Text

Redacted Updated Final Safety Analysis Report Chapter 8
	ML17033B533
Person / Time
Site:	North Anna
Issue date:	09/29/2016
From:	V Sreenivas; Plant Licensing Branch II
To:	Heacock D; Virginia Electric & Power Co (VEPCO)
	Sreenivas V, NRR/DORL/LPL2-1, 415-2597
Shared Package
ML17033B477	List: ML17033B480; ML17033B492; ML17033B500; ML17033B509; ML17033B515; ML17033B518; ML17033B525; ML17033B531; ML17033B533; ML17033B540; ML17033B545; ML17033B550; ML17033B570; ML17033B573; ML17033B575; ML17033B583; ML17033B585; ML17033B590; ML17033B591;
References
	Download: ML17033B533 (82)
	v • d • e

North Anna Power Station Updated Final Safety Analysis Report Chapter 8

Intentionally Blank Revision 5209/29/2016 NAPS UFSAR 8-i Chapter 8: Electric Power System Table of Contents Section Title Page

8.1 INTRODUCTION

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.1-1 8.1.1 Utility Grid . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.1-1 8.1.2 Onsite Electric System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.1-1 8.1.3 Identification of Safety-Related Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.1-3 8.1.4 Identification of Safety Criteria. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.1-4 8.1 Reference Drawings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.1-5 8.2 OFFSITE POWER SYSTEM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.2-1 8.2.1 Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.2-1 8.2.2 Analysis. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.2-2 8.2 Reference Drawings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.2-4 8.3 ONSITE POWER SYSTEMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.3-1 8.3.1 Alternating Current Power System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.3-1 8.3.1.1 Station Service Power System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.3-1 8.3.1.2 Vital Alternating Current Power System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.3-33 8.3.2 Direct Current Power System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.3-36 8.3.2.1 Description. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.3-36 8.3.2.2 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.3-38 8.3 References. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.3-40 8.3 Reference Drawings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.3-40

Revision 5209/29/2016 NAPS UFSAR 8-ii Chapter 8: Electric Power System List of Tables Table Title Page Table 8.3-1 Equipment Tripped Whenever Load Shedding is Initiated . . . . . . . . . . 8.3-43 Table 8.3-2 RSS Transformer A - Equipment Tripped . . . . . . . . . . . . . . . . . . . . . . . 8.3-43 Table 8.3-3 RSS Transformer B - Equipment Tripped . . . . . . . . . . . . . . . . . . . . . . . 8.3-44 Table 8.3-4 RSS Transformer C - Equipment Tripped . . . . . . . . . . . . . . . . . . . . . . . 8.3-44 Table 8.3-5 Cable and Raceway Redundancy Color Code Decision Table . . . . . . . 8.3-45 Table 8.3-6 Emergency Diesel Generator Loading Schedule - Bus 1H . . . . . . . . . . 8.3-46 Table 8.3-7 Emergency Diesel Generator Loading Schedule - Bus 1J . . . . . . . . . . . 8.3-50 Table 8.3-8 Enclosures With More Than One Field Run Color-Coded Cable . . . . . 8.3-53

Revision 5209/29/2016 NAPS UFSAR 8-iii Chapter 8: Electric Power System List of Figures Figure Title Page Figure 8.2-1 One Line Diagram; Electrical Distribution System . . . . . . . . . . . . . . . 8.2-5 Figure 8.2-2 General Arrangement Plan; North Anna 500-kV Switching Station; Louisa County, Virginia. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.2-6 Figure 8.2-3 Transmission Line Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.2-12 Figure 8.3-1 Examples of Acceptable Arrangements Where Horizontal or Vertical Separation Distances Cannot be Maintained . . . . . . . . . . . . . . . . . . . . 8.3-58

Revision 5209/29/2016 NAPS UFSAR 8-iv Intentionally Blank

Revision 5209/29/2016 NAPS UFSAR 8.1-1 CHAPTER 8 ELECTRIC POWER SYSTEM Volume VI

8.1 INTRODUCTION

The electric power system generates power and delivers it to the high-voltage switchyard for transmission to the utility grid.

Note: As required by the Renewed Operating Licenses for North Anna Units 1 and 2, issued March 20, 2003, various systems, structures, and components discussed within this chapter are subject to aging management. The programs and activities necessary to manage the aging of these systems, structures, and components are discussed in Chapter 18.

8.1.1 Utility Grid The output of the two units is delivered to a 500-kV switchyard through the unit main step-up transformers, as described in Section 8.2. The switchyard serves three 500-kV lines and one 230-kV line. The plant is connected to the switchyard by two 500-kV transmission lines, three 34.5-kV underground lines and two 34.5-kV overhead lines (available as back-up in case of a failed underground line or alternate feeders when the underground lines are out of service for testing, maintenance, or replacement) that supply power to the three reserve station service transformers. The 500-kV lines go to Ladysmith, Spotsylvania, and Midlothian, Virginia. The 230-kV line goes to Gordonsville. These intrasystem ties to the east, west, north, and south (Figure 8.2-3). VEPCOs transmission system and intrasystem ties are further described in Section 8.2.

8.1.2 Onsite Electric System The onsite electric system includes electrical equipment necessary to generate power and deliver it to the high-voltage switchyard. It also includes power supplies and equipment, including batteries, necessary to distribute power, both ac and dc, to the normal (non-safety-related) auxiliaries, and emergency (safety-related) auxiliaries. The onsite electric system also supplies power for control and instrumentation and is designed to provide dependable sources of power and to distribute it to the plant auxiliaries.

The onsite electrical system is shown in Figure 8.2-1. A list of station electrical drawings is provided as Reference Drawings 1 through 14.

The normal ac power source for each unit is the main generator, which is connected to three unit station service transformers by the isolated phase bus duct. The transformers have adequate capacity to supply all unit auxiliaries, with the exception of 4-kV buses 1G and 2G, for plant operation during normal power generation. Buses 1G and 2G are powered from the offsite sources via the reserve station service transformers B and C, respectively.

Revision 5209/29/2016 NAPS UFSAR 8.1-2 The preferred or reserve ac power source is the switchyard, which is connected to both units via three reserve station service transformers. The reserve station service power is available at all times to the safety-related equipment and has the capacity to drive the station auxiliaries in the event of a loss of the normal ac power supply. Upon a loss of power from the normal source on Unit 2, the normal station distribution system will transfer automatically to the reserve station service supply, provided no fault exists on the normal 4160V bus. On Unit 1, a main generator breaker has been installed. This allows Unit 1 to have its normal station service buses supplied from its normal station service transformers (backfed from the 500-kV switchyard) for most Unit 1 trips. This arrangement reduces the probability of combined loading from both Units 1 and 2 normal and emergency buses on the reserve station service transformer.

The standby emergency ac power source for each unit consists of two diesel generators. The standby ac power system has adequate capacity to supply the safety-related equipment. The standby ac power source, during the periods of interrupted preferred power, automatically supplies safety-related equipment.

An alternate ac (AAC) diesel generator has been added to provide emergency power in the event of a Station Blackout (SBO). A SBO is defined as loss of offsite power, concurrent with a turbine trip (loss of onsite power) and the failure of the emergency ac power source, but not the station batteries for the blacked out unit. The AAC system is auto-started by an SBO event.

Operator action is required to align the AAC diesel generator output to the desired emergency bus. The AAC diesel generator has adequate capacity to start and supply the required safety-related equipment for the blacked out unit.

When the AAC diesel generator is functional, the core damage frequency (CDF) is reduced for both units. The CDF is reduced even though no credit is taken for the use of the AAC diesel generator during accident sequences which result in core damage in less than one hour. The AAC diesel generator provides an effective means of minimizing the increased risk associated with removing an emergency diesel generator from service during any mode of operation. Risk is minimized by having only one emergency diesel generator unavailable at a time.

During a loss of offsite power when only one emergency diesel generator has failed, or is unavailable, the AAC diesel generator can be utilized to power the emergency bus without an emergency diesel generator. During a loss of offsite power when two or more emergency diesel generators have failed, or are unavailable, the control room operators will decide, based upon actual plant conditions, which emergency bus to power using the AAC diesel generator.

The 120V vital ac power source consists of four static inverters, each powered from its associated dc bus. These inverters provide a dependable 120V ac power source for the safety-related equipment, control, and instrumentation and are shown in Reference Drawing 13.

The 125V dc power source in each unit consists of four independent batteries and six battery chargers. Two battery chargers are spares.

Revision 5209/29/2016 NAPS UFSAR 8.1-3 The onsite ac power distribution system consists of three normal 4160V buses, a 4160V screen well bus, two emergency 4160V alternate ac buses, two emergency 4160V buses per unit, and four emergency 480V buses per unit. In addition, Units 1 is equipped with 11 normal 480V buses and Unit 2 is equipped with eight normal 480V buses. The 480V buses are fed from their respective 4160V buses through transformers. The 480V buses feed motors, motor control centers, transformers for 240/120V ac power and lighting distribution, and battery chargers for the 125V dc system and the standby diesel generators 125V dc systems.

The intake structure ac power distribution system for each unit consists of one 4160V switchgear assembly and one 480V motor control center fed from the 4160V bus through a transformer. In addition, the Unit 1 intake structure ac power distribution system consists of an additional 480V load center fed from the 4160V bus through a transformer. They supply motors, transformers for 240/120V ac power and lighting, and electrical equipment for the Unit 1 bearing cooling water tower.

The dam site ac power distribution system consists of one 480V motor control center supplying motors and transformers for 240/120V ac power and lighting systems. The 240/120V ac system supplies the battery charger for the dam site standby diesel generator.

The 125V dc distribution system for each unit consists of four main distribution cabinets for plant operation and dc loads essential for unit safety. The onsite dc power system is shown in Reference Drawing 13. Each standby diesel generator has an independent 125V dc power system.

Redundant safety-related equipment is supplied by redundant circuits that are physically and electrically isolated from each other to reduce the probability of simultaneous failure due to a single failure or incident.

Continuous Monitoring Recorders are installed to monitor and record main generator, station service, reserve station service and emergency bus voltages and currents during normal and transient plant conditions.

8.1.3 Identification of Safety-Related Systems The systems and devices that require electric power to function to achieve the system responses assumed in the safety evaluations and are needed to shut down the plant safely, are the following:

System Description Safety Function Type of Electric Power Safety injection Emergency core cooling ac (& dc control)

Containment Containment cooling and ac (& dc control) depressurization depressurization Containment isolation Isolate containment ac (& dc control) atmosphere

Revision 5209/29/2016 NAPS UFSAR 8.1-4 System Description Safety Function Type of Electric Power Service water Equipment and containment ac (& dc control) cooling Reactor protection system Core protection ac Radiation monitoring Detect recirculation spray ac (recirculation spray coolers cooler leak water outlet monitors only)

Equipment required to place the plant in a hot-shutdown condition and a cold-shutdown condition is listed in Sections 7.4.1.3 and 7.4.1.4, respectively.

8.1.4 Identification of Safety Criteria The following is a list of those criteria, safety guides, and standards implemented, unless otherwise noted in this section, in the original design of the onsite power systems:

10 CFR 50, Appendix A General Design Criterion 17 10 CFR 50, Appendix A General Design Criterion 18 Atomic Energy Commission (AEC) Safety Guide 6 Atomic Energy Commission (AEC) Safety Guide 9 Atomic Energy Commission (AEC) Safety Guide 22 IEEE-308-1971 IEEE-336-1971 IEEE-344-1971

Revision 5209/29/2016 NAPS UFSAR 8.1-5 8.1 REFERENCE DRAWINGS The list of Station Drawings below is provided for information only. The referenced drawings are not part of the UFSAR. This is not intended to be a complete listing of all Station Drawings referenced from this section of the UFSAR. The contents of Station Drawings are controlled by station procedure.

Drawing Number Description

1. 11715-FE-1A Main One Line Diagram, Unit 1 12050-FE-1A Main One Line Diagram, Unit 2

2. 11715-FE-1B 4160V One Line Diagram: Buses 1A & 1B, Transfer Buses D & E, Unit 1 12050-FE-1B 4160V One Line Diagram: Buses 2A & 2B, Unit 2

3. 11715-FE-1C 4160V One Line Diagram: Bus 1C, Intake Structure Bus 1G,

& Transfer Bus F, Unit 1 12050-FE-1C 4160V One Line Diagram: Bus 2C & Intake Structure Bus 2G, Unit 2

4. 11715-FE-1D 4160V One Line Diagram: Emergency Buses 1H & 1J, Unit 1 12050-FE-1D 4160V One Line Diagram: Emergency Buses 2H & 2J, Unit 2

5. 11715-FE-1AF 480V One Line Diagram: Emergency Buses 1H, 1H1, 1J, & 1J1, Unit 1 12050-FE-1AF 480V One Line Diagram: Emergency Buses 2H, 2H1, 2J & 2J1, Unit 2

6. 11715-FE-1P 480V One Line Diagram: MCC 1B2-1 & 1B2-3, Switchgear Room; Emergency MCC 1J1-1, Emergency Switchgear Room

7. 11715-FE-1Q 480V One Line Diagram: Emergency MCC 1H1-2, Cable Tunnel, Unit 1 12050-FE-1N 480V One Line Diagram: Emergency MCC 2H1-2, Cable Tunnel, Unit 2

8. 11715-FE-1R 480V One Line Diagram: Emergency MCC 1J1-2, Cable Tunnel, Unit 1 12050-FE-1P 480V One Line Diagram: Emergency MCC 2J1-2, Cable Tunnel, Unit 2

9. 11715-FE-1T 480V One Line Diagram: MCC 1H1-3 & 1J1-3, SW Pump House; Emergency MCC 1H1-1A & 1J1-1A, Emergency Generator 1H &

1J; Emergency MCC 1H1-3A & 1J1-3A, SW Reservoir Valve House; Unit 1

Revision 5209/29/2016 NAPS UFSAR 8.1-6 12050-FE-1R 480V One Line Diagram: MCC 2H1-3 & 2J1-3, SW Pump House; Emergency MCC 2H1-1A & 2J1-1A, Emergency Generator 2H &

2J; Unit 2

10. 11715-FE-1U 480V One Line Diagram: MCC Feeders

11. 11715-FE-1Z 480V One Line Diagram: Emergency MCC 1H1-1 & 1H1-4, Emergency Switchgear Room, Unit 1 12050-FE-1Q 480V One Line Diagram: Emergency MCC 2H1-1, 2H1-4,

& 2J1-1, Emergency Switchgear Room, Unit 2

12. 11715-FE-1AE One Line Diagram: 120V AC and 125V DC, Vital Power, Unit 1 12050-FE-1AE One Line Diagram: 120V AC and 125V DC, Vital Power, Unit 2

13. 11715-FE-1E One Line Diagram: 125V DC

14. 11715-FE-1N 480V One Line Diagram: MCC 1C1-2, Switchgear Room; 1G1-1, Intake Structure Control House; Unit 1

Revision 5209/29/2016 NAPS UFSAR 8.2-1 8.2 OFFSITE POWER SYSTEM 8.2.1 Description The North Anna Power Station is connected to the transmission system of VEPCO by three 500-kV lines and one 230-kV line going in separate directions.

Each main generator feeds electric power through a 22 kV isolated phase bus to a bank of three single-phase transformers for each unit, stepping the generator voltage of 22 kV up to the transmission voltage of 500 kV. The physical arrangement of power and control lines from offsite power sources and to remote structures is displayed in Figure 8.2-2. One-line diagrams depicting the electric system from the switchyard to the onsite system are given as Figure 8.2-1 and Reference Drawing 1. Additional information on VEPCOs transmission system, and specifically the portions of the system associated with the North Anna Power Station, is contained in the Applicant Environmental Report Supplement, North Anna Power Station, Units 1, 2, 3 and 4, Section 3.2, Appendix I (transmission line right-of-way maps) and Appendix J (response to questions 1, 2, and 3).

On Unit 1 & 2, surge arrestors (one per phase) have been installed in the isolated phase bus to protect the 22-kV system (main generator and isolated phase bus, etc.) from incurring damage in the event of a high-to-low fault in the generator step up transformers.

Station service transformers connected to the 22-kV isolated phase bus from each main generator normally supply power to the auxiliaries of each unit by stepping down the 22 kV to 4.16 kV.

Reserve station service power, for start-up and emergency use, is supplied by three 3-phase 34.5/4.16-kV transformers located near the power station. The 34.5-kV supply to these reserve station service transformers comes from two or more of the following: two 500/36.5-kV transformers located in the 500-kV switchyard and one 230/34.5-kV transformer located in the 230-kV switchyard. A switching capability is provided so that all three of the 34.5/4.16-kV transformers can be supplied from any of the station reserve transformers if necessary.

Transmission system interconnections required for Units 1 and 2 are shown in Figure 8.2-1.

These transmission interconnections are as follows:

1. A 500-kV line to the east to a 500-kV switching station near Ladysmith, Virginia, provides a connection.

2. A 500-kV line to the north to a substation near Spotsylvania, Virginia, provides a second connection to the VEPCO 500-kV system.

3. A 500-kV line to the south to a substation near Midlothian, Virginia, provides a third connection to the VEPCO 500-kV system.

Revision 5209/29/2016 NAPS UFSAR 8.2-2

4. A 230-kV line to the west to a substation near Gordonsville, Virginia provides a connection to the VEPCO 230-kV system.

Each of the four transmission lines leaves North Anna on a different right-of-way. The entire output of the two units can be carried on any one of three 500-kV lines. The 230-kV line rating is approximately one and a half times larger than the output of one nuclear unit due to the size of the two 500/230-kV transformers.

As seen in Figure 8.2-3, the VEPCO 500-kV system is extensive and interconnects with neighboring utility grids to the north, south, and west. The additions to the system associated with North Anna Units 1 and 2 and the interconnection to the 230-kV system further strengthen this system and increase its reliability.

8.2.2 Analysis Each of the 500-kV circuits and the 230-kV circuit connected to North Anna has sufficient capacity to supply the total required power to the station under any station condition. System and substation designs are such as to minimize the probability of loss of all offsite power sources.

Steady-state and transient stability studies have shown that offsite power sources remain available for the loss of either or both units at North Anna, the loss of any other unit or station on the VEPCO system, the loss of any 500-kV transmission line, or the occurrence of a three-phase fault on the transmission system followed by the failure of a circuit breaker.

Extensive power flow studies have been made of the transmission system in the North Anna area, including outages of the 500-kV circuits. None of these studies gave any indication of a steady-state stability problem. This is to be expected, as the capacity of the 500-kV circuits are such that the entire output of Units 1 and 2 can be easily carried by any one of the three 500-kV circuits and the location of the North Anna Station, in the heart of VEPCOs system, provides for strong ties into the system. The 230-kV circuit also strengthens the VEPCO system, but this circuit rating is approximately one and a half times larger than the output of one nuclear unit due to the size of the two 500/230 kV transformers.

The transient stability of Units 1 and 2 at North Anna has been analyzed by conventional methods using a digital computer program to perform the step-by-step analysis. The transient stability analysis showed that for any three-phase fault cleared at normal speed with normal relaying, the North Anna units remained quite stable.

To further test the system, the failure of critical circuit breakers was postulated and the system analyzed with three-phase faults adjacent to the station cleared by backup protection.

It should be noted that with the redundant protective equipment in the station designed for independent pole tripping, a failure of all three poles of a breaker simultaneously or of both protective relay systems simultaneously would have to occur to have such a severe condition.

These tests were made to assess overall system strength by determining the reaction of the system

Revision 5209/29/2016 NAPS UFSAR 8.2-3 to situations more severe than considered credible with the protective equipment provided. If a three-phase fault were to occur on any of the circuits at the station and all three poles of any breaker were to fail, the stability of the North Anna units is not ensured.

All of these situations postulate the failure of a line plus the failure of a circuit breaker and would be extremely rare occurrences. In any case, the studies have shown that the effects are local and that no cascading would result.

Transient stability tests were also made to study the effects of one pole of a critical circuit breaker failing to open while the remaining two poles open following a three-phase fault adjacent to the station and finally cleared by backup protection. The transient stability of both Units 1 and 2 were maintained under this severe condition.

The effect of the simultaneous sudden loss of both Units 1 and 2 at North Anna on the overall interconnected network has also been analyzed. No serious effects anywhere on the interconnected network were found in these studies.

The VEPCO transmission system consists of 500-kV, 230-kV, and lower voltage facilities in a highly integrated network that is strongly interconnected with neighboring systems. This network is designed to withstand the loss of any single facility without significantly affecting the overall system. Transient capability is a requirement for unit operation. The design is routinely tested and analyzed for adequacy by digital computer simulation. Further analysis is done in studies made jointly, on a continuing basis, with neighboring systems under several reliability agreements. Ongoing analysis is based on requirements dictated by federal regulations and industry standards and company procedures. These requirements also specify the level of considered contingencies.

The reliability of the overall system design is indicated by the fact that there have been no widespread system interruptions. Failure rates of individual facilities are low. Transmission lines are designed to have less than one lightning flashover per 100 miles per year, and the record shows much better performance, indicating conservative designs. Most lightning-caused outages are momentary, with few instances of line damage. The 34.5 kV switchyard is protected with a passive lightning protection system composed of 75-foot masts and static shielding protection wires. Other facilities do fail occasionally, but these are random occurrences, and experience has shown that equipment specifications are adequate.

The offsite power system conforms with General Design Criterion 17. Figure 8.2-2 shows the routing of redundant power and control lines from offsite power sources and to remote structures. The separation of redundant circuits, as discussed in Section 8.3.1.1.2.3, ensures that a single event will not cause a simultaneous failure of these circuits.

The control system for the switchyard breakers also conforms to General Design Criterion 17. Power supplies for the 500-kV switchyard controls are provided by two dc systems from separate and completely independent batteries and chargers. As a general design criterion,

Revision 5209/29/2016 NAPS UFSAR 8.2-4 each side of the 500-kV switchyard control house panel row is connected to a different dc system fed from respective dc distribution boxes. In the switchyard, each bay of three 500-kV circuit breakers is fed from battery 1 or battery 2, alternately. The battery chargers may be fed from any two of three independent sources in the switchyard. Power supplies for the 230-kV switchyard controls are provided by a separate dc system located in the 230-kV switchyard control house, and its battery charger is normally fed from 34.5 kv Bus 5 in the switchyard. Alternate feeds to this battery charger are also available from 34.5 kv Buses 3 and 4 as well as from a second source from Bus 5.

The control circuits are designed to operate as two different systems for each 500-kV line and circuit breaker function. The 500-kV transmission line protection consists of a combination of electromechanical, microprocessor based and static directional distance carrier blocking relay systems. There are two sets of protection relays for each transmission line with each on the opposite dc system and physically located on opposite sides of the control house. The line tripping functions from the primary and backup relays trip the respective circuit breakers through independent trip coils in each 500-kV circuit breaker. The line backup trip functions are routed directly to the breakers second set of trip coils, while the primary trip functions are routed to the breaker control panel, which is on the opposite battery from the backup functions, and then to the breaker through separate cable trays and cable trough sections.

There are also redundant 500-kV bus differentials using separate and independent current and control circuits. The two differentials for each 500-kV bus are located in different panel rows and use separate batteries for better reliability and redundancy. The 500/36.5-kV and 230/34.5-kV transformer differentials are located on separate dc sources for increased reliability as are the three 34.5-kV bus differentials.

The three independent 34.5-kV buses are separated by normally open circuit breakers with open disconnect switches. Each 34.5-kV bus #5 feeder breaker is operated by the battery associated with its sister breaker which feeds the same RSST since the protective relaying must be interconnected between the feeds to the RSSTs. The reserve station service transformers are fed from their respective 34.5-kV bus and are protected by overload relay schemes, and the cables are protected by pilot wire differentials.

8.2 REFERENCE DRAWINGS The list of Station Drawings below is provided for information only. The referenced drawings are not part of the UFSAR. This is not intended to be a complete listing of all Station Drawings referenced from this section of the UFSAR. The contents of Station Drawings are controlled by station procedure.

Drawing Number Description

1. 11715-FE-1A Main One Line Diagram, Unit 1 12050-FE-1A Main One Line Diagram, Unit 2

Figure 8.2-1 ONE LINE DIAGRAM; ELECTRICAL DISTRIBUTION SYSTEM Revision 5209/29/2016 NAPS UFSAR 8.2-5

Figure 8.2-2 (SHEET 1 OF 6)

GENERAL ARRANGEMENT PLAN; NORTH ANNA 500-KV SWITCHING STATION; LOUISA COUNTY, VIRGINIA Revision 5209/29/2016 NAPS UFSAR 8.2-6

Figure 8.2-2 (SHEET 2 OF 6)

GENERAL ARRANGEMENT PLAN; NORTH ANNA 500-KV SWITCHING STATION; LOUISA COUNTY, VIRGINIA Revision 5209/29/2016 NAPS UFSAR 8.2-7

Figure 8.2-2 (SHEET 3 OF 6)

GENERAL ARRANGEMENT PLAN; NORTH ANNA 500-KV SWITCHING STATION; LOUISA COUNTY, VIRGINIA Revision 5209/29/2016 NAPS UFSAR 8.2-8

Figure 8.2-2 (SHEET 4 OF 6)

GENERAL ARRANGEMENT PLAN; NORTH ANNA 500-KV SWITCHING STATION; LOUISA COUNTY, VIRGINIA Revision 5209/29/2016 NAPS UFSAR 8.2-9

Figure 8.2-2 (SHEET 5 OF 6)

GENERAL ARRANGEMENT PLAN; NORTH ANNA 500-KV SWITCHING STATION; LOUISA COUNTY, VIRGINIA Revision 5209/29/2016 NAPS UFSAR 8.2-10

Figure 8.2-2 (SHEET 6 OF 6)

GENERAL ARRANGEMENT PLAN; NORTH ANNA 500-KV SWITCHING STATION; LOUISA COUNTY, VIRGINIA Revision 5209/29/2016 NAPS UFSAR 8.2-11

The following information is HISTORICAL and is not intended or expected to be updated for the life of the plant.

Figure 8.2-3 TRANSMISSION LINE MAP Revision 5209/29/2016 NAPS UFSAR 8.2-12

Revision 5209/29/2016 NAPS UFSAR 8.3-1 8.3 ONSITE POWER SYSTEMS The onsite power systems consist of the ac power system, the vital ac power system, and the dc power system. A one line diagram showing the electrical distribution system is given in Figure 8.2-1.

8.3.1 Alternating Current Power System The ac power system is a dependable power source for the operation of the plant and safe shutdown of the reactor. The ac power system consists of the station service system and vital system. The voltage ratings of the ac power system are 4160V, 480V, 120/240V for the station service system, and 120V for the vital system. Reference Drawing 1 shows the main one-line diagram for the station, Reference Drawings 2 through 11 and 19 show the station service system, and Reference Drawing 12 shows the vital system.

Arrangement drawings of the onsite distribution and power supply components are shown on the following figures:

1. Power supply system components

a. Reserve station service transformers (preferred supply) - Reference Drawings 14 and 15.

b. Emergency diesel generators (standby supply) - Reference Drawings 15 and 16.

c. 125V dc power - Reference Drawings 17 and 18.

d. Vital ac power - Reference Drawing 18.

2. Onsite distribution system components - (ac) Reference Drawings 17 and 18, (dc) Reference Drawing 18.

Electrical schematic diagrams for each safety-related component and for each of its essential supporting system components are included in Report Numbers NA-TR-1001 and NA-TR-1002, Safety Related Electrical Schematics, dated May 10, 1973, and revisions thereto.

NA-TR-1001 and NA-TR-1002 were submitted to the Atomic Energy Commission (AEC) on May 18, 1973, as separate documents independent of the FSAR.

The ac power system for Unit 2 is similar to Unit 1.

8.3.1.1 Station Service Power System The station service power system sources are the station service transformers, the reserve station service transformers, the alternate ac diesel generator, and the emergency diesel generators. The station service transformers are also referred to as the normal source, the reserve station service transformers are referred to as the preferred source, and the emergency diesel generators as the standby source. These sources feed the distribution system (station service power system) consisting of the 4160V normal and emergency switchgear, 480V normal and emergency unit substations, 480V normal and emergency motor control centers, and the

Revision 5209/29/2016 NAPS UFSAR 8.3-2 safety-related equipment and auxiliaries necessary for safe shutdown of the reactor and power plant. In addition, the reserve station service transformers feed the intake structure consisting of two 4160V buses, three 480V transformers, two 480V motor control centers, and one 480V load center. The station service system is shown in Reference Drawings 2 through 11 and 19.

8.3.1.1.1 Description The reserve station service power source is connected to the distribution system by several different feeds. The feeds connect the three 34.5/4.16 kV reserve station service transformers to the following:

1. Six normal station service buses (three per unit).

2. Four emergency buses (two per unit).

3. Two intake structure buses (one per unit).

The normal buses are connected to the transformers via 5-inch overhead pipe bus and cables in tray. These feeds originate at the transformer low-side bushing and extend from the transformers to the north wall of the turbine building via the 5-inch pipe bus. The cables connect to the pipe bus at the north wall, are carried in trays over the turbine building, and are terminated in the normal bus switchgear located on the top floor of the service building. The normal bus feeds from A and B reserve transformers are physically separated from the C feed by an acceptable extent.

The four emergency buses are fed from the transformers by 4160V cable runs in duct, conduit, and cable tray. The first path has cable in duct from reserve station service transformers A and B to the turbine building where it continues in conduit and then in tray to emergency bus feeder breakers D1 and E1, respectively. The second path is for reserve station service transformer C cables, which run in duct to the service building so that they are kept separate from the cable runs of the other two transformers; these cables then continue in conduit and tray to emergency bus feeder breaker F1. Feeder breakers D1 and E1 are separated from breaker F1 by the wall separating Unit 1 switchgear from Unit 2 switchgear.

The feed to the intake structure buses is from the B and C transformers through a small section of overhead bus, then through their own duct banks into the intake structure switchgear room.

Before Unit 2 start-up, the reserve station service transformers are used to power auxiliaries. During start-up the reserve transformers deliver power to the necessary systems. Once the units generator is on the line, the station service transformers, are synchronized with the reserve station service transformers, and power to the normal 4160V switchgear is transferred to the normal source (main generator), without interruption, by feeding the buses from both sources for a short duration. The feeder breakers to the normal 4160V switchgear from the preferred source are then opened. Preferred power then feeds only the emergency and intake buses.

Revision 5209/29/2016 NAPS UFSAR 8.3-3 During Unit 1 start-up, if the reserve station service transformers are used to power auxiliaries, then the electrical alignment would be similar to Unit 2 described above. Unit 1 does not require that the reserve station service transformers be used to power the auxiliaries. With the addition of the main generator breaker, power can be backfed from the 500-kV switchyard through the main transformer to the station service transformers to the normal 4160V switchgear.

Once the units generator is online, power to the normal 4160V switchgear is supplied by the normal source (main generator). Power to the 500-kV switchyard is now supplied by the main generator so that power flow through the main transformer has been reversed. This arrangement reduces the probability of combined loading from both Units 1 and 2 normal and emergency buses on the reserve station service transformers. When combined with the load shedding scheme described later, it also allows for simultaneous start-up of Units 1 and 2 without overloading the reserve station service transformers.

The installation of the generator breaker on Unit 1 creates an additional independent source of offsite power from the transmission network to the onsite power distribution system, analogous to the reserve station service system, which is not dependent on the mode of operation of the Unit 1 generator. In addition, the Unit 2 normal station service system can be considered an additional independent source of offsite power from the transmission network to the onsite power distribution system. This source, however, is dependent on the mode of operation of the Unit 2 generator.

In the event that the main supply breaker from the normal source to a normal 4160V bus trips automatically, an automatic transfer from the normal station service transformer to the reserve station service transformer occurs, if no fault exists on the normal 4160V bus. The affected normal 4160V bus is supplied directly from the reserve station service transformer. The 4160V D, E, and F transfer buses are unaffected by the transfer and continue to connect the reserve station service transformers to the emergency buses to ensure continuous service for the safety-related equipment.

The emergency diesel generator is connected to the emergency bus by a breaker in the emergency switchgear room with control power from the station battery. The connecting cable is run in a cable trough and duct to the switchgear. The two units use four diesel generators arranged so that two are for Unit 1 and two are for Unit 2. Each diesel generator has 100% capacity to power the necessary safety-related equipment. The diesel generators are situated in the service building in individual missile-protected rooms.

The three reserve station service transformers are each rated at 18/24/30/33.6 MVA, OA/FA/FOA, 55/65C rise, 34.4/4.16 kV. Alarms in the control room sound to warn of a potential overload condition of the three reserve station service transformers. The emergency diesel generators are rated at 2750 kW for 8000 hr/yr, 3000 kW for 2000 hr/yr, and 3100 kW for 168 hr/yr. These ratings are within the maintenance factor. The diesel generators are also rated for higher values with the maintenance factor unspecified, since it may reduce the life of the diesel.

These ratings are 3300 kW at 1/2 hr/yr and 3800 kW at 7 sec/yr.

Revision 5209/29/2016 NAPS UFSAR 8.3-4 The 4160V emergency switchgear is arranged in two separate systems designated H and J.

The H bus is associated with train A, while the J bus is associated with train B. The buses are physically as well as electrically, separated from each other in different missile-protected areas on the bottom floor of the service building as shown in Reference Drawing 18. The 4160V H and J buses are arranged as shown in Reference Drawing 4. The 4160V buses are rated 1200A serving emergency loads through breakers equipped to protect the loads from overcurrent. The 480V emergency switchgear is also separated and located in missile-protected areas.

The 480V emergency switchgear buses H and J are arranged as shown in Reference Drawing 5. These buses are rated at 2000A with breakers equipped with overcurrent protection for the loads. The 480V motor control centers are shown in Reference Drawings 6 through 11 and 19.

The 480V emergency buses are equipped with normally open back feed breakers and an electrical connection which can be powered by a portable generator during a Beyond Design Basis Event.

The loads on the H and J buses on either the 4160V or the 480V level are typically redundant and are sized based on their required functions or the required functions of their associated components (e.g. a motor on a safety-related pump). The safety-related buses and their loads are shown in Reference Drawings 1 through 11 and 19.

There are other interconnections between buses, buses and loads, and buses and sources on the emergency 4160V system. The interconnection between bus and supply will be described for the H bus only since the J bus is identical, with the exception of the reserve station service transformer and transfer bus used and as noted in the following paragraph.

The H bus is connected to the reserve station service transformer C, its preferred supply, through a feeder breaker from the transformer to transfer bus F and two breakers in series between the transfer bus and the emergency bus. The feeder breaker from the transformer trips on overcurrent; transfer bus undervoltage; both 34.5 kV breakers (powering the transformer) open; or reserve station service transformer pilot wire, differential, or overcurrent. The breaker from the transfer bus trips due to overcurrent; undervoltage on either of the transfer or emergency buses; a trip of the feeder breaker from the transformer to the transfer bus; or transformer pilot wire, differential, or overcurrent. The feeder breaker in the emergency bus will trip due to an emergency bus undervoltage or overcurrent. The emergency diesel generator starts when a safety injection signal is received, at approximately 74% voltage on the bus for 2 seconds, or a 90%

degraded voltage level exists for 56 seconds. Following the safety injection start signal, the emergency diesel generator will load if a 90% degraded voltage level exists for 7.5 seconds. The emergency diesel generator breaker closes on the isolated bus at 95% generator voltage if certain conditions are met. The load breakers automatically trip on overcurrent or electrical fault and lock out, which prevents the breaker from being reclosed manually or automatically. Most of the 4160V load breakers also trip on undervoltage with time controlled reclosing when voltage is

Revision 5209/29/2016 NAPS UFSAR 8.3-5 restored on the bus. When a load breaker control switch is in the automatic position, the breaker will automatically close, as dictated by system requirements. All loads served by the stub bus, connected to the emergency bus, are shed due to undervoltage and may be manually reconnected.

The stub bus tie breaker is tripped and locked out when a containment depressurization actuation signal exists. The 480V emergency buses and motor control centers have no means of interconnections. Some 480V feeder breakers, in the motor control centers, automatically shed their loads on loss of offsite power to reduce emergency diesel generator loading.

On Unit 1, normal to emergency bus ties have been installed and, with the Unit 1 main generator breaker, provides two independent offsite power sources to each emergency bus. These bus ties exist between emergency bus 1H and the normal 4160V bus 1B and between the normal 4160V bus 2B and emergency bus 1J. These bus ties have a normally open breaker at each bus. In conjunction with this modification, the administrative tie between emergency buses 1H and 1J was removed.

On Unit 2, normal to emergency bus ties have been installed which provide an independent offsite power source to each emergency bus. These bus ties exist between emergency bus 2H and the normal 4160V bus 2C and between the normal 4160V bus 1A and emergency bus 2J. These bus ties have a normally open breaker at each bus.

On either degraded voltage or loss of voltage, an emergency bus will automatically transfer from its normally connected reserve station service transformer to the diesel generator. Manual transfer capability to the normal station service bus is also provided.

On Unit 2, the feeder breakers from the normal source (main generator) to the normal buses trip on overcurrent; undervoltage on the normal bus; turbine stop valve differential; generator differential; generator negative phase sequence; generator loss of field; generator ground; generator backup; generator overexcitation; generator leads differential; transmission line (A, B, or C) differential overcurrent; main transformer sudden pressure; turbine intercept and reheat valve differential; or generator power circuit breakers open. Tripping these breakers will, in turn, provide a permissive to close the breaker from the preferred power source (RSSTs) if there is no overcurrent on the normal bus and no undervoltage on the preferred source. The normal source feeder breakers that have tripped are locked open.

On Unit 1, the various main generator faults discussed above cause the tripping of the main generator breaker rather than the main feeder breakers from the normal source to the normal buses. The conditions of overcurrent, undervoltage on the normal bus, transmission line differential overcurrent, or sudden pressure, still trip the main feeder breakers. The main generator breaker trips associated with main generator faults or reactor trips allow power to be provided to the normal buses from the 500-kV switchyard instead of transferring to the preferred source as discussed on page 8.3-3.

To alleviate potential low-voltage profile conditions of the reserve station service system during combined unit operation using only the reserve station service system transformers, a

Revision 5209/29/2016 NAPS UFSAR 8.3-6 load-shedding scheme to certain non-safety-related secondary plant electrically driven equipment has been incorporated. When used, this scheme sends tripping signals to specific pieces of equipment based on the position of a unit start-up switch and the status of certain plant equipment. The tripping signal will trip specified running equipment and will defeat the auto-start capability of nonrunning equipment.

For the system to function, the operator places a two-position control switch in either the Unit 1 or Unit 2 start-up position. The particular equipment to be tripped by the switch positions will depend on the operating status of the main feedwater pumps, while other equipment will always receive a trip signal when load shedding is initiated.

The load-shedding scheme will initiate whenever the Unit 1 and Unit 2 normal (A, B, or C) bus is being fed from its associated reserve station service transformer, unless the operator has specifically defeated load shedding. To ensure the requirements of GDC-17 are met, load shedding should be enabled when (1) one unit is on-line and the other is in startup, (2) both units are on-line, or (3) both units are in startup. It may be necessary to defeat the load shed circuit for short periods to support maintenance activities. This will be procedurally controlled.

The equipment that is tripped any time load shedding is initiated is given in Table 8.3-1.

The other equipment powered by a particular reserve station service transformer is selectively tripped depending on the unit start-up switch position and the status of the feedwater pump in that unit. This results in six possible combinations of equipment to be tripped in addition to the equipment that is normally tripped for load shedding. The combinations are given in Tables 8.3-2, 8.3-3, and 8.3-4.

An undervoltage sensed on the preferred source feed trips the preferred source supply breakers, which, in turn, trip and lock open the preferred source feeder breakers to the emergency buses. An undervoltage caused on the emergency buses trips the preferred feeder breaker to the emergency buses and the associated emergency bus preferred supply breakers. These two breakers, which tie the transfer buses with the emergency buses, are in series so that a stuck breaker does not affect the clearing of the emergency buses from outside power sources before the connection of the diesel generators to the emergency buses.

Safety-related loads that may be transferred manually from one emergency bus to the other are charging pump C (CH-P-1C) and containment recirculation cooler fan C (HV-F-1C).

Channel 1 of the excore neutron flux monitor system (AMP-NM-1) can be powered from an emergency bus on the other unit.

The charging pump C is normally operated as either:

1. Running, in case pump A or B (CH-P-1A or CH-P-1B, respectively) is out for maintenance or otherwise not preferred to be in operation.

2. Available (not running) when either pump A or B is running.

Revision 5209/29/2016 NAPS UFSAR 8.3-7 Even though charging pump C may be powered from either the H or J emergency buses through breakers 15H7 or 15J7, respectively, interconnection of the buses cannot occur. These breakers are electrically interlocked to prevent inadvertant, simultaneous closing of both breakers.

To prevent overloading of the diesel generators, interlocks prevent automatic operation of two charging pumps on an emergency bus that has experienced an undervoltage.

During a safety injection signal with no loss of power, the A and B charging pumps, if available, will automatically start, but the diesel generators, even though started with the safety injection signal, will not be connected to their respective buses so they cannot be overloaded.

Normally only one charging pump (A or B) is required to run, with the other remaining pump (A or B) in the automatic mode. The C pump is normally a swing pump - available to be manually started when the A or B pump is unavailable (or it is not desired to operate them). If the C pump is to be considered an operable pump, it will be running, since the C pump gets no automatic starts.

The elementary diagram numbers showing the breaker interlocks mentioned above are 11715-ESK-5AL, 5AM, 5AN, and 5AP and are contained in Reference 1.

The indicators for each of the three charging pumps are as follows:

1. Green, red, and amber breaker position indication lights, located locally at switchgear, on the main control board and the auxiliary shutdown panel.

2. Ammeters, located on the main control board.

3. Annunciation on the main control board including 86 lockout trip for all four breakers associated with the three pumps.

4. Charging pump flow on main board and auxiliary shutdown panel.

5. Computer inputs include breaker closed for all four breakers associated with the three pumps.

The requirements of the single-failure criterion have been satisfied by providing three full-sized pumps and proper control design so that there will always be one pump available, even with a pump out for maintenance.

Three containment recirculation cooler fans are used for containment ventilation. The A and B fans are powered from the H and J emergency busses, respectively. The C fan can be powered from either the H or J emergency bus through breaker positions 14H7 or 14J7, respectively. Even though containment recirculation cooler fan C may be powered from either H or J emergency busses, the interconnection of the busses can not occur. There is only one breaker, and it has to be physically taken out of one cubicle and inserted into the other position.

All three containment recirculation fans are tripped by a containment depressurization actuation (CDA) signal or undervoltage. Fans A and B are available to be manually restarted when the CDA signal is reset and after a 30 seconds. delay on restoration of voltage. Fan C is

Revision 5209/29/2016 NAPS UFSAR 8.3-8 available to be manually restarted when the CDA signal is reset and on restoration of voltage. The elementary diagrams showing the breaker controls are 11715-ESK-6B, -6C, -6D, and -6E and are contained in Reference 1.

The indicators for each of the three containment recirculation cooler fans are as follows:

1. Green, red, and amber breaker position indicating lights, located on the ventilation panel in the main control room.

2. Annunciation on the main control board of breaker trip for each of the fan breakers.

3. Computer inputs for each fan breaker.

The requirements of single-failure criterion have been satisfied by providing proper control design to ensure that interconnection of the emergency busses will not occur.

Channel 1 of the Excore Neutron Flux Monitor System can be operated using either Unit 1 or Unit 2 emergency power. The option to use power from the opposite unit was provided to ensure that indication for this parameter would be available in the Fuel Building following a fire in the Control Room, Emergency Switchgear Room, Cable Tunnel, or Cable Vault.

For Unit 1, the transfer to Unit 2 power is made in the Unit 2 Emergency Switchgear Room.

A breaker in the Unit 1 Emergency Switchgear Room protects the Unit 1 Emergency Power System from faults caused by a fire in the Unit 2 Emergency Switchgear Room. The Unit 2 design is similar.

The transfer switches cannot be positioned to connect Unit 1 and Unit 2 Emergency Power Systems.

The identification of safety-related equipment enables plant personnel to recognize safety-related components. The emergency buses are color coded with the H bus designated as orange and the J bus designated as purple, and all cables associated with these buses that have safety-related functions are also color coded. The equipment is related to its associated bus by the alphanumeric equipment mark number; that is, the H bus feeds A, C, E, etc., designated equipment, and the J bus feeds B, D, F, etc., designated equipment.

The controls for the 4160V and 480V emergency switchgear breakers are powered from the battery (125V dc) distribution switchboards, as described in Section 8.3.2. The supplies are separate to ensure the redundancy of the control power for proper actuation of the breakers and are arranged so that the distribution board I is associated with bus H and board III with bus J.

The emergency switchgear is energized during normal operation, but not all equipment is continuously running. Because this situation exists, it becomes necessary to ensure that the equipment will work when it is needed. Therefore, tests of the entire system or components are conducted at specified intervals in accordance with Technical Specification requirements. The entire standby system is tested after installation to verify the starting speed and load ability. After

Revision 5209/29/2016 NAPS UFSAR 8.3-9 acceptance, the standby power systems are operated on a routine test schedule. Automatic starting of the diesel generators, an essential part of the safety-related systems, is tested in accordance with Technical Specifications.

Load Shedding and/or auto-start blocking of large 4160V motors is provided when the normal or G buses are being fed from the reserve station service transformers, to alleviate potential low-voltage profile conditions on the emergency buses during unit emergency (SI or CDA) conditions. This scheme is in addition to and separate from the load shedding previously described in this section.

For the condition of bus 2A being fed from RSST A during a Unit 1 SI or CDA, loads 2-SD-P-1A and 2-SD-P-2A will be shed.

For the conditions of bus 2B being fed from RSST B during a Unit 1 SI or CDA, loads 2-SD-P-1B, 2-FW-P-1B1, 2-FW-P-1B2 and 2-CN-P-1B will be shed.

All circulating water pumps of either unit experiencing an SI or CDA will be tripped when both buses 1G and 2G are being fed from the same source.

Automatic starting of the Condensate, Bearing Cooling, Component Cooling and Steam Generator Feed Pumps will be blocked during an SI or CDA when bus alignments are such that starting one or more of the pumps will degrade the voltage on the emergency bus.

The voltage correction mechanism on the Load Tap Changers for Reserve Station Service Transformers A, B, and C receives a signal to provide instantaneous voltage correction upon the occurrence of an SI signal on either unit. The signal will last for the duration of the event.

The equipment capacities are specified to meet the plant requirements and are shown in Reference Drawings 2 through 11 and 19.

Emergency Diesel Generators The emergency diesel generator, being a vital part of the emergency onsite power system, is discussed in detail below.

There are two 100%-capacity diesel generators for each unit. The diesel generators will automatically start when a safety injection signal is received, a 90% degraded voltage level for 56 seconds is sensed on the bus, or approximately 74% voltage for 2 seconds exists on the bus.

Following the safety injection start signal, the emergency diesel generator will load if a 90%

degraded voltage level exists for 7.5 seconds. When approximately 74% voltage is sensed for 2 seconds, or if the degraded voltage condition exists, the emergency bus is isolated and load shedding begins. The generator output breaker automatically closes onto the bus when the generator output voltage reaches 95% of nominal, either of the normal offsite power supply breakers are open, limited residual voltage remains on the bus, and the generator differential auxiliary relay is reset. An additional permissive exists for the emergency diesel generators output breakers requiring either of the bus-tie breakers to be open. Residual voltage on the Emergency

Revision 5209/29/2016 NAPS UFSAR 8.3-10 Bus is sensed by a relay that allows breaker closure only after the residual voltage has dissipated to approximately 1050V. The undervoltage and degraded voltage relaying schemes that initiate load-shedding are defeated when the diesel generator output breaker closes onto an isolated bus.

This is necessary to prevent voltage drops encountered during the diesel-loading sequence from causing load shedding to recur.

The following conditions will render the diesel generators incapable of responding to an emergency start signal discussed above:

1. Shutdown relay not reset.

2. Diesel generator (87) differential relay not reset.

3. Battery failure (100% loss of dc power).

4. Clogged or air-bound fuel oil lines.

5. Injection racks not open.

6. Air distributor valves sticking or low air pressure (less than 175 psig).

7. Air-start valves fail.

8. Improper governor setting or governor failure.

9. Improper set or faulty overspeed relay.

10. Engine firing on lube oil.

11. Control Room selector switch in MAN LOCAL.

These conditions are annunciated either directly based on the situation or indirectly via a start failure alarm in the diesel generator room and via an emergency diesel generator (EDG)

Trouble Alarm in the main control room. The diesel will also fail to start if the air start manual isolation valves are closed. These valves are locked in the open position and are checked periodically to ensure that they will not prevent the diesel generator from starting.

A listing of all equipment on the bus, including loading and unloading by manual or automatic action, time of each event, size of load, identification of redundant equipment, and length of time each load is required is shown in Table 8.3-6 for the H bus and Table 8.3-7 for the J bus. The schedules were set up in order to ensure that the emergency diesel-generator loading satisfies Position 2 of Safety Guide 9. The sequence of events used in the development of the schedules is as follows, where To = 0 seconds: (1) safety injection signal occurs at To - 50 seconds, (2) loss of preferred power source is sensed by undervoltage relays at To seconds, and (3) the CDA signal occurs at To + 55 seconds. Tables 8.3-6 and 8.3-7 show two Unit 1 scenarios as examples. While these scenarios do not bound worst-case EDG loading, they show the sequencing of loads for these events. Engineering controls and incorporates load additions into worst-case voltage profile and load calculations to ensure EDG ratings are not exceeded.

Revision 5209/29/2016 NAPS UFSAR 8.3-11 The accident analysis in Chapter 15 consider a loss-of-coolant accident (LOCA) to occur coincident with a loss of offsite power (LOOP). Information Notice 93-17, Safety Systems Response to Loss of Coolant and Loss of Offsite Power identified a potential problem with the diesel loading sequence if a LOOP should occur subsequent to a LOCA. Virginia Power evaluated this situation with respect to emergency diesel generator loading even though the North Anna licensing basis considers the LOOP to occur coincident with the LOCA. The evaluation identified that a LOOP subsequent to a LOCA would not result in overloading of the emergency diesel generators.

A diesel can be started by either of two redundant compressed air-starting systems (described in Section 9.5).

The diesel is fueled from the fuel-oil system described in Section 9.5.4. The fuel-oil day tank in the missile-protected diesel-generator room has a minimum allowed fuel capacity to enable the diesel to run for one hour. The day tank is designed to meet applicable codes.

The engine lubrication system consists of engine and motor-driven lubricating-oil pumps, lubricating-oil filters, and an air cooler. The diesel-generator lubrication system is described in Section 9.5.

The diesel-generator combustion air intake and exhaust system and the diesel-generator cooling and heating systems are described in Section 9.5.

All the required equipment and accessories of the above systems are supplied from the emergency motor control centers associated with the particular diesel generator. Each diesel generator has associated with it an ac fuel-oil transfer pump, an ac backup fuel-oil transfer pump, and a dc auxiliary fuel-oil pump. The ac fuel-oil transfer pump and its backup are fed from separate emergency motor control centers, and the dc auxiliary fuel-oil pump (backup to diesel-driven fuel-oil pump) is supplied from its respective diesel-generator battery.

The instrumentation and control for the diesel generators are fed from the emergency motor control centers and the 125V dc system associated with the diesel. The instrumentation includes:

voltmeters, ammeters, wattmeter, frequency meter, synchroscope, and varmeters, which are situated on the emergency-generator panels in the main control room. Local meters are in the diesel-generator room.

The controls include manual switches and push buttons, which are situated on the emergency-diesel-generator panels in the main control room. Local switches and push buttons are in the emergency-diesel-generator rooms.

The diesel-generator seismically-qualified control panels are floor rather than engine-skid mounted to reduce the possibility of vibration-induced failure.

The emergency-diesel-generator supply breaker automatic protective trips are diesel-engine overspeed, generator overexcitation, bus overcurrent, and generator differential. The

Revision 5209/29/2016 NAPS UFSAR 8.3-12 emergency-diesel-generator automatic engine trips are high lube-oil temperature, high jacket water coolant temperature, high crankcase pressure, low lube-oil pressure, start failure, generator differential, and diesel-engine overspeed. During testing, all protective trips are available to protect the emergency diesel generator from the abnormal occurrences stated above. During an emergency start, the emergency-diesel-generator breaker trips automatically only on diesel overspeed, bus overcurrent, and generator differential. The emergency diesel generators are automatically shut down only on generator differential and diesel-engine overspeed. All other emergency-diesel-generator protective trips are bypassed during an emergency start. The breakers can also be manually tripped, and the diesels manually stopped.

The diesel-generator feeder breaker trip and engine shutdown setpoints are as follows:

Cause of Trip Setpoint Percent of Design

1. Overcurrent 1200A time overcurrent 213

2. Overexcitation Range 59.4 A - 62.1A 110-115%

3. Generator differential 144A time overcurrent Not applicable

4. Low lube-oil pressure 17 psig 57

5. Engine overspeed 1035-1053 rpm 115-117

6. Start failure 7 sec 300

7. High lube-oil temperature 230°F 107

8. High jacket coolant temperature 205°F 111

9. High crankcase pressure +2.0-in. water The bases for the setpoints are as follows:

1. Overcurrent: The setpoint of 1200A is 213% of full load current of the generator, which adequately protects the equipment against fault currents. This setting offers some level of protection against high continuous currents, but is high enough to prevent inadvertent tripping and enforces the equipment availability.

2. Overexcitation: The setpoint range 59.4A - 62.1A is 110-115% of normal operation rating at rated kVA, which protects the equipment but is high enough to prevent inadvertent tripping.

3. Generator differential: This setpoint is not based on any design rating of the diesel generator, but on the criteria that the minimum available fault current should be at least 10 times the pick-up of the differential relay in order to account for current transformer error. The 144A setpoint meets this criteria and therefore, protects the generator from internal faults while avoiding spurious relay actuation due to current transformer error.

4. Low lube-oil pressure: The setpoint of 17 psig, with alarm at 20 psig, is 57% of normal operating pressure and is high enough to protect the engine from damage but low enough to prevent inadvertent tripping.

Revision 5209/29/2016 NAPS UFSAR 8.3-13

5. Engine overspeed: The setpoint range of 1035-1053 rpm is 115-117% of rated speed, which is low enough to protect the engine from damage but high enough to prevent tripping recovery from load rejection, in accordance with Safety Guide 9.

6. Start failure: The setpoint of 7 seconds is 300% of normal start time, which is long enough to ensure a start, if the engine is capable of starting, but short enough not to drain the air-starting tanks, which would prevent subsequent manual start tries (see Section 9.5.6).

7. High lube-oil temperature: The setpoint of 230°F is 107% of normal operating temperature, which is low enough to protect the engine but high enough to prevent inadvertent tripping.

The alarm setpoint is 225°F.

8. High jacket coolant temperature: The setpoint of 205°F is 111% of normal operating temperature, which is low enough to protect the engine but high enough to prevent inadvertent tripping. The alarm setpoint is 195°F.

9. High crankcase pressure: The setpoints are low enough to protect the engine but high enough to prevent inadvertent tripping, and within the requirements of the diesel-generator manufacturer.

The consequences to the plant of the loss of a diesel-generator set during accident conditions due to inadvertent trip(s) or trip(s) caused by marginal settings of essential protective functions are minimal since: these trip(s) will affect only one diesel generator and, therefore, one train of the redundant engineered safeguards equipment is still available; and, the tripped diesel, since it is still in sound condition, can be restarted after isolation of the cause, thus restoring to full redundancy the engineered safeguards equipment.

The consequence to the plant of the loss of a diesel-generator set during accident conditions due to bypassing of the various trips, at a time a trip is necessary to protect the diesel-generator set, will in all probability be the permanent loss of the generator set. However, the redundant diesel-generator set will still be available to supply its engineered safeguards equipment.

The difference between the above two cases is that in the former the diesel-generator set will be protected from disabling damage and probably can be restarted. In the latter case, it may be lost permanently. The result of both cases is that the redundant diesel-generator set will always be available to power the necessary engineered safeguards equipment.

The diesel generators are protected against missiles, which include tornado missiles and air bottle failure generated missiles, by missile-proof rooms. Since the engine is designed to contain a crankcase explosion, there will be no missiles resulting from such an explosion.

The individual rooms are designed to meet criteria indicated on Table 3.2-1 for tornado missile protection. The air bottles are built to ASME Section VIII requirements and are protected from overpressure by two relief valves; therefore, overpressure failure is not credible. In addition,

Revision 5209/29/2016 NAPS UFSAR 8.3-14 individual rooms are provided for each diesel so air bottle rupture would not affect more than one diesel.

With respect to no-load operation, the manufacturer has stated that there are no mechanical limitations on running the Fairbanks Morse model 38TD8-1/8 engine at full-speed no-load conditions; however, running in an unloaded condition would result in an accumulation of unburned oil residue in the engine exhaust system, which could result in a stack fire if a sudden load were applied. Operating procedures ensure that the engine is loaded up before securing the unit, after extended no-load operation.

The diesel generators are load tested in accordance with Technical Specifications.

To allow isochronous (independent) and droop (parallel) operation of the diesel generator following testing, an automatic speed reset capability has been installed in the emergency-diesel-governor speed reference circuit. The preset speed condition (900 rpm) is necessary for two reasons: (1) to ensure that the emergency diesel generators can accommodate the oncoming load without tripping, and (2) to ensure that control instrumentation and other safety-related equipment will operate at the proper frequency. Following the shutdown of the emergency-diesel-generator system, the reset will automatically set the speed reference to the predetermined speed setting on the electric governor. The control relays that are used for this purpose are powered from the 125V dc distribution panels 2A and 2B.

Surveillance testing of the diesel generators does not conflict with the recommendations of the engine manufacturer.

Maintenance on the emergency diesel generators is performed in accordance with established administrative procedures.

To comply with 10 CFR 50, Appendix R, capability has been provided to operate the diesel from the diesel generator room when a fire prevents access to the main control room. The following design features have been provided for this capability:

1. Location of relays and current transducers for Train H diesel generators in the Unit 1 and Unit 2 Emergency Switchgear Train H Rooms.

2. Installation of transfer switches, lockout relays, metering, control and indication of circuit breakers and diesel engines in the 1H and 2H diesel generator rooms.

3. Installation of meters in the 1H and 2H diesel generator rooms to measure bus voltage, frequency, kilowatts, kilovars, and emergency supply breaker amperes.

4. Cable routing outside the main control room and plant fire areas containing Train J diesels, with the exception of the emergency switchgear room.

Revision 5209/29/2016 NAPS UFSAR 8.3-15 8.3.1.1.2 Analysis 8.3.1.1.2.1 Compliance with NRC Criteria. In accordance with General Design Criterion 17, the onsite ac power system is highly reliable, with redundancy to ensure safe shutdown of the plant while maintaining fuel conditions within acceptable design limits and containment integrity. The onsite ac power system has been shown in the description of the system to have the independence, redundancy, and testability necessary to perform its necessary functions with a single failure. The offsite ac power system is energized at all times so that it is available continuously. The onsite power system is designed to minimize the possibility of losing all ac power onsite. The individual systems are separated and independent of each other so a coincidental loss of power generation and offsite power will not reduce the integrity of the plant.

In accordance with General Design Criterion 18, the operability and functional performance of the components of the systems are designed to permit periodic testing.

In accordance with Safety Guide 6, the emergency ac power system for each unit is separated into two redundant and independent systems to provide safety-related equipment with dependable power with the loss of one system. The separated systems are able to be connected to a preferred power source or to a standby power source with no connection between the redundant systems.

In accordance with Safety Guide 9, the emergency diesel generators were sized by conservative methods during the construction permit stage of design. The diesel generators 2000-hour rating is 3000 kW with a 30-minute rating of 3300 kW. At the operating license stage of review, the greatest predicted load for each diesel-generator set was 2938-kW maximum for the worst case of loss of power and a design-basis LOCA (DBA) which was 89.03% of the 30-minute rating. The emergency diesel generators shall not be continuously loaded to more than their 2000-hour rating of 3000 kW. The emergency power system has been tested prior to reactor criticality, as specified in Table 14.1-1.

The diesel-generator sets are capable of reaching rated voltage and speed within 10 seconds of receiving the starting signal and accepting sequentially the required safety and shutdown loads after a loss of offsite power. During initial loading, the voltage decreases to approximately 60% of nominal. This voltage value is less than the minimum indicated in Safety Guide 9; however, it is still satisfactory since the voltage drop occurs only at the application of the initial load block and voltage regulator action restores voltage so that motors accelerate and voltage is restored to 100%

before the application of the second load block. At no other time during the loading sequence does voltage dip below 75% of nominal.

The restoration of voltage is to 90% of nominal within 40% of the load block interval. The diesel-generator sets, even under this condition, meet the requirements of Safety Guide 9; that is, they successfully start and accelerate the motors to meet their design purpose.

Revision 5209/29/2016 NAPS UFSAR 8.3-16 Frequency during the initial loading does decrease below 95% of nominal and is not restored to within 2% of nominal in less than 40% of the initial load block time interval. This is not in accordance with the values in Safety Guide 9; however, it is still satisfactory since the discrepancy occurs only at the application of the initial load block and governor action restores the frequency and accelerates the motors prior to the application of the second load block. At no other time does the frequency violate Safety Guide 9 requirements.

The diesel generators, during recovery of transients or disconnections of the largest single load, do not reach above 1001 rpm, which is the total normal speed plus 75% of the difference between overspeed trip (1035-1053 rpm) and nominal (900 rpm). A diesel generator is tested for confirmation of its suitability to carry the required emergency loads.

The following information is HISTORICAL and is not intended or expected to be updated for the life of the plant.

A description of the testing procedures follows:

Tests have been conducted by the manufacturer to document generator transient performance under across-the-line induction-motor-starting conditions. These tests were conducted on a 12-cylinder 38TD8-1/8 engine, a 996-30 frame-size alternator, and a Basler exciter. The only essential difference between the equipment tested and the equipment supplied is the field-forcing capability increase from 300 to 500%. This change results in improved transient performance (Reference 2).

Tests have been conducted by the manufacturer to document starting and load acceptance reliability on a similar 12-cylinder 38TD8 1/8 engine generator set. The diesel generator was connected directly to a 3000 kW resistive load and automatically set to sequence as follows:

1. Start unit and accelerate it to rated speed and load.

2. Maintain 3000 kW load for 5 minutes

3. Shut the unit down without an idling or cooling-off period and allow it to stand until temperatures drop to the keep-warm system level.

4. Repeat steps 1, 2, and 3 through 100 consecutive cycles.

The manufacturer performed prototype tests including 100 start and load acceptance tests on similar equipment and supplied the test records. Also, one of the furnished diesel generators was loaded at the factory with a starting load equivalent to 110% of the initial and largest load block as follows:

1. Start diesel generator and accelerate to speed and voltage.

2. Load generator with approximately 11,000-starting-kVA motor load (110% of initial load block).

3. Repeat 25 times allowing a sufficient interval between successive starts for diesel generator and load to cool.

Revision 5209/29/2016 NAPS UFSAR 8.3-17 The following information is HISTORICAL and is not intended or expected to be updated for the life of the plant.

During each start and loading, generator transients including speed, terminal voltage, and frequency were recorded. The results included a voltage drop-voltage recovery profile to indicate the value and duration of the transients. The test report provided verification that the generator voltage was restored before the application of the second load block.

Preoperational testing of the emergency diesel generator portion of the onsite power system was as follows:

1. The plant emergency electric power distribution system was isolated from the offsite transmission system by direct actuation of the undervoltage sensing relays within the onsite system.

2. By applying simulated accident signals, the emergency diesel generator was functionally tested in the modes of operation and sequencing of loads. Each test was of sufficient duration to achieve stable operating condition, and thus permit detection of adverse conditions.

3. During each test, the terminal voltage and power were monitored to verify proper operation of the diesel generator.

In accordance with Safety Guide 22, the ac power systems important to safety are designed to permit their safety-related functions to be tested periodically by VEPCOs trained personnel to ascertain the actuation of components and of the whole system, where possible, during reactor operation. When the actuation of the entire system is not feasible during reactor operation, those systems are calibrated and tested during a scheduled shutdown of the plant. These systems are impracticable to test during reactor operation and would adversely affect reactor operability. The control components are set and tested by VEPCOs personnel to ensure proper actuation.

Additional information is provided in Chapter 7.

8.3.1.1.2.2 Compliance with IEEE Criteria. In accordance with IEEE Standard 308, the station service power system and its components are designed to operate during and after a design-basis event, retain its safety features, and keep its parameters within their specified limits. The safety-related systems are redundant systems so that a loss of one will not endanger personnel or structures. The design basis accident is discussed in Chapter 15, and all required Class 1E equipment is qualified to operate during and after an event. The onsite electric system is designed to deliver dependable power to components during and after the event, so that there is no degradation in performance. The onsite electric system is constantly monitored in the main control room, and the breakers can be operated remotely or locally. All associated material pertaining to Class 1E equipment is installed separately from its redundant counterpart to prevent a common failure.

Revision 5209/29/2016 NAPS UFSAR 8.3-18 The power supply to the Class 1E equipment is from either the preferred power source or the standby power source. The Class 1E bus is energized during all phases of operation. This arrangement permits immediate response of equipment to any abnormal operating conditions. In the event of a preferred power source failure, the standby power source is energized and supplies the necessary power to the safety-related loads for safe shutdown and maintenance of security after shutdown or accident. The independent power supplies (preferred and standby) are arranged and connected such that loss of one does not degrade or cause loss of the other. The standby system is designed to withstand all postulated events so that a common failure is minimized.

The onsite electric power system is designed with physical separation, electrical isolation, and redundancy to prevent a failure of safety-related loads. The redundant loads are physically separated, either by distance or barrier, depending on available room and the areas environment.

They are electrically separated to minimize concurrent failure and allow a redundant group to perform its function even though its counterpart is incapacitated.

Each safety-related load group has power available from either preferred or standby power supplies, which are completely independent.

The preferred power system supplies power to the onsite electric system through the distribution system. The preferred power supply is capable of providing sufficient power to start up one unit while operating all required loads of the other unit. The system is normally fed by two circuits in the high-voltage switchyard but can operate with only one circuit available. The entire system is monitored to ensure the availability of the supply to the onsite electric system, and the source is capable of operating necessary equipment.

The standby power system supplies power to the emergency buses in the event the preferred power source is unavailable. Each standby power source has the capacity to supply the necessary safety-related equipment. The standby power supply is monitored constantly by indicators and alarm points that annunciate if any of the major components or parameters are not within specified conditions. The standby power source contains more than 7 days of fuel available for the operation of the system. The fuel is provided from two underground missile-protected tanks.

Fuel transfer from the underground tanks to each diesel day tank is performed by an ac fuel-oil transfer pump fed from the emergency buses associated with the respective diesel. The standby power supply is controlled from a remote station or locally so the supply or feed can be chosen automatically or manually for the conditions presented (i.e., start and load standby power supply, disconnect unnecessary loads due to loss of preferred power source, and selection of suitable power supply when both are available). The standby power source supply breakers and load breakers automatically protect equipment from electrical disturbances not associated with normal operation, and the action is indicated both at the remote station and locally.

The onsite electric equipment after installation and before reactor criticality was tested to demonstrate that all components were installed, connected, and operate properly and all metering and protective devices were properly calibrated and adjusted. The safety-related systems are

Revision 5209/29/2016 NAPS UFSAR 8.3-19 tested periodically to detect the start of deterioration and to demonstrate that the system is available for proper operation.

In accordance with IEEE Standard 336, VEPCOs agent had a Quality Control Division responsible for inspecting and witnessing electrical equipment tests from the time of production to the start-up of the power generating station. Chapter 17 of the original FSAR described the Divisions responsibilities, procedures, and documentations in detail. The Division used 10 CFR 50, Appendix B, as a basic requirement of operation and maintained a staff to enforce manufacturers, installers, and testers compliance to 10 CFR 50, Appendix B, and all applicable codes, standards, and guides.

The Class 1E equipment compliance to IEEE Standard 344-1971 is described in Section 3.10.2.

8.3.1.1.2.3 Criteria for Cable and Raceway Routing, Designation, and Identification. S a f e t y system cables and raceways are color coded. Safety system cables or raceways of one color code are separated from cables or raceways of another color code in accordance with the criteria contained in this section. This separation is designed so that a single failure within the protection system does not prevent minimum protection system action. Non-safety-system cables and raceways are not color coded. Non-safety-related cables are not permitted to be routed in raceways with cable of more than one color code. Where field run non-color-coded cables are routed with cables of one color code and then enter an enclosure containing different color-coded cables, they are separated by 6 inches or a barrier is provided. If a barrier cannot be provided or they cannot be separated, then these cases are documented, reviewed, and resolved by the engineers.

The cable code designation is a 10-character alphanumeric code with each part indicating specific information, such as unit number, system code letters, part code number or letter, color code letter, service class letter, and cable number. The design of the cable system incorporates this code designation. Every cable run 10 feet or more and raceway section in the power station, except security, lighting, party-paging, and telephone systems, is identified with an alphanumeric code designation that includes a color code letter for safety system circuits.

Non-safety-system circuits are not color coded; cables are given the code letter N in the color code letter designation, meaning no color code.

The raceway code designation is an 8- or 9-character alphanumeric code with each part indicating specific information, such as unit number, raceway type, service class, raceway identification, color code, and conduit number identification letter if required. The design of the raceway system incorporates this code designation.

Both code methods of identification, designation and color, are used to ensure physical separation of redundant circuits that are a part of the safety system. Redundancy is primarily obtained by the use of two trains and four channels, each of which is color coded.

Revision 5209/29/2016 NAPS UFSAR 8.3-20 Applicable train and channel color identification is as follows:

Train A - Orange color and code letter O Train B - Purple color and code letter P Channel I - Red color and code letter R Channel II - White color and code letter W Channel III - Blue color and code letter B Channel IV - Yellow color and code letter Y When it becomes necessary to have common ties between buses, the direct tie between 4160V emergency orange and purple buses is accomplished by using a bus tie cable that is color coded green (G), so that it can be associated with either P or O.

The charging pumps for each unit are provided in triplicate, each pump being rated at 100%

capacity. Two pumps are permanently connected (one to each emergency bus) with the third pump capable of being tied through interlocks and individual circuit breakers to either bus, depending on needs. The power cables of the third swing pump are color coded green (G), while the individual circuit breaker control cables will be color coded the same as the bus to which the circuit breaker is connected.

The containment recirculation cooler fans for each unit are provided in triplicate. Two fans are permanently connected (one to each emergency bus) with the third fan being capable of being tied to either bus by physically moving the circuit breaker from one redundant bus to the other.

The cable between the two breaker cubicles is color coded green (G), and the cable feeding the load is color coded orange (O). The breaker is assigned to the orange bus, and the only time it can be moved to the purple bus is after the total loss of the orange bus. This circuit is run in conduit.

The control ties between the normal 4160V buses and safety-related control panels are color coded G (green). These circuits are each run in conduit. The G conduits running to the orange and purple cabinets are separated from each other.

The reserve station service transformers supply preferred power to the emergency buses via feeders from transfer buses D, E, and F. These tie power cables between the emergency buses and the transfer buses are not color coded. However, the tie breaker control cables are color coded, the same as the bus to which the breaker is connected.

Color-coded cable routing separation is programmed into the computerized cable scheduling program to prevent the placement of cables of one color code into a raceway with cables(s) of another color code. Table 8.3-5 lists the available color codes and related color code letters that are contained in the computerized cable scheduling program.

The service classes for cables are as follows.

Revision 5209/29/2016 NAPS UFSAR 8.3-21 The H service identification is used primarily for raceways and cables above 600V service.

Minimum tray size is based on scheduling the cables one layer deep with maintained 1/4-diameter spacing of the larger cable between adjacent cables. One-eighth-diameter spacing is maintained between outside cables and tray side rails. IPCEA Publication No. P-46-426, Derating Table VII, Line 1, is applied where required.

The L service identification is used for raceways and power cables 600V or less, including 480V feeders, large 480V motor leads, dc feeders, dc motor leads, lighting feeders, etc. Tray size and cable spacing and/or derating is the same as for the H service.

The K service identification is used for raceways and power cables No. 4 AWG copper or smaller operating at 600V or less. In general, this service class includes small 480V motor leads, small 480V distribution circuits, small dc circuits and motor leads, and some lighting loads.

K service class tray fill does not exceed 50% of the calculated usable cross-section tray area.

Cables in a K service class raceway meet one of the following conditions:

1. No conductor I2R loss heating (interlocks, indicating lamps, controls, etc.).

2. Intermittent duty (valve operators, cranes, etc.) operation less than 40% of the time or for not longer than 30 minutes at any one operation.

3. Cable for continuous operation is derated to 40% of normal.

K service class derating and size limitations are not applicable to BDB (Beyond Design Basis) cables permanently installed in K service class raceway that distribute power from BDB receptacle cabinets and distribution panels. During normal operations, BDB cables are de-energized and have negligible effect on existing non-BDB cabling. During postulated BDB external events with ELAP (extended loss of AC power), existing non-BDB K service cabling would be de-energized, therefore would neither affect nor be affected by BDB cabling.

The C service identification is used for raceways and cables of control, metering, relaying, and alarm circuits. In general, these services include 125V dc and 120V ac control leads, PT cables, CT cables, etc. The C service class tray fill does not exceed 50% of the calculated usable cross-sectional tray area.

The X service identification is used for raceways and cables of data, communication, alarm, control, or instrumentation services. These services include cables from thermocouples, resistance temperature detectors, process instruments, and computer signals. Generally, this service class includes anything less than 50V, although some low-energy control or signal systems may operate above 50V and still be considered low level. The X service class tray fill does not exceed 50% of the calculated usable cross-sectional tray area.

C and K service class cables (600V insulation) may be combined in the same K raceway without further separation. The C and L service class cables may be run in the same L tray providing that L cable spacing is maintained. BDB low voltage power and control cables (600V)

Revision 5209/29/2016 NAPS UFSAR 8.3-22 are maintained de-energized during normal operations and design basis accidents/events and have negligible effect on non-BDB cabling; therefore they may be run in service class C, K and L raceway.

Raceway type identification is as follows:

Raceway Type Code Raceway Type A Armored cable or direct burial cable C Conduit D Duct and concealed conduit over 20 ft length F Floor sleeves and concealed conduit 20 ft length or under T Tray and troughs U Trenches and blockouts W Wall sleeves The conduit, sleeve, and duct have the following restrictions placed on them for percent fill:

1. One cable - 50% fill.

2. Two cables - 3l% fill.

3. Three or more cables - 40% fill.

4. Floor and wall sleeves 5 feet long or less - 80% fill.

The overfill of raceways may be authorized after it has been determined that the electrical and mechanical integrity of the cable(s) in the raceway have not been compromised.

The unit number indicates the unit to be serviced. The system code designator, the part code number or letter, cable number, raceway number, or conduit number, depending on which one is described, are all design controlled for internal use. The entire alphanumeric designation code is to ensure separation, isolation, and identification.

Non-color-coded trays in all areas are in general vertically separated 15-inch minimum from color-coded trays as measured from the bottom of one side rail to the bottom of the side rail of the tray above or below. This 15-inch vertical separation from other trays may be reduced to a minimum separation of 2 inches as measured between the bottom of one tray side rail to the top of the side rail below for short tray runs if required. Non-color-coded trays do not have any horizontal separation requirements beyond standard construction and access clearances.

Solid metal tray covers (sheet or corrugated) are provided on all trays except the top tray under a solid floor for general cable protection. Other approved tray cover configurations (e.g.

marinite board) have been provided in lieu of solid metal tray covers where construction constraints dictate and electrical separation barriers are required.

Revision 5209/29/2016 NAPS UFSAR 8.3-23 Safety system trays in missile-producing areas are separated as described below:

1. Vertical separation between different color-coded trays is maintained at 45 inches at a minimum from the bottom of the side rail to the bottom of the side rail of the tray above or below. Non-color-coded trays may be installed between color-coded trays provided the 15-inch separation is maintained between the bottoms of the side rails.

2. Horizontal tray separation is maintained at 4 feet from side rail to side rail between trays of different color coding.

3. Where separation cannot be maintained in accordance with the paragraphs above, appropriately designed missile barriers are provided.

Color-coded trays in non-missile-producing areas have separation criteria as follows:

1. Orange and purple safety system cable trays are vertically separated from each other by a 30 inches at a minimum from the bottom of one side rail to the bottom of the side rail of the tray above or below. A non-color-coded tray may be installed between two color-coded (orange and purple) trays provided the 15-inch separation (30 inches overall) is maintained.

2. Horizontal tray separation is maintained at 24 inches at a minimum from side rail to side rail between trays having different color coding.

3. Color-coded trays other than orange and purple trays are vertically separated from one another 15 inches at a minimum from the bottom of one side rail to the bottom of the side rail of the tray above or below.

4. Vertical separation between an orange or purple tray to any other color-coded tray is 15 inches at a minimum from the bottom of one side rail to the bottom of the side rail of the tray above or below.

Where separation cannot be maintained in accordance with the paragraphs above for non-missile-producing areas or for color-coded vertical tray risers that pass less than 2 feet from horizontal tray runs of different color coding, barriers are provided and as a minimum conform dimensionally to Figure 8.3-1.

Color-coded rigid metallic conduits in missile-producing areas have a 2-foot separation vertically and horizontally between conduits and trays having different color codings.

Rigid metallic conduits or metal-enclosed ducts in non-missile-producing areas have no minimum physical vertical or horizontal separation beyond that required by construction installation or access clearances between conduits and/or metal enclosed ducts of different color coding.

When encased in concrete, cables in a duct bank are vertically and/or horizontally separated from differently color-coded ducts and/or non-color-coded ducts by standard duct bank design separation.

Revision 5209/29/2016 NAPS UFSAR 8.3-24 Color-coded cables are not permitted to be direct buried.

Unit 1 color-coded cables are separated from Unit 2 color-coded cables in accordance with the general separation criteria contained in this section.

For example, Unit 1 orange cables not only are separated from other differently color-coded Unit 1 cables, but also are separated from Unit 2 color-coded cables, including Unit 2 orange color-coded cables.

Where cables are routed in free air to enter and exit raceways, the separation requirements are the same as required for cable trays. Where minimum physical separation cannot be achieved, barriers are used.

Sleeve separation criteria are as follows: sleeves that enter equipment are separated such that the minimum cable separation criteria detailed in the specification for that piece of equipment are met, or sleeves may be separated by a barrier. Sleeves that are used as intermediate raceway sections are separated such that the minimum separation is the more stringent separation requirement of the two ends of the sleeves. Where minimum physical separation cannot be achieved, barriers are used.

Criteria for separation in special areas are as follows: the open cable trench is a non-missile-producing area in the main control room. The open cable trench is defined as a non-color-coded raceway for the purposes of separation from any color-coded raceway running within the open cable trench. Where color coded trays run over non-color coded cable in the open cable trench, the barrier is installed in the color coded tray. Where cables are routed in free air space from raceways to the board rack or panel sillframe, the minimum separation is equivalent to requirements for separating trays in that area. The areas enclosed by control board or panel sillframes directly under the termination area are special non-missile-producing areas and are an extension of the control boards or panels. Where cables are routed in the free air space within the sillframe to a control board or a panel entrance location, the minimum separation is as stated in the specification for the respective equipment entered, or a barrier is used. Where cables are routed in the free air space within the sillframe, which is common to adjacent control boards or panels with different color codes, a barrier is provided as an extension of the separation partition between the adjacent panels for a distance required to meet the minimum separation in the specification for the equipment entered.

The areas enclosed above the panels top hat are considered an extension of the panels. The separation criterion in the top hat is in accordance with the separation required in the specification of the panel entered or barriers approved by the engineers.

Revision 5209/29/2016 NAPS UFSAR 8.3-25 Differently color-coded field run cables within equipment are separated from each other as outlined below.

1. Separation requirements in the equipment supplied by the nuclear steam supplier are 6 inches or as much as practicable.

2. Separation requirements in the balance-of-plant equipment are in accordance with the specification for the equipment, or by 6 inches if no specification requirements are stated, or a barrier is used.

All enclosures that have more than one field run color-coded cable within them are listed in Table 8.3-8 with the color codes per Table 8.3-5. The differently color-coded cables are separated in accordance with the above unless noted below.

There are certain conditions where the above separation instructions cannot be followed or would be impractical. These authorized exceptions are as follows:

1. Green (G) with orange (O) or purple (P) in Panels 1-EP-CB-28E and F and 2-EP-CB-28E and F. G cable does not have to be separated from O cable in 1-EP-CB-28E and 2-EP-CB-28E but does have to be separated from all other colors. G cable does not have to be separated from P cable in 1-EP-CB-28F and 2-EP-CB-28F but does have to be separated from all other colors. (In 2-EP-CB-28E and F Unit 1, G cable must be separated or barriered from all Unit 2 colors including Unit 2 G color-coded cable.) The single-failure criterion is not compromised since the signal is from a single nonsafety-related source and any failure of it, or any other associated electrical failure, will cause a safety action mode.

2. Orange (O) with red (R) in Enclosures 1-BY-C-02, 1-EI-CB-23A, 34, 63A, 301A, 1-EI-CP-04, 1-EP-CB-04A, 11N1, 13N1, 14N1, 32, 36, 41N1, 43N1, 80A, 80E, MOV-1590, 1591, 1592, 1593, 1594, 1595, RCPC&V19A, 19D, 19E and HH-14, and 2-BY-C-02, 1-VB-INV-01, 2-VB-INV-01, 2-EI-CB-23A, 34, 63A, 192A, 301A, 2-EI-CP-04, 2-EP-CB-04A, 12N1, 34, 37, 42N1, 43R1, 80A, 80E, MOV-2590, 2591, 2592, 2593, 2594, 2595, RCPC&V6B-2, 6C-2, 6D-2 and HH-2-2. O and R cables in the above enclosures do not have to be separated from each other, except for service class considerations, since they are integrally associated with each other and do not compromise the single-failure criterion.

3. Purple (P) with blue (B) in Enclosures 1-BY-C-05, 1-EI-CB-23C, 301B, 1-EI-CP-04, 1-EP-CB-04C, 01-VB-INV-03, 11R1, 13R1, 14R1, 31, 37, 41R1, 80C, 80G, RCPC&V8B and HH-15, and 2-EI-CP-04, 2-BY-C-05, 2-EI-CB-23C, 192B, 301B, 2-EP-CB-04C, 02-VB-INV-03, 12R1, 35, 36, 42R1, 80C, 80G, RCPC&V21B-2 and HH-1-2. P and B cables in the above enclosures do not have to be separated from each other, except for service class considerations, since they are integrally associated with each other and do not compromise the single-failure criterion.

4. Orange (O), red (R), and red/white (A), and white (W) and red/white (A) in Enclosures 1-EP-CB-12A and B, and 2-EP-CB-12A and B. O, R and A, and W and A cables in the

Revision 5209/29/2016 NAPS UFSAR 8.3-26 above enclosures do not have to be separated from one another since the A cable is electrically isolated from the other color-coded cables by a key interlock. Thus, the single-failure criterion is not compromised.

5. Purple (P), blue (B), and blue/yellow (T), and yellow (Y) and blue/yellow (T) in Enclosures 1-EP-CB-12C and D, and 2-EP-CB-12C and D. P, B and T, and Y and T cables in the above enclosures do not have to be separated from one another since the T cable is electrically isolated from the other color-coded cables by key interlock. Thus, the single-failure criterion is not compromised.

6. Green (G) and orange (O) and green (G) and purple (P) in Enclosures 1-EE-SS-01 and 02, and 2-EE-SS-01 and 02. G and O and G and P cables need not be separated in the above enclosures since there is no means of providing an electrical connection between the redundant buses. The breaker in 1-EE-SS-01 (2-EE-SS-01) has to be physically moved to 1-EE-SS-02 (2-EE-SS-02) to provide an electrical power source from the redundant bus. The moving of the breaker may only take place on total loss of the O system. Thus, the single-failure criterion is not compromised.

7. Green (G) and orange (O) and green (G) and purple (P) in Enclosures 1-EE-SW-01 and 02, and 2-EE-SW-01 and 02. G and O and G and P cables need not be separated in the above enclosures since there is no means of providing an uncontrolled electrical connection between the redundant buses. There is one area where the above occurs.

The swing backup devices selectively tied to either emergency bus as described previously are provided in accordance with Section 8.3.1.1, which describes the operation of the three pump motors. Thus, the single-failure criterion is not compromised.

8. Orange (O) and purple (P) in Enclosures 1-EI-CP-04, 1-EP-CB-28A, B, H, and J, and 2-EI-CP-04, 2-EP-CB-28A, B, H, and J. O and P cables have been separated and barriered as much as practicable. Areas where there is less than 6 inches of separation have been analyzed and it has been determined that the single-failure criterion is not compromised. In 1-EP-CB-28H Unit 2, O must be separated from all Unit 1 colors including O. In 1-EP-CB-28J Unit 2, P must be separated from all Unit 1 colors including P. In 2-EP-CB-28H Unit 1, O must be separated from all Unit 2 colors including O. In 2-EP-CB-28J Unit 1, P must be separated from all Unit 2 colors including P.

9. Red (R) and white (W), and blue (B) and yellow (Y) in Junction Boxes JB-009 and JB-010, and JB-009-2 and JB-010-2. R cable does not have to be separated from W cable in JB-009 and JB-009-2. B cable does not have to be separated from Y cable in JB-010 and JB-010-2.

The cables in the junction boxes are not redundant to each other; thus, they do not violate the single-failure criterion.

10. Orange (O) and white (W), and purple (P) and yellow (Y) in 1-BY-C-04 and 07, and 2-BY-C-04 and 07. O cable does not have to be separated from W cable in 1-BY-C-04,

Revision 5209/29/2016 NAPS UFSAR 8.3-27 2-BY-C-04, 1-VB-INV-02, and 2-VB-INV-02. P cable does not have to be separated from Y cable in 1-BY-C-07, 2-BY-C-07, and 02-VB-INV-04. These cables are integrally associated with each other and do not compromise the single-failure criterion.

11. Orange (O) and white (W) in RCPC/V-17C and 1-EP-CB-204, and purple (P) and yellow (Y) in RCPC/V-4C and 1-EP-CB-204. O cable does not have to be separated from W cable in RCPC/V-17C and 1-EP-CB-204. The cables are integrally associated with each other since the cables go to the SOVs for PCV-1455C. P cable does not have to be separated from Y cable in RCPC/V-4C, 01-VB-INV-04, and 1-EP-CB-204. The cables are integrally associated with each other since the cables go to the SOVs for PCV-1456. Therefore, these cables do not compromise the single-failure criterion.

12. Orange (O) and white (W) in RCPC/V-11D-2 and 2-EP-CB-204, and purple (P) and yellow (Y) in RCPC/V-21D-2 and 2-EP-CB-204. In panel 2-EP-CB-204, the O section and P section are separated by a barrier in the panel. O cable does not have to be separated from W cable in RCPC/V-11D-2 and 2-EP-CB-204. The cables are integrally associated with each other since the cables go to the SOVs for PCV-2455C. P cable does not have to be separated from Y cable in RCPC/V-21D-2 and 2-EP-CB-204. The cables are integrally associated with each other since the cables go to the SOVs for PCV-2456. Therefore, these cables do not compromise the single-failure criterion.

13. Orange (O), red (R), purple (P) and blue (B) in 1-EI-CB-49B, 2-EI-CB-49B, 1-EP-CP-219, and 2-EP-CB-219. O cable does not have to be separated from R cable and P cable does not have to be separated from B cable. It is required to have O and R cable separated from P and/or B cable in the above equipment. The O and R, and P and B are integrally associated with each other and do not compromise the single-failure criterion.

14. Red (R), white (W), blue (B) and yellow (Y) cables in Panel 1-EI-CB-159. These cables do not perform a safety-related function and are not redundant to each other. Therefore, the single-failure criterion does not apply and is not violated.

15. Orange (O), purple (P), red (R) and blue (B) in 1-EI-CP-04. O cable does not have to be separated from R cable, and P cable does not have to be separated from B cable. It is required to have O and R cable separated from P and/or B cable in the above equipment. The O and R, and P and B are integrally associated with each other and do not compromise the single-failure criterion.

16. Red (R) and blue (B) color-coded cable were routed in JB-5098 (TE-1453-1 and 2),

JB-5877-2 (TE-2453-1 and 2). The use of dual element RTD (TE-1453/2453) to provide redundant monitoring is acceptable because a fault in the RTD or in the common cable to the junction box would result in a loss of pressurizer liquid temperature indication which does not affect any present safety analysis. Since pressurizer liquid temperature channel is a nonsafety related channel, no credit has been taken for it in any accident analysis. A review has been made to determine if a short circuit in the common cable (either a ground fault or a

Revision 5209/29/2016 NAPS UFSAR 8.3-28 hot short between channels) would have any impact on any other existing circuits in the primary plant process rack. The investigation has determined that this would have no impact on existing circuits in the primary plant process rack.

17. During an Appendix R emergency, the backup containment telecommunications antenna system of one unit will be connected to the primary antenna system of the other unit. Neutral cables are routed with yellow cables of one unit and blue cables of the other unit. The acceptability of this situation is justified under Design Change DC 91-03-03.

The duct lines for reserve station service transformer C have a 2-foot minimum separation, and the overhead buses have a 20-foot minimum separation from transformers A and B so that any single duct line, manhole, overhead bus, or cable failure does not disable the entire system and at least one station transformer. The 4160V power control and protection system cables are similarly separated.

The nuclear instrumentation system (NIS) cables are run in rigid steel conduit. NIS conduit groups, color-coded red, white, blue, and yellow, have a minimum 2-foot separation between the differently color-coded conduits. A minimum of 2-foot separation is maintained between NIS conduits, power cables, or control rod drive mechanism cables. A minimum 6-foot separation is maintained between differently color-coded NIS cables at electrical penetrations.

The methods of fire detection and protection in the areas where cables are installed are described in Sections 8.3.1.1.2.6 and 9.5.1.

8.3.1.1.2.4 Criteria for Identifying Safety-Related Equipment. S a f e t y - r e l a t e d c a b l e a n d raceways are identified in the plant by the color coding scheme discussed in Sections 8.3.1.1.2.3, 8.3.1.2, and 8.3.2. During installation, the cable is marked every 20 to 25 feet with a single bank of appropriately colored tape. In addition, a permanent color marker with the cable alphanumeric code designation, which indicates, as described before, the unit number, system code, part code, color code, service class, and the cable number, is attached to the cable at each end after the cable has been permanently terminated at both ends.

A permanent colored marker tag or band without the alphanumeric code designation is attached wherever the cable passes from one type of raceway to another.

The color marker indicates to plant personnel that equipment and cabling is safety-related since only those components that are safety-related have color-coded feeders. There are seven basic color codes throughout the plant, as described in Section 8.3.1.1.2.3.

Revision 5209/29/2016 NAPS UFSAR 8.3-29 The following information is HISTORICAL and is not intended or expected to be updated for the life of the plant.

8.3.1.1.2.5 Cable Qualification Tests.

Stone & Webster Scope All cable for safety and safety-related services, whether inside or outside the containment, was purchased under particular specifications for the design-basis conditions of inside the containment.

The qualification test requirements under these specifications include the following tests.

1. Standard cable tests - these tests were covered by IPCEA S-19-81 and/or ASTM-B8, whichever is applicable for the cable construction.

2. Radiation resistance test - each cable sample was irradiated to the expected dose within the containment over a period of 40 years (3 x 107 rads) plus the maximum dose during a postulated accident condition, the sum of which was equivalent to 108 rads and did not show any significant change in the physical and electrical properties.

3. Nuclear incident qualification test - each cable sample should be capable of operating for not less than 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months when subjected to the following environmental conditions:

a. Temperature - 280°F; pressure - 45 psig.

b. Partial steam pressure - 49.2 psia.

c. Relative humidity - 100%.

In addition, the cable sample shall, subsequent to the transient conditions above, be capable of operating for 12 months when subjected to the environmental conditions of:

a. Temperature - 140°F; pressure 14.7 psia.

b. Relative humidity - 100%.

4. Cable tray fire propagation test - each cable sample should pass the following fire propagation test:

a. A metallic test tray, approximately 8 feet in length, should be arranged vertically, protected from drafts or winds, and loaded with one layer of cables allowing 1/2 of a cable diameter space between cables.

b. Crumpled burlap (24 by 24 inches, 9 oz/yd2) previously soaked with transformer insulating oil, was affixed approximately 12 inches above the lower cable ends and ignited and allowed to burn until the burlap igniter is consumed.

c. The cable sample was be considered satisfactory if:

1) A self-sustaining or propagating fire did not result.

2) Electrical integrity was not lost in less than 5 minutes after ignition.

3) Excessive smoke did not appear from cable sample after burlap is consumed.

Revision 5209/29/2016 NAPS UFSAR 8.3-30 The following information is HISTORICAL and is not intended or expected to be updated for the life of the plant.

4) Hot drippings of insulation did not result.

Any cable construction that did not pass all of the above qualification tests was rejected and not permitted for use within the containment on safety-related equipment.

Westinghouse Scope Westinghouse performed cable testing in a postaccident steam and chemical environment of 80 psig (maximum) and a temperature in excess of 300°F. The general appearance of the cables following these tests was good. Some loosening of the jacket from the insulation at the cable ends occurred, due to moisture getting under the insulation and then flashing to steam during the rapid decrease in pressure in the tests. Had the cable ends been prepared as field-made splices, this separation would have been prevented.

Tests were performed by the cable manufacturer in a steam environment of 214°F for 436 hours0.00505 days 0.121 hours 7.208995e-4 weeks 1.65898e-4 months . During this test, some cable was energized and was carrying current. A visual inspection following this test showed the cables to be in excellent condition. High voltage, tensile, elongation, and stretch showed insignificant changes in their characteristics.

Tests were also performed by the cable manufacturer where the specimens were exposed to a gamma radiation field of 2.8 x 107 rads followed by exposure in a steam atmosphere of 85 psig for two 30-minute cycles. Following these tests, the physical appearance of the cable was excellent. Changes in electrical characteristics were as follows:

1. Insulation resistance - 90% of original value.

2. Specific inductance (SIC) - no change.

3. Dissipation factor - change from 2.2 to 2.1%.

4. AC breakdown - 82% of original value.

In another test program, cables obtained from a nuclear construction site were tested.

These cables consisted of AWG No. 12 conductor control cable, AWG No. 4 single conductor power cable, and AWG No. 12 single conductor instrument cable.

The cables were thermally aged to an equivalent of 40 years followed by irradiation up to 2 x 108 rads, followed by steam exposure at 287°F and 60 psig and boric acid spray.

On the sixth day of the test, the 480V potential and the cable currents were reestablished.

From this point on, the potential and currents were reset each day to the desired values:

Potential = 480V, current through No. 4 conductors = 50A, current through cables with No. 12 conductors = 15A. The potential and currents were maintained for 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months each day, for a total of 16 days.

Revision 5209/29/2016 NAPS UFSAR 8.3-31 The following information is HISTORICAL and is not intended or expected to be updated for the life of the plant.

The results of the test program indicate that all except one sample withstood the postaccident environmental and electrical conditions to which they were subjected. The test sample that failed appeared to have shorted as a result of cable whipping adjacent to the rigid splice material during the steam injection phase.

8.3.1.1.2.6 Criteria for Fire Stops and Seals. Cables, cable trays, and conduits penetrate walls and floors through metal sleeves imbedded in the walls and floors or rectangular blockouts in the walls and floors. These sleeves and blockouts are sealed at all floor and wall penetrations between fire areas. In addition, all conduits penetrating walls or floors and terminating at a distance of up to 5 feet from such walls or floors are sealed. All conduits that penetrate the control room pressure envelope are sealed.

The seals perform two functions. The seals are designed to have a fire rating equal to the fire rating of the wall or floor in which installed and to provide the necessary pressure seal where required (i.e., the seals in walls and floors surrounding the main control area).

In addition, the seals are designed (1) to permit future addition and removal of cables, (2) for ease of installation, (3) to permit uniform quality, and (4) for compatibility with cable jacket materials.

Installed cables are specified to meet, as a minimum, the fire propagation test outlined in IEEE 383 or, for some cables, UL 910 (NFPA 262 in conjunction with the National Electric Code), when the cable is to be used for applications involving non-safety-related equipment and non-Appendix R equipment. The UL 910 test is considered an acceptable alternative to the IEEE 383 fire propagation test.

Since the cables are designed not to propagate flame, no intermediate fire stops in raceways are installed except at the cable penetrations through walls and floors between fire areas and in the vertical cable tray risers found in the reactor containment.

The fire stops found in all vertical cable tray risers in the reactor containment were installed such that a continuous vertical riser that may have more than one raceway identification number was considered to be one riser for purposes of installing fire stops (i.e., 1TK11ON (17-foot riser) and 1TK111N (2-foot riser) was considered to be one 19-foot riser). Cable trays that have

Revision 5209/29/2016 NAPS UFSAR 8.3-32 portions of their routing installed vertically have fire stops installed in the vertical sections only, if applicable as described herein.

1. Cable Penetration Area In the area located between Elevation 259 ft. 6 in. and Elevation 291 ft. 10 in. and between column 9 and column 7. Fire stops were installed at midheight for risers between 10 and 30 feet or at no greater than 15-foot intervals for risers more than 30-foot high.

2. Outside of Cable Penetration Area Vertical risers in these have fire stops installed at each floor/ceiling level (on the floor side) and between levels, fire stops were installed at no greater than 30-foot intervals.

Dow Corning Q3-6548 RTV Silicone Foam is used for the fire stops and for the penetration seals. The foam may be used in conjunction with Johns Manville Cerafiber, Cerablanket, or their equal as the permanent damming material, or in conjunction with temporary damming materials which are removed.

The combination of foam and permanent damming materials has been successfully tested by VEPCO for a 3-hour fire resistance rating. Penetration seals which do not use permanent damming materials have been successfully tested by Dow Corning for a three hour fire resistance rating.

Procedures regarding silicone foamed penetration seals have been developed. These procedures described all preinstallation, installation, and postinstallation quality control checks to ensure properly installed seals.

When Dow Corning foam (DCF) was installed as a penetration sealant for fire barrier penetrations at North Anna Power Station, very little data existed on the aging effects on the DCF fire protection properties. Due to this lack of data, forty-eight samples of DCF material were prepared in 1976 and stored within the normal plant environment for the purpose of studying the effects aging has on the foam material.

The samples of Dow Corning silicone foam were stored in two locations at the station:

Unit 1 cable tray room and the Auxiliary Building. After a ten-year waiting period, the samples were analyzed in 1986, 1991, and 1996, to determine if any shrinkage had taken place or if its ability to withstand flame had been affected. Laboratory measurements indicated that the shrinkage stopped and its ability to withstand flame had not been affected. Therefore, no further testing will be performed. The results of the testing are contained in Technical Report No. EE-0109, Dow Corning Foam Analysis Five-Year Evaluation of Aging Effects, North Anna Power Station.

Detailed procedures for resealing breached seals have been developed. These procedures require that breached seals be resealed in a timely manner following the completion of removing or adding cables. Station procedures require that compensatory measures be imposed during

Revision 5209/29/2016 NAPS UFSAR 8.3-33 periods when seals have been breached. The procedures ensure that the resealing provides the original integrity of the seal.

Sample penetration seal inspections to identify open or deteriorated seals are performed on an annual basis (20% per year).

The cable used throughout the plant is fire retardant and, therefore, fire hazards in areas of electrical cable concentrations are minimized. The cable vaults and tunnels have smoke detectors for alarm and carbon dioxide extinguishing systems activated by temperature detectors. The control room has smoke detectors in the air inlets and the subfloor for alarm and Halon-1301 extinguishing system in the subfloor activated by temperature, except directly under cabinets that are barriered from the remainder of the subfloor area. Fires in these cabinets would be extinguished manually with carbon dioxide extinguishers.

8.3.1.2 Vital Alternating Current Power System The vital ac power system provides a highly reliable source of 120V ac for safety-related instruments and equipment.

8.3.1.2.1 Description The vital ac power system is shown in Reference Drawing 12. It consists of four separate vital bus panels, each fed independently from an associated 125V dc/120V ac, single-phase static inverter. Each inverters output is rated at 120V ac and 60 Hz.

The inverters are normally powered from the station battery chargers via the 125V dc system. In the event station ac power is lost, each inverter is automatically fed from its associated station battery without disturbing the vital bus voltage or frequency. Each inverter has a dedicated Class 1E bypass transformer, a static transfer switch and a manual transfer switch to supply an alternate source of power to the vital bus.

Voltage regulating transformers fed from 480V ac emergency buses are provided to supply a nominal 120V ac to vital bus panels in the event either panels respective inverter fails or is undergoing maintenance. For this reason, manual bypass switches or static transfer switches are provided to transfer the load of vital bus panels from the inverters to the voltage regulating transformers. The vital bus panels 1-I and 1-III supply 120V ac power to the safety system trains A and B, respectively. All four vital bus panels 1-I, 1-II, 1-III, and 1-IV supply 120V ac power to the safety system channels I, II, III, and IV, respectively. The loads for each vital bus panel are shown in Reference Drawing 12.

Unit 1 supplies power to Unit 1 instruments and equipment and certain Unit 2 instruments that are required following fires that cause the loss of the Unit 2 Emergency Power System, in accordance with 10 CFR 50 Appendix R (Section 9.5.1). Channel 1 of the Unit 2 Excore Neutron Flux Monitor System is normally supplied from Unit 2 vital bus panel 2-I via a transfer switch in the Unit 1 Emergency Switchgear Room. This transfer switch allows the power source to be

Revision 5209/29/2016 NAPS UFSAR 8.3-34 shifted to a Unit 2 Appendix R distribution panel which is powered from the Unit 1 vital bus system. The same Appendix R panel also supplies power to the Unit 2 indicators on auxiliary monitoring panel 1-EI-CB-203 in the Fuel Building. The Unit 2 Emergency Power System supplies power to Unit 1 indicators in a similar manner. (See Section 7.7.1.13.2.)

Vital ac power system monitoring equipment is provided in the main control room.

Voltmeters are provided for monitoring the vital bus voltage through isolating transducers mounted in each vital bus panel. Annunciation of inverter trouble to input under voltage, output under voltage, synchronization failure, or input ground detection on each inverter is provided.

The Vital AC buses are equipped with normally open back feed breakers and an electrical connection which can be powered by a portable generator during a Beyond Design Basis Event.

In accordance with the NRC Safety Evaluation Report for License Amendments 235 and 217, dated May 12, 2004, the following compensatory measures will be implemented when an instrument bus inverter is unavailable:

1. Entry into the extended inverter Completion Time of Required Action A.1 of Technical Specification 3.8.7, InvertersOperating will not be planned concurrent with emergency diesel generator maintenance.

2. Entry into the extended inverter Completion Time of Required Action A.1 of Technical Specification 3.8.7, InvertersOperating will not be planned concurrent with planned maintenance on another Reactor Protection System/Engineered Safeguards Feature Actuation System channel that results in that channel being in a tripped condition.

Each inverter is equipped with output voltage, current, and frequency meters.

8.3.1.2.2 Analysis 8.3.1.2.2.1 Compliance with AEC General Design Criteria. In accordance with Criterion 17, the vital power system has sufficient capacity to supply vital equipment necessary for safe operation and shutdown of the reactor while maintaining the acceptable fuel design limits and containment integrity.

The system also has independence and redundancy of components to ensure the performance of safety functions despite a single failure.

The individual components are protected and separated from each other to reduce the probability of simultaneous malfunction during a design basis accident or a loss-of-power condition.

In accordance with Criterion 18 and Regulatory Guide 1.22, the vital power system status is continuously displayed and periodically checked. It is designed to allow periodic testing of the system and individual components with the testing usually performed during reactor refueling so

Revision 5209/29/2016 NAPS UFSAR 8.3-35 as not to interrupt power generation. The individual channels or trains may be checked during operation without affecting the total system.

8.3.1.2.2.2 Compliance with NRC Safety Guides. In accordance with Safety Guide 6, the vital power system is separated into redundant and independent components so that loss of one component will not jeopardize the safety functions performed by the other components.

8.3.1.2.2.3 Compliance with IEEE Standards 336 and 344. The vital power system equipment was inspected and tested from the time of manufacturing to the start-up of the entire plant by VEPCOs agent. Inspection provided assurance of first-rate quality of equipment and included, but was not limited to, checks for dimensions, part identification, correct wiring, cleaning and packaging for shipment, and installation. The tests performed and witnessed included standard factory tests and special tests when specified. After installation, the system and individual components were completely checked out to ensure completeness and correctness of the system.

The system was then energized and checked out again as further proof of completeness of the system and its components.

Additional details on quality assurance and seismic requirements are in Section 3.10.2 and Chapter 17 of the original FSAR.

8.3.1.2.2.4 Criteria for Vital Cable and Raceway Routing, Designation, and Identification. F o r a general description of cable and raceway routing, designation, and identification refer to Section 8.3.1.1.2.3.

Specific information on color coding applicable only to the vital power systems for North Anna Units 1 and 2 is as follows:

Vital Bus Vital Bus Unit 1 Unit 2 Bus Source Bus Service Codes 1-I 2-I Red (R) Orange (O), red (R) and Non Coded (N) 1-II 2-II White (W) White (W) and Non Coded (N) 1-III 2-III Blue (B) Purple (P), blue (B) and Non Coded (N) 1-IV 2-IV Yellow (Y) Yellow (Y) and Non Coded (N)

The cables that are color coded purple and blue may be in the same cabinet and the blue/yellow may be to either a blue or yellow piece of equipment as outlined in Section 8.3.1.1.2.3. Orange & red and orange & white color-coded cable may be run in the 1-I (2-I) and 1-II (2-II) inverter cabinets respectively since they are integrally associated as outlined in Section 8.3.1.1.2.3. Purple & blue and purple & yellow color-coded cable may be run in 1-III (2-III) and 1-IV (2-IV) inverter cabinets respectively since they are integrally associated as outlined in Section 8.3.1.1.2.3.

Revision 5209/29/2016 NAPS UFSAR 8.3-36 8.3.2 Direct Current Power System The dc power system is rated at 125V to provide a highly reliable source of power for the operation of vital safety and non-safety-related equipment necessary for the proper and safe operation of the station, as well as safe reactor shutdown under all postulated accident conditions.

8.3.2.1 Description The principal equipment for the 125V dc system for Unit 1 is shown in Reference Drawing 13. The 125V dc system for Unit 2 is identical to that of Unit 1 and is completely independent.

The 125V dc system for Unit 1 consists of six battery chargers (two of which are spares),

four 60-cell lead calcium batteries, and four battery distribution switchboards.

The system is divided into four channels, each operating independently of the other. The channels are identified by Roman numeral I, II, III, or IV. All equipment assigned to the same channel has the same Roman numeral.

Each battery consists of 60 series-connected cells, ungrounded and designed for continuous duty. The individual cells are of the sealed type, arranged two cells per clear plastic container, with covers bonded in place to form a leakproof seal. Each cell has one hydrometer reading tube built in and located in diagonal corners of the container. Each battery cell is designed to be earthquake resistant. The batteries are mounted on earthquake-resistant racks for security and to facilitate maintenance.

Each battery charger has a maximum continuous output current of 250A with an input of 460 +/- 10% V ac, three phase. Each charger is equipped with a dc voltmeter and ammeter, ground detection, and alternating current failure relays.

Each battery distribution switchboard is NEMA Class II metal clad, with a 2500A, two-wire ungrounded main bus, and two-pole, manually operated air circuit breakers. Each switchboard is provided with a noninterrupting ground-testing system for those loads being fed from breakers rated at 100A or less. Each switchboard provides the interconnection of the respective battery charger and battery to their particular loads.

Batteries are contained in separate missile-protected battery rooms. All rooms are located in the service building, as shown in Reference Drawings 17 and 18. Batteries 1-I and 1-III are located at Elevation 294 ft. 0 in. and batteries 1-II and 1-IV are located at Elevation 254 ft. 0 in.

The batteries are connected by separate conduit and duct routes to their respective distribution switchboards.

The 125V dc distribution switchboards 1-I and 1-III supply 125V dc power to the safety system trains A and B, respectively. Each dc switchboard supplies 125V dc to its respective vital bus inverter. The vital bus system is discussed in further detail in Section 8.3.1.2.

Revision 5209/29/2016 NAPS UFSAR 8.3-37 The loads for each dc distribution switchboard are shown in Reference Drawing 13.

Battery chargers 1-I, 1-II, and 1C-I are powered from 480V ac emergency bus 1H; battery chargers 1-III, 1-IV, and 1C-II are powered from 480V ac emergency bus 1J. Charger 1C-I provides backup service for charger 1-I or 1-II in the event that either is out of service. Key interlocked circuit breakers are provided on switchboards 1-I and 1-II to ensure against the connection of charger 1C-I to both switchboards simultaneously. Charger 1C-II operates identically to charger 1C-I in providing backup service for chargers 1-III and 1-IV.

The 125V dc system is ungrounded. Two lamps are provided on each distribution switchboard and main control board for ground detection indicating. A ground-testing system for loads fed from breakers rated at 100A or less is also provided.

The dc system status is continuously displayed in the main control room and a periodic visual check is made of the equipment. Each battery distribution switchboard is provided with an isolating transducer that feeds a battery voltage recorder in the main control room. In addition, voltmeters are provided on the main board to indicate switchboard voltage. A condition of high output voltage, low supply voltage, low output current, low output voltage, or ground fault of a particular battery charger will activate an alarm on the main control room board annunciator.

During normal operation, the 125V dc load is fed from the battery chargers with the batteries floating on the system. On loss of normal power to the battery chargers, the dc load is automatically fed from the station batteries. Each battery is rated and designed to operate all required loads for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , after which standby generation power will be available to energize the battery chargers.

The diesel generators have their own separate and independent batteries, chargers, and distribution panels and are described in detail in Section 8.3.1.

The battery rooms are continuously ventilated to reduce the accumulation of hydrogen gas that is emitted during charging and discharging. The maximum hydrogen generation occurs during overcharging, and since hydrogen is highly combustible, the possibility of a fire must be considered. The ventilation system in the battery room is designed to maintain the hydrogen concentration well below 2% volume hydrogen concentration. Twenty-four hours of overcharge with the fire dampers shut and the room essentially airtight would result in a hydrogen concentration in the room of less than 1.75%. The threshold concentration for ignition is 4% and considering that the room is ventilated continuously and all materials are fire resistant, the likelihood of a fire is virtually negligible. Flow switches are installed in the ventilation ducts and provide an alarm to the control room on loss-of-air flow to the battery rooms.

Revision 5209/29/2016 NAPS UFSAR 8.3-38 The consequences of a battery explosion is limited to the incapacitation of only that battery since:

1. Each battery is located in a separate closed room designed to criteria indicated on Table 3.2-1.

2. The amount of combustible materials within any one battery room is minimal.

3. The ventilation systems for each of the battery rooms is independent and isolable.

The probability of a battery explosion is minimal because of the type of battery construction and accessories, such as sparkproof vents. However, if a battery explosion should occur, it would be contained within its room. Any fire that might ensue following the explosion will be contained within the room by automatic operation of fire dampers. Smoke detectors are provided to alert the station operating personnel so that the ventilation system for that room can be shut down.

8.3.2.2 Analysis 8.3.2.2.1 Compliance with NRC General Design Criteria In accordance with Criterion 17, the 125V dc system, consisting of batteries, battery chargers, and dc distribution switchboards, is of a capacity that one channel provides highly reliable 125V dc power for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to provide for the safe shutdown of the reactor during postulated accidents in the event there is a loss of power. The redundant batteries are separated from each other in missile-protected rooms, and their chargers are separated and fed from two separate emergency buses, H and J. The switchboard circuits are redundant to each other so that a single failure of the battery will not disable any of the safety functions that are required. The redundancy includes breaker control power from board I to the H bus breakers and from board III to the J bus breakers. The boards also feed redundant dc distribution panels. The I channel is associated with train A, and the III channel is associated with train B. The 125V dc channels are designed to perform independent of each other to ensure proper actuation in the event of a single failure.

In accordance with Criterion 18 and Regulatory Guide 1.22, the 125V dc system is tested periodically in addition to its status being displayed continuously from the main control room. A periodic check of the individual pieces of equipment is made, and the indicators on the equipment reveal any trouble that may be encountered.

The batteries are subject to periodic inspection and test as required by the Technical Specifications. The battery test allows the testing of alarms for the charger and the battery. Test jacks allow for the testing of the branch circuits to alleviate grounds on the system without interrupting power to the equipment being checked.

Revision 5209/29/2016 NAPS UFSAR 8.3-39 8.3.2.2.2 Compliance with NRC Safety Guides In accordance with Safety Guide 6, the battery system has no automatic connection between redundant dc load groups. Two batteries share one backup charger, but the connecting breakers for the backup charger are key interlocked to avoid simultaneous closing. Both breakers are normally open and are manually operated. The backup charger may be used in place of either one of the normal chargers, but not both of the normal chargers due to the key interlock. The separation of redundant loads is provided by concrete walls, individual cable trays, or conduits. The design of the system eliminates any possibility of a single failure disrupting power to vital sources.

8.3.2.2.3 Compliance with IEEE Standards In accordance with IEEE 308-1971, the 125V dc system is redundant and separated, as previously stated. The chargers are capable of charging the batteries from the maximum discharged condition to full charge in 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months while supplying the normal or emergency steady-state loads. The chargers are internally protected from a feedback surge from the batteries resulting from internal damage or loss of ac power.

In accordance with IEEE 336 and 344-1971, the 125V dc system, consisting of all components, was checked and tested many times from the time of manufacturing to start-up of the entire plant by VEPCOs agent. The checks were to ensure first-rate quality of the equipment and included checks of dimensions, performance, cleaning, packaging for shipment, and installation.

The tests on the chargers that were performed and witnessed included a 24-hour test at float and equalizing voltage, performance tests that included dielectric, a circuit operation test, a no-load test, a current limit, a ripple voltage measurement, voltage regulation, and seismic tests. The test on the batteries included 5-hour discharge at the 5-hour rate for each cell for batteries 1-I, 1-II, 1-III, 1-IV, 2-I, 2-II, and 2-III, and a 2-hour discharge at the 2-hour rate for battery 2-IV and a duty cycle test on three randomly picked cells. All equipment was inspected and documentation concerning the equipment from start to completion of the power station was prepared. In the event of a malfunction or discrepancy with the equipment or installation, the equipment was held until the defect was corrected and the equipment proven to have been in compliance with standards.

Additional details are in Section 3.10.2 and Chapter 17 of the original FSAR.

8.3.2.2.4 Criteria for Direct Current Cable and Raceway Routing, Designation, and Identification A general description of cable and raceway routing, designation, and identification is in Section 8.3.1.1.2.3.

Revision 5209/29/2016 NAPS UFSAR 8.3-40 Specific information on color coding applicable only to the 125V dc power system is as follows:

DC Switchboard Designations Power Source Codes Service Codes Unit 1 Unit 2 Battery Charger Battery 1-I 2-I Orange (O) Red (R) Orange (O), red (R), and noncoded (N) 1-II 2-II Orange (O) White (W) White (W) and noncoded (N) 1-III 2-III Purple (P) Blue (B) Purple (P), blue (B), and noncoded (N) 1-IV 2-IV Purple (P) Yellow (Y) Yellow (Y) and noncoded (N)

Battery charger (C-I), which is powered from the orange train, can supply either dc bus I or II via red/white (A) secondary cables. Similarly, battery charger (C-II), which is powered from the purple train, can supply either dc bus III or IV via blue/yellow (T) secondary cables. Unit 2 is arranged similarly.

8.3 REFERENCES

1. Safety-Related Electrical Schematics, North Anna Power Station, Units 1 and 2, NA-TR-1001.

2. Fast Starting Diesel Generator for Nuclear Plant Protection, IEEE Paper No. G9CP177 -

PWR.

3. Criteria Specification for Design and Identification of Electrical Cable, NAS-3012.

4. Test for Flame-Propagation and Smoke-Density Values for Electrical and Optical-Fibre Cables Used in Spaces Transporting Environmental Air, Underwriters Laboratories (UL) 910, Fifth Edition.

8.3 REFERENCE DRAWINGS The list of Station Drawings below is provided for information only. The referenced drawings are not part of the UFSAR. This is not intended to be a complete listing of all Station Drawings referenced from this section of the UFSAR. The contents of Station Drawings are controlled by station procedure.

Drawing Number Description

1. 11715-FE-1A Main One Line Diagram, Unit 1 12050-FE-1A Main One Line Diagram, Unit 2

Revision 5209/29/2016 NAPS UFSAR 8.3-41