapacitate the secondary relay control circuits, and vice versa.

The primary and secondary protective relay systems are physically separated. Separate con-trol boards are provided for the primary and secondary protective devices. Redundant, inde-pendent dc systems including battery, charger, control panel, and segregated control cables are provided for control of oil circuit breakers and the primary and secondary protective relay systems. The control cables between the control boards and oil circuit breakers are separate.

Each set of protective tripping relays energizes separate breaker trip coils, completing the redundancy of relay systems for security and reliability.

The switchyard meets minimum requirements for reliability and security as developed in the Northeast Power Coordinating Council and New York Independent System Operator Reli-ability Criteria as it applies to protective relays.

8.2.1.2 Station Auxiliary (Startup) Transformers 12A and 12B Ginna Station was originally designed with a single station auxiliary transformer 12A. A spare station auxiliary transformer 12B, was subsequently acquired and in 1977 the spare transformer was permanently connected to the 34.5-kV bus. To increase the availability mar-gin in the event of a single system failure, the 34.5-kV bus was later split and the system con-figured as shown in Figure 8.1-1. Station auxiliary transformer 12A is connected to circuit 7T and station auxiliary transformer 12B is connected to circuit 767. Circuit 7T receives 34.5 kV from RG&E station 13A via 115 kV to 34.5 kV stepdown transformer 7, which has an integral load tap changer (LTC) for voltage regulation. Circuit 767 receives 34.5 kV from RG&E Station 13A via 115 kV to 34.5-kV stepdown transformer 6. Circuit 767 voltage reg-ulator and transformer 7 ensure acceptable voltages during system transients.

Transformers 12A and 12B are self-cooled/forced-air-cooled three-winding transformers (oil-immersed type), rated 28/37.33 MVA (55C rise) with 12% higher continuous capability at a 65C rise. The transformers have two identical secondary windings each exactly half of the total capacity.

The high voltage winding is rated at 34.5-kV. The two secondary windings are each rated at 4.16-kV.

The transformers are equipped with current transformers for metering and relaying, oil-level gauge with alarm, oil temperature indicator with alarm, and a tank pressure relief device with alarm.

Three lightning arresters are connected to the high-voltage bushings for lightning pro-tection. In addition, the transformers have high-speed protective relays, including differen-Page 17 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER tial, phase and ground backup, that rapidly remove all sources of power during an internal fault to minimize damage.

During normal operations the station auxiliary transformers supply the engineered safeguards (Class 1E) auxiliary loads and the station unit transformer (11) supplies the non-Class 1E auxiliary loads. Transformer 11 is fed by the Ginna Station main generator. During startup, shutdown, and loss of Ginna Station generating capacity, transformers 12A and 12B supply all auxiliary loads because transformer 11 is not available. A main generator trip results in the automatic transfer of the auxiliary loads on buses 11A and 11B to the station auxiliary transformers by the closing of bus ties 11A-12A and 11B-12B and the opening of the trans-former 11 feeds (see Figure 8.1-1).

The transformers are very conservatively sized. Each is capable of supplying all plant auxil-iary loads for full power operation without exceeding 90% of the forced air rating at 55C rise. This value will not exceed 33.6 MVA at maximum guaranteed turbine output; however, the transformers are capable of continuous operation at 41.8 MVA at 65rise . During startup and shutdown of the station, the requirements are considerably less, due to partial loading of many of the auxiliaries. The engineered safety features system load imposed on the transformer is only a fraction of its total rating. During MODES 1 and 2, one secondary winding supplies one 4-kV bus section, which in turn supplies two 4-kV/480-V transformers providing power to the engineered safety features system. This is done to avoid having to transfer those auxiliaries from one secondary winding to another at the time that they are required to operate. Thus the transformer is very lightly loaded during MODES 1 and 2 and the operator is continuously aware of its status.

Breakers 12AX, 12AY, 12BX, and 12BY (see Figure 8.1-1) permit the station auxiliary trans-formers to be lined up so that transformer 12A supplies one engineered safeguards bus and transformer 12B supplies the other (50/50 mode), transformer 12A supplies both safeguards buses (0/100 mode), or transformer 12B supplies both safeguards buses (100/0 mode). The 50/50 mode is the normal configuration.

Periodic maintenance is performed by Ginna Station on 12A and 12B transformers to ensure maximum reliability. In addition to inspection and cleaning, oil sampling and analysis are performed and power factor, excitation, and capacitance measurements are made to determine degradation of the oil and insulation.

Page 18 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER 8.2.2 ANALYSIS 8.2.2.1 Transmission System 8.2.2.1.1 Loss of Ginna Station Output Upon a sudden loss of Ginna Station generating capacity, the plant auxiliary load, including engineered safety features, would continue to be fed from either one or both of the 34.5-kV lines. The load from transformer 11 would be transferred to the station auxiliary transform-ers. If the generation was less than 50% capacity, the reactor could remain in operation; if greater than 50%, the plant would be tripped because of steam dump capacity.

The Interconnection Agreement between R. E. Ginna Nuclear Power Plant, LLC and Roches-ter Gas and Electric Corporation does not require a reduction in power for the loss of any sin-gle 115-kV transmission circuit (908, 909, 911, 912, 913, 937). Upon a loss of any circuit, Ginna Station certifies it can reduce power to net generation levels that will not damage equipment in the event of a subsequent circuit outage.

The main criterion in determining the dependability of the transmission system is to deter-mine if it will remain synchronized with the rest of the system after the most severe fault, sus-tained for the longest duration under second contingency conditions. Synchronization is maintained for the longest duration fault, 9.5 cycles, if a breaker fails to open and backup breakers must open to clear. The critical clearing time is between 11 and 12 cycles at which time a fault would create electrical instability at Ginna Station.

8.2.2.1.2 Switchyard Direct Current Power System At station 13A, as in other major stations, dc rather than ac is used for tripping and closing of the breakers in order to remove the possibility of a loss of ac voltage or a reduction to a low value and the inability to operate the trip coil due to a heavy fault on the protected circuit.

The dc source consists of two completely independent battery systems.

The dc sources are sufficient to supply station requirements without ac powered chargers for more than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of normal operation. Duplicate feeds, one from the 115-kV/34.5-kV transformer 6 at station 13A and one at 12 kV from station 132, provide redundant charging supply to the batteries.

8.2.2.1.3 Transmission Network Protective Features Arrangements to minimize the probability of power failure due to faults in the network inter-connections and the associated switching are as follows:

A. Redundancy is designed into the network interconnections by transmission lines connected to the RG&E 115-kV transmission network at stations 121 and 122. A single circuit may be interrupted and the others will be capable of carrying the required emergency loading.

B. Four 115-kV transmission circuits (908, 909, 912 and 937) are installed on separate struc-tures on the same right-of-way and each line of circuit structures is separated from the oth-ers.

Page 19 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER C. Each circuit is protected from lightning by an overhead shield wire. Switching surge pro-tection is accomplished via surge arresters.

D. The breaker-and-a-half switching arrangement in station 13A includes two full capacity main buses which feed each circuit through a circuit breaker connected to each bus. Pri-mary and secondary relaying are provided for each circuit along with circuit breaker failure backup for fault clearing. These provisions permit the following:

1. Any circuit can be switched under normal or fault switching without affecting another circuit.

2. Any single circuit breaker can be isolated for maintenance without interrupting the power or protection to any circuit.

3. Short circuits of a single main bus will be isolated without interrupting service to any circuit.

4. Failure of a tie breaker to clear a short circuit will result in the loss of its two adjacent circuits until it is isolated by disconnect switches .

5. Failure of a bus side breaker to clear a short circuit will result in the loss of only one circuit until it is isolated, except circuit 7T.

6. Circuit protection against failure of the primary protective relaying is provided by sec-ondary relaying.

With the above protective features, the probability of loss of more than one source of 115-kV power from credible faults is low.

Information on loss-of-offsite-power events is contained in References 1 and 2.

8.2.2.1.4 Northeast Power Coordinating Council Load-Shedding Practic The Northeast Power Coordinating Council (NPCC), of which RG&E is a member, has insti-tuted load-shedding practices based on frequency. Presently the NPCC has established a two-step automatic load scheme that can compensate for a total generation deficiency of 25%. It is within this 25% range that the NPCC expects its members to maintain coordination.

"Coordination" is defined as preventing the large generating units from tripping ahead of the load shed relays in hopes of recovering from generation deficiencies. Specifically, coordina-tion requires that Ginna remain on-line until the load-shedding scheme has sufficient time to operate and the system to recover from a mismatch of generation and load. The existing under frequency setpoint which achieves the required coordination is 57.7 Hz.

Page 20 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER 8.2.2.2 Station Auxiliary (Startup) Transformers 12A and 12B 8.2.2.2.1 Original Ginna Station Design Ginna Station was originally designed with a single station auxiliary transformer No. 12A. A single transformer was considered acceptable because it would afford the required degree of plant safety for the following reasons:

A. The plant can be safely shut down without the use of offsite power. In the unlikely event of complete loss of electrical power to the station, decay heat removal would continue to be ensured by the availability of one steam-driven and two motor-driven auxiliary feed-water pumps and steam discharge to the atmosphere via main steam safety valves and atmo-spheric relief valves.

B. All vital loads (safety systems, instruments, etc.) can be supplied from emergency diesel generators.

C. The diesel generators have an adequate fuel supply readily available to them (Section 9.5.4). Reserve fuel supplies are available for delivery within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

The two diesel generators, each capable of supplying safeguards loads, and the station aux-iliary transformer provide three separate sources of power immediately available for opera-tion of these loads. Thus the power supply system meets the single-failure criterion required of safety systems.

D. As an emergency backup to the diesel generators, should they be required to operate for an extended period during an outage of the station auxiliary transformer, power can be fed back from the 115-kV grid through the generator step-up transformer and the station unit transformer. Before power can be brought in from this source, flexible links at the genera-tor terminals must be removed. This operation can be accomplished in about 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

E. Heat removal can be accomplished by dumping steam, in association with natural circula-tion, following loss of power to reactor coolant pumps.

8.2.2.2.2 Transformer Failure Rates The use of a single station auxiliary transformer is a well-established practice in the electrical utility industry. Failure rates of transformers vary with voltage rating, type of service, main-tenance, as well as various other factors; however, in discussions with various utilities, the number of recorded failures for transformers in startup service has been very low.

A survey conducted in 1966 by the Electrical System and Equipment Committee of Edison Electric Institute is further proof of this low failure rate. Briefly, the 63 utilities that took part in the survey reported 768 transformer failures during the period between January 1, 1956, and December 31, 1965. The report does not list the total number of transformers that were reviewed by the survey. However, based on an increase of 50% in installed transformer capacity in a 10-year period, and using the total of 12,170 transformers installed during the period, the annual failure rate for all types of transformers would be 0.2%. It does record the fact that 20 of the 768 failures occurred in generating stations; however, the length of time that the transformers were in service was not recorded.

Page 21 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER This report also indicates that 319 failures were associated with transformers installed in the same 10-year period. This is an annual failure rate of 0.0026 transformer failure per trans-former year for all types of services such as distribution, transmission tie, and also transform-ers. The actual number of failures in generating station service could be a very low number.

The Edison Electric Institute report also indicated that a very high percentage of transformer failures occur early in life, as much as 25% in the first year. Since the transformer will be energized for plant testing for about 1 year prior to plant operation, this abnormally high fail-ure period will have been passed. If the failures in the first year are deducted from the total number, the annual failure rate would be even less than 0.0026.

8.2.2.2.3 Backup Auxiliary Transformers Even though a single station auxiliary transformer ( 12A) is sufficient, an additional trans-former (12B) was made available in 1977 that would provide backup for the loss of the 12A transformer. The backup transformer was connected to the 34.5-kV bus through a normally open varmaster switch, which had full capability to withstand fault currents, and a discon-necting switch. Protective relaying, independent of the station auxiliary transformer 12A, was also installed and supplied by nonsafety ac and dc power supplies.

In the event of a reactor accident, coupled with long-term unavailability of the station auxil-iary transformers, the station unit transformer (11) could be used as backup to the diesel gen-erators for providing power for long-term cooldown. This can be accomplished by disconnecting flexible links on the isolated phase bus at the generator terminals and back-feeding from the 115-kV system through the generator step-up transformer. This effort could be accomplished in a short time (6 to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />)a after which the vital loads on the four 480-V buses could be transferred from the diesel generators.

The NRC reviewed the Ginna compliance with General Design Criterion 17 and determined that the RG&E system met current regulatory requirements. In the Safety Evaluation Report for SEP Topic VII-3, Safe Shutdown, dated April 2, 1981 (Reference 3), it was concluded that "this design meets the current NRC requirements for offsite power supply (General Design Criterion 17), provided that the disconnection of the main generator terminals can be accom-plished within the time constraints imposed by coolant water inventory and battery life."

Since Ginna Station has sufficient coolant water inventory (see Chapter 10) and the batteries were considered capable of supplying vital loads for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, which is longer than required for the terminal disconnection action to enable backfeeding, General Design Criterion 17 was considered met. Subsequent replacement of the batteries continue to meet this 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> require-ment (Reference 6).

Reference 3 noted that in the event of loss of both diesel generators the offsite power supply would be subject to single failure (transformer 12A); however, the design was acceptable because of the ability to manually shift to transformer 11 within the above time constraints.

During the 1987 Ginna Station MODE 6 (Refueling) outage, station auxiliary transformer

a. This was reviewed and found acceptable during the review of SEP Topic VIII-1.A, SER, dated January 19, 1982.

Page 22 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER 12A was out of service for maintenance and the two emergency diesel generators were sup-plying power. Low fuel oil levels in both emergency diesel-generator day tanks caused by partially plugged suction strainers to the diesel fuel oil transfer pumps threatened loss of both diesel generators and a station blackout.

It was concluded that although the existing offsite power system met the requirements of existing licensing commitments, it lacked sufficient operating margin when applying the sin-gle-failure criterion. Therefore, the offsite power system was reconfigured by splitting the existing 34.5-kV onsite bus and energizing both station auxiliary transformers 12A and 12B, one from each independent offsite transmission line as described in Section 8.2.1.2. Crediting either the two station auxiliary transformers or a single station auxiliary transformer and back feeding through the generator step-up transformer meets the General Design Criteria 17 requirement to have two physically independent circuits.

8.2.2.3 Radiation Exposure During Restoration of Power Restoration of power or putting emergency or backup sources of power into operation may require access to plant areas that could be subjected to above normal radiation levels, result-ing from accident conditions (e.g., the loss-of-coolant accident is the worst postulated acci-dent) that could exist during power restoration. Entry to the station auxiliary transformer area (Nos. 11, 12A, and 12B), the generator bus area, and the diesel-generator area could be neces-sary or desirable to restore power. The design basis direct radiation levels at these locations for a 24-hour period following a loss-of-coolant accident, as calculated at initial plant licens-ing, are listed in Table 8.2-1.

Following a LOCA, radiation exposure from airborne contamination may exist. The design-basis inhalation dose rate within 200 ft of the containment, as calculated at initial plant licens-ing, is given in Table 8.2-2.

Radiation exposure from airborne contamination can be reduced to acceptable levels by equipping workers with breathing apparatus. Direct radiation would be the limiting source in determining the access time in designated work areas. As noted in the tabulation, direct radi-ation would decay very rapidly following a loss-of-coolant accident. This rapid decay of radiation following an accident would permit access to these work areas.

Results of more recent calculations are contained in Chapter 12.

Page 23 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER REFERENCES FOR SECTION 8.2

1. Letter from K. W. Amish, RG&E, to J. F. OLeary, AEC,

Subject:

Abnormal Occur-rences 73-9 and 73-10 (related to a loss-of-offsite-power event), dated October 31, 1973.

2. Letter from L. D. White, Jr., RG&E, to D. L. Ziemann, NRC,

Subject:

Loss of Offsite Power Events at the R. E. Ginna Nuclear Power Plant, dated November 15, 1979.

3. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,

Subject:

SEP Topics VII-3 and VIII-2 (R. E. Ginna Nuclear Power Plant), dated April 2, 1981.

4. Rochester Gas and Electric Corporation, Design Analysis EEA 09004, Rev. 0, May 4, 1991.

5. Rochester Gas and Electric Corporation, Design Analysis DA-EE-96-068-03, Offsite Power Load Flow study, Rev. 0, July 10, 1996

6. Rochester Gas and Electric Corporation, Design Analysis DA-EE-2001-028, Vital Bat-tery 8 Hour Capacity, Rev. 0, June 28, 2001.

Page 24 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER Table 8.2-1 DIRECT RADIATION DOSE RATESa (REM/HR)

Time (hr) Station Auxiliary Diesel Generator Generators Bus Transformer 0 9 4.5 6.9 1 2.5 1.2 1.8 2 1.7 0.9 1.3 24 0.08 0.04 0.06

a. At listed locations following a loss-of-coolant accident.

Page 25 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER Table 8.2-2 INHALATION DOSE RATESa (REM/SEC)

Time (hr) 25% of Iodine Available for Leakage All Iodine is Present in is Assumed to be Present in Removable Form Nonremovable Form 0 0.67 0.67 1 7.1 x 10-2 4.1 x 10-2 2 5 x 10-2 1.04 x 10-2 24 0.7 x 10-2 0.39 x 10-2

a. Within 200 ft of containment following a loss-of-coolant accident.

Page 26 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER 8.3 ONSITE POWER SYSTEM 8.3.1 ALTERNATING CURRENT POWER SYSTEM 8.3.1.1 Description The electrical power system is designed to provide a simple arrangement of buses requiring the minimum of switching to restore power to a bus in the event that the normal supply to that bus is lost.

8.3.1.1.1 Single-Line Diagrams The basic components of the alternating current portions of the station electrical system are shown in Drawings 03201-0102, 33013-0623, 33013-0652, and 33013-0653, which show the overall station system, 4160-V system, the 480-V system, and the 120-V ac instrument bus system.

8.3.1.1.2 Station Unit Transformer The plant generator serves as the main source of auxiliary electrical power during "on-the-line" operation of the plant. Power is supplied via a 19/4.16-kV, three-winding station unit transformer that is connected to the main leads from the generator.

Auxiliary power required during plant startup, shutdown, and after reactor trip is supplied from the 34.5-kV system. After reactor or turbine generator trip, the necessary auxiliaries on the 4160-V buses are transferred by a fast bus transfer scheme using stored energy breakers from the station unit transformer to the station auxiliary transformer(s). Control power for the breakers is obtained from the station batteries. The 34.5-kV switchyard is served by two separate sources. Both sources come directly from the Rochester Gas and Electric Corpora-tion (RG&E) 115-kV system through step-down transformers. Incoming lines to the 115-kV substation, other than the tie to the plant generator step-up transformer, consist of six lines from the RG&E transmission network. The 34.5-kV system is also the normal supply for the auxiliary load associated with plant engineered safeguards.

Three auxiliary transformers provide all the electrical power requirements for the onsite loads at Ginna Station. The station auxiliary transformers 12A and 12B, are described in Section 8.2 and represent two of the three auxiliary transformers. The 12A and 12B transformers are double secondary transformers and one or both are connected to two 4160-V buses, 12A and 12B. The station unit transformer (No. 11) is also a three-winding transformer identical in capacity to the No. 12 transformers and is directly connected to the isolated phase bus. The voltage rating is 19 kV to 4160 V. The station unit transformer is connected on the secondary side to two non-Class 1E 4160-V buses, 11A and 11B.

The primary purpose of transformer 11 is to supply normal station auxiliary loads while the main generator is connected to the 115-kV grid. The same conservatism is applied to the sta-tion unit transformer as to the station auxiliary transformers in that it can carry all auxiliaries within 90% of its forced-air rating at 55C; however, its normal load is considerably higher than that of the No. 12 transformers.

Page 27 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER When off-line or during startup, all onsite power is supplied from the offsite 34.5-kV system through transformer 12A, 12B, or 12A and 12B. The four 4160-V buses are arranged as shown in Drawings 33013-0623, sheet 1 and Drawing 33013-0653. Bus 11A is fed from bus 12A and bus 11B is fed from bus 12B through bus tie breakers. Once the main generator is synchronized to the grid, the bus ties are opened at about 5% power, isolating buses 11A and 11B from 12A and 12B. Buses 11A and 11B supply all non-safety-related loads while buses 12A and 12B remain energized from the offsite system and supply safety-related and non safety related loads on the 480-V safeguards buses through station service transformers.

After a reactor or turbine generator trip, the necessary auxiliaries on the 4160-V buses are transferred by a fast bus transfer scheme using stored energy breakers from the station unit transformer to the station auxiliary (12A and 12B) transformers. The station auxiliary trans-formers are served by two independent sources: one line through a tie to the RG&E 115-kV switchyard via stepdown transformer 7 (circuit 7T)is connected to transformer 12A and a sec-ond line through a tie to the RG&E 115-kV switchyard via step-down transformer 6 (circuit 767) is connected to transformer 12B.

8.3.1.1.3 The 4160-Volt System The 4160-V system (Drawing 33013-0653) consists of four buses that are classified as non-Class 1E. The system is formed by four sets of Westinghouse metal-clad switchgear, which use DH type air circuit breakers. Discrete relaying is used to afford overcurrent, undervolt-age, and underfrequency protection as required. The two buses connected to the No. 11 transformer supply all normal plant auxiliary loads (non-Class 1E) and are designated 11A and 11B. The two buses connected to the offsite system through transformers 12A and 12B supply all the startup power and also feed the Class 1E loads on the 480-V safeguards system through four station service transformers.

Buses 11A and 11B are connected to the generator leads via bus main breakers and the station unit transformer. Buses 11A and 12A or buses 11B and 12B can be tied together via bus tie breakers. When off-line, a tie breaker is also supplied between buses 11A and 11B, which may be closed under administrative control so as to perform certain maintenance activities.

All 4160-V auxiliaries except condensate booster pump 1A are split between buses 11A and 11B. In addition, buses 11A and 11B each serve one 4160/480-V station service transformer.

Buses 12A and 12B each serve two 4160/480-V station service transformers. Bus 12A also feeds condensate booster pump 1A.

Buses 11A and 11B are provided with solid-state underfrequency relays and undervoltage relays to provide protection against a loss-of-flow transient. The underfrequency relays are set to give a reactor trip before decreasing bus frequency can degrade primary system flow below the level assumed in the steady-state or transient analyses (Section 15.3). The setpoint information is described in Section 8.2.2.

8.3.1.1.4 The 480-Volt System 8.3.1.1.4.1 480-Volt Buses The 480-V system (Drawing 33013-0652) is divided into six buses. Each bus is supplied by a separate 4160/480-V station service transformer. The 480-V buses are supplied from the Page 28 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER 4160-V buses as follows: buses 14 and 18 from bus 12A, 16 and 17 from 12B, 13 from 11A, and 15 from 11B. Tie breakers are provided between 480-V buses 14 and 13, buses 16 and 14, buses 16 and 15, and buses 17 and 18.

The buses are formed by Westinghouse load centers using DB type air circuit breakers. The breakers are protected by overcurrent devices. They were each originally equipped with three single-phase series trip thermal/mechanical direct acting devices. These overcurrent devices were upgraded by replacing the three single-phase devices with one, three-phase solid-state device referred to as an Amptector. The Amptector design has been superseded by the West-inghouse Westector, which is equivalent in fit and fuction to the Amptector design. New and replacement overcurrent devices are now Westector units. The solid-state device detects fault currents and overloads and directly trips the circuit breaker mechanically. Tripping energy is derived from the load current flowing through sensors so that no separate power source is required. The assembly is mounted on the breaker and consists of sensors, a solid-state trip unit, actuator, and discriminator. The solid-state overcurrent trip devices are set so as to be coordinated with associated breakers, which include the 4160-V buses and motor control cen-ters. Coordination ensures that the correct device clears the fault or overload and that no other device operates except where necessary to afford backup protection. The devices used on buses 14, 16, 17, and 18 are Class 1E. Those used on buses 13 and 15 are non-Class 1E.

All Class 1E assemblies are qualified to IEEE 344-1975 thus ensuring operability during a safe shutdown earthquake.

8.3.1.1.4.2 Class 1E Trains Two Class 1E independent trains provide the necessary redundancy on the 480-V safeguards system. Train A consists of 480-V safeguards buses 14 and 18, while train B consists of safe-guards buses 16 and 17. Buses 14 and 16 are located in the auxiliary building, while 17 and 18 are located in the screen house.

A bus tie between the two inplant Class 1E 480-V safeguards buses 14 and 16 can be used for maintenance purposes. This tie consists of a breaker in each bus, one manually operated and the other electrically operated.

The bus tie control scheme is discussed in Section 7.3.1.2.

Each safeguards bus has two undervoltage channels. Each channel has a type 27N relay to detect a complete loss of voltage and a type 27 relay to detect abnormally low voltage. One out of two relays is required to activate the channel. Activation of either channel will give an undervoltage protection system alarm. Activation of both channels will result in bus load shedding and an associated diesel generator start and bus connection.

In the event of a loss of offsite power, or abnormal offsite power, the diesel generators are started concurrent with load shedding. When the diesel generators come up to speed and close onto the buses, the undervoltage relays reset, thus allowing the operator to manually load any of the motors that are required. Some loads may also be automatically loaded onto the bus. The automatic load sequencer is not activated unless a safety injection signal is pres-ent.

Page 29 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER The failure of a 125-V dc/120-V ac inverter coincident with an undervoltage condition or the loss of offsite power was examined for impact on the undervoltage protection system func-tionality. This failure scenario was less limiting than the single failure of a diesel generator to start. As a result of the analysis, the undervoltage protection system design was modified for buses 14, 16, 17, and 18 to provide power to the undervoltage control cabinets from the 125-V dc battery system instead of from the 120-V ac system and inverter. The modified under-voltage protection system design functionality is not impaired by a postulated coincident inverter/loss of offsite power failure condition.

In the event of a station service failure or degraded voltage resulting in the loss of one 480-V safeguards bus, the diesel generator associated with that train will get a start command. Once up to speed, the diesel-generator breaker on that bus only will close restoring rated voltage.

Should the same event occur concurrent with a safety injection signal, the other bus on that train will be tripped by the undervoltage relay on the failed bus. This condition will actuate the load sequencer on that train and Class 1E loads will be brought into service in a prepro-grammed fashion. The other train, not experiencing undervoltage, will program into service only those loads that are not already in service. That is, no load shedding of engineered safety features actuation system (ESFAS) will occur.

8.3.1.1.5 The 120-Volt Alternating Current System The 120-V ac instrument supply (Drawing 03201-0102) is split into four buses that are capa-ble of being supplied by multiple sources. Each bus is supplied by a pair of mechanically interlocked breakers such that paralleling of redundant sources is prevented.

Two of the buses are fed by inverters which are in turn supplied from separate 125-V dc buses. The other two buses are supplied by constant voltage transformers connected to sepa-rate 480-V buses. Instrument buses 1A and 1C have two power sources, with automatic transfer from the primary to backup supply. Instrument Buses 1A, 1B, and 1C provide power to vital plant instrumentation. All three buses are backed up by safety-related emergency sup-plies; bus 1A from battery 1A and diesel generator 1A; bus 1B from diesel generator 1A; and bus 1C from battery 1B and diesel generator 1B. Instrument bus loads are shown in Drawing 03201-0102.

In addition to the four instrument buses, one channel each of containment wide range pressure and steam generator B pressure instrumentation (P950 and P479) are fed from a separate inverter (MQ-483), which is supplied from 125-V dc battery 1A. See Section 8.3.2.1.

8.3.1.1.5.1 Instrument Bus 1A Instrument bus 1A is normally supplied from Class 1E 125-V dc distribution system train "A" through inverter A. The backup supply is the Class 1E 480-V ac bus 14 MCC-1C through a regulating transformer. When the normal supply fails, a static switch automatically switches to the backup supply. When the normal supply returns, the static switch is manually switched back to the normal supply. The automatic transfer switch is initiated by any of the following:

inverter failure, overcurrent beyond the static switch, inverter output undervoltage, manual operation, or a failure of the static switch. When inverter or static switch maintenance is required, instrument bus 1A can be manually switched to the maintenance supply, which is Page 30 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER supplied from non-Class 1E bus 13 MCC-1A and a regulating transformer, by operating a mechanically interlocked breaker at the instrument bus 1A distribution panel in the main con-trol room.

Several local alarms on the inverter feed a common alarm which annunciates on the main control board, directing operators to check the instrument bus inverters. There are two ac voltmeters and a frequency meter located on the 1A instrument bus distribution panel that indicate the 1A inverter output voltage and frequency and the 1A instrument bus output volt-age. A main control board alarm will annunciate if the 1A instrument bus voltage drops below 105 V ac.

8.3.1.1.5.2 Instrument Bus 1B Instrument bus 1B is normally supplied from Class 1E bus 14 MCC-1C and a regulating transformer. The backup supply for instrument bus 1B is supplied from non-Class 1E bus 13 MCC-1A and a regulating transformer. Operator action is required to switch to the backup supply by operating a mechanically interlocked breaker at the instrument bus 1B distribution panel located in the main control room. There is an ac voltmeter located on the 1B instru-ment bus distribution panel which indicates the 1B bus voltage. A main control board alarm will annunciate if the 1B instrument bus voltage drops below 105 V ac.

8.3.1.1.5.3 Instrument Bus 1C Instrument bus 1C is normally supplied from Class 1E 125-V dc distribution system train "B" through inverter B. The backup supply is the Class 1E 480-V ac bus 16 MCC-1D through a regulating transformer. When the normal supply fails, a static switch automatically switches to the backup supply. When the normal supply returns, the static switch is manually switched back to the normal supply. The automatic transfer switch is initiated by any of the following:

inverter failure, overcurrent beyond the static switch, inverter output undervoltage, manual operation, or a failure of the static switch. When inverter or static switch maintenance is required, instrument bus 1C can be manually switched to the maintenance supply, which is supplied from non-Class 1E bus 13 MCC-1A and a regulating transformer, by operating a mechanically interlocked breaker at the instrument bus 1C distribution panel in the main con-trol room.

Several local alarms on the inverter feed a common alarm which annunciates on the main control board, directing operators to check the instrument bus inverters. There are two ac voltmeters and a frequency meter located on the 1C instrument bus distribution panel that indicate the 1C inverter output voltage and frequency and the 1C instrument bus output volt-age. A main control board alarm will annunciate if the 1C instrument bus voltage drops below 105 V ac.

8.3.1.1.5.4 Instrument Bus 1D Instrument bus 1D is normally supplied from non-Class 1E bus 15 MCC-1B via a regulating transformer. The backup supply for instrument bus 1D is supplied from bus 13 MCC-1A via a regulating transformer. Operator action is required to switch to the backup supply by oper-ating a mechanically interlocked breaker at instrument bus 1D distribution panel located in Page 31 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER the main control room. There is an ac voltmeter located on the 1D instrument bus distribution panel that indicates the 1D bus voltage. A main control board alarm will annunciate if the 1D instrument bus voltage drops below 105 V ac.

Critical channel D instruments (one channel each of containment wide-range pressure and steam generator B pressure instrumentation [P950 and P479]) are fed from class 1E inverter MQ-483, which is supplied from battery 1A.

8.3.1.1.6 Emergency Power 8.3.1.1.6.1 Emergency Power Sources The first source of emergency power is the 34.5/4.16-kV station auxiliary transformers. As described in Section 8.2.1.2, each of the two transformers has an independent supply. One is circuit 767 from 115/34.5-kV transformer 6 at RG&E station 13A and the second is circuit 7T from 115-kV/34.5-kV transformer 7 at RG&E Station 13A. The routing is entirely indepen-dent of the main transmission right-of-way.

If the 34.5-kV sources and/or the 12A and 12B transformers should fail, the next source of emergency power is the two diesel-generator sets. Each set consists of an Alco model 16-251-F engine coupled to a Westinghouse 1950-kW (continuous rating), 0.8 power factor, 900 rpm, three-phase, 60-cycle, 480-V generator. The diesel-generator units have extended rat-ings of 2300 kW for 0.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> and 2250 kW for 2 succeeding hours.

Each unit, as a backup to the normal standby ac power supply, is capable of sequentially start-ing and supplying the power requirement of one complete set of engineered safety features equipment. The units are located in separate rooms in a Seismic Category I structure located outside the northeast wall of the turbine building.

8.3.1.1.6.2 Diesel-Generator Rapid Startup and Loading Each diesel generator is automatically started by an air motor. Each unit has a complete 40-ft3 air storage capacity (two 20-ft3 tanks each) and compressor system powered from the 480-V emergency bus. The piping and the electrical services are arranged so that manual transfer between units is possible. Each unit has the air storage capacity required to ensure that the available diesel cranking time is sufficient for five diesel starts without recharging the air receivers. The unit is capable of being started and supplying one-third load after 10 sec. It can be fully loaded 30 sec after the initial starting signal. The starting system is completely redundant for each diesel generator.

To ensure rapid start, the units are equipped with water jacket and lube-oil heating and pre-lube pump for circulation of lube oil when the unit is not running. The units are located in heated rooms.

An audible and visual alarm system is located in the main control room and will alarm abnor-mal conditions of jacket water temperature, lube-oil temperature, fuel-oil level, jacket water and lube oil cooler service water AOV valve position, and starting air pressure.

Page 32 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER 8.3.1.1.6.3 Diesel-Generator Protective Trips The protective trips and conditions that render the diesel generators incapable of responding to an automatic start signal are the following:

• Low lube-oil pressure (40 psig; two-out-of-three logic).

• Overcrank.

• Reverse power (if safety injection signal not present).

• Overcurrent (if safety injection signal not present).

• Overspeed.

• Control switch in PULL-STOP.

• Local/remote switch in LOCAL.

The reverse power and overcurrent protective trips are automatically bypassed upon receipt of a safety injection actuation signal. Since the low lube-oil pressure trip uses redundant sen-sors and coincident logic, the diesel generator protective trips meet the requirements of Branch Technical Position ICSB-17. (References 1, 2 and 3)

All instrument tubing and instruments required for diesel generator operation are Seismic Category I. These instruments include lube oil pressure, jacket water pressure, and fuel oil pressure switches.

The Technical Specifications require that the generator be periodically tested to verify the capability to reject a load of 295-kW without tripping due to overspeed.

An overspeed condition would cause generator damage and therefore the diesel generator should be shut down for corrective action to be taken to restore the generator output to nor-mal.

A shutdown of the diesel generator is indicated in the control room by an audible alarm on the control board and by the generator bus voltmeter.

Normal oil pressure is about 85 psi; the emergency diesel-generator audible alarm sounds at 60 psi. Low oil pressure shutdown is initiated when two-out-of-three oil pressure switches operate at 40 psi. Since the engine cannot run without proper lubrication, shutdown permits corrective action to be taken before the engine is damaged and the diesel generator can then be returned to service.

8.3.1.1.6.4 Fuel Oil Supply An onsite diesel-generator fuel oil inventory is maintained to support operation of both diesel generators. Information on diesel fuel oil, including storage locations and tank capacities, is found in Section 9.5.4. Fuel oil storage and sampling requirements are in the Technical Spec-ifications.

Page 33 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER 8.3.1.1.6.5 Diesel-Generator Startup Logic The diesel-generator units are given a starting signal any time there is an abnormal voltage condition, and also when a safety injection signal is initiated. The logic diagram for the die-sel-generator startup is shown in Drawing 33013-1353, Sheet 5. The index of logic symbols is shown in Drawing 33013-1353, Sheet 1.

The units have demonstrated that they are capable of coming up to speed and voltage, ready to accept load, in 10 sec. They have also demonstrated the capability of accepting blocks of loads; however, to keep voltage dips to a minimum, loads are sequenced onto their buses using programmed time increments of 5 to 7 sec.

8.3.1.1.6.6 Emergency Power Supply During MODES 1 and 2, and normal shutdown, the diesels are in a standby condition. Diesel generator 1A is available to supply buses 14 and 18, and diesel generator 1B is available to supply buses 16 and 17. Each diesel-generator set is automatically started and placed on line upon undervoltage (without a safety injection signal) on one of the 480-V buses associated with the set. The undervoltage protection system is designed with two channels per bus.

With an undervoltage signal on both channels of a particular bus, the associated diesel gener-ator starts and loads onto the affected bus. An undervoltage signal on a single channel will give an undervoltage protection system alarm but will not start the diesel generator. The automatic actuation upon undervoltage conditions on a safeguards bus is as follows:

a. All motor feeder breakers, the main supply, and the tie breakers to non-safety-related buses that are on the affected bus are tripped. Exceptions to this are the component cooling pumps, which require both undervoltage conditions and a safety injection signal to trip, and the containment spray pumps and motor control centers 1C and 1D, which require a manual trip.

b. The diesel generator is started.

c. After the unit comes up to speed and voltage, the emergency generator breaker closes. The electrically driven auxiliary feedwater pump is loaded onto the bus when a start signal is present. The component cooling pump and motor control centers remain connected and are operational as soon as power is restored. The service water pumps have timed delays before being added to the diesel so as not to add to the starting load. Other equipment must be manually started as automatic load sequencing does not occur on undervoltage alone.

If there is a requirement for engineered safety features operation (i.e., the initiation of a safety injection signal) coincident with undervoltage on the 480-V bus, the sequential starting of engineered safety features equipment is as shown in Table 8.3-1 and in Drawing 33013-1353, Sheet 8.

Starting of containment spray pumps, if initiated by high containment pressure, is accom-plished simultaneously with any of the steps shown in Table 8.3-1.

The motor control centers once energized remain tied to their respective buses and are not shed (tripped) during undervoltage. The injection valves are automatically opened at the same time as the respective pumps are started.

Page 34 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER Tie breakers exist between buses 14 and 16 and buses 17 and 18 (see Drawing 33013-0623, Sheets 1 and 2). The tie between buses 14 and 16 consists of a breaker in each bus, one man-ually operated and the other electrically operated. The tie between buses 17 and 18 consists of a single electrically operated breaker. This feature is used when the plant is in MODE 5 (Cold Shutdown) for maintenance. Technical Specifications require that the tie breakers between buses 14 and 16 and buses 17 and 18 remain open when the plant is above MODE 5 (Cold Shutdown) conditions. Closure of either the electrically operated tie breaker between buses 14 and 16 or the breaker between 17 and 18 is annunciated in the control room.

The electrically operated bus tie breaker between buses 14 and 16 can only be closed if either bus 14 or 16 is deenergized. The diesel generator and normal supply breakers on buses 14 and 16 will not close if the electrically operated tie breaker is closed. The electrically oper-ated bus tie breaker is automatically tripped on safety injection and/or undervoltage condi-tions.

Above MODE 5 (Cold Shutdown), the tie breaker for buses 17 and 18 is maintained in the test position, which prevents electrical or mechanical closure. Below MODE 5 (Cold Shut-down), when the breaker is racked in, the control scheme allows the bus tie breaker to be closed only if either bus 17 or 18 is deenergized. The diesel generator and normal supply breakers on buses 17 and 18 will not close if the tie breaker is closed. The tie breaker is auto-matically tripped on safety injection and/or undervoltage conditions.

The breakers cannot be closed when a safety injection signal is present. The Ginna Station design utilizes a safety injection signal reset function that requires both completion of engi-neered safety features sequencing and administrative controls prior to manual reset.

In the June 16, 1994, Safety Evaluation Report, the NRC evaluated the appropriateness of using the tie breaker for buses 17 and 18 (52/BT 17-18) at Ginna Station during the recircula-tion phase of a design-basis accident. Specifically, given the worst-case design-basis accident (loss-of-coolant accident with loss of offsite power) and failure of one emergency diesel gen-erator, the cross-ties between the two redundant Class 1E 480-V safeguards buses could be utilized such that two service water pumps could be powered by one diesel generator. The NRC determined that adequate time limitations and surveillance requirements exist at Ginna Station for the proper use of the tie breakers on occurrence of loss of offsite power and failure of one emergency diesel generator, and that these actions are consistent with the guidance provided in Generic Letter 91-11. The NRC concluded that pending completion of their eval-uation of analyses submitted by RG&E supporting single service water pump operation in the recirculation phase (see Section 9.2.1.4.1), the compensatory measure of using the bus tie breaker for buses 17 and 18 during the recirculation phase of a design-basis accident is acceptable.

The issue regarding single service water pump operation during loss-of-coolant accident (LOCA) recirculation has since been resolved. See Section 9.2.1.4.1. The option to use the bus tie breaker to supply a second service water pump from a single emergency diesel gener-ator is retained, following appropriate evaluation by Technical Support Center staff.

Should any of the feeder breakers associated with the above safeguards components or the 480-V bus tie breaker trip due to overload, they can be reclosed from the control room. The Page 35 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER emergency generator overload trip is blocked when there is a safety injection signal. Over-load trip elements on the reversing starters associated with the various motor-operated valves can be reset at the motor control centers.

Diesel generator 1B has two series circuit breakers feeding bus 17. This arrangement reduces the likelihood of a loss of both diesel generators in an event (such as fire or tornado) that affects the screen house in such a way as to simultaneously fault both buses 17 and 18 and their feeder cables.

Either diesel-generator unit is capable of supplying all power required by a full set of engi-neered safety features; therefore, failure of either one can be tolerated.

8.3.1.1.6.7 Alternative Shutdown Provisions In response to the requirements of Appendix R to 10 CFR 50, an alternative shutdown system was installed at Ginna Station. This system provides isolation of control circuits in the 1A diesel-generator room and also provides sufficient control features so as to allow local control of the 1A diesel generator. The isolation of control and control power circuits outside the 1A diesel-generator room ensures that fire damage in other fire areas cannot inhibit proper diesel control and operation. In addition, alternative controls and instrumentation in the 1A diesel-generator room could start up and ensure continued operation of the diesel generator during and following certain fires, including a fire that results in complete evacuation of the control room. This ensures availability of an onsite Class 1E 480-V safeguards ac source for safe shutdown of the plant.

8.3.1.1.6.8 Regulatory Review of Diesel-Generator Capability A regulatory review of the onsite diesel-generator capability at Ginna Station was conducted pursuant to the NRC Systematic Evaluation Program (SEP). It was determined that the max-imum automatically connected load to either generator was 1995 kW and the maximum long-term automatically connected load was 1517 kW, both of which are well within the corre-sponding generator ratings of 2300 kW (30-minute rating), 2250 kW (2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> rating), and 1950 kW (continuous rating)(Reference 1). Recent analyses (References 24 and 25) provided similar results for automatically connected loads as shown in Tables 8.3-2a and 8.3-2b.

Therefore, the total automatically connected load is within the criteria of Regulatory Guide 1.9 (Reference 4).

8.3.1.2 Analysis 8.3.1.2.1 Evaluation of Layout and Load Distribution The physical locations of electrical distribution system equipment is such as to minimize vul-nerability of vital circuits to physical damage as a result of accidents.

Routing and separation standards applicable to existing cables are those that were invoked at the time of cable installation. For more information, see Section 8.3.1.4.

The redundant onsite ac power trains have no automatic transfers of loads and/or load groups, except safety injection pump 1C and its fan will transfer automatically to bus 16 after a time Page 36 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER delay if not loaded onto bus 14 when a safety injection signal is present. The manual transfer of load groups or manual inter-connection of emergency buses have interlocks to prevent inadvertent paralleling of redundant sources.

8.3.1.2.2 Diesel Generators Each diesel generator is sized to start and carry the engineered safety features required during worst case accident loading conditions. These loads are shown in Drawing 33013-0652 and tabulated in Tables 8.3-2a and 8.3-2b.

8.3.1.2.3 Normal Power Sources In the event that normal power should be available for actuation of Emergency Core Cooling System (ECCS) components, the magnitudes and starting sequence of the engineered safety feature loads are the same as stated for the diesel generator. The time required for loading is shorter. Normal power sources may be loaded immediately so that first loading may be ener-gized 10 sec sooner than can be accomplished in loading of the diesel generator.

8.3.1.2.4 Reliability Assurance 8.3.1.2.4.1 Redundancy The electrical system equipment is arranged so that no single contingency can inactivate enough engineered safety features equipment to jeopardize the plant safety. The 480-V engi-neered safety features equipment is arranged on four buses.

Two independent offsite power sources are available to supply the engineered safety features equipment. These offsite sources each feed an independent station auxiliary transformer.

See Figure 8.1-1. Offsite circuit 7T feeds transformer 12A. Offsite circuit 767 feeds trans-former 12B. Each transformer is capable of supplying all plant engineered safety features equipment. Breakers 12AX, 12AY, 12BX, and 12BY (see Figure 8.1-1) permit the station auxiliary transformers to be lined up so that transformer 12A supplies one engineered safe-guards bus and transformer 12B supplies the other (50/50 mode), transformer 12A supplies both safeguards buses (0/100 mode), or transformer 12B supplies both safeguards buses (100/

0 mode). The 50/50 mode is the normal configuration.

The plant auxiliary equipment is arranged electrically so that multiple items receive their power from the two different sources. The charging pumps are supplied from the 480-V buses 14 and 16. The four service water pumps are divided between 480-V buses 17 and 18.

The four containment fans are divided between 480-V buses 14 and 16. The two residual heat removal pumps are on separate 480-V emergency buses 14 and 16. Valves are supplied from motor control centers.

8.3.1.2.4.2 Sequencing Circuits Refer to Table 8.3-1 for the engineered safety features automatic actuation sequence and times after the initiation signal for the cases when the normal power source is available and when only the diesel generator power source is available.

Page 37 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER The components of the sequencing circuits are control relays and electro-pneumatic timing relays. One control relay or one timing relay is used to close each circuit breaker feeding 480-V three-phase power to the engineered safety features components. The control power for the relays is supplied from the station batteries. Battery 1A supplies the sequencing cir-cuits for safeguards actuation train A, while battery 1B supplies the sequencing circuits for safeguards actuation train B. The sequencing circuits for the two safeguards actuation trains are located in separate safeguards actuation relay racks in the relay room.

When there is voltage on the associated 480-V safeguards buses (see Drawing 33013-0652),

closure of the master safety injection relay contact initiates the safeguards sequencing circuit by energizing one control relay and seven timing relays. In train A, the control relay immedi-ately closes the circuit breaker 52/SIP1A to energize safety injection pump 1A. After a 5-sec time delay, the first timing relay times out and closes its contact to close circuit breaker 52/

SIP1C2, starting safety injection pump 1C. The second timing relay times out after 10 sec to close circuit breaker 52/RHRP1A and start residual heat removal pump 1A. In the same man-ner, each of the remaining five timing relays times out, with a 5-sec interval between each relay, closing the circuit breakers for one service water pump, two containment air recirculat-ing fans, and an auxiliary feedwater pump.

The sequencing circuit for train B is similar to that described above for train A. Safety injec-tion pump breaker 52/SIP1B is closed instantaneously to start safety injection pump 1B. After a 7-sec time delay, the contact of the first timing relay times out to close circuit breaker 52/SIP1C1 to start safety injection pump 1C. The next time delay relay times out 12 sec after the initiating signal to close circuit breaker 52/RHRP1B and start residual heat removal pump 1B. The remaining timing relays time out at 5-sec intervals to start one service water pump, two containment air recirculating fans, and an auxiliary feedwater pump.

8.3.1.2.4.3 Sequencing Relays The sequencing relays all begin timing at the instant the circuit is energized. Each relay times out independently. Therefore, if a timing relay fails to operate, the circuit breaker operated by that relay will not close and the associated component will not start. However, the sequence is not interrupted and the remaining components will be started.

The reliability of the Agastat timing relays has been proven by operating experience in many applications and by reliability tests. Operability is further ensured by calibrations and system testing during each MODE 6 (Refueling) outage.

An analytical design bases has been established for the setpoints associated with the time delay relays used at Ginna Station. Agastat timers that require replacement use the setpoints determined by the design analyses to ensure proper system operation. Replacement Agastat timers must provide the necessary time delay signals consistent with the functional require-ments for each system. Each relay application is analyzed to determine the following three tolerances or ranges:

a. The system "functional operating range" is the range within which the relay is required to operate for the system to meet its designed operating requirements. The relay setpoints plus all calibration tolerances must fall within the system operating range.

Page 38 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER

b. "Calibration tolerance" defines the range within which the relay is expected to fall when checked during periodic testing and calibration. If the setpoint is found outside of this range, it must be recalibrated and the frequency of testing may be increased to ensure it stays within this range.

c. The "Acceptable Drift is the range in which the relays setpoints is allowed to drift without exceeding the relays design limits. This range will be used as acceptance criteria for all Agastat relays; however, the required operating range will still be the calibration tolerance discussed above.

Replacement relays are tested for proper setpoints and operation following installation using plant calibration and test procedures. Both Class 1E and non-Class 1E relays are evaluated to ensure that the relay setpoints provide the required performance.

If the sequence has started and 480-V power on the safeguards buses is interrupted, the circuit breakers will be tripped and the sequencing relays will be deenergized by contacts of the 480-V bus undervoltage relays. The timing relays reset instantaneously. When 480-V power is restored, the 480-V bus undervoltage relays energize the sequencing circuit and the sequence is repeated from the beginning.

8.3.1.2.4.4 Engineered Safety Features Actuation The Engineered Safety Features Actuation System (ESFAS) at Ginna Station consists of con-trol relays, electro-pneumatic timers, and a series of electrical and mechanical interlocks on each train. In general, Class 1E equipment is loaded on the safeguards buses at approxi-mately 5-sec intervals. The only exception is the 1C safety injection pump, which is a "swing" pump and may be fed from either breaker 52/SIP1C2 (bus 14, train A) or breaker 52/

SIP1C1 (bus 16, train B). Bus 14 has been designated as the preferred source for the 1C safety injection pump motor. To prevent closure of both circuit breakers, causing buses 14 and 16 to be paralleled, a network of interlocks is used.

a. Circuit breakers 52/SIP1C1 and 52/SIP1C2 are electrically interlocked such that if one breaker is closed, the closing coil of the other breaker cannot be energized.

b. The time delay relays, associated with the 1C SIP breakers, on the train A and B sequencers are interlocked using timed delayed contacts. This ensures that only one SIP-1C breaker is given a closed command. In addition, a control feature exists that initiates a transfer from bus 14 to bus 16 should the 52/SIP1C2 fail to close for any reason except an electrical fault.

In the event of an electrical fault on the 1C motor, the transfer is blocked, after closure onto bus 14 fails, thus ensuring that both safety trains are not subject to a common fault.

8.3.1.2.4.5 Separation The power feed from the diesel generators is run by a separate route so that if the tunnel were lost, power to the engineered safety features would still be provided.

One outside source of power is required to give sufficient power to run normal operating equipment. One transmission line can supply all the plant auxiliary power. The 115-kV/34.5-kV station transformer 6 or transformer 7 can supply all the auxiliary loads.

Page 39 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER 8.3.1.2.4.6 Fuse Coordination The sizing of pairs of individual circuit fuses in the plant are coordinated with source-side fuses so as to provide selective blowing. In some cases, a minimum size ratio of 2 to 1 between the source-side fuse and the load-side fuse exists. With this sizing ratio, the load-side fuse will clear the circuit for any condition of fault or overload without blowing the source-side fuse. Fuses are used to provide isolation of non-Class 1E dc loads fed from the two Class 1E battery systems. Therefore, all faults will clear before causing a bus outage.

The 480-V switchgear has automatic transfer of dc control power to an emergency supply from the redundant train. Fuse coordination eliminates a common-mode failure mechanism by preventing a single postulated event (automatic transfer of dc control power into a fault) from interrupting dc control power to redundant buses.

8.3.1.2.4.7 Overload and Short Circuit Protection All ac motors whether continuous or intermittent duty have both overload and short circuit protection. These protective devices are sized and coordinated in order to achieve full short circuit protection and maximize system operability. Any instantaneous tripping is set to oper-ate at a minimum of 1.73 times the locked rotor current. Motor-operated valves required to operate during or after a loss-of-coolant accident are equipped with a safety injection bypass of any thermal overload relay and/or the overload heater is sized to account for uncertainties in favor of completing safety-related action. The bypass is activated on receipt of a safety injection signal and remains activated until safety injection is reset. The short circuit protec-tion is not bypassed. This ensures operation of the motor-operated valves required to operate during a safety injection signal in the event of abnormal current levels less than 1.73 times locked-rotor current. This is in compliance with Regulatory Guide 1.106.

8.3.1.2.5 Instrument Bus Evaluation Instrument buses 1A, 1B, 1C, and 1D provide 120-V ac power to instrumentation and con-trols which are used to monitor and actuate systems important to the safety of the plant. The instrument buses meet the single failure criteria of IEEE Standard 379-1972. The inverters and static switches for instrument buses 1A and 1C meet the separation criteria of IEEE Stan-dard 384-1974.

The inverter, regulating transformer, and static switch combination provides an uninterrupt-ible supply to instrument buses 1A and 1C. Static bypass switches are solid-state devices using semiconductors for the switching element. Maximum transfer time, including sensing time, is 1/4 cycle. Therefore, static switch spurious trips will not affect the devices connected to instrument bus 1A or 1C because power to the instrument bus will not be interrupted. The backup supplies (bus 14 or 16) will be available unless the plant is already shut down. If the plant is shut down and a static switch spurious trip occurs on one bus, the other bus will still remain in operation.

Static switch transfer is initiated by inverter failure, overcurrent beyond the static switch, inverter output undervoltage, or manual pushbutton. A failure in the static switch itself will also cause automatic transfer of the load to the backup supply.

Page 40 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER Transfer of instrument bus 1A and 1C loads without interruption will reduce the number of unnecessary plant trips and the associated transients resulting from failures in the inverter feed supply. A complete failure or loss of power from both the backup and normal supplies will place in trip mode those controls fed from the instrument bus and will normally produce a plant trip. The only monitoring instrumentation which would be lost is that associated with the single deenergized instrument bus.

The backup supply from bus 14 for instrument bus 1A and the backup supply from bus 16 for instrument bus 1C improves the reliability of both instrument buses. The backup supply cables to the constant voltage transformers meet the separation requirements of IEEE 384-1974.

A single regulated supply from nonsafeguards bus 13 provides the maintenance supply to instrument buses 1A, 1B, 1C, and 1D. The maintenance supply transfer switches are used as isolation devices, as defined by IEEE Standard 384-1974. The necessary separation between redundant Class 1E systems and between Class 1E systems and associated systems is accom-plished with the maintenance supply transfer switches for each instrument bus.

The two 7.5-kVA single-phase circuits from instrument buses 1A and 1C affect safeguards buses 14 and 16, respectively. One circuit from bus 14 is required to supply instrument bus 1A backup when the normal supply fails and during maintenance of the normal supply. One circuit from bus 16 is required to supply instrument bus 1C backup when the normal supply fails and during maintenance of the normal supply. With the additional load, the total engi-neered safety features load (Tables 8.3-2a and 8.3-2b) remains below the rated load capacity of each diesel generator for all phases of operation.

8.3.1.2.6 Loss of Offsite Power Under Accident Conditions 8.3.1.2.6.1 Operator Actions In the event of a loss-of-coolant accident (which is considered the worst-case condition) and with an outage of the station auxiliary transformers, it can be shown that the plant can be maintained in a safe shutdown condition by operating the diesel generators to supply vital loads. During other types of accidents, e.g., loss of flow or steam line break, cooldown can be accomplished by dumping steam in conjunction with flow coastdown and natural circulation.

Operator actions to be taken under accident conditions and with the station auxiliary trans-formers out of service are described below. These conditions assume that the diesel genera-tors have already received a start signal and are up to speed and rated voltage.

Shutdown Condition

a. Loss-of-coolant accident: Operate diesel generators to assume vital loads to maintain plant in safe shutdown condition. If incoming power from the 115-kV switchyard is available, the flexible generator bus disconnects (links) should be removed and power supplied from the station unit transformer in order that the diesels may be secured and act as a backup source.

b. Loss-of-flow accident: During hot plant conditions, dump steam as necessary in conjunc-tion with coolant flow coastdown and natural circulation to maintain plant temperature Page 41 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER within permissible range. Operate diesel generators to assume vital loads to maintain safe plant shutdown. During cold plant conditions, operate residual heat removal system to maintain temperature below 200F.

c. Steam line break accident (only applicable to hot plant condition): Operate diesel genera-tors to assume vital loads to maintain safe plant shutdown. Dump steam in conjunction with flow coastdown and natural circulation to reduce plant temperature below 200F.

While the two diesel generators are in service, the 4160-V buses can be restored using the 115-kV system and transformer 11 in 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> or less. This limits the time the two diesels are the sole source of power to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> or less.

Startup Condition The actions would be the same as for a shutdown condition, except the startup would be ter-minated and the reactor tripped prior to initiating these actions:

Power Operating Condition

a. Loss-of-coolant accident: Operate diesel generators to assume vital loads to maintain reac-tor in safe shutdown condition. If power is available from the 115-kV switchyard, remove flexible generator bus disconnects (links) , and transfer emergency load to station unit transformer in order that the diesel generator can be secured and used as a backup source.

b. Loss-of-flow accident: Operate diesel generators to assume vital loads to maintain plant in safe shutdown condition. Dump steam in conjunction with coolant coastdown and natural circulation to maintain temperature in permissible range.

c. Steam line break accident: Operate diesel generators to assume vital loads to maintain plant in safe shutdown condition. If possible, dump additional steam in conjunction with coolant flow coastdown and natural circulation to reduce plant temperature below 200F.

Transfer vital loads to station unit transformer and secure the diesel generators when access can be gained to the turbine building to remove generator bus disconnects (links) .

8.3.1.2.6.2 Reliability Assurance Based on the foregoing discussion, it can be concluded that the electrical power system, uti-lizing two station auxiliary transformers fed from two independent sources plus two indepen-dent diesel generators (as shown in Figure 8.1-1), provides a reliable and flexible power system, capable of supplying the necessary plant equipment required under postulated out-ages with accident conditions existing. The bases for this conclusion follow:

a. The emergency diesel-generator power supply has been provided with sufficient capacity and redundancy to permit failure of a unit to start, with the remaining unit capable of sup-plying the vital loads necessary for safe plant shutdown. The engine is equipped with jack-etwater and lube-oil heating, which maintain temperatures at a level to permit immediate load acceptance. A motor-driven lube-oil pump runs continuously until the engine is started, so that engine bearings are always lubricated and ready for operation. Therefore, the emergency diesel generators do not undergo cold fast starts.

Page 42 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER

b. A rigid program of preventative maintenance and testing is carried out to ensure that the diesel generators are maintained in a ready state and transformer failures are reduced to a minimum. Surveillance testing is performed monthly, and during these tests the diesels are run for a minimum of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> at its continuous kW rating.

c. Emergency procedures are in effect to handle accident conditions under postulated power outages.

d. Sufficient quantities of diesel fuel oil will be on hand or in reserve to operate the diesel gen-erators during any postulated power outage or accident condition. Information on diesel fuel oil capacities and availability is found in Section 9.5.4. Diesel fuel tanks are emptied, cleaned, and refilled with fresh fuel in accordance with the preventive maintenance pro-gram.

e. Provisions have been made to supply power to the station unit a transformer from the 115-kV grid after disconnecting the generator.

f. The probability of losing one station auxiliary transformer is low, based on reliability of these transformers. When considered in conjunction with a plant accident that requires shutdown of the plant, the probability is even less. However, in the event one transformer fails the second transformer is immediately available. The probability of losing both station auxiliary transformers is very low.

See Section 8.1.4.4 for additional safety features in case of station blackout.

8.3.1.2.7 Degraded Grid Voltage The "degraded-grid-voltage" issue was first considered by the NRC in 1976 following a degraded grid condition at an operating plant. (Reference 5) A subsequent event at a second operating plant brought into question the conformance of the station electric distribution sys-tem to General Design Criterion 17. (Reference 6) Both of these items were ultimately resolved as part of the NRC SEP. The SEP evaluated the adequacy of protection against degraded grid voltages, as discussed in Section 8.3.1.2.7.1. The SEP also evaluated the ade-quacy of onsite power system voltages, as discussed in Section 8.3.1.2.7.2.

8.3.1.2.7.1 Susceptibility to Degraded Grid Voltage Conditions By Reference 7, the NRC requested RG&E to assess the susceptibility of Ginna Station to sustained degraded voltage conditions and to assess the interaction between offsite and onsite emergency power systems. RG&E responded to the NRC request and in Reference 8 the NRC concluded that the Ginna Station design was adequate based on the following consider-ations:

a. The Ginna Station Technical Specifications address degraded voltage protection. The Technical Specifications define the maximum times (determined by equipment manufactur-ers) that Class 1E equipment can operate for various degraded voltages without causing equipment damage, loss of equipment life, or a reduction in ability of equipment to perform required functions. The loss-of-voltage setpoint ensures that Class 1E motors will start and be loaded onto diesel generator within the time assumed in the accident analysis (Chapter 15). The Technical Specifications also define maximum allowable time delays of various Page 43 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER bus voltage levels before protective relaying action must be initiated to preclude any loss of service life of the motors. In addition, the time delays are long enough to override short bus voltage transients due to motor starting. Relays are tested periodically to ensure that they comply with the Technical Specifications.

b. The second level of voltage protection (degraded voltage condition) uses two-out-of-two coincident logic and is integrated into the logic scheme for the first level of voltage protec-tion (loss-of-voltage condition). The loss-of-voltage protection has been upgraded and also requires coincident logic to trip. The logic automatically disconnects offsite power from Class 1E safeguards buses experiencing degraded voltage and initiates a voltage restoration for onsite emergency diesel generators. The relays and relaying scheme comply with IEEE 308-1974 and IEEE 279-1971.

c. In order to protect Class 1E equipment from unsatisfactory bus voltages, the undervoltage setpoints and time-delay values have been chosen to allow retention of the load-shedding feature even after emergency buses are being supplied by onsite sources. The load-shed-ding setpoints are chosen such that relay operating drift will not cause spurious trips of the onsite sources while Class 1E loads are being sequenced onto the buses. (Reference 28) 8.3.1.2.7.2 Adequacy of Onsite Power System Voltages By Reference 6, the NRC requested RG&E to conduct an analysis to determine if the Ginna Station onsite power distribution system, in conjunction with offsite power sources, has suffi-cient capacity and capability to automatically start and operate all required safety loads within equipment voltage ratings. In response to the NRC request, RG&E performed an analysis based on an interactive computer loadflow program that modeled the entire Ginna Station electrical distribution system. The NRC reviewed the RG&E analysis and, in Reference 9, concluded that the Ginna Station design was acceptable based on the following consider-ations:

a. Under worst-case conditions, the Class 1E equipment will automatically start and continue to operate within their voltage design ratings.

b. The voltage at the Class 1E equipment will not exceed the upper design voltage rating under maximum offsite voltage and minimum plant loading conditions.

c. The analysis submitted was verified by test. The test data indicate that the analytical results are lower than actual measured values; thus the model is conservative with accept-able percentage error differences.

d. Spurious trips will not occur for the voltages and plant operating conditions analyzed.

8.3.1.3 Containment Electrical Penetrations General Design Criterion 50 requires that containment penetrations be designed so the con-tainment structures can, without exceeding the design leakage rate, accommodate the postu-lated environment resulting from a loss-of-coolant accident. IEEE 317, Reference 10, augmented by Regulatory Guide 1.63, Reference 11, provides electrical penetration design bases acceptable to the NRC staff.

Page 44 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER The Ginna Station containment electrical penetrations are listed in Table 8.3-3. The penetra-tions have been shown to maintain structural integrity when subjected to mechanical stresses caused by large magnitude fault currents. The manufacturer has conducted tests at current levels higher than those available at Ginna. The tests indicated that no seal failures occurred on the high-energy penetrations when subjected to the design-basis fault currents. In addi-tion, an RG&E study has shown that the penetrations can adequately handle the heating effects due to all levels of abnormal fault currents. These currents are assumed to be sus-tained for a period of time equal to the time for the backup circuit breaker to detect and clear a fault condition. The details of the evaluation can be found in References 12, 13, 14, 15 and 16.

8.3.1.4 Independence of Redundant Systems Routing and separation standards applicable to existing cables are those that were invoked at the time of cable installation. Specific criteria for evaluating routing and separation issues associated with cables are provided in Reference 26.

8.3.1.4.1 Criteria Relating to Cable-Tray Loading and Separatio The following criteria were established for cable-tray loading and separation.

4160-V Power Cable

a. Generally, this power cable is routed in trays and/or a conduit designated for high-energy power circuits.

b. Cable load capacity in the original design was derated by using a 0.81 factor.

480-V Power Cable A. Generally, the 480-V power cable is routed in trays designated for power circuits and not instrumentation and control.

B. Emergency diesel-generator feeders to buses 14 and 16 are separated, as are the feeders to buses 17 and 18.

C. Control cables are mixed in some cases with 480-V low power cable, size number 6 and smaller.

D. Tray loadings of 50% physical fill are typical; there are exceptions where some trays approach 100% fill. However, in all cases thermal loading has been considered. In the original design derating factors of 0.6 for 480-V power cable size number 4 and larger and 0.5 for size number 6 and smaller were used. In the case of the 480-V pressurizer heater cables, extra spacing has been provided around the cables and a derating factor of 0.5 has been used. With the use of these derating factors, the trays as filled are acceptable.

For modifications or design analyses performed after 1991 the criteria used for determining ampacity and derating factors in 480-V and 4160-V power cables in open top cable trays is that developed in ICEA P-54-440/NEMA Standard WC51, "Ampacities of Cables in Open Top Cable Trays."

Page 45 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER Control Cable In general, control cable trays are not filled above 100% of their physical capacity. However, there are areas where the cable fill may be over 100%. In all cases, however, thermal loading and seismic effects have been considered and these trays are acceptable as filled.

Instrument Cable In general, instrument cable trays are not filled above 100% of their physical capacity. How-ever, there are areas where the cable fill may be over 100%. In all cases, however, thermal loading and seismic effects have been considered and these trays are acceptable as filled.

8.3.1.4.2 Separation of Redundant Circuits The following criteria were established for separation of redundant circuits.

A. All components requiring redundant cabling, as well as the cabling for redundant compo-nents, have been identified and the redundant power, instrumentation, and control cables are run separately.

1. There is four-channel separation for the reactor protection and safeguards instrumen-tation circuits. This separation is maintained from the sensor through the analog racks to the logic or relay cabinets.

2. Logic output control and power cables for the operation of redundant components in safety-related or engineered safety features systems are routed separately, except where cable trays converge at the control board. The location of redundant component wiring in the control board requires that these cables converge in this area.

3. Undervoltage control cabling for bus 17 is not routed separately from redundant cabling in the west side of tray SH3, located in the basement of the screen house.

There is no single contingency that can impair these cables in tray SH3 and inactivate enough engineered safety features equipment to jeopardize plant safety. Tray SH3 is not vulnerable to damage from mechanistic effects, and internal cable faults will not affect the independence of redundant undervoltage control cable in the west side of tray SH3.

B. Direct current control power from the station batteries is run in underground duct, sepa-rated, and apart from the cable tunnel, in order to maintain the necessary control in the event of an emergency.

C. The physical separation between redundant power, control, and instrument cable trays is generally a minimum of 5 in. vertically and 2 in. horizontally. An effort has been made to maintain maximum separation between trays, and in most cases has been accomplished, with separation of as much as 1 ft or more.

The means of achieving physical separation between redundant cables for power, control, and instrument systems is by use of a galvanized sheet metal barrier in cable trays. Board-type barriers made of refractory materials, such as Marinite, are also used in some cases to achieve electrical separation of cables.

Page 46 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER D. There are three different locations on the containment where electrical penetrations are made. The three locations are widely separated. The physical separation of the penetration cartridges within the particular area is determined by the concrete reinforcing bars. The 10-in. penetration sleeves are spaced on minimum vertical spacing of 2-ft centers as dictated by the reinforcing.

8.3.1.4.3 Quality Assurance Redundancy requirements for new modifications are initiated by the cognizant discipline (electrical) system designer. The designer prepares the applicable circuit schedule sheet (des-ignating the cable routing and termination), which is checked by the cognizant electrical engi-neer.

The construction group installs the cable as directed by the circuit schedule sheet. When the circuit is completed, the foreman of the installing crew verifies that it was properly installed.

The installations are monitored by field engineers and complete checks of all Class 1E cir-cuits are made to further ensure that the installation is consistent with the design.

With respect to the initial cable installation, Westinghouse had direct responsibility for plant design and construction but RG&E field engineers also checked to ensure that cable installa-tion met established criteria.

8.3.2 DIRECT CURRENT POWER SYSTEMS 8.3.2.1 Description 8.3.2.1.1 Direct Current System The basic components of the direct current portions of the station electrical system are shown in Drawing 03202-0102.

The 125-V dc system is divided into two buses with one battery and two battery chargers (supplied from the 480-V system) serving each. The battery chargers supply the normal dc loads as well as maintaining proper charges on the batteries.

Two 60-cell, lead-acid, 1495 amp-hr stationary batteries (1A and 1B) are provided for power supply for control, emergency lighting, and the inverters for critical 60-cycle instrument power. Control power for all 4160-V and 480-V switchgear sections and for each diesel-gen-erator can be supplied from either battery.

Two batteries provide separate sources of dc power. The train A engineered safety features equipment is supplied from battery 1A while train B engineered safety features equipment is supplied from battery 1B. In addition, the 480-V engineered safety features switchgear and diesel-generator control panels are supplied from either battery by means of an automatic transfer circuit in the switchgear and control panels. The normal supply from train A (switch-gear buses 14 and 18 and diesel generator 1A) is from dc distribution panels 1A in the auxil-iary building, diesel generator building, and screen house. These panels also provide the emergency dc supply for train B (switchgear buses 16 and 17 and diesel generator 1B). Sim-ilarly, dc distribution panels 1B in the auxiliary building, diesel generator building and screen Page 47 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER house provide the normal supply for switchgear buses 16 and 17 and diesel generator 1B and the emergency supply for switchgear buses 14 and 18 and diesel generator 1A. In the event of loss of the normal Class 1E battery supply, throwover contactors automatically transfer the load to the emergency supply (other battery). The alarm relays for the diesel generators actu-ate main control board annunciators. The distribution panels are shown in Drawing 03202-0102.

Battery testing is conducted in accordance with the Technical Specifications. A standard IEEE-450 discharge test verifies that battery capacity is at least 80% of the manufacturer's recommendations.

120-V ac instrument bus 1A is supplied by inverter 1A from battery 1A through main dc dis-tribution panel 1A switch 15. 120-V ac instrument bus 1C is supplied by inverter 1B from battery 1B through main dc distribution panel 1B switch 15. The 120 Vac instrument power connections are shown on Drawing 03201-0102. One channel of wide range containment pressure and steam generator B pressure instrumentation (P950 and P479) is fed from a sepa-rate inverter (MQ 483), which is supplied by battery 1A through the main control board dc distribution panel 1A switch 14. See Drawing 03202-0102.

8.3.2.1.2 Battery Room The two station batteries are in the basement of the control building. This locates the batteries within a Seismic Category I area and makes them fully accessible at all times. The batteries are seismically qualified to the requirements of IEEE 323-1983 and IEEE 344-1987. Each battery is provided with a rack designed to withstand earthquake forces. Bracing is provided to keep the cells from falling from the racks during an earthquake, and blocking is provided between the cells to prevent cell breakage through bumping together. The two batteries are physically separated by a 2-hr fire wall.

Supplemental heating and cooling to the battery rooms is provided by a non-seismic air con-ditioning unit, with associated service water piping, ventilation ductwork, electric heating coil, and fire dampers. The electric heating coil is seismically mounted in the heating, venti-lation, and air conditioning unit discharge duct. The unit is controlled by thermostats located in each battery room. The system is designed to maintain the battery room space temperature within the normal operating temperature range and not adversely affect the storage capacity of the batteries. The unit and associated ductwork and piping are designed to function during all plant modes. Although the overall design is nonseismic, the piping and ductwork are designed to maintain structural integrity during a design-basis earthquake. Each battery room has an ac-powered propeller exhaust fan that takes suction from the area to remove hydrogen gas generated by the batteries. Also, there is a separate emergency dc-powered ventilation system that is manually actuated in the event of low air flow in the ductwork of either of these battery room exhaust fans. Loss of battery room ventilation is alarmed in the control room. (See also Section 9.4.9.3.)

8.3.2.1.3 Battery Chargers There are four battery chargers available to the station batteries, each with a capacity of 200 amps. Chargers A (BYCA) and B (BYCB) are current limited to 165 amps. Chargers A1 Page 48 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER (BYCA1) and B1 (BYCB1) are rated at 200 amps. The normal configuration is for chargers A1 and B1 to be in service, and chargers A and B to be in standby mode. Battery chargers A and A1 are normally aligned to battery A (BTRYA) , and battery chargers B and B1 are nor-mally aligned to battery B (BTRYB).

8.3.2.1.4 Technical Support Center Battery A third 60-cell, lead-acid, 2880-amp-hr station type battery was installed in the technical sup-port center. This new battery and 500-amp charger supply power to the uninterruptible power supply to the plant process computer. The uninterruptible power supply is designed to pro-vide continuous power for up to 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> during loss of its normal power supply and failure of the technical support center diesel generator to start. It also supplies dc power to the turbine emergency bearing oil pump, airside seal oil backup pump, circulating water discharge valves (V-3150 and V-3151), the 4-kV breaker test cabinet, and the anticipated-transient-without-scram (ATWS) mitigation system actuation circuitry (AMSAC) inverter. The AMSAC inverter supplies 120-V ac power to the AMSAC system FOX-3 rack that powers the AMSAC modules. The technical support center battery is capable of supplying both safe-guards dc trains in the event of an emergency.

However, the system is designed with an intertie between each of the two main (A and B) dis-tribution panels and the technical support center panel so that either Class 1E battery and its chargers can be removed from service. This intertie is utilized only during maintenance, test-ing, or abnormal plant conditions. The intertie is also configured so both Class 1E battery systems can be paralleled simultaneously through the technical support center battery (see Drawing 03202-0102). Procedures permit this condition only during specific 10 CFR 50 Appendix R conditions in which some process instrumentation from both trains is required for long-term cooldown.

Paralleling both safety-related dc trains is restricted by two separate key locks on the throwover switches and separate locked disconnect switches in each battery room.

The technical support center battery is tested periodically. Monthly, the specific gravity of selected cells is tested. Quarterly, the specific gravity of all cells is tested.

8.3.2.2 Analysis Each of the two station batteries is capable of carrying its expected shutdown loads following a plant trip and a loss of all ac power for a period of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> without battery terminal voltage falling below 108.6 V. Major loads with their approximate operating times for the four hour coping period on each battery are listed in Table 8.3-4 (Reference 27) and shown in Drawing 03202-0102.

Each of the four battery chargers has been sized to recharge either of the above partially dis-charged batteries within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> while carrying its load.

At least one battery charger on each batteryshall be in service for each battery so that the bat-teries will always be at full charge in anticipation of a loss-of-offsite-power incident. This ensures that adequate dc power will be available for starting the emergency diesel generators and other emergency uses.

Page 49 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER Automatic transfer of 125-V dc load groups from train A to train B (or vice versa) occurs in fifteen locations. Six throwover relays provide control power for the six 480-V buses, two throwover relays provide control power for the two diesel generator control panels, two throwover relays provide control power for the four switchgear breakers (12AX, 12AY, 12BX, 12BY), four throwover relays provide control power for buses 14, 16, 17 and 18 undervoltage system, and one throwover relay provides control power to main control board annunciator panels A through L. The throwover relays automatically transfer load to the redundant train on loss of power from the normal source. Each load automatically transfers back to the normal supply when the normal supply is restored.

Three abnormal battery conditions are alarmed in the control room. First, an alarm will acti-vate if voltage on either bus decreases to 110 V. The alarming bus can be identified by moni-toring separate bus voltmeters located on the control board. Low-voltage annunciation provides warning of a change from normal conditions before they reach critical voltage con-ditions. Second, an alarm will activate if the output from a battery charger is lost. Local instrumentation is used to identify the affected battery charger. Third, an alarm will activate for a ground on either battery. The affected battery is identified by a local ground light on the respective main battery charger.

In addition a battery load flow monitor system monitors current magnitudes and direction for each of the station batteries. The system provides visual displays of the direction and magni-tude of current going into and out of each battery locally in the battery room and remotely in the main control room. The system annunciates abnormal battery conditions and loss of con-tinuity of battery circuits both locally and in the main control room. The system provides a separate group alarm for the vital batteries, which activates when either battery indicates a high voltage (greater than 140 V), low voltage (less than 132 V), low charging rate, or nega-tive (discharging) rate. The charger alarm will respond to charger current levels of zero or less. This system, along with the three abnormal battery condition alarms, affords complete indication of abnormal dc system conditions.

In a generic letter to licensees, Generic Letter 91-06, on April 29, 1991, the NRC staff identi-fied actions to be taken by licensees related to Generic Issue A-30, Adequacy of Safety Related DC Power Supplies. Rochester Gas and Electric Corporation responded (Reference

17) to the generic letter with detailed information on the safety-related direct current system at Ginna Station including the control room alarms/indications and response procedures asso-ciated with the battery monitoring system; existing maintenance, surveillance, and testing procedures associated with the batteries and battery chargers; justification for negative responses to questions presented in the generic letter; and procedural changes that would be implemented to comply with the recommendations of the generic letter. The NRC action with respect to Generic Letter 91-06 was completed upon transmittal to RG&E (Reference 18) of their finding that RG&Es responses satisfied the reporting requirements of the generic letter.

8.3.2.3 Direct Current Fuse Coordination As a result of SEP Topic VI-7.C.1, Independence of Redundant Onsite Power Systems, spe-cific design requirements have been established and implemented to provide dc fuse coordi-nation.

Page 50 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER There are two redundant Class 1E 125-V dc distribution systems, each consisting of a main fuse and a series of branch fuses. Branch fuses usually feed panels with smaller branches and subbranches. Certain branch fuses feed supplementary overcurrent protection fuses. The supplementary fuses supply discreet loads within equipment and are generally not coordi-nated. All main and branch fuses (not supplementary overcurrent fuses) are treated as isola-tion devices. An isolation device prevents malfunctions in one section of a distribution system from causing unacceptable influences in other sections of that system. Non-Class 1E circuits are electrically isolated from Class 1E circuits by these isolation devices.

All fuses used as isolation devices in the distribution systems are required to be coordinated, which is generally defined as being able to carry design basis currents for all loads. In addi-tion, isolation devices closest to a fault must clear prior to the clearing or degrading of the upstream fuses. Coordination is demonstrated provided that the following more detailed requirements are satisfied:

A. All branch fuses must continuously carry worst-case credible loads without interruption of service under accident temperature conditions. Worst-case credible loads are the sum of all Class 1E and non-Class 1E components within a load group; that is, all components fed by a branch fuse are assumed to be operating at the same time.

B. All main fuses (those that supply branch fuses) are sized to carry the combination of all Class 1E worst-case credible load currents plus 125% of all non-Class 1E normal loads.

C. Isolation is demonstrated by maintaining a minimum main to branch fuse ratio depending on the operating characteristics of the fuses. In addition, where a large number of branches are supplied by a main fuse, the effects of the branch circuits carrying normal load current must be combined along with the largest faulted branch to ensure that the main fuse will not be degraded or blow.

D. Actual response characteristics are developed and used along with the I2t values (for 30-amp fuses and above) when different types of fuses are being coordinated.

A mixture of time delay, general purpose, and fast-acting fuses are used in the dc distribution systems. Various combinations are made to coordinate with each other.

The main and branch fuses used in the dc distribution system must have a minimum dc rating of 140 V.

Since the Class 1E distribution systems supply both safeguards and non-safeguards loads, the interconnections between Class 1E and non-Class 1E loads must not result in a degradation of the safety systems. The fuses supplying the nonessential loads are therefore considered isola-tion devices and must meet Class 1E requirements. The specific criteria in IEEE 308 govern-ing the connection and disconnection of non-safety-related distribution buses apply. In addition, the separation requirements of IEEE 384-1981 also apply to the extent practical given the existing plant configuration. Where IEEE 384-1981 cannot be met, the separation criteria of Section 8.3.1.4 must be met.

The dc distribution system fed from the Class 1E vital batteries has been analyzed, upgraded if required, and tested to meet the dc fuse coordination requirements. All fuses fed from the Page 51 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER Class 1E vital batteries are included in the Ginna Station configuration control program and changes in dc fuses are controlled through the configuration control program.

8.3.3 FIRE PROTECTION FOR CABLE SYSTEMS Information on fire protection systems and practices at Ginna Station is contained in Section 9.5.1. Information on fire protection for cable systems is also given below and in References 19 through 23.

In general, motor and transformer feeder cables are rated on a continuous basis at 115% of full load current. This provides for motor operation at service factor rating. Tray loadings of 50% physical fill are typical; there are exceptions where some trays approach 100% fill.

However, in all cases thermal loading has been considered. In the original design, derating factors of 0.6 for 480-V power cable size number 4 and larger and 0.5 for size number 6 and smaller were used. In the case of the 480-V pressurizer heater cables, extra spacing has been provided around the cables and a derating factor of 0.5 has been used. With the use of these derating factors, the trays as filled are acceptable. For modifications or design analyses per-formed after 1991 the criteria used for determining ampacity and derating factors in 480-V and 4160-V power cables in open top cable trays is that developed in ICEA P-54-440/NEMA Standard WC51, "Ampacities of Cables in Open Top Cable Trays".

Fire barriers are used at cable trays and cable runs where they enter or leave a designated fire area. There are fire barriers where the cable trays enter the relay room, auxiliary building, and where vertical trays pass through floor openings.

Alternating current circuits within the plant are protected by circuit breakers. Direct current circuits are protected by fuses. The use of circuit breakers provides three-phase isolation of a circuit that is not guaranteed by using fuses for three-phase circuits, since the operation of any thermal element of the breaker opens all three phases of the breaker.

Nonsegregated, metal-enclosed 4160-V buses are used for all major bus runs where large blocks of current are to be carried. The routing of the metal-enclosed buses minimizes its exposure to mechanical, fire, and water damage.

Power circuit cables were established on the basis of the maximum ambient temperature expected, the current requirements of the respective equipment, and the designed cable tray loading. An ambient temperature of 50C within the reactor containment and an ambient temperature of 40C in all other plant areas are the design-basis ambient temperatures for all power cable ratings.

The application and routing of control, instrumentation, and power cables minimizes their vulnerability to damage from any source. All cables are designed using conservative margins with respect to their current carrying capacities, insulation properties, and mechanical con-struction. Power cable insulation in the reactor building has fire-resistant sheathing, selected to minimize the harmful effects of radiation, heat, and humidity. Appropriate instrumentation cables are shielded to minimize induced voltage and magnetic interference. Wire and cables related to engineered safety features and Reactor Trip System (RTS) are routed and installed Page 52 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER to maintain the integrity of their respective redundant channels and protect them from physi-cal damage.

The station auxiliary transformers, the station unit transformer, and the generator step-up transformer are located outdoors, physically separated from each other.

Lightning arresters are used where applicable for lightning protection. All outdoor transform-ers are covered by automatic water spray systems to extinguish oil fires quickly and prevent the spread of fire. Transformers are spaced to minimize their exposure to fire, water, and mechanical damage.

The 4160-V switchgear and 480-V load centers are located in areas that minimize their expo-sure to mechanical, fire, and water damage. This equipment is properly coordinated electri-cally to permit safe operation of the equipment under normal and short circuit conditions.

The 480-V motor control centers are located in the areas of electrical load concentration.

Those associated with the turbine-generator auxiliary system in general are located below the turbine-generator operating floor level. Those associated with the nuclear steam supply sys-tem are located in the auxiliary building.

Page 53 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER REFERENCES FOR SECTION 8.3

1. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,

Subject:

SEP Topics VII-3 and VIII-2, dated April 2, 1981.

2. U.S. Nuclear Regulatory Commission, Diesel-Generator Protective Trip Circuit Bypasses, Branch Technical Position ICSB-17.

3. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,

Subject:

SEP Topics VI-7.F, VII-3, VII-6, and VIII-2, Safety Evaluations for Ginna, dated June 24, 1981.

4. U.S. Nuclear Regulatory Commission, Selection, Design, and Qualification of Diesel-Generator Units Used as Standby (Onsite) Electric Power Systems at Nuclear Power Plants, Regulatory Guide 1.9.

5. Letter from A. Schwencer, NRC, to L. D. White, Jr., RG&E,

Subject:

R. E. Ginna Atomic Power Station (degraded grid voltage event at another site), dated August 12, 1976

6. Letter from W. Gammill, NRC, to All Power Reactor Licensees (except Humboldt Bay),

Subject:

Adequacy of Station Electric Distribution Systems Voltages, dated August 8, 1979.

7. Letter from A. Schwencer, NRC, to L. D. White, Jr., RG&E,

Subject:

R. E. Ginna Atomic Power Station (susceptibility to degraded voltage), dated June 3, 1977.

8. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,

Subject:

Amendment 38 to Provisional Operating License DPR-18, dated March 26, 1981.

9. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,

Subject:

SEP Topic VIII-1.A, Potential Equipment Failures Associated With Degraded Grid Voltage, dated Janu-ary 29, 1982.

10. IEEE-317, Electrical Penetration Assemblies in Containment Structures for Nuclear Power Generating Stations.

11. U.S. Nuclear Regulatory Commission, Electric Penetration Assemblies in Containment Structures for Light-Water-Cooled Nuclear Power Plants, Regulatory Guide 1.63.

12. Letter from H. G. Saddock, RG&E, to D. L. Ziemann, NRC,

Subject:

SEP Topic VIII-4, Electrical Penetrations of Reactor Containment, dated April 12, 1979.

13. Letter from L. D. White, Jr., RG&E, to D. M. Crutchfield, NRC,

Subject:

SEP Topic VIII-4, Electrical Penetration of Reactor Containment, dated July 21, 1980.

14. Letter from J. E. Maier, RG&E, to D. M. Crutchfield, NRC,

Subject:

SEP Topic VIII-4, Electrical Penetrations, dated June 9, 1981.

15. Letter from J. E. Maier, RG&E, to D. M. Crutchfield, NRC,

Subject:

SEP Topic VIII-4, Electrical Penetrations, dated July 14, 1981.

Page 54 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER

16. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,

Subject:

SEP Topic VIII-4, Electrical Penetrations of Reactor Containment, Safety Evaluation Report for R. E.

Ginna Nuclear Power Plant, dated October 8, 1981.

17. Letter from R. C. Mecredy, RG&E, to A. R. Johnson, NRC,

Subject:

Resolution of Generic Issue A-30, Adequacy of Safety-Related DC Power Supplies (Generic Letter 91-06, dated April 29, 1991), dated October 28, 1991.

18. Letter from A. R. Johnson, NRC, to R. C. Mecredy, RG&E,

Subject:

Closure of Generic Letter 91-06, "Resolution of Generic Issue A-30, Adequacy of Safety-Related DC Power Supplies" - (TAC No. M81444), dated June 21, 1993.

19. Letter from D. L. Ziemann, NRC, to L. D. White, Jr., RG&E,

Subject:

Amendment 24 to Provisional Operating License DPR-18, dated February 14, 1979.

20. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,

Subject:

Fire Protection -

Ginna, dated December 17, 1980.

21. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,

Subject:

Fire Protection -

Ginna, dated February 6, 1981.

22. Letter from Leon D. White, RG&E, to A. Schwencer, NRC,

Subject:

Fire Protection at R. E. Ginna Nuclear Power Plant, dated February 24, 1977.

23. Letter from J. E. Maier, RG&E, to D. M. Crutchfield, NRC,

Subject:

10 CFR Part 50, Appendix R, Alternative Shutdown System, dated January 16, 1984.

24. Design Analysis, DA-EE-92-098-01, Diesel Generator A Steady State Loading Analysis, Rev. 6, dated January 24, 2011.

25. Design Analysis, DA-EE-92-120-01, Diesel Generator B Steady State Loading Analysis, Rev.6, dated January 24, 2011.

26. Topical Design Basis - Electrical Independence, dated June 19, 1997.

27. Design Analysis DA-EE-97-069, Sizing of Vital Batteries A and B, Revision 6, dated July 08, 2013.

28. Design Analysis DA-EE-93-006-08, 480 Volt Undervoltage Relay Settings and Test Acceptance Criteria, Revision 7, dated June 14, 2013.

Page 55 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER Table 8.3-1a ENGINEERED SAFETY FEATURES ACTUATION (ESFAS) SEQUENCE ACTION (TRAIN A)

Time (Sec) (Train B action similar) 0 Starting signal will be given to emergency generator 1A.

0 Trip signals will be given to the following 480-V bus tie breakers; 52/BT 16-14, 52/BT 16-15, 52/BT 14-13, and 52/BT 17-18. Administrative procedure is such that breakers 52/BT 16-14 and 52/BT 17-18 shall be open during normal plant operation. Thus, in effect, the only tie breakers that could need to be tripped are 52/BT 14-13 and 52/BT 16-15.

0 All nonsafeguards loads on buses 14 and 18 will be given trip signals.

Note: With outside power available, the sequence will follow that given in the diesel-generator loading tabulation shown in Table 8.3-1b. In this case, 10 sec should be subtracted from the times given in Table 8.3-1b starting with "Safeguards buses energized."

Without outside power the automatic sequences will proceed as follows:

0 All loads will be tripped off buses 14 and 18 with the exception of the safeguards motor control center 1C and the containment spray pump.

10 Emergency generator 1A will have started and reached no-load speed and voltage at which time the breakers connecting it to buses 14 and 18 will close.

10 to 45 The sequence will follow that given in Table 8.3-1b.

Page 56 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER Table 8.3-1b ENGINEERED SAFETY FEATURES ACTUATION (ESFAS) SEQUENCE ACTION -

DIESEL GENERATOR LOADING Bus 14 and 18 - Train A Bus 16 and 17 - Train B Time (Generator 1A) Time (Generator 1B)

(sec) (sec) 0 Safety injection signal 0 Safety injection signal 10 Safeguards buses energized 10 Safeguards buses energized 15 Safety injection pump 1A running 15 Safety injection pump 1B running 20 Safety injection pump 1C running 22 (If sequencing timer 2/SIP1C2 fails to operate) safety injection pump 1C run-ning 25 Residual heat pump 1A running 27 Residual heat pump 1B running 30 Service water pump 1A or 1C running, 32 Service water pump 1B or 1D running, selected prior to accident, i.e., prese- selected prior to accident, i.e., prese-lected lected 35 Containment fan 1A running 37 Containment fan 1B running 40 Containment fan 1D running 42 Containment fan 1C running 45 Auxiliary feedwater pump 1A running 47 Auxiliary feedwater pump 1B running 52 (If sequencing timer 2/SIP1C2 oper-ates and BKR1C2 does not close) safety injection pump 1C running a Containment spray pump 1A running a Containment spray pump 1B running

a. May be loaded onto safeguards buses anytime after buses are energized Page 57 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER Table 8.3-2a DIESEL GENERATOR LOADING (TRAIN A)

Injection Phase Recirculation Recirculation (Ref. 24, Table 13) Phase (High Head) Phase (Low Head)

(Ref.24, Table 14) (Ref. 24, Table 15)

Engineered Safety Features Quantity Power Quantity Power Quantity Power Load (kW) (kW) (kW)

Safety Injection Pumps 2 301 2 301 0 0 Residual Heat Removal 1 125 1 145 1 145 Pump Service Water Pump 1 266 2 266 2 266 Containment Air Recircu- 2 200 2 145 2 145 lating Fans Auxiliary Feedwater Pump 1 230 0 0 1 230 Containment Spray Pump 1 191 0 0 0 0 Component Cooling Water 0 0 1 127 1 127 Pump Motor Control Center 1 144 1 171 1 172 Loading Excitation Losses 1 17 1 17 1 17 and Crankcase Exhaust Motor Cable Losses 1 35 1 24 1 18 TOTAL ENGINEERED 2010a 1908a 1531a SAFEGUARDS LOAD

a. NOTE: Rounding of individual loads causes the total load to be conservatively higher than pre-dicted within the following references.

Page 58 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER Table 8.3-2b DIESEL GENERATOR LOADING (TRAIN B)

Injection Phase Recirculation Recirculation (Ref. 25, Table 13) Phase (High Head) Phase (Low Head)

(Ref.25, Table 14) (Ref. 25, Table 15)

Engineered Safety Features Quantity Power Quantity Power Quantity Power Load (kW) (kW) (kW)

Safety Injection Pumps 2 301 2 301 0 0 Residual Heat Removal 1 125 1 145 1 145 Pump Service Water Pump 1 266 2 266 2 266 Containment Air Recircu- 2 200 2 145 2 145 lating Fans Auxiliary Feedwater Pump 1 230 0 0 1 230 Containment Spray Pump 1 191 0 0 0 0 Component Cooling Water 0 0 1 127 1 127 Pump Motor Control Center 1 136 1 162 1 164 Loading Excitation Losses 1 17 1 17 1 17 and Crankcase Exhaust Motor Cable Losses 1 34 1 25 1 18 TOTAL ENGINEERED 2001a 1900a 1523a SAFEGUARDS LOAD

a. NOTE: Rounding of individual loads causes the total load to be conservatively higher than pre-dicted within the following references.

Page 59 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER Table 8.3-3 CONTAINMENT ELECTRICAL PENETRATIONS Penetration Manufacturer Circuit Descriptiona Number AE-1 Crouse-Hinds Containment air recirculation fan 1C AE-2 Crouse-Hinds Pressurizer heaters AE-3 Crouse-Hinds Motor-operated valves and pressurizer heater groups 21, 22, and 23 AE-4 Crouse-Hinds Containment air recirculation fan 1B AE-5 Crouse-Hinds Pressurizer heaters AE-6 Crouse-Hinds Reactor compartment fans 1A/1B, pressurizer heater groups 24, 25, and 26, and lighting transformer 1D AE-7 Crouse-Hinds Motor-operated valves and reactor compartment fans 1A/1B AE-8 Crouse-Hinds Solenoid-operated valves and instrumentation and control AE-9 Crouse-Hinds Spare AE-10 Crouse-Hinds Instrumentation and control AE-11 Crouse-Hinds Instrumentation and control AE-12 Westinghouse Instrumentation and control AE-13 Crouse-Hinds Reactor coolant pump 1B AE-14 Crouse-Hinds Reactor coolant pump 1B BE-1 Crouse-Hinds In-core instrumentation BE-2 IST Conax Fiber Optic BE-3 Crouse-Hinds In-core instrumentation and hydrogen recombiner 1B BE-4 Crouse-Hinds In-core instrumentation CE-1 Crouse-Hinds Instrumentation and control and microprocessor rod position indication CE-2 Crouse-Hinds Instrumentation and control CE-3 Westinghouse Instrumentation and control CE-4 Crouse-Hinds Instrumentation and control CE-5 Crouse-Hinds Instrumentation and control CE-6 Crouse-Hinds Instrumentation and control CE-7 Crouse-Hinds Instrumentation and control CE-8 Crouse-Hinds Power and intermediate range detectors CE-9 Crouse-Hinds Power and source range detectors Page 60 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER Penetration Manufacturer Circuit Descriptiona Number b

CE-11 Crouse-Hinds Power and intermediate range detectors CE-12 Crouse-Hinds Power and source range detectors CE-13 Crouse-Hinds Control rod drive lift coils CE-14 Crouse-Hinds Control rod drive gripper coils CE-15 Crouse-Hinds Control rod drive lift coils, Control rod shroud fan 1A CE-16 Crouse-Hinds Control rod drive lift coils CE-17 Crouse-Hinds Control rod drive gripper coils CE-18 Crouse-Hinds Control rod drive lift coils CE-19 Crouse-Hinds Motor-operated valves and instrumentation CE-20 Crouse-Hinds Control rod shroud fan 1B CE-21 Crouse-Hinds Containment air recirculation fan 1A CE-22 Crouse-Hinds Smoke and fire detectors CE-23 Crouse-Hinds Motor-operated valves and instrumentation CE-24 Crouse-Hinds Containment air recirculation fan 1D CE-25 Crouse-Hinds Reactor coolant pump 1A CE-27 Crouse-Hinds Reactor coolant pump 1A CE-29 Crouse-Hinds Instrumentation and solenoid-operated valves CE-30 Westinghouse Radiation monitors CE-31 Westinghouse Radiation monitors CE-32 Crouse-Hinds Instrumentation and solenoid-operated valves CE-33 Crouse-Hinds Instrumentation and solenoid-operated valves CE-34 Westinghouse Radiation monitors

a. Only the major circuit descriptions are listed for each penetration.

b. Penetration Number CE-10 no longer exists.

Page 61 of 62 Revision 26 5/2016

GINNA/UFSAR CHAPTER 8 ELECTRIC POWER Table 8.3-4 MAJOR BATTERY LOADS Battery A Loading (Loads > 10 Amps)

Load Current Time Frame Inverter A/Auxiliary Loads 141 amps 0-4 hours MOV 3505A (Starting) 82 amps 0-1 minutes Feedwater Pump A dc Lube Oil Pump (Starting) 83 amps 0-1 minutes Circuit Breaker Tripping 82 amps 0-1 minutes Feedwater Pump A dc Lube Oil Pump (Running) 16 amps 1-12 minutes Circuit Breaker Closing/Field Flash 61 amps 239-240 minutes MCB Annunciators A-L 16 amps 0-4 hours Battery B Loading (Loads > 10 Amps)

Load Current Time Frame Inverter B/Auxiliary Loads 112 amps 0-4 hours MOV 3504A (Starting) 82 amps 0-1 minutes Feedwater Pump B dc Lube Oil Pump (Starting) 82 amps 0-1 minutes Circuit Breaker Tripping 82 amps 0-1 minutes TDAFW Pump dc Oil Pump (Starting) 71 amps 0-1 minutes Feedwater Pump B dc Lube Oil Pump (Running) 14 amps 1-12 minutes TDAFW Pump dc Oil Pump (Running) 15 amps 1 - 240 minutes Circuit Breaker Closing/Field Flash 61 amps 239-240 minutes MOV 3996 (Starting) 115 amps 1-2 minutes Page 62 of 62 Revision 26 5/2016