ML17334A173

Amendment 1 to Updated Safety Analysis Report, Chapter 8, Electric Power (Redacted)

ML17334A173
Person / Time
Site:	Watts Bar
Issue date:	11/02/2017
From:	Tennessee Valley Authority
To:	Office of Nuclear Reactor Regulation
Shared Package
ML17334A154	List: ML17334A156 ML17334A157 ML17334A158 ML17334A159 ML17334A160 ML17334A162 ML17334A163 ML17334A164 ML17334A165 ML17334A169 ML17334A170 ML17334A172 ML17334A173 ML17334A177
References
Download: ML17334A173 (251)

Text

WBN TABLE OF CONTENTS Section Title Page 8.0 ELECTRIC POWER 8.1-1

8.1 INTRODUCTION

8.1-1 8.1.1 Utility Grid and Interconnections 8.1-1 8.1.2 Plant Electrical Power System 8.1-1 8.1.3 Safety-Related Loads 8.1-3 8.1.4 Design Bases 8.1-3 8.1.5 Design Criteria and Standards 8.1-4 8.1.5.1 Design Criteria 8.1-5 8.1.5.2 Other Standards and Guides 8.1-5 8.1.5.3 Compliance to Regulatory Guides and IEEE Standards 8.1-7 References 8.1-16 8.2 OFFSITE (PREFERRED) POWER SYSTEM 8.2-1 8.2.1 Description 8.2-1 8.2.1.1 Preferred Power Supply 8.2-2 8.2.1.2 Transmission Lines, Switchyard, and Transformers 8.2-4 8.2.1.3 Arrangement of the Start Boards, Unit Boards, Common Boards, and Reactor Coolant Pump (RCP) Boards 8.2-5 8.2.1.4 Arrangement of Electrical Control Area (Nuclear Plant) 8.2-6 8.2.1.5 Switchyard Control and Relaying 8.2-6 8.2.1.6 6.9-kV Start Boards Control and Relaying 8.2-9 8.2.1.7 6.9-kV Unit and RCP Board Control and Relaying 8.2-13 8.2.1.8 Conformance with Standards 8.2-13 8.2.2 Analysis 8.2-20 References 8.2-23 8.3 ONSITE (STANDBY) POWER SYSTEM 8.3-1 8.3.1 A.C. Power System 8.3-1 8.3.1.1 Description 8.3-1 8.3.1.2 Analysis 8.3-26 8.3.1.2.1 Standby A.C. Power Systems 8.3-26 8.3.1.2.2 Analysis of Vital 120-Volt A.C. Control Power Systems A.C. Distribution Boards and Inverters 8.3-29 8.3.1.2.3 Safety-Related Equipment in a LOCA Environment 8.3-31 8.3.1.3 Physical Identification of Safety-Related Equipment in A.C. Power Systems 8.3-36 8.3.1.4 Independence of Redundant A.C. Power Systems 8.3-37 8.3.1.4.1 Cable Derating and Raceway Fill 8.3-38 8.3.1.4.2 Cable Routing and Separation Criteria 8.3-39 8.3.1.4.3 Sharing of Cable Trays and Routing of Non- Safety-Related Cables 8.3-47 8-i

WBN LIST OF TABLES Number Title 8.3.1.4.4 Fire Detection and Protection in Areas Where Cables are Installed 8.3-51 8.3.1.4.5 Cable and Cable Tray Markings 8.3-51 8.3.1.4.6 Spacing of Power and Control Wiring and Components Comprising the Class 1E Electrical Systems in Controls Boards, Panels, and Relay Racks 8.3-53 8.3.1.4.7 Fire Barriers and Separation Between Redundant Trays 8.3-53 8.3.2 D.C. Power System 8.3-53 8.3.2.1 Description 8.3-53 8.3.2.1.1 Vital 125V D.C. Control Power System 8.3-53 8.3.2.1.2 Non-Safety-Related D.C. Power Systems 8.3-61 8.3.2.2 Analysis of Vital 125-Volt D.C. Control Power Supply System 8.3-62 8.3.2.3 Physical Identification of Safety-Related Equipment in D.C.

Power Systems 8.3-67 8.3.2.4 Independence of Redundant D.C. Power Systems 8.3-67 8.3.3 Fire Protection for Cable Systems 8.3-68 References 8.3-68 Appendix 8A Analysis of Submerged Electrical Equipment (During Post LOCA)

Powered from Auxiliary Power System Appendix 8B Analysis of Submerged Electrical Equipment (During Post LOCA)

Powered from Instrumentation and Control Power System Appendix 8C Probability/Reliability Analysis of Protection Device Schemes for Associated and Non-Class 1E Cables 8-ii

WBN LIST OF TABLES Number Title 8.1-1 Safety Loads and Functions 8.1-2 Electrical Penetration Assembly Short-Circuit Capability 8.2-1 Common Station Service Transformer (CSST) Loading 8.3-1 Safety-Related Standby (Onsite) Power Sources and Distribution Boards 8.3-2 Shutdown Board Loads Automatically Tripped Following A Loss of Preferred (Offsite) Power 8.3-3 Diesel Generator Load Sequentially Applied Following A Loss of Preferred (Offsite) Power 8.3-4 Unit 1 Power Train A Board Loading 8.3-5 Unit 1 Power Train B Board Loading 8.3-6 Unit 2 Power Train A Board Loading 8.3-7 Unit 2 Power Train B Board Loading 8.3-8 Shutdown Transformer Loading 8.3-9 D.C. Control Power for Safety-Related Standby (Onsite) Power Distribution Boards 8.3-10 Components Having Manual Transfer Between Power Divisions 8.3-11 120V A.C. Vital Instrument Power Board Load Data 8.3-12 125 VDC Vital Battery Capacity Data 8.3-13 Vital 125V D.C. Battery Loss Concurrent with Loss of Offsite Power 8.3-14 Major Electrical Equipment that Could Become Submerged Following a LOCA 8-iii

WBN LIST OF FIGURES Number Title 8.1-1 SERC - 2 TVA Transmission System 8.1-2 Key Diagram Station Aux. Power System 8.1-2a Key Diagram Station Aux. Power System 8.1-2b General Transformer Taps & Voltage Limits Aux. Power Sys.

8.1-3 Key Diagram 120V A.C. and 125V D.C. Vital Plant Control Power System 8.2-1 Powerhouse Units 1 and 2 Wiring Diagram Development Single Line 8.2-1a Hydro and Steam Power Stations Wiring Diagrams Development Single Line 8.2-1b Control Building Switchboards 250V D.C. Battery Boards 8.2-1c Wiring Diagrams D.C. Battery Circuits Single Line 8.2-2 500 and 161kV Transmission Arrangement 8.2-3 Switchyard Electrical Equipment General Arrangement Plan 8.2-4 Deleted 8.2-5 Electrical Equipment Com and Unit Sta. Serv. and RCP 6900V Buses 8.2-5a Powerhouse Unit 1 15kV, 2000A, 3P, 3W Tube Type Duct 8.2-6 Deleted 8.2-7 Control Building Units 1 and 2 Electrical Equipment Electrical Control Area Plan - EL.

755.0 8.2 10 Deleted 8.2-11 Control Building Units 1 and 2 Electrical Equipment Battery and D.C. Eqpt. Room Plans, Sections and Details 8.2-12 Wiring Diagram, 250-Volt Battery System, Single Line 8.2-13 Powerhouse Units 1 and 2 Wiring Diagrams 250 Volt Battery System Single Line 8.3-1 Diesel Generator Building Equipment Plans and Sections 8.3-1A Additional Diesel Generator Building Equipment Plans and Sections 8.3-2 Control, Auxiliary, and Reactor Bldg. Units 1 and 2 Electrical Equipment General Arrangement Plan EL. 729.0, 772.0, and Section 8-iv

WBN LIST OF FIGURES Number Title 8.3-3 Control and Auxiliary Building Units 1 and 2 Electrical Equipment General Arrangement EL. 713.0, 757.0 8.3-4 Diesel Generator Building Electrical Equipment 480V Diesel Auxiliary Boards Plans and Sections 8.3-5 Powerhouse Units 1 and 2 Wiring Diagrams 6900V Shutdown Power Schematic Diagram 8.3-5a Second Level Voltage Protection 8.3-6 Auxiliary Building Unit 1 Wiring Diagrams 6900V Shutdown Power 1A-A Schematic Diagrams 8.3-7 Auxiliary Building Unit 1 Wiring Diagrams 6900V Shutdown Power 1A-A Schematic Diagrams 8.3-8 Auxiliary Building Unit 1 Wiring Diagrams 6900V Shutdown Power 1B-B Schematic Diagrams 8.3-9 Auxiliary Building Unit 1 Wiring Diagrams 6900V Shutdown Power 1B-B Schematic Diagrams 8.3-10 Auxiliary Building Unit 1 and 2 Wiring Diagrams 6900V Shutdown Power 2A-A Schematic Diagrams 8.3-11 Auxiliary Building Unit 1 and 2 Wiring Diagrams 6900V Shutdown Power 2A-A Schematic Diagrams 8.3-12 Auxiliary Building Unit 1 and 2 Wiring Diagrams 6900V Shutdown Power 2B-B Schematic Diagrams 8.3-13 Auxiliary Building Unit 1 and 2 Wiring Diagrams 6900V Shutdown Power 2B-B Schematic Diagrams 8.3-14A Deleted 8.3-14B Auxiliary Building Units 1 and 2 Wiring Diagrams 6900V Standby Dsl. Gen.

Schematic Diagram 8.3-14C Diesel Generator Building Units 1 and 2 Wiring Diagrams 6900V Standby Dsl. Gen.

Schematic Diagram (DG 1B-B) 8.3-14D Diesel Generator Building Unit 1 Wiring Diagrams 6900V Standby Dsl. Gen.

Schematic Diagram (DG 2A-A) 8.3-14E Diesel Generator Building Unit 1 Wiring Diagrams 6900V Standby Dsl. Gen.

Schematic Diagram (DG 2B-B) 8-v

WBN LIST OF FIGURES Number Title 8.3-15 Auxiliary Building Units 1 and 2 Wiring Diagram 480V Aux. Bldg. Common BD Single Line 8.3-16 Auxiliary Building Units 1 and 2 Wiring Diagrams 6900V Shutdown Board 1A-A Single Line 8.3-17 Auxiliary Building Units 1 and 2 Wiring Diagrams 6900V Shutdown Board 1B-B Single Line 8.3-18 Auxiliary Building Units 1 and 2 Wiring Diagrams 6900V Shutdown Board 2A-A Single Line 8.3-19 Auxiliary Building Units 1 and 2 Wiring Diagrams 6900V Shutdown Board 2B-B Single Line 8.3-20 Auxiliary Bldg. Unit 1 Wiring Diagrams 480V Shutdown BD 1A1-A Single Line 8.3-20 Sh A Auxiliary Bldg. Unit 1 Wiring Diagrams 480V Shutdown BD 2A1-A Single Line 8.3-21 Auxiliary Bldg. Unit 1 Wiring Diagrams 480V Shutdown BD 1A2-A Single Line 8.3-21A Auxiliary Bldg. Unit 2 Wiring Diagrams 480V Shutdown BD 2A2-A Single Line 8.3-22 Auxiliary Bldg. Unit 1 Wiring Diagrams 480V Shutdown BD 1B1-B Single Line 8.3-22 Sh A Auxiliary Bldg. Unit 1 Wiring Diagrams 480V Shutdown BD 2B1-B Single Line 8.3-23 Auxiliary Bldg. Unit 1 Wiring Diagrams 480V Shutdown Board 1B2-B Single Line 8.3-23A Auxiliary Bldg. Unit 2 Wiring Diagrams 480V Shutdown BD 2B2-B Single Line 8.3-24 Diesel Gen. Bldg. Units 1 and 2 Wiring Diagrams 6900V Diesel Generators Single Line 8.3-25A Deleted 8.3-25B Diesel Generator Building Unit 1 Wiring Diagrams Standby Dsl. Gen. Schematic Diagram (DG 1A-A) 8.3-25C Diesel Generator Building Unit 1 Wiring Diagrams Standby Dsl. Gen. Schematic Diagram (DG 1B-B) 8.3-25D Diesel Generator Building Unit 1 Wiring Diagrams Standby Dsl. Gen. Schematic Diagram (DG 2A-A) 8.3-25E Diesel Generator Building Unit 1 Wiring Diagrams Standby Dsl. Gen. Schematic Diagram (DG 2B-B) 8-vi

WBN LIST OF FIGURES Number Title 8.3-26A Deleted 8.3-26B Diesel Generator Building Unit 1 Wiring Diagrams Standby Dsl. Gen. Schematic Diagram (DG 1A-A) 8.3-26C Diesel Generator Building Unit 1 Wiring Diagrams Standby Dsl. Gen. Schematic Diagram (DG 1B-B) 8.3-26D Diesel Generator Building Unit 1 Wiring Diagrams Standby Dsl. Gen. Schematic Diagram (DG 2A-A) 8.3-26E Diesel Generator Building Unit 1 Wiring Diagrams Standby Dsl. Gen. Schematic Diagram (DG 2B-B) 8.3-27A Deleted 8.3-27B Diesel Generator Building Unit 1 Wiring Diagrams Standby Dsl. Gen. Schematic Diagram (DG 1A-A) 8.3-27C Diesel Generator Building Unit 1 Wiring Diagrams Standby Dsl. Gen. Schematic Diagram (DG 1B-B) 8.3-27D Diesel Generator Building Unit 1 Wiring Diagrams Standby Dsl. Gen. Schematic Diagram (DG 2A-A) 8.3-27E Diesel Generator Building Unit 1 Wiring Diagrams Standby Dsl. Gen. Schematic Diagram (DG 2B-B) 8.3-28A Deleted 8.3-28B Diesel Generator Building Unit 1 and 2 Wiring Diagrams Standby Dsl. Gen.

Schematic Diagram (DG 1A-A) 8.3-28C Diesel Generator Building Unit 1 Wiring Diagrams Standby Dsl. Gen. Schematic Diagram (DG 1B-B) 8.3-28D Diesel Generator Building Unit 1 Wiring Diagrams Standby Dsl. Gen. Schematic Diagram (DG 2A-A) 8.3-28E Diesel Generator Building Unit 1 Wiring Diagrams Standby Dsl. Gen. Schematic Diagram (DG 2B-B) 8.3-29A Deleted 8.3-29B Diesel Generator Building Unit 1 Wiring Diagrams Standby Diesel. Generator Schematic Diagram (DG 1A-A) 8.3-29C Diesel Generator Building Unit 1 Wiring Diagrams Standby Diesel. Generator Schematic Diagram (DG 1B-B) 8-vii

WBN LIST OF FIGURES Number Title 8.3-29D Diesel Generator Building Unit 1 Wiring Diagrams Standby Diesel. Generator Schematic Diagram (DG 2A-A) 8.3-29E Diesel Generator Building Unit 1 Wiring Diagrams Standby Diesel. Generator Schematic Diagram (DG 2B-B) 8.3-30 Diesel Generator Building Units 1 and 2 Wiring Diagrams 480V Diesel. Auxiliary. BD 1A1-A and 2A1-A Single Lines 8.3-31 Additional Diesel Generator Building Units 1 and 2 Wiring Diagrams 480V Diesel.

Auxiliary. BD 1A2-A and 2A2-A Single Line 8.3-32 Diesel Building Units 1 and 2 Wiring Diagrams Fuel Oil System Schematic Diagram 8.3-33 Diesel Generator Building Unit 1 Wiring Diagram Standby Diesel. Generator System Schematic Diagram (DG 1A-A) 8.3-33A Diesel Generator Building Unit 1 Wiring Diagram Standby Diesel Generator System Schematic Diagram (DG 1B-B) 8.3-33B Diesel Generator Building Unit 1 Wiring Diagram Standby Diesel Generator System Schematic Diagram (DG 2A-A) 8.3-33C Diesel Generator Building Unit Wiring Diagram Standby Diesel Generator System Schematic Diagram (DG 2B-B) 8.3-34 Diesel Generator Building Unit 1 Wiring Diagrams Standby Diesel Generator System Schematic Diagram (DG 1B-B) 8.3-34A Diesel Generator Building Unit 1 Wiring Diagram Standby Diesel Generator System Schematic Diagram (DG 1B-B) 8.3-34B Diesel Generator Building Unit 1 Wiring Diagram Standby Diesel Generator System Schematic Diagram (DG 2A-A) 8.3-34C Diesel Generator Building Unit 1 Wiring Diagram Standby Diesel Generator System Schematic Diagram (DG 2B-B) 8.3-35 Auxiliary and Diesel Generator Building Units 1 and 2 Wiring Diagrams Essential Raw Cooling Water System. Schematic Diagram 8.3-36 Auxiliary Building Units 1 and 2 Electrical Equipment Battery and D.C. Equipment.

Rooms Plans, Sections and Details 8.3-37 Powerhouse Units 1 and 2 Wiring Diagram 120V A.C. Vital Inst. Power. BDS 1-I and 2-I Connection Diagram 8.3-38 Powerhouse Units 1 and 2 Wiring Diagram 120V A.C. Vital Inst. Power. BDS 1-II and 2-II Connection Diagram 8-viii

WBN LIST OF FIGURES Number Title 8.3-39 Powerhouse Units 1 and 2 Wiring Diagram 120V Vital Inst. Power. BDS 1-III and 2-III Connection Diagram 8.3-40 Powerhouse Units 1 and 2 Wiring Diagram 120V A.C. Vital Inst. Power. BDS 1-IV and 2-IV Connection Diagrams 8.3-41 Deleted 8.3-42 Deleted 8.3-43 Deleted 8.3-44 Powerhouse Reactor Building - Unit 1 Conduit and Grounding Floor EL 702.78 Details 8.3-45 Powerhouse Reactor Building Unit 2 Conduit and Grounding EL 702.78 Details 8.3-46 Diesel Generator Building Electrical Equipment General Arrangement EL. 742.0, 760.5 8.3-47 Powerhouse Units 1 and 2 Wiring Diagrams 125V Vital Battery BD I Single Line 8.3-48 Powerhouse Units 1 and 2 Wiring Diagrams 125V Vital Battery BD II Single Line 8.3-49 Deleted 8.3-50 Powerhouse Units 1 and 2 Wiring Diagrams 125V Vital Battery BD IV Single Line 8.3 54 Deleted 8.3-55 Schematic Diagram DC Distribution Panel 8.3-56 Powerhouse Units 1 and 2 Wiring Diagrams 125V Vital Battery BD V Single Line 8.3-57 Auxiliary Building Units 1 and 2 Electrical Equipment 125V Vital Battery V - EL 772.0 8.3-58 Deleted 8.3-59 Yard Diesel Generator Building Architectural Plans and Details 8-ix

WBN 8.0 ELECTRIC POWER

8.1 INTRODUCTION

8.1.1 Utility Grid and Interconnections The Tennessee Valley Authority (TVA) is a corporation of the United States Government serving the State of Tennessee and parts of six other States in the southeast on the boundaries of Tennessee. TVA is interconnected with electric power companies to the north, west, south, and east of its service area. As shown in Figure 8.1-1, the TVA grid consists of interconnected hydro plants, fossil-fueled plants, combustion turbine plants, and nuclear plants supplying electric energy over a transmission system consisting of various voltages up to 500 kV.

The Watts Bar Nuclear Plant is located 48 miles northeast of Chattanooga, Tennessee, on the west bank of the Tennessee River. The plant is connected into a strong 500kV transmission grid. The 500kV Switchyard is a double breaker - double bus configuration. Both units and five 500kV transmission lines can be connected to either or both buses through a 500kV breaker.

Preferred power is supplied from the existing Watts Bar Hydro 161kV Switchyard over two radial lines located entirely on TVA property. The Watts Bar Hydro 161kV Switchyard is interconnected with the TVA power system through six 161kV transmission lines and five hydro generators.

8.1.2 Plant Electrical Power System The plant electric power system consists of the main generators, the unit station service transformers, the common station service transformers, the diesel generators, the batteries, and the electric distribution system as shown on Figures 8.1-2, 8.1-2A, 8.1-2B, and 8.1-3.

Under normal operating conditions, the main generators supply electrical power through isolated-phase buses to the main step-up transformers and through the unit station service transformers (located adjacent to the Turbine Building) to the non-safety auxiliary power system. Offsite electrical power normally supplies Class 1E circuits through the 161-kV system via Common Station Service Transformers (CSSTs) C and D. Alternatively, offsite power to the Class 1E system can also be supplied through CSSTs B or A, but not both simultaneously, if the normal CSST is unavailable. The primaries of the unit station service transformers are connected to the isolated-phase bus at a point between the generator terminals and the low-voltage connection of the main transformers. During normal operation, station auxiliary power is taken from the main generator through the unit station service transformers and from the 161-kV system through the common station service transformers. During startup and shutdown, all auxiliary power is supplied from the 161-kV system through CSSTs A, B, C and D. The standby (onsite) power is supplied by four diesel generators. Capability is also provided to supply the Class 1E circuits through the 161kV system via CSST A or B in the event CSST D or C, respectively, is unavailable.

8.1-1

WBN The safety objective for the power system is to furnish adequate electric power to ensure that safety related loads function in conformance with design criteria and design bases. Major loads on the electric power system having assigned safety related functions are shown in Table 8.1-1.

The safety objective has been accomplished by: (1) establishing design criteria and bases that conform to regulatory documents and accepted design practice, and (2) implementation of these criteria and bases in a manner that assures a system design and a constructed plant which satisfies all safety requirements. The applicable documents governing the design are shown in Section 8.1.5.

Figures 8.1-2 and 8.1-2A depict the plant distribution system that receives ac power from:

(a) The two nuclear power units.

(b) The two independent preferred (offsite) power circuits, which have access to the TVA transmission network, and in turn have multiple interties with other transmission networks.

(c) The four 4400kW diesel generator standby (onsite) power sources.

The power received from the above sources is distributed to both safety related and non-safety related loads in the plant.

The safety related loads are arranged electrically into four power trains, two for each nuclear unit. Power trains 1A and 2A comprise load group A. Power trains 1B and 2B comprise load group B. Two diesel generators and one load group can provide all safety related functions to mitigate a LOCA in one unit and safely shutdown the other unit. Each power train of each unit has access to a diesel generator (standby source) and each of the two preferred offsite sources.

Figure 8.1-3 depicts the vital ac and dc control power distribution systems that connect four 125V batteries, four battery chargers and eight 120V ac uninterruptable power systems (UPS) with their respective safety related loads and non safety related loads. The 125V dc distribution system is a safety related system which receives power from four independent battery chargers and four 125V dc batteries and distributes it to safety related loads and non-safety related loads of both units. The 120V ac distribution system receives power from eight independent UPSs and distributes it to the safety related and non-safety related loads. These systems are described in Sections 8.2 and 8.3.

8.1-2

WBN 8.1.3 Safety-Related Loads Major loads requiring electric power to perform their safety related function are listed in Table 8.1-1.

8.1.4 Design Bases The design bases for the electric power system are listed below.

Offsite (Preferred) Power System

1. Each of the two offsite power circuits has sufficient capacity, is continuously energized, and is available to supply the plant safety loads following a loss of coolant accident (LOCA) to assure that core cooling, containment integrity, and other vital safety functions are maintained.

2. The two offsite power circuits are designed to be physically independent so as to minimize the likelihood of their simultaneous failure under operating and postulated accident and environmental conditions. The two offsite power circuits do share the Watts Bar Hydro 161kV switchyard which is permitted by GDC 17.

Onsite (Standby) Power Systems

1. The onsite power systems are designed to provide sufficient capacity to assure that acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded as a result of anticipated operational occurrences. Further, these systems provide sufficient capacity to ensure that the core is cooled and containment integrity and other vital functions are maintained in the event of postulated accidents in one unit and to safely shutdown the other unit.

2. The onsite power systems are capable of performing their safety functions assuming a single failure.

3. The onsite power systems are located within Category I structures so that they are protected from natural phenomena.

4. The onsite power systems are designed to perform their safety function considering the effects of the following events:

a. postulated accident environment

b. fires

c. accident-generated missiles

d. fire protection system operation

e. accident-generated flooding, sprays, or jets

f. single act, event, component, failure, or circuit fault that could cause multiple equipment malfunctions.

8.1-3

WBN

g. Loss of all offsite power or loss of all offsite power concurrent with a LOCA.

5. The onsite power systems are designed to permit appropriate surveillance, periodic inspections, and testing of important areas and features to assess the continuity of the systems and the condition of their component.

6. The onsite standby ac power sources are designed to be automatically initiated in the event of an accident signal or a loss of offsite power.

7. The vital batteries have adequate capacity for a period of 30 minutes, without chargers, to provide the necessary dc power to perform the required safety functions in the event of a postulated accident in one unit and to safely shutdown the other unit, assuming a single failure.

8. The vital batteries have adequate capacity for a period of two hours for an Appendix R scenario, or four hours for a station blackout event to provide the necessary dc power to maintain both reactors at hot shutdown, assuming the loss of all ac power sources.

Load shedding of non-required loads may be performed to achieve the four hour coping duration for blackout conditions.

9. The vital battery chargers have adequate capacity to simultaneously supply the combined demands of the steady-state loads and to restore the battery from the design discharge state to the design charged state within an acceptable time interval irrespective of status of plant during which the demands occur.

8.1.5 Design Criteria and Standards Although the design of the electric power system for the Watts Bar Nuclear Plant preceded the publication of several of the standards and regulatory guides referenced below, the design meets the intent of those standards and guides.

8.1.5.1 Design Criteria

1. IEEE Std 279-1971, IEEE Standard Criteria for Protection Systems for Nuclear Power Generating Stations.

2. IEEE Std 308-1971, IEEE Standard Criteria for Class 1E Electric Systems for Nuclear Power Generating Stations.

3. Criterion Nos. 1, 2, 3, 4, 5, 17, and 18, AEC General Design Criteria for Nuclear Power Plants (10 CFR 50, Appendix A, July 7, 1971).

4. AEC Quality Assurance Criteria for Nuclear Power Plants (10 CFR 50, Appendix B, June 26, 1971).

8.1.5.2 Other Standards and Guides

1. IEEE Std. 317-1976, IEEE Standard for Electrical Penetration Assemblies in Containment Structures for Nuclear Fueled Power Generating Stations.

8.1-4

WBN

2. ANSI C84.1-1970, Voltage Ratings for Electric Power Systems and Equipment (60 Hz)

3. IPCEA P-46-426, Power Cable Ampacities, Vol 1 - Copper Conductors.

4. ANSI C37.1-1962, Relays Associated with Power Switchgear.

5. ANSI Standards for Power Circuit Breakers.

a) ANSI C37.4-1953, Alternating-Current Power Circuit Breakers.

b) ANSI C37.5-1969, Methods for Determining Values of a Sinusoidal Current Wave, Normal-Frequency Recovery voltage, and a Guide for Calculation of Fault Currents for Application of AC High-Voltage Circuit Breakers Rated on Total Current Basis.

c) ANSI C37.6-1971, Schedules of Preferred Ratings for AC High-Voltage Circuit Breakers Rated on a Total Current Basis.

d) ANSI C37.7-1960, Interrupting Rating Factors for Reclosing Service Power Circuit Breakers.

e) ANSI C37.8-1952, Rated Control Voltages and Their Ranges for Power Circuit Breakers.

f) ANSI C37.9-1953, Test Code for Power Circuit Breakers g) ANSI C37.11-1972, Requirements for Electrical Control for AC High-Voltage Breakers Rated on a Symmetrical Current Basis.

h) ANSI C37.12-1969, Guide Specifications for AC Power Circuit Breakers.

i) ANSI C37.03-1964, Definitions for AC High-Voltage Circuit Breakers.

j) ANSI C37.10-1964, Application Guide for AC High-Voltage Circuit Breakers.

k) ANSI C37.13-1963 (R1969), Low-Voltage AC Power Circuit Breakers.

6. ANSI C37.19-1963, Low-Voltage a.c. Power Circuit Breakers and Switchgear Assemblies.

7. ANSI C37.20-1969 (C37.20-1974*), Switchgear Assemblies and Metal-Enclosed Bus.

• Revision of standard applies to fifth vital battery system.

8. ANSI C57, Transformers, Regulators, and Reactors.

a) ANSI C57.12-1968, Test Codes for Distribution, Power and Regulating Transformers, and Shunt Reactors.

b) ANSI C57.10-1969, Requirements for Transformers 67,000 Volts and Below, 501 through 5,000 KVA Single Phase, 501 through 10,000 KVA Three Phase.

8.1-5

WBN c) ANSI C57.102-1958, (IEEE 76-1958), Acceptance and Maintenance of Transformer Askarel in Equipment.

d) ANSI C57.13-1968, Requirements for Instrument Transformers.

e) ANSI C57.92-1962, Guide for Loading Mineral-Oil -Immersed Power Transformers.

9. NEMA AB-1-1964 (AB1-1975*), Molded-Case Circuit Breakers

• Revision of standard applies to fifth vital battery system.

10. NEMA EI-2-1966, Instrument Transformers

11. NEMA SG3-1965, Low-Voltage Power Circuit Breakers

12. NEMA SG4-1965, High-Voltage Power Circuit Breakers

13. NEMA SG5-1967, Power Switchgear Assemblies

14. NEMA SG6-1960, Power Switching Equipment

15. NEMA TR1-1971, Transformers, Regulators, and Reactors

16. NEMA MG1-1967, Motors and Generators

17. ICEA S-61-402, NEMA WC5 Thermoplastic-Insulated Wire and Cable for the

[1,2]

Transmission and Distribution of Electrical Energy.

18. IPCEA S-56-434, Polyethylene-Insulated Thermoplastic-Jacketed Communication Cables

19. ICEA S-66-524, NEMA WC7 Cross-linked-Thermosetting-Polyethylene Insulated Wire

[1,2]

and Cable for the Transmission and Distribution of Electrical Energy.

20. NFPA No. 78-1971, Lightning Protection Code

21. ICEA S-19-81, NEMA WC3 Rubber-Insulated Wire and Cable for the Transmission and Distribution of Electrical Energy. Specific references herein are from the fifth edition

[1,2]

dated July 1969.

22. ICEA S-28-357, NEMA WC1-1963, American National Standards Institute Requirements for Asbestos, Asbestos-Varnished Cloth, and Asbestos- Thermoplastic Insulated Wires

[1,2]

and Cable (C8.36-1962).

23. ICEA S-68-516, NEMA WC8-1976, Ethylene-Propylene-Rubber-Insulated Wire and

[1,2]

Cable for the Transmission and Distribution of Electrical Energy.

24. NRC IE Circular No. 81-13, "Torque Switch Electrical Bypass Circuit for Safeguard Service Water Valve Motors."

The torque switch bypass feature reflected in this IE Circular is implemented within the Watts Bar design by wiring the control circuits in all active valves as follows:

8.1-6

WBN

1) For MOVs which are required to open as part of their safety function, the opening torque switch will be removed from the control circuit by removing connecting wires from the torque switch or by installation of a permanent electrical bypass.

2) The closing torque switch on all position-seated valves whose safety function is to close will be removed from the control circuit by removing the connecting wires from the torque switch or by installing a permanent electrical bypass.

3) The closing torque switch on all torque-seated valves whose safety function is to close will be bypassed during travel by a position limit switch, allowing the torque switch to open the control circuit only on seating. (The list of the active motor-operated valves which require torque switch bypass is identified in WBN calculation, "Selection Criteria for MOVs Requiring Thermal Overload Bypass," WBN-OSG4-095).

25. ICEA P-54-440, Ampacities Cables in Open-Top Cable Trays, and National Electrical Code, NFPA-70-1987 (See Electrical Design Standard DS-E12.6.3)

26. ANSI C37.40-1969, "IEEE Standard Service Conditions and Definitions for High-Voltage Fuses, Distribution Enclosed Single-Pole Air Switches, Fuse Disconnecting Switches, and Accessories."

27. ANSI C37.90-1972, "Relays and Relay Systems Associated with Electric Power Apparatus."

8.1.5.3 Compliance to Regulatory Guides and IEEE Standards The extent to which the recommendations of the applicable NRC regulatory guides and the IEEE standards are followed for electrical power systems are shown below. The symbol (F) indicates full compliance. Those which require further clarification or are not fully implemented are discussed in the footnotes as indicated.

Regulatory Guide 1.6 (Safety Guide 6), Revision 0 "Independence Between Redundant Standby (Onsite) Power Sources and Between Their Distribution Systems." (F)

Regulatory Guide 1.9, Revision 3, "Selection, Design, Qualification, and Testing of Emergency Diesel Generator Units used as Class 1E Onsite Electrical Power Systems at Nuclear Power Plants." (5)

Regulatory Guide 1.22 (Safety Guide 22), Revision 0, "Periodic Testing of Protection System Actuation Functions." (F) [Note 2 of Table 7.1-1]

Regulatory Guide 1.29, Revision 0, "Seismic Design Classification." (F) 8.1-7

WBN Regulatory Guide 1.30 (Safety Guide 30), Revision 0, "Quality Assurance Requirements for the Installation, Inspection and Testing of Instrumentation and Electric Equipment." (See Chapter 17, Section 17.1)

Regulatory Guide 1.32 (Safety Guide 32), Revision 0, "Use of IEEE Std 308-1971," "Criteria for Class 1E Electric Systems for Nuclear Power Generating Stations." (F)

Regulatory Guide 1.40, Revision 0, "Qualification Tests of Continuous Duty Motors Installed Inside the Containment of Water-Cooled Nuclear Power Plants." (F)

Regulatory Guide 1.41, Revision 0, "Preoperational Testing of Redundant Onsite Electric Power Systems to Verify Proper Load Group Assignments." (F)

Regulatory Guide 1.47, Revision 0, "Bypassed and Inoperable Status Indication for Nuclear Power Plant Safety Systems." (F) (8)

Regulatory Guide 1.53, Revision 0, "Application of the Single-Failure Criterion to Nuclear Power Plant Protection Systems." (F) [Note 3 of Table 7.1-1]

Regulatory Guide 1.62, Revision 0, "Manual initiation of Protective Actions. (F)

Regulatory Guide 1.63, Revision 2, "Electric Penetration Assemblies in Containment Structures for Water-Cooled Nuclear Power Plants." (F) (1)

Regulatory Guide 1.73, Revision 0, "Qualification Tests of Electric Valve Operators Installed Inside the Containment of Nuclear Power Plants." (F)

Regulatory Guide 1.75, Revision 0, "Physical Independence of Electric Systems." (2)

Regulatory Guide 1.81, Shared emergency and shutdown Electric Systems for Multi-Unit Nuclear Power Plants. (3)

Regulatory Guide 1.89, Revision 1, "Environmental Qualification of Certain Electrical Equipment Important to Safety for Nuclear Power Plants." (3) (Only applicable to equipment within the scope of 10 CFR 50.49)

Regulatory Guide 1.93, Revision 0, "Availability of Electric Power Sources. (F)

Regulatory Guide 1.100, Revision 0, "Seismic Qualification of Electric Equipment for Nuclear Power Plants." (4)

Regulatory Guide 1.106, Rev. 1, "Thermal Overload Protection for Electric Motors on Motor Operated Valves." (9)

Regulatory Guide 1.108, withdrawn by NRC - August 1993.

Regulatory Guide 1.118, Rev. 2, "Periodic Testing of the Electric Power and Protection Systems." (6), (See Section 7.1, Table 7.1-1, Note 11 for I&C systems)

IEEE Trial-Use Std 338-1971, "Criteria for the Periodic Testing of Nuclear Power Generating Station Protection Systems." (F) 8.1-8

WBN IEEE Std 338-1977, "Criteria for the Periodic Testing of Nuclear Power Generating Station Protection Systems." (6), (See Section 7.1, Table 7.1-1, Note 11 for I&C Systems)

IEEE Std 344-1971, "Guide for Seismic Qualification of Class 1E Equipment for Nuclear Power Generating Stations." (F)

IEEE Std 387-1984, "Criteria for Diesel Generator Units Applied as Standby Power Supplies for Nuclear Power Stations." (See Appendix 8D).

IEEE Std. 450-1980, "IEEE Recommended Practice for Maintenance, Testing, and Replacement of Large Lead Storage Batteries for Generating Stations and Substations." (10)

IEEE Std. 484-1975, "IEEE Recommended Practice for Installation Design and Installation of Large Lead Storage Batteries for Generating Stations and Substations." (7)

IEEE Std. 485-1978, "IEEE Recommended Practice for Sizing Large Lead Storage Batteries for Generating Stations and Substations." (7)

IEEE Std. 535-1979, "IEEE Standard for Qualification of Class 1E Lead Storage Batteries for Nuclear Power Generating Stations." (7)

Notes:

1. Regulatory Guide 1.63 Position C.1 Full Compliance: The electric penetrations have been designed to maintain mechanical integrity for the maximum short circuit current that could occur and the time duration required for the backup protective device to operate. A redundant overcurrent protection system is provided for all penetrations except instrumentation circuits where fault current is not a problem.

The only 6.9kV circuit feeding loads inside the containment are for the reactor coolant pumps (RCP). The breaker used for control of the RCPs is backed up by a second breaker to provide the redundant over-current protection system required by RG 1.63.

The breakers are each provided with independent dc control power from different batteries so that failure of either battery will not violate the single failure criteria. Provisions for testing are described below.

The 480V load center circuits have a low voltage power circuit breaker backed up by a current limiting fuse. The penetration withstands the available fault current vs. time duration for the load center breaker and fuse. The breakers have direct acting trips and are independent of control power. The fuse is located in the cable termination compartment of the load center bolted to the breaker cable terminal.

8.1-9

WBN The 480V motor control center (MCC)-circuits have a molded case circuit breaker backed up by a fuse. The penetration withstands the available fault current vs. time duration for the breaker and fuse. Molded case breakers have direct acting trips.

Low voltage control circuits have a molded case breaker backed up by a fuse or a fuse backed up by a fuse. The penetration withstands the available fault current vs. time duration for the breaker and fuse. The molded case breakers have direct acting trips.

The energy levels in the instrument systems are sufficiently low so that no damage can occur to the containment penetration.

Table 8.1-2 lists the parameters that show the capability of each typical penetration to withstand without loss of mechanical integrity, the maximum fault current vs. time condition that could occur as a result of a single random failure of the primary overload protection. Thus, the single failure criterion of IEEE 279 is met.

In addition to the single failure criterion of IEEE 279, the following requirements of IEEE Std. 279 are met as follows:

Testability: The overcurrent protection system provided for 6900V penetration circuits include drawn out-type relays which are field testable using manufacturer provided test sets or TVA test sets to simulate fault currents following established procedures. Low voltage power circuit breakers and molded case circuit breakers are field tested using test sets built by Multiamp Corporation or equal. Testing is done by simulating fault current following established procedures.

8.1-10

WBN Periodic resistance measurement is not practical for containment penetration conductor overcurrent protection fuses. Resistance verification is performed as one of the final steps in the manufacturing process, assuring proper construction and rating.

Manufacturers do not publish this baseline data since construction changes are made based on design and material improvements.

Because of this, no baseline data would be available if periodic resistance measurements were performed. Routine removal of fuses for testing is not prudent according to the manufacturer.

Routine removal can result in damaging of the fuse holder and contact points. Fuse manufacturers have also stated that the protective characteristics of fuses do not deteriorate with service life. Service temperatures above the rated temperature, current surges, and unusual cycling conditions reduce the fuses' service life, i.e., the fuse becomes more protective. Under no conditions will a fuse become less protective during its service life. In lieu of field testing by resistance, inspection of fuses and their holders will be performed in accordance with TVAs fuse control procedure each time fuses are manipulated to ensure: (1) that the proper size fuse is installed, (2) that the fuse shows no sign of deteriorations, (3) that the fuse connections are tight and clean.

(See IEEE Std 242-1975, Recommended Practice for Protection and Coordination of Industrial and Commercial Power Systems).

Should a problem be identified during inspection or should a problem arise with a specific brand or model of fuse, necessary corrective actions should be initiated through the plants Corrective Action Program.

Penetration protective devices in 480V circuits energized during plant operation are mounted in either motor control centers, Class 1E low voltage switchgear, or panel boards. Both Class 1E and non-Class 1E motor control centers are ITE Imperial Corporation series 5600 supplied under the same contract. All 480V non-Class 1E distribution equipment that houses penetration protective devices are located in the same seismic structure as Class 1E distribution equipment. Equipment bought to Class 1E standards is qualified to operate both during and after an operating basis earthquake (OBE) or a safe shutdown earthquake (SSE) The non-Class 1E motor control centers supplied under the same contract as Class 1E are manufactured using the same materials and components which results in the same high degree of operational reliability during an OBE.

8.1-11

WBN Position C.2 Full Compliance: X/R ratios in excess of 8.0 were used in the qualification tests for low voltage penetrations and were in excess of 15 for the medium voltage penetrations..

Position C.3 Full Compliance: The duration times used in the qualification tests exceeded those required by IEEE Std. 317-1976 and RG 1.63.

Position C.4 Full Compliance: The basic impulse test voltage used in qualification test for the medium voltage penetration was 1.2 x 50 micro-second test. The test consisted of a full wave test series of three positive and three negative waves.

Position C.5 Full Compliance: Aging tests in excess of 5000 hours0.0579 days <br />1.389 hours <br />0.00827 weeks <br />0.0019 months <br /> have been run on all non-metallic materials to establish Arrhenius curves.

Position C.6 N/A Position C.7 N/A 2A. Regulatory Guide 1.75 was issued after the Watts Bar design was complete.

Separations criteria for WBNP are given in Section 8.3.1.4.2.

2B. Regulatory Guide 1.81 RI (Position C.1)

The design of the WBNP 125V vital dc system and the construction permit application were made before June 1, 1973. The design, as a minimum, meets the requirements of position 3 of the subject regulatory guide as follows: The system is capable of supplying minimum ESF loads and the loads required for attaining a safe and orderly shutdown of the unit assuming a single failure and loss of offsite power. The ESF output relays and their trained loads that require power to operate, are assigned as follows:

(1) Unit 1 A train - 125V dc Vital Battery I, 120V a.c. Vital UPS 1-I.

(2) Unit 1 B train - 125V dc Vital Battery II, 120V a.c. Vital UPS 1-II.

(3) Unit 2 A train - 125V dc Vital Battery III, 120V a.c. Vital UPS 2-III.

(4) Unit 2 B train - 125V dc Vital Battery IV, 120V a.c. Vital UPS 2-IV.

The 120-volt a.c. vital instrument power is supplied by four UPS units per unit. They furnish power for the four-channel reactor protection system (RPS) input relays. The relays fail safe, (i.e., actuate reactor protection system (RPS) signal, on a loss of power) thus a single failure and/or a loss of offsite power does not prevent the safe and orderly shutdown of either unit.

Some plant common loads are supplied from unit 1, channels I and II and other plant common loads are supplied from Unit 2. In no case does the sharing inhibit the safe shutdown of one unit while the other unit is experiencing an accident. All shared systems are sized to carry all credible combinations of normal and accident loads.

8.1-12

WBN (Position C.2)

(a) Watts Bar is a two-unit plant.

(b) With a single failure (loss of a battery or loss of a diesel generator) in the plant and an assumed loss of offsite power, sufficient ESF loads are still automatically available to the accident unit and to safely shutdown the remaining unit. The shared safety systems are designed so that one load group (Train 1A & 2A or Train 1B & 2B) can mitigate a design basis accident in one unit and accomplish an orderly shutdown of the other unit.

For these events, electric motors driving equipment in the shared systems are connected without regard to which unit has initiated the accident signal. Therefore, a spurious accident signal in the non-accident unit concurrent with an accident in the other unit will not cause a standby power supply (Diesel generator or vital battery) to be overloaded.

(c) The most severe DBE is an accident in one unit with a loss of offsite power.

Sufficient diesel generator (DG) power is available to attain a safe and orderly shutdown of both units with the loss of one DG unit. Assuming the loss of offsite power and a design bases accident in one unit, on division of ESF equipment can be used to bring the plant to a safe and orderly cold shutdown. Therefore, the safe shutdown could be achieved with the complete failure of a power train in one unit or even with the complete failure of the same power train (-A or -B) in both units.

(d) The DG units and the onsite distribution system are arranged in two redundant trains per unit. Due to the shared ESF system 9example: ERCW), only one of the redundant power trains per plant can be taken out for maintenance or tested at a time.

(e) No interface of the unit operators is required to meet position 2.b. and 2.c.

(f) Control and status indication for the DG units is provided on a central control board (Panel 0-M-26) available to both unit operators. DC system status (volts, current, etc.)

is provided on a unit basis.

(g) The recommendation of Regulatory Guide 1.6, 1.9 except as discussed note 7, and 1.47 are met.

(Position C.3)

(h) The construction permit for WBNP was issued before June 1, 1973.

3. Regulatory Guide 1.89, Revision 1, endorses methodology for equipment qualification in accordance with 10 CFR 50.49. For details of Watts Bar environmental qualification of Class 1E equipment see Reference [1] of Section 3.11.

4. Regulatory Guide 1.100 Rev. 0 reflects the requirements of IEEE Std. 344-1975.

Although Watts Bar Nuclear Plant Class 1E equipment was seismically qualified to IEEE Std. 344-1971, the qualification procedures are consistent with the requirements of IEEE Std. 344-1975.

5. Since Regulatory Guide 1.9 has been revised, the following information defines the 8.1-13

WBN degree of conformance with Regulatory Guide 1.9 R3 for the design bases listed in Section 8.1.4.

Position C.0 WBN meets the intent of IEEE 387-1984 Position C1.1 Full compliance Position C1.2 Full compliance Position C1.3 Does not comply - Revision 2 of RG 1.9 Position C2 required the predicted loads not to exceed the short time rating. This position has required the predicted loads not to exceed the continuous rating. WBN diesel generators load assignment was based on the RG 1.9 R2 limit.

Position C1.4 Full compliance Position C1.5 Full compliance Position C1.6 Full compliance Position C1.7.1 Full compliance Position C1.7.2 Does not comply - Although a first-out surveillance system is not installed for the DG system at WBN, DG protective trips such as differential overcurrent have been provided with targets to indicate which protective device operated. In addition, the status of protective devices installed to shutdown the DG for generator or engine trouble is alarmed in the MCR. Where more than one protective device function group is operated, the information is fed to the MCR computer/display which would provide the information as to which group operated first.

Position C1.8 Full compliance Position C2.2.1 Full compliance Position C2.2.2 Full compliance Position C2.2.3 Full compliance Position C2.2.4 Full compliance Position C2.2.5 WBN meets the intent of this position. The diesel generators associated with the nuclear unit affected by the SI event are started by 1E circuits. However, the starting of the diesel generators of the non-SI unit is implemented with a non-1E circuit (common start circuit). The intent of this position is to have all the DGs started in case there is a loss of off-site power (LOOP).

WBN meets this precautionary requirement with the common start circuit. In the event of a LOOP, the 1E LOOP circuits also start 8.1-14

WBN the DGs, independent of the common start circuit.

Position C2.2.6 Does not fully comply. The design basis at WBN is a simultaneous LOOP/LOCA, not LOOP followed by LOCA.

Although there are some design features to meet the effects of LOOP followed by LOCA, there is no analysis to demonstrate the design will meet the DG voltage and frequency requirements.

Position C2.2.7 Full compliance Position C2.2.8 Full compliance Position C2.2.9 Full compliance Position C2.2.10 Full compliance Position C2.2.11 Full compliance Position C2.2.12 Full compliance Position C2.2.13 Full compliance Position C2.2.14 Full compliance Position C2.3.1 Full compliance with the exceptions identified by C2.2.5 and C2.2.6 Position C2.3.2 Full compliance, with exception that Technical Specification SR 3.8.1.21, developed and approved for initial plant licensing, eliminates the requirement to perform the ten-year independence testing during a plant shutdown.

Position C3 Full compliance Position C4 Full compliance

6. The Watts Bar design complies with all of the positions of Regulatory Guide 1.118, Rev.

2 for electrical power systems except as follows:

Position C.6(a) - Where feasible test switches or other necessary equipment will be installed permanently to minimize the use of temporary jumpers in testing in accordance with the requirements in IEEE Standard 338-1977.

7. Full compliance for Fifth Vital Battery Only.

8. WBN is in full compliance with the intent of RG 1.47 (BISI) Rev. 0.

8.1-15

WBN

9. The Watts Bar Design complies with Position C.1(b) of Regulatory Guide 1.106 R1 except as follows:

Position C.1(b) requires bypass of the thermal overload (TOL) contacts of all safety-related motor-operated valves (MOVs) during accident conditions. TVA will bypass the TOL contacts of all active valves (valves required to perform a mechanical function after a safety injection (SI) signal). Since active valves are the only ones required to change position to shutdown the reactor or to mitigate the effects of a design basis event, they are the only MOVs requiring this assurance of position change. (The list of the active motor-operated valves which require TOL bypass are identified in WBN Calculation, "Selection Criteria for MOVs Requiring Thermal Overload Bypass," WBN-OSG4-095.).

10. For Unit 1, full compliance with IEEE Std 450-1980 with the following exceptions: 1) A capacity test (also called a performance test) will be performed periodically on each diesel generator battery system, as recommended by IEEE 450-1980 or IEEE 450-1995. 2) A modified performance test based on Section 5.4 of IEEE Std 450-1995 may be performed in lieu of the performance or service test in accordance with the Technical Specification. 3) The criteria for acceptance of connection resistance measurements may be established by the manufacturer's recommended limit as indicated in IEEE Std 450-1995, Section D.2.

For Unit 2, full compliance with IEEE Std. 450-1980 with the following exceptions: (1) A modified performance test based on section 5.4 of IEEE 450-1995 may be performed in lieu of the performance or service test in accordance with the Technical Specification.

(2) Also, the criteria for acceptance of connection resistance measurements may be established by the manufacturer's recommended limit as indicated in IEEE Std. 450-1995, Section D.2. (3) Additionally, a performance test will be performed at a 24 months frequency if the battery has reached 85% of the expected life with capacity > 100% as delineated in IEEE Std. 450-1995, Section 5.2.C.

REFERENCES

1. TVA Submittal to NRC "WBN Unit 1 Supplemental Information on WBN Cable Issues" L44 900615 803, Enclosure 4.

2. TVA Submittal to NRC "WBN Unit 1 Electrical Cable Damage - Assessment &

Resolution Plan" L44 891220 806, Enclosure 1.

8.1-16

WBN TABLE 8.1-1 (SHEET 1 of 3)

SAFETY LOADS AND FUNCTIONS Safety Loads Function Power Centrifugal Charging Pumps Provide emergency core cooling during 6900V ac emergency shutdown Safety Injection Provide emergency core cooling during 6900V ac Pumps emergency shutdown Residual Heat Remove reactor heat during a shutdown 6900V ac Removal Pumps condition Containment Spray Provide cooling spray inside containment 6900V ac Pumps during high pressure conditions Essential Raw Provide cooling water for component cooling 6900V ac Cooling Water system and other miscellaneous systems Pumps Auxiliary Feed- Provide water to the steam generators 6900V ac water Pumps during emergency conditions Pressurizer Provide heat for maintaining adequate 480V ac Heat Group pressure in the primary coolant system Component Cooling Provide cooling water to the NSSS 480V ac System Pumps equipment Spent Fuel Cooling Cool spent fuel pool 480V ac Pumps Fire Pumps Provide water for fire control and emergency 480V ac feedwater to steam generators, the Aux Boration MU Tank, and Spent Fuel Pool for flood mode operation

WBN TABLE 8.1-1 (SHEET 2 of 3)

SAFETY LOADS AND FUNCTIONS (Cont'd)

Safety Loads Function Power Reactor Lower To circulate air in reactor lower 480V ac Compartment compartment dead-ended compartments Cooling Fans Containment Air Enhances the ice condenser and 480V ac Return Fans containment spray heat removal operation by circulating air from the upper compartment to the lower compartment, through the ice condenser Emergency Air Maintains air temperature in operating 480V ac Conditioning areas within environmental qualification temperature limits Ventilation Controls air temperature and/or source 480V ac System and/or radioactive content prior to, during, & 125V dc and following emergency conditions Vital Battery Maintain 125V vital batteries at proper 480V ac Chargers charge level Hydrogen Maintain a safe level of hydrogen in the 480V ac Recombiner (Unit 2 Only) containment Motor Control Provide power for small motors, fans, 480V ac Centers MOV's, heaters, and small pumps associated with safety-related equipment Process Protection System Monitors process parameters which initiate 120V ac actuation of reactor trip and engineering safeguards systems

WBN TABLE 8.1-1 (SHEET 3 of 3)

SAFETY LOADS AND FUNCTIONS (Cont'd)

Safety Loads Function Power Solid-State Protection Prevents reactor from operating in unsafe 120V ac System condition Nuclear Instrument System Monitors reactor power level for reactor 120V ac control and trip logic Auxiliary Relay Auxiliary relays for process control 120V ac & 125V dc Racks Power Switchgear Control power for power switchgear 125V dc Vital Inverter Supplies power to the vital instrument 125V dc & 480V ac buses Reactor Trip Switchgear Trips reactor when limits of the operating 125V dc Control safe region are approached Diesel Generator Remote control of diesel generators 125V dc Control Auxiliary Feed Automatic start of auxiliary feed pump 125V dc Pump Turbine turbine Solenoid Valves Provide flow control and isolation. Includes 125V dc & 120V ac process solenoid valves and solenoid pilot valves for pneumatic valves Inadequate Core Monitors reactor vessel level, saturation 120V ac Cooling Monitor (Unit 2 margin, and incore thermocouple Only) temperatures Common Q Post-Accident Monitors reactor vessel level, saturation 120V ac Monitoring System (Unit 2 margin, and incore thermocouple Only) temperatures BOP Process Monitors balance-of-plant process 120V ac Instrumentation parameters

WBN TABLE 8.1-2 Electrical Penetration Assembly Short-Circuit Capability Backup Device Rated Short Tested Calculated Primary Device Rated Serv Wire Ckt Sym Rated I2t Short Ckt Short Ckt Opening Time Opening I2t Volts Volts Size Amp (x 106) Sym Amp Sym Amp Sec Time Sec (x106) 8,000 6,900 750 45,000 2,910 57,486 <33,000 0.098 0.098 106.72 1

MCM 600 480 350 33,000 633 35,000 32,636 0.01 0.052 55.39 MCM 600 208 350 33,000 633 35,000 <22,000 0.01 0.025 12.1 MCM 600 480 250 32,500 323 33,900 30,000 0.01 0.052 46.8 MCM 600 480 2/0 28,000 91.7 28,300 26,346 0.01 0.052 36.09 600 125DC 4 AWG 14,300 8.95 15,000 5,643 0.01 0.01 0.317 600 480 4 AWG 14,300 8.95 15,000 13,078 0.01 0.015 2.57 600 125DC 6 AWG 9,040 3.56 9,500 5,634 0.01 0.01 0.317 600 480 8 AWG 5,840 1.39 5,960 5,347 0.01 0.015 0.429 600 125DC,1 8 AWG 5,840 1.39 5,960 4731 0.010 0.04 0.90 20VAC 600 120VAC, 10 AWG 3,800 0.56 3,900 786 0.010 0.04 0.025 125VDC 600 120VAC, 12 AWG 2,360 0.223 2,410 284 0.01 1.4 0.113 125DC, 48VDC, 24VAC, 24VDC, 250VDC (1)

Parallel 750 MCM Conductors

SECURITY-RELATED INFORMATION, WITHHELD UNDER 10CFR2.390 FIGURE 8.1-1

WBN 8.2 OFFSITE (PREFERRED) POWER SYSTEM 8.2.1 Description Preferred offsite power is supplied from TVA's 161kV transmission grid at Watts Bar Hydro Plant (WBH) switchyard over two separate transmission lines, each connecting to two 161-6.9-kV common station service transformers (CSSTs) at Watts Bar Nuclear Plant (WBN).

The Class 1E power system is normally supplied from offsite power through CSSTs C and D.

For flexibility, there is also a maintenance feed available from CSSTs A and B to the Class 1E power systems which can be used when CSST C or D is out of service during any operating mode.

The Class 1E power system can be transferred from the offsite normal power supply to the offsite alternate and maintenance power supply to demonstrate operability of the board transfer. Transfers from the normal supply to the alternate supply may be manual or automatic.

Automatic transfers from the normal power supply to the alternate power supply are initiated by any transformer or line failure relays.

Manual (routine) transfers are initiated at the discretion of the operator for test or normal operation. Manual transfers may be effected from the main control room by placing the "auto-manual" transfer switch in manual, then placing the control switch for the selected supply breaker in the "close" position and the control switch for the supply breaker in the "trip" position.

For all unit generator trips except those caused by electrical faults that open 1 and/or 2 main generator 500kV circuit breakers, the Balance of Plant (BOP) ac auxiliary power system remains connected to its unit sources for 30 seconds, then fast transfers to offsite power supplied through common transformers A and B. If the unit trip is caused by an electrical fault, the BOP system transfer is not delayed.

Transmission system studies (TSS) have been made that show for an acceptable range of transmission grid conditions, one offsite power circuit consisting of one 161kV transmission line and transformer C, or the other transmission line and transformer D is capable of starting and running all required safety-related loads, for a design basis accident in one unit and simultaneous orderly shutdown of the other unit. Additionally, studies have shown that one transmission line and CSST A, or one transmission line and CSST B are capable of starting and running the minimum required safety-related loads for one train in each unit. The analyses assumed that equipment started by a safety injection signal (SIS) started at the same time unless the load's control circuitry has sequential time delay, that all equipment that is tripped off by a SIS was tripped, and that all continuous loads that could be operating immediately after the SIS, whether safety-related or not, were running.

A load shedding feature is provided for part of the BOP loads in the event of a two Unit trip with either CSSTs A or B out of service. Load shedding was not considered in the TSS.

8.2-1

WBN 8.2.1.1 Preferred Power Supply The features of the offsite power system are shown in Figure 8.2-1, Development Single Line Diagram. Preferred power is supplied from the existing Watts Bar Hydro 161kV switchyard over two 161kV overhead lines approximately 1.5 miles long, located entirely on TVA property.

These two transmission lines are supported on separate towers, and the separation of the two lines is sufficient to ensure that the failure of any tower in one line will not endanger the other line.

The Watts Bar Hydro 161kV switchyard bus arrangement is designed so that the loss of any one of the four main bus sections will not cause loss of power to either of the two preferred power source lines to the nuclear plant. The Watts Bar Hydro Plant switchyard is interconnected with the TVA power system through six 161kV transmission lines and the five Watts Bar Hydro generators, as shown on the development single line, Figure 8.2-1A. This switchyard also provides connections to the four inactive steam-driven generators in the Watts Bar Steam Plant.

The Watts Bar-Sequoyah and the Watts Bar-Athens 161kV lines both terminate on the Hydro plant switchyard bus 1, Section 1. These two lines are on separate rights of way except for sharing a common 0.87-mile, double-circuit tower river crossing. The Athens line terminates in the Athens 161kV substation along with one 161kV line from Fort Loudon Hydro Plant, one 161kV line from Loudon 161kV substation via the Sweetwater substation, and one line from Charleston 161kV substation which is tied to Sequoyah Nuclear Plant (SQN). The Sequoyah line terminates in the 161kV switchyard at SQN. The Sequoyah 161kV switchyard is connected to the 500kV system through an intertie transformer bank, to one of the generating units at SQN, to Chickamauga Hydro Plant, and to other substations which are integral parts of the transmission system with either direct or indirect connections to other TVA steam or hydro electric generating plants.

The Watts Bar-Great Falls 161kV transmission line terminates on bus 2, section 2 in the Watts Bar Hydro Plant switchyard. At Great Falls Hydro Plant this line is terminated in the 161kV switchyard along with a second circuit from Watts Bar Hydro which is routed by way of Spring City 161kV substation and with 161kV transmission lines that interconnects with the power system network through the Murfreesboro 161kV substation, McMinnville 161kV substation, West Cookeville 161kV substation, and the Center Hill Hydro Plant. The Great Falls and the Winchester 161kV transmission lines cross approximately 2.87 miles from the Watts Bar Hydro switchyard (Figure 8.2-2).

8.2-2

WBN The Watts Bar-Spring City 161kV transmission line terminates on bus 1, Section 3 in the Watts Bar Hydro Plant switchyard. At Spring City this line is terminated on the 161kV bus along with a 161kV line that extends to Great Falls Hydro Plant. The Spring City and Winchester lines that extend from Watts Bar Hydro Plant cross 2.74 miles from the switchyard (Figure 8.2-2).

The Watts Bar-Rockwood and the Watts Bar-Winchester 161kV transmission lines are terminated on bus 2, section 4, in the Watts Bar Hydro Plant switchyard. The Rockwood line terminates on the Rockwood 161kV bus along with a 161kV line from the Crossville 161kV substation and a 3-terminal line tied to the 161kV switchyard of the Roane County 500kV substation and the Kingston Steam Plant. The Crossville 161kV substation and Kingston Steam Plant are further connected to the TVA 161kV transmission system network. The Watts Bar-Rockwood line is on a separate right-of-way except for being on double-circuit towers with the Watts Bar-Winchester line for 0.9 mile and does not cross other lines that terminate at Watts Bar Hydro switchyard (Figure 8.2-2). The Watts Bar-Winchester 161kV transmission line terminates at Winchester 161kV substation. The Winchester, Spring City, and Great Falls 161kV transmission lines have crossings near the Watts Bar Hydro Plant switchyard (Figure 8.2-2).

Two 161kV transmission lines extend approximately 1.5 miles from Watts Bar Hydro Plant switchyard to the Watts Bar Nuclear Plant site to furnish preferred power to the nuclear plant.

The transmission line for CSSTs A and D terminates on bus 1, Section 1 and bus 2, Section 2.

This line does not cross other 161kV lines (Figure 8.2-2). The transmission line for CSSTs B and C terminates on bus 2, section 4 and bus 1, section 3 in the hydro plant switchyard. This line crosses over the Spring City and the Great Falls 161kV transmission lines near the hydro plant switchyard (Figure 8.2-2).

The transmission line structures for 161kV lines are designed to meet or exceed load requirements specified in the National Bureau of Standards Handbook No. 81 (National Electric Safety Code Part 2). Designing to these requirements ensures the adequacy of lines for wind and heavy icing conditions in excess of those that would be expected to occur in this area. The phase conductor and shield wire design tensions are selected to avoid vibration problems.

Long experience with area transmission lines verifies that TVA design practices have been successful in avoiding vibration problems. No galloping conductor conditions have been observed in the eastern portion of the TVA transmission system.

Transmission lines in the 161kV voltage class have two overhead ground wires provided for lightning protection. The use of circuit breakers with high speed reclosing relays results in the majority of these interruptions due to lightning being momentary.

8.2-3

WBN-1 8.2.1.2 Transmission Lines, Switchyard, and Transformers The two 161kV and the five 500kV lines connecting the nuclear plant with the TVA transmission network are indicated functionally on Figure 8.2-1. The onsite transmission line arrangement is shown on Figure 8.2-3. Preferred power is supplied from the existing Watts Bar Hydro 161kV switchyard over two radial 161kV overhead lines approximately 1.5 miles long. These transmission lines provide power to the nuclear plants CSSTs A and D and CSSTs B and C and are routed to the east and north of the nuclear plant transformer yard respectively. These lines are routed to minimize the likelihood of their simultaneous failure.

The location of common station service transformers A and B is shown on Figures 8.2-3 and 8.2-5. Each transformer has a single primary and two secondary windings. The primary voltage is 161kV with the winding rated 57/76/95 MVA, OA/FA/FOA (Future). The secondary voltage is 6.9 kV and each winding is rated 36/48/60 MVA, OA/FA/FOA (Future). The primary winding of each transformer has an automatic load-tap changer unit which will adjust voltage based on the normally connected start bus.

The location of common station service transformers C and D is also shown on Figure 8.2-3.

Each transformer has a single primary winding with an automatic on Load Tap Changer unit and two secondary windings. Tap changer will adjust voltage based on the loading on 6.9kV start busses (connected to Y-winding). The primary voltage is 161kV, and the winding is rated 33/44/55 MVA, OA/FOA/FOA. The secondary voltage is 6.9 kV, and each winding is rated 24/32/40 MVA, OA/FOA/FOA.

Calculated loads for common station service transformers A, B, C and D are well below winding ratings for all conditions.

Fire protection is provided for each common station service transformer by a deluge type water sprinkler system which can be automatically activated by thermostats or the transformer electrical protection devices.

8.2-4

WBN 8.2.1.3 Arrangement of the Start Boards, Unit Boards, Common Boards, and Reactor Coolant Pump (RCP) Boards From the low-voltage side of common station service transformers A and B, 6.9kV station service buses supply the 6.9kV common, unit, and RCP boards via the 6.9kV start boards. The station service (start) buses are outdoor, nonsegregated, partially ventilated, metal-clad structures and are shown on Figure 8.2-5. At the 6.9kV startboard, these buses enter the outdoor metal-clad switchgear and connect to supply breakers. The design of the 6.9kV start boards and RCP boards conforms to ANSI, C37.20 (Standard for Switchgear Assemblies including Metal-Enclosed Bus) and is classified as outdoor metal-clad switchgear. Section 20, 6.2.2 of this standard defines the requirements for barriers. The circuit breakers at the 6.9kV start boards are electrically operated, vertical lift drawout type, with stored energy mechanisms.

These circuit breakers have a continuous rating of 3,000 and 3,750 amperes for the RCP Start Bus breakers and Start Buses A and B breakers, respectively, an insulation system for 13.8kV, interrupting rating of 1,000 MVA, and a momentary rating of 80,000 amperes. The circuit breakers are utilized at 6.9kV. Therefore, there is sufficient margin between the application and the rating of these circuit breakers.

From the 6.9-kV start board the two 6.9kV start buses A and B and the two 6.9kV RCP start buses A and B run on separate support structures as outdoor, nonsegregated, partially ventilated metal-clad assemblies (Figure 8.2-5). The bus bars are fully insulated with flame-retardant material, bus supports are flame-retardant, and the metal enclosures are such that arcing faults in one bus will not endanger the other. The 6.9kV RCP start buses enter the RCP outdoor metal-clad switchgear and connect to supply breakers.

The four unit station service transformers are located in the transformer yard, south of the Turbine Building and directly under the delta section of the main generator isolated-phase bus.

Location of the unit station service transformers is shown on Figure 8.2-5. From each of the unit station service transformer low-voltage sides two 6.9kV buses originate, one running in the switchyard parallel to the south wall of the Turbine Building and connecting to the RCP switchgear, and the other entering the south Turbine Building wall for routing to the unit and common boards. The unit station service buses are outdoor, nonsegregated, partially ventilated, metal-clad construction until they enter the Turbine Building, where the construction changes to indoor type. After entering the Turbine Building, the unit station service buses are routed to the appropriate supply breakers in the 6.9kV unit and 6.9kV common boards, entering through the tops of the 6.9kV unit boards and the bottoms of the 6.9kV common boards. The 6.9kV unit and common boards are indoor, metal-clad switchgear with electrically operated, vertical lift drawout breakers with stored energy mechanisms.

8.2-5

WBN From four of the 6.9kV unit boards located in the Turbine Building maintenance feeder cables are routed to the 6.9kV shutdown boards located in the Auxiliary Building where they connect to the supply breakers. These feeder cables are routed in divisional raceway to maintain separation between the two offsite power sources.

CSSTs C and D are connected to 6.9kV common switchgear C and D via a bus similar to 6.9kV start buses A and B (Figure 8.2-5A). The 6.9kV common switchgear C and D are then connected to the 6.9kV shutdown boards via cables which are routed through conduit banks and cable trays.

All of the indoor station service buses are non-ventilated, non-segregated, metal-clad, drip proof construction. In addition, the outdoor portions are weatherproof and equipped with 120V 1-phase heaters to maintain the temperature inside the housing at least 5°C above outside temperature.

All buses are provided with gas-resistant seals at entry to switchgear. At the penetration of an outside building wall, the buses are provided with a fire-resistant and moisture-resistant barrier.

8.2.1.4 Arrangement of Electrical Control Area (Nuclear Plant)

Figures 8.2-7 and 8.2-11 show the electrical control area where the relay, control, 250V dc control power distribution panels and battery boards are located. Control power for start board power circuit breakers and associated protective relays is distributed from the 250V dc supply via circuit breakers on the Turbine Building dc distribution boards. Physical isolation of control power supplies is achieved by metal barriers between adjacent panels. Two separate 250V dc buses are provided in these panels. Each bus can be fed from one of the two 250V battery boards (Figures 8.2-12 and 8.2-13) through manual, mechanically interlocked, nonautomatic circuit interrupters. The power circuit breaker and associated relay control circuits are allocated to these two dc buses on the basis of switchyard connections. This allocation of control circuits ensures that the common station service transformer control and relay circuits are fed from two independent dc distribution buses. Each circuit is protected by a circuit breaker and supervised by an amber indicating light located on the recording and instrument board. These indicating lights are grouped on the panel on the basis of the dc buses they are connected to, and their wiring is physically separated on the panel on the same basis.

8.2.1.5 Switchyard Control and Relaying The design of the offsite (preferred) power system with its normal provision of two immediate access circuits from the transmission network via Watts Bar Hydro Plant complies with the NRC regulatory position expressed in Regulatory Guide 1.32 for the preferred design of such a system. The CSST maintenance configurations can also be aligned to provide two immediate access circuits.

The transmission line relay protection circuits at the hydro plant continuously monitor the conditions of the offsite power system and are designed to detect and isolate the faults with maximum speed and minimum disturbance to the system.

8.2-6

WBN The principal features of these schemes are described below. The two 161kV offsite power lines to the nuclear plant are protected by two-zone step distance phase relays, breaker failure, and backup ground relays. The other 161kV lines connected to the Hydro plant are protected by three-zone (reversed third zone) step distance phase relays augmented with directional comparison carrier blocking and have directional overcurrent carrier ground, breaker failure, and backup ground relays. The relay potential circuits are fed from a set of potential transformers connected to each main bus section.

The 161kV transmission line protective relay system at the hydro plant provides for fast detection of faults and is designed to maximize the reliability of the incoming power to the nuclear plant. A breaker failure relaying scheme is provided at the hydro plant to ensure system availability. Should a breaker fail to clear a fault, breaker failure relays will isolate the fault by clearing all other breakers tied to the faulted bus section.

Figure 8.2-lA shows a single line diagram of the Watts Bar Hydro Plant switchyard. The switchyard is monitored and controlled by personnel continuously on duty in the System Operations Center (SOC) located in Chattanooga, Tennessee. The SOC continuously monitors the Watts Bar Hydro switchyard and is capable of remotely dispatching investigative responders for faults not isolated or cleared and achieving the reset of protective relaying, i.e., bus differential, breaker failure, etc., and closing switchyard breakers.

The 161kV breakers at the hydro plant are oil circuit breakers equipped with an accumulator tank charged by a 250-volt dc compressor motor to provide compressed air for the closing operation. Spring energy is used for tripping the breaker. These breakers may be tripped manually at the breaker cabinet, remotely from the control room or automatically by protective relay action.

The Watts Bar Hydro 161kV switchyard is protected by a bus differential relay scheme. The bus differential relays continuously monitor the current inflow and outflow from the bus section under their supervision. Whenever the current inflow does not equal the current outflow, the relays operate instantaneously to trip and lock out all breakers in their protected bus section.

Each common station service transformer at the nuclear plant is protected by a percentage differential relay with harmonic restraint, a sudden pressure relay, transformer phase over-current relays, and a neutral over-current relay in each transformer's common 6.9kV neutral.

The operation of the transformer protection relays will trip and lock out the power circuit breakers connecting it to the hydro plant switchyard, trip and lock out associated 6.9kV circuit breakers at the nuclear plant, and start a high-pressure suppression system to limit damage from or extinguish transformer file at the nuclear plant.

The 161kV power supply to the common station service transformers possesses a high degree of reliability even under electrical fault conditions. The following discussion describes the sequence of events following postulated faults:

8.2-7

WBN

1. Transmission line fault.

If the instantaneous element of the line protective relays at the hydro plant is actuated, the line breaker is tripped and a high speed reclosure occurs. If after the high speed reclosure the fault has not cleared, the breaker will trip again and a standard speed (synchronism check-voltage check) reclosure occurs. In the majority of cases, these reclosures restore the line back to service. There is no appreciable disturbance on the two feeders to the common station service transformers. However, a trip after this will lock out the breaker isolating the faulted line.

2. Transmission line fault and failure of the line circuit breaker at the hydro plant to clear the fault.

The corresponding breaker failure relay is automatically initiated, starting a timer. If the fault is not cleared within the time setting of the timer all circuit breakers connected to that bus will be tripped and locked out. With normal position of circuit breakers described previously, both offsite power circuits to the nuclear plant continue to receive power without interruption.

3. Main bus fault in Watts Bar Hydro Plant Switchgear.

This type of fault is detected by the bus differential relays. When initiated, bus differential relays trip and lock out the circuit breakers connected to the faulted bus.

4. Common station service transformer faults at the nuclear plant or transformer feeder faults.

These faults cause tripping of all the transformer circuit breakers on the high (hydro switchyard) and low (nuclear plant) voltage sides of the transformer. In addition, the trip relay initiates the transformer fire protection suppression system and starts the fire pump. This event results in the loss of two of the four common station service transformers; the other two transformers continue to receive power from the main bus in the hydro switchyard.

5. Common station service transformer faults at the nuclear plant or transformer feeder faults and failure of one 161kV circuit breaker at the hydro plant to operate properly.

These events caused the operation of protection described under 4 above, followed by the operation of the breaker failure relay which trips all breakers connected to the bus at the time of failure. The event results in the loss of two of the four transformers; the other two transformers continue to receive power from its main bus in the hydro switchyard.

8.2-8

WBN Automatic transfers of the Class 1E power system from the normal power supply to the alternate power supply only occur when the relay logic is tripping a transmission line and the associated common station service transformers. Automatic transfers of the Class 1E power systems are not provided for CSST maintenance alignments.

Control power for power circuit breakers and associated protective relays is supplied by two independent 250V batteries and is distributed via circuit breakers on separate panels. Figures 8.2-1B and 8.2-1C show the single line diagrams for the two panels at Watts Bar Hydro Plant.

Two separate 250V dc buses are provided in these panels. Each bus can be fed from one of the two 250V battery boards through manual, mechanically interlocked, nonautomatic circuit interrupters. The power circuit breaker and associated relay control circuits are allocated to these two dc buses on the basis of switchyard connections. This allocation of control circuits ensures that the control and relay circuits of the two nuclear plant lines are fed from two independent dc distribution buses.

8.2.1.6 6.9kV Start Boards Control and Relaying 6.9kV Start Buses The secondaries of common station service transformers A and B feed into two start boards containing four circuit breakers each. Two of the circuit breakers, 1512 and 1614, are the normal and alternate feeders for start bus A while breakers 1612 and 1514 are the normal and alternate feeders for start bus B. Two other breakers, 2512 and 2614, are the normal and alternate feeders for RCP start bus A, and breakers 2612 and 2514 are the normal and alternate feeders for RCP start bus B. The two circuit breakers feeding each start bus from a different common station service transformer are interlocked and the control circuits arranged in such a manner that manually-initiated high-speed (six cycles or less) transfers can be made from either breaker to the other breaker. Automatic transfers can only be made from the normal breaker to the alternate breaker and are delayed until the bus residual voltage reduces to 30% of nominal. All automatic transfers are initiated by undervoltage on the bus. The 250V dc normal control power for the pair of breakers feeding start bus A is supplied from a separate battery and dc distribution board from that of the normal control power for the two breakers feeding start bus B. Alternate control power feeders are similarly segregated.

Manual control of the circuit breakers is provided on the electrical control board in the Main Control Room where the operator has instrumentation showing the voltage on each of the two buses and current flowing in each of the four CSST secondary windings. The following annunciation is provided:

1. Start Bus Fan Failure

2. Start Bus Transfers

3. Start Bus Failures or Undervoltage 8.2-9

WBN Annunciation No. 3 is composed of bus differential relay operation, bus a.c. voltage failure, and control bus dc voltage failure. Start bus A is the normal feeder to 6.9kV common board A and the alternate feeder to 6.9kV unit boards 1A, 1C, 2A, and 2C. Start bus B is the normal feeder to 6.9kV common board B and the alternate feeder to 6.9kV unit boards 1B, 1D, 2B, and 2D.

6.9kV Common Switchgear C and D Start Boards A and B The secondaries of common station service transformers C and D feed into 6.9kV common switchgear C and D (Figure 8.1-2a). Each switchgear contains two circuit breakers which are aligned to the common station service transformers as follows:

1. Common station service transformer C:

This transformer provides normal (offsite) power from the secondary Y winding to 6.9kV shutdown board 1A-A through circuit breaker 1712 and from the secondary X winding to 6.9kV shutdown board 2A-A through circuit breaker 2714. In addition, this transformer provides alternate (offsite) power from the secondary X winding to 6.9kV shutdown board 1B-B through circuit breaker 2714 and from the secondary Y winding to 6.9kV shutdown board 2B-B through circuit breaker 1712. These feeders are protected by overcurrent and ground overcurrent relays. All of these switchgear circuit breakers are normally closed.

These circuits are designated as R for separation identification.

2. Common station service transformer D:

This transformer provides normal (offsite) power from the secondary X winding to 6.9kV shutdown board 1B-B through circuit breaker 2814 and from the secondary Y winding to 6.9kV shutdown board 2B-B through circuit breaker 1812. In addition, this transformer provides alternate (offsite) power from the secondary Y winding to 6.9kV shutdown board 1A-A through circuit breaker 1812 and from the secondary X winding to 6.9kV shutdown board 2A-A through circuit breaker 2814. These feeders are protected by overcurrent and ground overcurrent relays. All of these switchgear circuit breakers are normally closed.

These circuits are designated as P for separation identification.

The secondaries of common station service transforms A and B feed into the 6.9kV start boards A and B. The start boards can be aligned to the 6.9kv shutdown boards through the unit boards as follows:

1. Common station service transformer A:

This transformer provides offsite power, from the secondary Y winding through circuit breaker 1512, for normal power to 6.9kV common board A and alternate power to 6.9kV unit boards 1A, 1C, 2A and 2C. When CSST D is not available this transformer can be aligned manually to provide power to the train B 6.9kV shutdown boards. Normal (offsite) power from the transformer secondary Y winding can be aligned to 6.9kV shutdown board 1B-B via 6.9kV start board A through circuit breaker 1512 to 6.9kV unit board 1C through circuit breakers 1524 and 1722 and to 6.9kV shutdown board 1B-B through circuit breaker 1726. Similarly, normal (offsite) power from transformer secondary Y 8.2-10

WBN winding can be aligned to 6.9kV shutdown board 2B-B via 6.9kV start board A through circuit breaker 1512 to 6.9kV unit board 2C through circuit breakers 1534 and 1822 and to 6.9kV shutdown board 2B-B through circuit breaker 1826.

These circuits are identified as P separation designation.

2. Common station service transformer B:

This transformer provides offsite power, from the secondary Y winding through circuit breaker 1612, for normal power to 6.9kV common board B and alternate power to 6.9kV unit boards 1B, 1D, 2B and 2D. When CSST C is not available this transformer can be aligned manually to provide power to the train A 6.9kV shutdown boards. Normal (offsite) power from the transformer secondary Y winding can be aligned to 6.9kV shutdown board 1A-A via 6.9kV start board B through circuit breaker 1612 to 6.9kV unit board 1B through circuit breakers 1622 and 1714 and to 6.9kV shutdown board 1A-A through circuit breaker 1718. Similarly, normal (offsite) power from transformer secondary Y winding can be aligned to 6.9kV shutdown board 2A-A via 6.9kV start board B through circuit breaker 1612 to 6.9kV unit board 2B through circuit breakers 1632 and 1814 and to 6.9kV shutdown board 2B-B through circuit breaker 1818.

These circuits are identified as R separation designation.

The provisions made for independence of offsite sources are limited such that CSST A and B cannot be credited simultaneously for supply of 6.9kV Class 1E power.

Additionally, CSST A and B only have the capacity to supply one train of 6.9kV shutdown boards for each unit.

All alternate and maintenance feeder circuit breakers located on the 6.9kV shutdown boards are open during normal plant operation and are utilized only when the normal power supply is not available. The maintenance supplies can be used to provide a second qualified off site power source to the 6.9kV shutdown boards when required. All transfers between the normal, alternate and maintenance feeders take place at the 6.9kV shutdown boards.

8.2-11

WBN 6.9kV Common Station Switchgear C and D Control The normal control power for circuit breakers 1712 and 2714 is supplied from the existing 125V dc vital Battery Board I; the normal control power for circuit breakers 1812 and 2814 is supplied from the existing 125V dc vital Battery Board II. This arrangement provides physically and electrically independent supplies. Control power circuits have been uniquely identified as P and R. P-designated cables are routed in separate raceways from R-designated cables with any exceptions and their justifications documented in the design criteria. The alternate control power for circuit breakers 1712 and 2714 is supplied from existing 125V dc vital Battery Board III; the alternate control power for circuit breakers 1812 and 2814 is supplied from existing 125V dc vital Battery Board IV. These cables have been routed such that with either breakers 1712 and 2714 or breakers 1812 and 2814 receiving control power from the designated alternate source (and with the other breaker pair receiving control power from the normal source) physical and electrical independence of control power for each switchgear is maintained.

Manual control of the circuit breakers is provided on the electrical control board in the main control room where the operator has instrumentation showing the voltage on each of the two buses and the current flowing in each of the four feeder breakers.

The following annunciation is provided: Loss of Control Power 6.9kV Start Boards A & B, Unit Boards and Common Boards Control Power The normal control power for circuit breakers used to supply offsite power from CSST A and B to the 6.9kV shutdown boards is arranged to provide physically and electrically independent supplies.

The normal and alternate control power feeds to the 250VDC control buses for 6.9kV Start Boards A and B, Unit Boards 1B, 1C, 2B, 2C and Common Board A and B are supplied from 250VDC Turbine Building Distribution Boards 1 and 2. The normal power feeder cables for 6.9kV Start Board control bus A are routed separately from those for control bus B. The normal power feeder cables for the 6.9kV Common Board A control bus are routed separately from those for 6.9kV Common Board B. The normal power feeder cables for the 6.9kV Unit Board 1B control bus are routed separately from those for 6.9kV Unit Board 1C. The normal power feeder cables for the 6.9kV Unit Board 2B control bus are routed separately from those for 6.9kV Unit Board 2C.

Control cables associated with CSST A normal alignments are designated as P and control cables associated with CSST B normal alignments are designated as R for separation identification.

6.9kV Start Board Breaker Control The breaker control cables for 6.9kV Start Bus A normal feeder breaker 1512 are routed separately from those for 6.9kV Start Bus B normal feeder breaker 1612. Control cables associated with breaker 1512 are designated as P and control cables associated with breaker 1612 are designated as R for separation identification. 6.9kV start bus alternate feeder breakers 1614 and 1514 are not credited for supply of offsite power.

8.2-12

WBN 6.9kV Unit Board 1B, 1C, 2B, 2C Breaker Control The breaker control cables for circuit breakers 1714, 1622 (NO) and 1114 (NC) at 6.9kV Unit Board 1B are routed separately from those for breakers 1722, 1524 (NO) and 1122 (NC) at 6.9kV Unit Board 1C. Similarly, the breaker control cables for circuit breakers 1814, 1632 (NO) and 1214 (NC) at 6.9kV Unit Board 2B are routed separately from those for breakers 1822, 1534 (NO) and 1222 (NC) at 6.9kV Unit Board 2C. Control cables associated with breakers 1114, 1214, 1622, 1632, 1714 and 1814 are designated as R and control cables associated with breakers 1122, 1222, 1524, 1534, 1722 and 1822 are designated as P for separation identification.

8.2.1.7 6.9kV Unit and RCP Board Control and Relaying The alternate feeder to each 6.9kV unit and RCP board is from one of the start buses with the normal feeder being from a unit station service transformer.

Each 6.9kV unit and RCP board can be selected for automatic or manual transfer between the normal and alternate supply breakers. Manual transfers are high speed (6 cycles or less) and can be made from the normal to the alternate supply or from the alternate to the normal supply.

Automatic transfers can only be made from the normal to the alternate supply. Automatic transfers initiated by loss of voltage on the unit board are delayed until the bus residual voltage decreases to 30% of nominal. Those transfers initiated by reactor trip or turbine trip signals on the unit or RCP boards are high speed transfers. Control power is from the 250V dc distribution system.

The unit and RCP boards are protected by overcurrent, ground overcurrent, and differential current protective relays. Manual control of the two feeder breakers of each board is provided in the main control room. Load shedding provisions are included for the RCP boards and will trip the alternate supply breakers on the 6.9kV RCP board 1C, 1D, 2C, and 2D. The operator has instrumentation that gives the voltage of each board and the current flowing in either of the two feeder breakers. The following annunciation is provided:

1. Unit and RCP Board Transfer

2. Unit and RCP Board Failure or Undervoltage

3. Load Shedding Initiated Annunciation No. 2 is composed of board differential relay operation, board ac voltage failure, and control bus dc voltage failure.

Annunciation No. 3 is composed of a loss of voltage on either 6.9kV start bus A or B, and both units 1 and 2 tripped.

8.2.1.8 Conformance with Standards This section discusses provisions included in the design of the offsite (preferred) power system to achieve a system design in conformance with requirements of GDC 17, GDC 18, and NRC Regulatory Guides 1.6 and 1.32.

The following requirements of these documents apply to offsite power.

Criterion 17 8.2-13

WBN General Design Criterion 17 requires that:

1. "The offsite power supply be of sufficient capacity and capability to assure, assuming the onsite (standby) power supply is not functioning, that

a. Specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded as a result of anticipated operational occurrences, and

b. The core is cooled and containment integrity and other vital functions are maintained in the event of postulated accidents."

2. "Electric power from the transmission network to the onsite electric distribution system shall be supplied by two physically independent circuits (not necessarily on separate rights of way) designed and located so as to minimize to the extent practical the likelihood of their simultaneous failure under operating and postulated accident and environmental conditions. A switchyard common to both circuits is acceptable."

3. Each of the two circuits supplying electric power from the transmission network to the onsite electric distribution system "shall be designed to be available in sufficient time following a loss of all onsite alternating current power supplies and the other offsite electric power circuit, to assure that specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded."

4. One of the two circuits supplying electric power from the transmission network to the onsite electric distribution system "shall be designed to be available within a few seconds following a loss-of-coolant accident to assure that core cooling, containment integrity, and other vital safety functions are maintained."

5. "Provisions shall be included to minimize the probability of losing electrical power from any of the remaining supplies as a result of, or coincident with the loss of power generated by the nuclear unit, the loss of power from the transmission network, or the loss of power from the onsite electrical power sources."

Criterion 18 General Design Criterion 18 requires that the offsite power circuits be designed to permit periodic inspection and testing to show:

1. "The operability and functional performance of the components" of the circuits,

2. The operability of the systems as whole systems, and

3. "Under conditions as close to design as practical, the full operation sequence that brings the system into operation."

Regulatory Guide 1.6 Regulatory Guide 1.6 requires that "Each ac load group should have a connection to the preferred (offsite) power source. A preferred power source may serve redundant load groups."

8.2-14

WBN SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Regulatory Guide 1.32 Regulatory Guide 1.32 states that "Criterion.17 delineates the design requirements regarding availability of power from the transmission network. Accordingly, a preferred design would include two immediate access circuits from the transmission network. An acceptable design would substitute a delayed access circuit for one of the immediate access circuits provided that availability of the delayed access circuit conforms to Criterion 17."

Each of the above requirements and the provisions included in the design to meet them is addressed in the discussion which follows:

The discussion is arranged in two parts:

(1) Physical measures for achieving independence and physical measures taken to minimize the likelihood of failures of portions of the offsite power system inducing failure of the other power sources and (2) Functional provisions for achieving adequate capacity, capability, and availability; functional measures taken to minimize the likelihood of failure of portions of the offsite power system inducing failure of other power sources.

Physical Measures The CSSTs and buses are connected and arranged to provide two physically independent offsite power (OSP) circuits to the onsite (Class 1E) distribution system. One OSP circuit that is connected to CSSTs A and D is designated P while the other OSP circuit that is connected to CSSTs B and C is designated R. Circuits designated P and R are routed in separate conduits and trays to assure physical independence with any exceptions and their justifications documented in the design criteria. Nonsegregated phase buses are used to connect the secondaries of CSSTs C and D to 6.9-kV common switchgear C and switchgear D, respectively. Switchgear C and D are separated by 70 feet between centerlines. The outdoor portions of the buses, are weatherproof and equipped with 120V, single-phase heaters to maintain the temperature inside the housing at least 5°C above outside temperature. The conductors are fully insulated with flame-retardant material, bus supports are flame retardant and the metal enclosures will prevent any arcing fault in one bus from damaging the other bus.

The 6.9kV common switchgear C and D are connected to the 6.9kV shutdown boards by cables arranged to provide two physically independent sources of offsite power. The cables from both 6.9kV common switchgear C and D are in an underground conduit bank to a conduit vault located 144 feet west of switchgear C and approximately 86 feet east of the Turbine Building wall. From the conduit vault to the Turbine Building, the cables are in overhead trays that are 17 feet above ground. The cables for the normal circuits are routed through cable trays and separate conduits through the Turbine Building and into the Auxiliary Building to the 6.9kV shutdown boards. The cables for the alternate circuits are routed through cable trays and separate conduits alongside the exterior of the Turbine Building, across the top of the Control Building, and then enter the top of the Auxiliary Building and drop down to the shutdown boards. This routing assures that the normal and alternate feeds for each shutdown board are physically separate and independent of each other. It does result in circuits from the secondaries of CSST C (designated as R) and CSST D (designated as P) being routed on common support structures for a distance of 42 feet from a conduit vault to the Turbine Building wall. These tray supports are separated horizontally 61/2 feet, and the trays are 17 feet above 8.2-15

WBN SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 grade, except where they enter the conduit vault. For this limited area, the most likely threat to either the normal or alternate circuits would be a runaway vehicle.

These cables (designated P and R) are routed in close proximity to each other in the conduit vault as they transition from the cable trays to their respective common switchgear ductbank, and in the Turbine Building as they transition from the cable trays to their respective conduits.

These cables routed in free air, where they are in close proximity in the conduit vault and Turbine Building, are fire-wrapped to preclude one faulted circuit from affecting the other circuit.

A chain link fence separates the cable tray supports from a maintenance access road. In addition, there is a 4-foot slope from the base of the pedestal-type supports to the road which is 10 feet away. Due to the size and quantity of insulated cables in each tray, it is very unlikely that either circuit would be lost due to a collapse of a support for any reason. Since cables for each circuit are separated as 3-phase bundles in the respective P or R designated tray, phase-to-phase faults between normal or alternate circuits are considered extremely unlikely. Thus, a ground fault on one circuit is the most likely type of fault.

A ground fault or a short circuit on the secondary side of either CSST C or CSST D is cleared by operation of its respective breaker in the Watts Bar Hydro Plant 161kV switchyard. An automatic transfer of the loads fed from the faulted CSST will be initiated to the unfaulted CSST.

The faulted circuits can be isolated by opening the 6.9kV common switchgear C and D breakers. By reclosing the WBH 161kV switchyard breakers, power can be restored to the nuclear plant 6.9kV shutdown boards through the unfaulted secondaries of CSST C and/or D.

An alternate path is available to the shutdown boards from the 161kV circuits by way of CSST A and/or CSST B through the maintenance supply circuit from the 6.9kV unit boards to the 6.9kV shutdown boards.

The offsite circuits are designed and located so as to minimize to the extent practical the likelihood of their simultaneous failure under operating and postulated accident conditions.

Common station service buses A and B maintain 61 feet centerline-to-centerline separation, until they converge at the unit start board. The buses run on separate support structures and run approximately 15 feet before entering the unit start board. At the unit start board, these buses enter the outdoor, metal-clad switchgear and connect to the board supply breakers. The buses are provided with gas resistant seals at the entry to the switchgear. The supply and feeder breakers at the 6.9kV unit start board are electrically operated, vertical lift draw out type, with stored energy mechanisms. The unit start board consists of a normal feeder breaker and an alternate feeder breaker for each of the 6.9kV start buses A and B and the RCP start buses A and B. The normal feeder breaker and the alternate feeder breaker obtain their supply from separate buses and separate common station service transformers, thereby giving each start bus two possible and independent sources of power.

From the feeder breakers of the 6.9kV unit start board, the two 6.9kV unit start buses A and B and RCP start buses A and B run on separate support structures. These buses are outdoor, non-segregated, and the conductors are fully insulated with flame-retardant material. At the penetration of the outside building wall, the unit buses are provided with fire- and moisture-resistant barriers. The RCP start buses enter the outdoor metal-clad switchgear and connect to the RCP board supply breakers. These breakers are electrically operated, vertical lift draw out type, with stored energy mechanisms.

8.2-16

WBN The 6.9kV start buses enter the turbine building spaced 8 feet 6 inches centerline-to-centerline and maintain this spacing through the building. The start buses are tapped at appropriate places and routed to the appropriate supply breakers in the 6.9kV unit and 6.9kV common boards. The start buses enter the unit board supply breakers through the top of the boards.

The unit board normal supply breaker and alternate supply breaker for each board are separated along the length of the board by several feeder breakers, thereby preventing a fault in one supply breaker from damaging the other. All buses are provided with gas-resistant seals at entry to the switchgear.

Functional Measures Compliance with GDC 17 is discussed in the following paragraphs.

Each of the two 161kV circuits providing offsite power to Watts Bar Nuclear Plant is supplied through two power circuit breakers connecting with separate sections of the main bus in the WBH Plant switchyard. The two overhead transmission lines are routed to minimize the probability of their simultaneous failure. Each 161kV line terminates at a pair of 161 - 6.9-kV common station service transformers (A and D, and B and C, respectively). Each pair of transformers, as well as the buses and cables that are used to connect them to the onsite power (standby) distribution system at the 6.9kV shutdown boards are physically and electrically independent.

Each of the 6.9kV shutdown boards is connected to the offsite power circuits via common station service transformer (CSST) C or D through the 6.9-kV shutdown boards normal or alternate supply breakers. For a loss of power from either CSST C or D not due to a fault in the CSST differential zone of protection, under this alignment, the affected 6.9kV shutdown board loads will be disconnected from offsite power and sequentially loaded onto their respective diesel generator.

For an acceptable range of 161-kV grid conditions, either offsite power circuit can start and supply all electrical equipment that would be supplied from the Class 1E distribution systems for a design basis accident in one unit and simultaneously orderly shutdown of the other unit, and a simultaneous single worst case transmission system contingency. For this event, transformers C or D would be operating within its OA rating and transformers A or B within its FA rating and adequate voltage would be supplied to the safety-related buses.

CSST A or B may be used a replacement for CSSTs D or C, respectively, through the 6.9kV shutdown board maintenance supply breakers. CSST A and B each have sufficient rated capacity to maintain adequate voltage for one train of shutdown boards for each unit while supplying required BOP loads for a design basis accident in one unit and safe shutdown of the other unit. When USSTs are used the affected shutdown board maintenance feeders are supplied from the USSTs through the Unit Boards and are automatically transferred to CSST A or B in the event of a unit trip. Use of CSST A or B as an offsite source requires that CSST A and B both be available and that the associated power and control feeders be in their normal positions to ensure independence. Due to independence limitations, CSST A and B cannot be credited for supply of both offsite power sources simultaneously. Feeders for CSST A are independent of those for CSST C and feeders for CSST B are independent of those for CSST D. Supply of Class 1E power by CSST A or B requires manual breaker operations to align the CSST source to the applicable shutdown board maintenance feeders.

A load-shedding scheme is provided to reduce the BOP loads under certain conditions, but no credit is taken for load shedding in the TSS.

The BOP load-shedding scheme trips selected loads if both Unit 1 and 2 generators are tripped 8.2-17

WBN and either CSST A or B is out of service. Initiation of load shedding is accomplished automatically by undervoltage at transformer secondary Y-winding of either CSST A or B, and both Unit 1 and 2 generators tripped. Two reactor coolant pumps per unit are tripped when the above conditions exist. Tripping of these loads results in a significant reduction (50% of the reactor coolant pumps) of the station load.

The load-shedding scheme consists of two redundant trip and lockout circuits for each circuit breaker receiving a load-shed command. The redundant load- shedding circuits are located in different 6.9kV start boards. One load- shedding circuit associated with CSST A is in 6.9-kV start board A, and the other which is associated with CSST B is in 6.9kV start board B. Control power to the redundant auxiliary power system (APS) load-shedding circuits is provided from separated 250V dc batteries and battery boards. APS load- shedding circuit 1 receives control power from 250V DC Battery 1 via 250V Turbine Building Board 1, and APS circuit 2 from 250V DC Battery 2 via 250V Turbine Building Board 2. Loss of control power to either 250V Turbine Building Board initiates automatic transfer from the normal dc supply to the alternate dc supply with annunciation that auto transfer has occurred. This maximizes the ability of the load-shedding scheme to operate if grid and generator conditions warrant such operation.

The 6.9kV shutdown boards are provided with loss-of-voltage and degraded- voltage relays that initiate transfer from the normal supply, to the standby (diesel generator) power supply. If the standby supply is paralleled with one of the offsite supplies for testing, loss of the standby supply would cause reverse power relays to trip the standby circuit breaker.

For a loss of offsite power during diesel generator testing, the diesel generator will switch to the emergency mode of operation. If an accident signal is initiated during testing of the standby supply, the standby breaker is tripped and the emergency loads are automatically energized by the offsite power supply. Should a LOCA and a loss of offsite power occur when a diesel generator is paralleled with the grid under test, its 6.9kV shutdown board standby and supply breakers are tripped, load shedding occurs and the diesel generator sequencer will load the accident loads. Only one diesel generator will be in the test mode (i.e., operated in parallel with the offsite power supply) at any given time unless both units are in cold shutdown or not fueled; then, both diesels of the same train may be in test. Therefore, loss of any onsite power generation will not prevent the distribution system from being powered from the offsite circuits.

Common station service transformers C and D both have two 6.9kV secondary windings with automatic high-speed load-tap changer units. Each secondary of the transformer is the normal power supply for one 6.9kV shutdown board in each unit. Each secondary is also the alternate power supply for the opposite train, opposite unit 6.9kV shutdown board in each unit.

The impedance between the two 6.9kV secondary windings is more than 93% of the sum of the H to X and H to Y winding impedances, (H refers to the primary winding). The loading on one 6.9kV winding has little effect on the voltage at the other winding, although this effect was considered in establishing grid interface requirements.

Overcurrent relaying and loss-of-voltage relaying for the shutdown boards are coordinated so that a faulted or overloaded bus will not be transferred from one preferred power circuit to another because of depressed voltage resulting from the fault or overload. For the range of grid conditions identified as acceptable, loss of power from one offsite power circuit, whether from failure at the transmission grid interface, failure of any part of the preferred power circuit itself, or failure of part of the onsite distribution system, will not cause loss or degradation of the other offsite power circuit. CSST A, B, C and D trips are initiated by any transformer or line failure relay such as fault-pressure, transformer-overcurrent, ground-current, line-protection, or differential relaying. Initiation of a CSST trip by these protective devices also causes automatic fast transfer of the 6.9kV shutdown boards normally supplied from that CSST to their alternate 8.2-18

WBN-1 supplies.

The design of the control power feeders to 6.9kV common switchgear C and D and to 6.9kV shutdown boards ensures compliance with GDC 17, i.e., a loss of control power will not result in a loss of power from CSSTs C and D which provide ac power to Train A and Train B shutdown boards respectively. Specifically, 6.9kV common switchgear C that normally provides ac power to Train A 6.9kV shutdown board receives control power from the vital battery that provides control power to the Train A 6.9kV shutdown board. Similarly, the control power to 6.9kV common switchgear D is from the vital battery that provides control power to Train B 6.9kV shutdown board.

The 6.9kV common switchgear C (circuit breakers 1712 and 2714) and 6.9kV shutdown board 1A-A feeder breakers 1716, 1718, and 1932 receive normal control power from 125VDC vital battery board (VBB)I. The 6.9kV common switchgear D (circuit breakers 1812 and 2814) and 6.9kV shutdown board 1B-B feeder breakers 1726, 1728, and 1934 receive normal control power from 125VDC VBBII. A design basis loss of VBBI and a single failure of VBBII (loss of control power) will result in the inability to automatically trip 6.9kV common switchgear C and D, respectively, and will inhibit the automatic transfer of the respective 6.9kV shutdown board until manual transfer to the alternate control power source is accomplished locally at the switchgear.

However, this does not result in loss of offsite power; breakers 1712 and 2714 on 6.9kV common switchgear C or breakers 1812 and 2814 on 6.9kV common switchgear D will remain in their normally closed position.

The non-Class 1E control power circuits from the vital battery boards to 6.9kV common switchgear C and D have redundant protection (breaker and fuse) in the event of a failure.

Selective coordination exists between the non-Class 1E and Class 1E circuits that are fed from each of the vital battery boards. Thus, failure of all of the non-Class 1E control power circuits on the vital battery boards will not have any effect on the Class 1E circuits or battery boards.

WBNP is in full compliance with GDC 17.

Use of CSST B as a replacement for CSST C requires control of breakers on 6.9kV start board B and 6.9kV unit boards 1B and 2B. Similarly, use of CSST A as a replacement for CSST D requires control of breakers on 6.9kV start board A and 6.9kV unit boards 1C and 2C. These breakers are controlled with non-Class 1E 250Vdc supplied by 250Vdc Turbine Building Distribution Boards 1 and 2. The normally aligned 250Vdc power sources and control power feeders to the start boards and unit boards meet the requirements for independence of offsite sources in accordance with GDC -17.

Regulatory Guide 1.6 has been implemented by providing the two preferred source circuits are, however, shared between the two nuclear units each ac load group with a connection to each of the preferred source circuits. Figure 8.1-2 indicates that redundant power trains in each unit are fed from different preferred source circuits. The two preferred source circuits are, however, shared between the two nuclear units.

Regulatory Guide 1.32 has been implemented by providing two immediate access circuits from the transmission network. Under normal plant alignments and either two immediate access circuits or one immediate access circuit and one delayed access circuit under maintenance alignments. Figures 8.1-2, 8.1-2a, 8.1-2b, and 8.2-1 indicate the functional arrangement of these continuously energized circuits.

Normal power is supplied to the 6.9kV unit boards by the unit station service transformers; to the 6.9kV common boards A and B by CSSTs A and B, and to the 6.9kV shutdown boards by the CSSTs C and D during normal plant operation.

8.2-19

WBN CSSTs A and B supply power to the 6.9kV unit boards and 6.9kV common boards A and B during startup or shutdown. Additionally CSST A or B may supply power to 6.9kV shutdown boards during maintenance of CSST D or C respectively in any operating mode.

Power continuity to the 6.9kV shutdown boards is normally provided from common station service transformers C and D. To provide a stable voltage these transformers have automatic load tap changers on each secondary which adjust voltage based on the normally connected shutdown boards.

During maintenance of common station service transformer C or D, power continuity to the normally connected train of 6.9kV shutdown boards is provided by the boards' maintenance feeds which connect to unit boards with access to common station service transformers B or A respectively. Use of transformers A and B is restricted such that they are not simultaneously credited as an independent source of offsite power for the Class 1E power system. Common station service transformers A and B have automatic load tap changers on the primary winding which adjust voltage based on the normally connected start board.

The automatic load tap changers for all common station service transformers are normally controlled in the automatic mode with the capability for manual adjustment from the main control room.

In addition to compliance with the above standards for portions of the offsite power system, the 6.9kV start board, 6.9kV unit boards, 6.9kV RCP boards, and the associated 6.9kV buses were procured in accordance with certain TVA standards and industry standards. TVA specifications require conformance of this equipment to such standards as the following: the overall construction, ratings, tests, service conditions, etc. are required to be in conformance to ANSI C37.20 and NEMA SG-5; the power circuit breakers are referenced to ANSI C37.4 through C37.9 and NEMA SG-4; associated relays are specified to conform to ANSI C37.1, instrument transformers to ANSI C57.13 and NEMA EI-2, and wiring to IPCEA S-61-402 and NEMA WC5.

The design of the equipment arrangement was also implemented to comply with GDC 3 for fire protection and with GDC 18 and Regulatory Guide 1.22 for each of periodic tests and inspections.

In accordance with GDC 18 requirements, the offsite power system has been designed to permit appropriate periodic inspection and testing. Transfers from the normal (offsite) supply to the alternate (offsite) supply, or from the normal or alternate supply to the standby supply, may be manual or automatic. Testing of these transfers while the nuclear unit is at power could result in transients that could cause tripping of the reactor or turbine. For this reason, testing of the manual and automatic sequence will be performed when the unit is shutdown. Provisions exist for individual testing of the BOP load-shedding circuits while maintaining the load-shedding capability of the circuit not being tested.

8.2.2 Analysis Each 161kV circuit and its associated CSSTs have sufficient capacity and adequate voltage to supply the essential safety auxiliaries of a unit under loss-off-coolant accident (LOCA) conditions and the other unit in concurrent orderly shutdown with a simultaneous worst0case single transmission system contingency.

Physical separation of lines, primary and backup protection systems, and a strong transmission grid minimize the probability of simultaneous failures of offsite power sources. Results of 8.2-20

WBN steady-state and transient stability studies show that the offsite power sources remain intact and are reliable sources to supply the onsite electric power system for (1) an SI in a WBN nuclear unit with an electrical fault in the generator step-up transformer, or (2) an SI in a WBN nuclear unit and either the loss of SQN Unit 2, the loss of the largest load on the grid (Bowater 161-kV substation), or the loss of the most critical transmission line.

Transient unit stability studies were performed to show that the WBN unit and the Watts Bar Hydro Plant units would maintain synchronism for a line-to-ground fault and a stuck breaker.

Transient voltage stability studies were performed on the 500-kV and 161-kV system by simulating a line-to-ground fault with a stuck breaker. These studies were performed to ensure relay coordination, unit stability, and voltage recovery requirements were met.

System Operation Each 6.9kV shutdown board can be powered through any one of four shutdown board supply breakers. For normal operation, power is supplied from the common station service transformers C and D through the 6.9kV common switchgear C and D circuits. The normal supply breakers are shown normally closed on Figure 8.1-2a. Shown normally open are the breakers that connect the alternate offsite power circuits to the shutdown boards (via CSSTs C or D), the emergency supply breakers that connect each shutdown board to a separate standby diesel generator, and the maintenance supply breakers that can provide power to the shutdown boards via the unit boards.

Automatic fast-bus transfers from the normal to the alternate source are initiated by CSST protection devices. Return to the normal supply is manual only. Manual transfers are fast transfers completed in approximately six cycles. Manual transfer may be effected between any incoming feeder breakers.

Each 6.9kV shutdown board is equipped with loss-of-voltage and degraded-voltage relaying.

When a shutdown board is connected to either its normal or alternate power source, loss-of-voltage or degraded-voltage initiates bus transfers to the standby diesel generator supply.

The degraded-voltage relays (27 DAT, DBT, DCT) have a voltage setpoint of 96% of 6.9kV (nominal, decreasing). These relays are arranged in a two-out-of-three coincidence logic (Figure 8.3-5A) to initiate a 10-second (nominal) time delay. If the voltage is still low at the end of 10 seconds, an alarm will be annunciated in the Control Room, a trip of the 6.9kV shutdown-board supply breaker will occur, load shedding from the 6.9kV and 480V shutdown boards and diesel generator start will be initiated, and the 480V shutdown-board current-limiting reactor-bypass breaker will close.

The undervoltage protection consists of three sets of relays. The first set of these relays (27LVA, LVB, LVC) has a voltage setpoint of 87% of 6.9kV (nominal, decreasing). These relays are arranged in a two-out-of-three coincidence logic (Figure 8.3-5A) to initiate a time delay that is set at 0.75 seconds. At the end of this time delay, if the voltage is still low, a trip of the 6.9kV shutdown-board supply breaker will occur. Once the supply breakers have been opened, a second set of induction disk-type undervoltage relays, 27D, which has a voltage setpoint of 70% of 6.9kV (nominal, decreasing) and an internal time delay of 0.5 seconds (nominal) at zero volts, will start the diesel generator. A third set of induction disk-type undervoltage relays, 27S, which has a voltage setpoint of 70% of 6.9kV (nominal, decreasing) and an internal time delay of 3 seconds (nominal) at zero volts, will initiate load shedding of the loads on the 6.9kV shutdown board, selected loads on the 480V shutdown board, and closure of the 480V shutdown-board current-limiting reactor bypass breaker.

8.2-21

WBN The time delays associated with the 27 DAT, DBT, DCT and with the 27 LVA, LVB, LVC relays are designed to allow for normal voltage transients on the system.

Voltage relays monitor the circuits to each 6.9kV shutdown board's alternate and emergency supply breakers and permit automatic transfer to those sources only when adequate voltage is available. A typical transfer scheme is shown schematically in Figure 8.3-5 for 6.9kV shutdown board 1A-A.

To protect the Class 1E equipment from a sustained overvoltage, each 6.9kV shutdown board is provided with a set of two instantaneous solid-state overvoltage relays, 59-O. These relays are arranged in a one-out-of-two logic which annunciates in the main control room after a short time delay. The relays have a nominal voltage setpoint of 7260 volts +/- 1% (110% of motor rated voltage). Upon receipt of the overvoltage alarm, the operator takes the necessary action to reduce the voltage.

The loss-of-voltage load-shedding relays are not bypassed when on diesel power, but will remain in the circuit at all times. WBNP's basis for retention of this feature is that it provides for automatic resequencing of the loads following any temporary loss of bus voltage. Since the loss-of-voltage load-shedding relay setpoint is fixed at 4830 volts +/- 5% (70% of 6.9kV) with an inverse time delay, the starting of the largest driven load will not cause actuation of the load shedding feature. Therefore, the operation of the load-shedding relay system is:

1. To shed the loads to prevent overloading the diesel generator and close the 480V shutdown-board current-limiting reactor-bypass breaker.

2. Allow the diesel generator to recover to rated speed and voltage.

3. And reconnect the loads in proper sequence.

Overcurrent and differential overcurrent protective relays are provided for each shutdown board to lockout all supply breakers if the loss of voltage is caused by overload or an electrical fault.

This prevents transfer of a fault between offsite power circuits or to the diesel generator. This minimizes the probability of losing electrical power from the transmission network on the onsite electrical power source.

Each of the offsite preferred power sources is monitored by an undervoltage relay. In the event of a loss of voltage on either 6.9kV start bus A or B with both units tripped, the load-shedding scheme will be initiated. This load-shedding scheme will trip off part of the BOP loads. The alternate supply breakers on 6.9kV RCP boards 1C, 1D, 2C and 2D will be tripped and locked out. Two redundant trip and lockout circuits are provided for each circuit breaker being load-shed. These redundant circuits have coincident logic features to minimize the probability of failure to operate and spurious trips. Functional test capability is built into each load-shedding circuit. The test features allow independent testing of each circuit while maintaining the load shedding feature of the circuit not undergoing testing. The redundant load-shedding circuits will be tested periodically.

The NRC issued Bulletin 2012-01, Design Vulnerability in Electrical Power Systems describing a condition resulting from the loss of a single phase between the transmission network and the onsite power distribution system at an operating nuclear plant in the United States. TVA has taken the short term actions described in the bulletin and the nuclear industry is developing a 8.2-22

WBN long term resolution. TVA has added the following license condition (Unit 2 License Condition 2.C.5) for the long term actions:

Actions to resolve the issues identified in the Bulletin will be implemented on or before December 31, 2017.

REFERENCES None 8.2-23

WBN TABLE 8.2-1 (SHEET 1 of 2)

COMMON STATION SERVICE TRANSFORMER (CSST) LOADING Equipment Max Load* or Rating (MVA)

CCST A H-WDG 76 MVA X-WDG 48 MVA Y-WDG 48 MVA CSST B H-WDG 76 MVA X-WDG 48 MVA Y-WDG 48 MVA CSST C H-WDG 55 MVA X-WDG 40 MVA Y-WDG 40 MVA CSST D H-WDG 55 MVA X-WDG 40 MVA Y-WDG 40 MVA

• The worst case loading is less than or equal to the transformer rating.

WBN TABLE 8.2-1 (SHEET 2 of 2)

OFFSITE POWER SYSTEM EQUIPMENT CAPABILITIES, WORST-CASE PARAMETERS (Cont'd)

Equipment Rating or Nominal Limits Allowable Operating Time EQUIPMENT CAPABILITIES VOLTAGE LIMITS A. Balance of Plant Motors 6.6-kV Rated Min Operating kV Continuous 5.94 kV Min Starting kV Not Applicable 5.61 kV Max Operating kV 7.26 kV B. Class 1E Motors 6.6-kV Rated Min Operating kV Continuous 5.94 kV Min Starting kV Not Applicable 5.61 kV Max Operating kV 7.26 kV

SECURITY-RELATED INFORMATION, WITHHELD UNDER 10CFR2.390 FIGURE 8.2-3

Figure 8.2-4 Deleted

FIGURE 8.2-6 DELETED

WATTS BAR FINAL SAFETY ANALYSIS REPORT CONTROL BUILDING UNITS 1 & 2 ELECTRICAL EQUIPMENT ELECTRICAL CONTROL AREA PLAN EL 755.0 TVA DWG NO. 45N210 RJ FIGURE 8.2-7

FIGURE 8.2-8 through 8.2-10 DELETED

SECURITY-RELATED INFORMATION, WITHHELD UNDER 10CFR2.390 FIGURE 8.2-11

WBN 8.3 ONSITE (STANDBY) POWER SYSTEM 8.3.1 AC Power System The onsite ac power system is a Class 1E system which consists of: (1) the standby ac power system, and (2) the 120V vital ac system. The safety function of the standby ac power system is to supply power to permit functioning of components and systems required to assure that (1) fuel design limits and reactor coolant pressure boundary design conditions are not exceeded due to anticipated operational occurrences, and (2) the core is cooled and vital functions are maintained in event of a postulated accident in one unit and to safely shutdown the other unit, subject to loss of the preferred power system and subject to any single failure in the standby power system. The safety functions of the 120V Vital ac System is to supply power continuously to reactor protection, instrumentation, and control systems; engineered safety features instrumentation and control systems; and other safety-related components and systems, subject to loss of offsite and standby ac power sources and any single failure within the vital ac system.

8.3.1.1 Description Standby AC Power System The standby ac power system is a safety-related system which continuously supplies power for energizing all ac-powered electrical devices essential to safety. Power continuity to the 6.9kV shutdown boards is maintained by switching the preferred (normal or alternate offsite) sources, and the standby (onsite) source. Source selection is accomplished by automatically transferring from normal or alternate sources to the standby source. The reverse transfers are manual. The circuits connecting the normal, alternate, and standby sources to the distribution portion of the standby ac power system are shown in Figure 8.l-2a. The normal and alternate power circuits and the transfer scheme used to effect the source switching for these circuits is further discussed in Section 8.2.

System Structure The standby ac auxiliary power distribution system consists of the following:

a. The four Class 1E diesel generator units (EDGU).

b. The 6.9kV shutdown boards and 6.9kV shutdown relay logic panels.

c. The 6.9kV/480V transformers and the 480V shutdown boards.

d. All the motor control centers supplied by the 480V shutdown boards for both units.

8.3-1

WBN This system is shown on Figure 8.l-2a.

The standby power system serving each unit is divided into two redundant load groups power trains. These power trains (Train A and Train B for each unit) supply power to all safety-related equipment. The power train assignment for safety-related electrical boards is indicated by use of a -A or -B suffix following its designation on all drawings and documents. Loads supplied from these boards are safety-related unless designated on the single line drawings with a triangle symbol. Equipment shown on schematic drawings is safety- related when designated with a train assignment of A or B. Nonsafety-related loads are also supplied from the Standby Power System through Class 1E protective devices.

Physical Arrangement of Components The boards, motor control centers, and transformers comprising the system are arranged to provide physical independence and electrical separations between power trains necessary for eliminating credible common mode failures. The power train assignment for safety-related electrical equipment is indicated by use of an -A or -B suffix following its designation on all drawings and documents.

The specific arrangements of these major components are described as follows:

Reference:

Figures 8.3-1 through 8.3-4.

Diesel Generators The physical arrangement of the four diesel generators and associated equipment provides physical independence by isolation as indicated in Figure 8.3-1. Each diesel generator and its associated support equipment is separated from all others by missile and fire barrier type walls.

(See Section 9.5.1) 6900-Volt Shutdown Boards 1A-A, 1B-B, 2A-A, and 2B-B These boards are located in the Auxiliary Building at Elevation 757.0. They are arranged electrically into four power trains (2 per unit) with two boards associated with each load group and each unit. The boards comprising load group A are located in the Unit 1 area and those of load group B are located in the Unit 2 area. The load group A boards are separated from the load group B boards by an 8-inch reinforced concrete wall extended to the ceiling (see Section 9.5.1). The minimum distance between load group A and load group B boards is 8 feet 111/2 inches. The two boards associated with load group A or load group B are separated from each other by a distance of 19 feet 9 inches.

6900-480-Volt Shutdown Board Transformers 1A1-A, 1A-A, 1A2-A, 1B1-B, 1B-B, 1B2-B, 2A1-A, 2A-A, 2A2-A, 2B1-B, 2B-B. and 2B2-B These transformers are located in the Auxiliary Building at Elevation 772.0. Four rooms have been provided so that the transformers associated with power trains A and B of both nuclear units are in separate rooms. The walls isolating these rooms are made of 8-inch reinforced concrete and extend to the ceiling (see Section 9.5.1). The three transformers associated with one train of each unit are located in one of the four rooms (Figure 8.3-2).

8.3-2

WBN 480-Volt Shutdown Boards 1A1-A, 1A2-A, 1B1-B, 1B2-B, 2A1-A, 2A2-A, 2B1-B, and 2B2-B Separate rooms for the 1A, 2A, 1B and 2B boards and their respective 480-volt Control/Auxiliary Building Vent boards are located in the Auxiliary Building at Elevation 757.0 (Figure 8.3-3).

480-Volt Reactor MOV Boards 1A1-A, 1A2-A, 1B1-B, 1B2-B, 2A1-A, 2A2-A, 2B1-B, and 2B2-B These boards are located in the Auxiliary Building at Elevation 772.0. They are located in separate rooms on a power train basis and are located in the same room as the reactor vent boards associated with the same unit and train. The 480-volt Auxiliary Building common board is in the room with MOV boards 1A1-A and 1A2-A. The isolating walls of these rooms are constructed of 8-inch reinforced concrete extended to the ceiling (see Section 9.5.1 and Figure 8.3-2).

480-Volt Reactor Vent Boards 1A-A, 1B-B, 2A-A, and 2B-B These boards are located in the rooms with the 480-volt reactor MOV boards described above (Figure 8.3-2).

480-Volt Control/Auxiliary Building Vent Boards 1A1-A, 1A2-A, 1B1-B, 1B2-B, 2A1-A, 2A2-A, 2B1-B, and 2B2-B These boards are located in the rooms with the 480-volt shutdown boards described above (Figure 8.3-3).

480-Volt Diesel Auxiliary Boards 1A1-A, 1A2-A, 1B1-B, 1B2-B, 2A1-A, 2A2-A, 2B1-B, 2B2-B These boards are located in the diesel generator building at Elevation 760.5. They are located in separate rooms on a unit and train basis. The isolating walls of the rooms are reinforced, poured-in-place concrete (see Section 9.5.1). Interconnecting doorways are protected by self-closing fire-resistance doors (Figure 8.3-4).

6900-480-Volt Pressurizer Heater Transformers 1A-A, 1B-B, 1C, 1D, 2A-A, 2B-B, 2C, and 2D These transformers are located in the Auxiliary Building at Elevation 782.0. Transformers 1A-A, 2A-A, 1D and 2D are located in one room in the Unit 1 area. Transformers 1B-B, 2B-B, 1C and 2C are located in one room in the Unit 2 area (Figure 8.3-2).

System Operation Each 6.9kV shutdown board can be powered through any one of four shutdown board supply breakers. For normal operation, power is supplied from the 6.9kV common station service transformers C and D through the common station service Switchgear C and D circuits. The breakers are shown normally closed on Figure 8.1-2A. Shown normally open are the breakers connecting the alternate offsite power circuits to the shutdown board (via common station service transformers C and D), the breaker connecting the shutdown board to a diesel generator for standby operation, and the maintenance circuit to the shutdown boards (via the unit boards). However, the maintenance source shall only be used when both units are in the 8.3-3

WBN cold shutdown mode.

For a discussion of the automatic transfer of the shutdown boards see Section 8.2.2.

When the preferred (offsite) power is not available, each shutdown board is energized from a separate standby diesel generator.

Each 6.9kV shutdown board is equipped with loss-of-voltage and degraded-voltage relaying.

The loss-of-voltage and degraded-voltage relays initiate a transfer to the standby diesel generator. When a 6.9kV shutdown board is supplied from an alternate supply, the loss-of-voltage and degraded-voltage relays will also initiate automatic transfer from the alternate to the standby diesel-generator supply. Voltage relays monitor each source and permit connection only if adequate power is available. A typical transfer scheme is shown in Figure 8.3-5 for 6.9kV shutdown board 1A-A.

To protect the Class 1E equipment (motors, etc.), each 6.9kV Class 1E shutdown board is provided with one set of degraded-voltage relays and three sets of undervoltage relays. The degraded-voltage relays (27 DAT, DBT, and DCT) have a voltage setpoint of 96% of 6.9kV (nominal, decreasing).

The relays are arranged in a two-out-of-three coincidence logic (Figure 8.3-5A) to initiate a 10-second (nominal) time delay. At the end of 10 seconds, if the voltage is still low an alarm will be annunciated in the Control Room, a trip of the 6.9kV shutdown board supply breaker will occur, load shedding from this board and selected loads from the 480V shutdown board will be initiated, and the 480V shutdown-board current-limiting reactor-bypass breaker is closed.

The undervoltage protection consists of three sets of relays. The first set of these relays (27 LVA, LVB, LVC) has a voltage setpoint of 87% of 6.9kV (nominal, decreasing). These relays are arranged in a two-out-of-three coincidence logic (Figure 8.3-5A) to initiate a time delay that is set at 0.75 seconds. At the end of this time delay, if the voltage is still low, a trip of the 6.9kV shutdown board supply breaker will occur. Once the supply breakers have been opened, a second set of induction disk-type undervoltage relays, 27D, which has a voltage setpoint of 70% of 6.9-kV (nominal, decreasing) and an internal time delay of 0.5 seconds (nominal) at zero volts, will start the diesel generator. A third set of induction disk-type undervoltage relays, 27S, which has a voltage setpoint of 70% of 6.9kV (nominal, decreasing) and an internal time delay of 3 seconds (nominal) at zero volts, will initiate load shedding of the loads on the 6.9kV shutdown board, selected loads on the 480V shutdown board, and closure of the 480V shutdown-board current-limiting reactor-bypass breaker.

The time delays associated with the 27 DAT, DBT, DCT and the 27 LVA, LVB, LVC relays are designed to allow for normal voltage transients on the system.

To protect the Class 1E equipment (motors, etc.) from a sustained overvoltage, each 6.9kV Class 1E bus is provided with a set of two solid-state overvoltage relays, 59-0. These relays are arranged in a one-out-of-two logic which annunciates in the MCR. The relays have a nominal voltage setpoint of 7260 volts + 1% (110% of motor rated voltage). The operator takes the necessary action to reduce the voltage.

The loss-of-voltage load-shedding relays are not bypassed when on diesel power, but will remain in the circuit at all times. TVA's basis for retention of this feature is that it provides for automatic resequencing of the loads following any temporary loss of bus voltage. Since the 8.3-4

WBN loss-of-voltage load-shedding relay setpoint is fixed at 4830 volts + 5% (70% of 6.9-kV) with an internal time delay of 3 seconds at zero volts, the starting of the largest driven load will not cause actuation of the load-shedding feature. Therefore, the operation of the load-shedding relay system is:

1. To shed the loads to prevent overloading the diesel generator and close the 480V shutdown-boards current-limiting reactor-bypass breaker,

2. To allow the diesel generator to recover to rated speed and voltage, and

3. To reconnect the loads in proper sequence.

Overcurrent and differential-overcurrent protective relays are provided for each shutdown board to lockout all supply breakers if the loss of voltage is caused by overload or an electrical fault.

This prevents transfer of a faulted bus between offsite power circuits or to the diesel generator.

This minimizes the probability of losing electrical power from the transmission network or the onsite electrical power source.

A loss of voltage on the 6.9kV shutdown board starts the diesel generator and initiates logic that trips the supply feeder breakers, all 6.9kV loads (except the 480V shutdown board transformers), and the major 480-V loads. The bypass breaker for the 480V shutdown-boards current-limiting reactor is also closed as part of this logic. Table 8.3-2 shows the loads that are automatically tripped. Figures 8.3-6 through 8.3-13 show the load stripping schematically.

When the diesel generator has reached rated speed and voltage, the generator will be automatically connected to the 6.9kV shutdown board bus. (Refer to Figure 8.3-14B, 14C, 14D and 14E). This return of voltage to the 6.9kV shutdown bus initiates logic which connects the required loads in sequence. Table 8.3-3 shows the order of applied loads. The standby (onsite) power system's automatic sequencing logic is designed to automatically connect the required loads in proper sequence should the logic receive an accident signal prior to, concurrent with, or following a loss of all nuclear units and preferred (offsite) power.

There are no automatic transfers of board supplies between redundant power sources. All 480V shutdown boards and all motor control centers have alternate feeders to their respective board buses. Transfers between the normal and alternate feeders are manual. Some manual transfers of loads between power trains are used. These transfers are tabulated in Table 8.3-10.

All circuit breakers supplying the alternate feeders for the manual transfers in Table 8.3-10

[with the exception of the spent fuel pit pump C-S, the 125V auxiliary feedwater turbine (AFWT) dc manual transfer switch (units 1 and 2), and the 120V AFWT AC manual transfer switch (units 1 and 2)] are normally opened. The transfer switches are mechanically interlocked to prevent closing a switch in a manner to parallel both feeds. Breaker position for alternate feeders will either be alarmed in the MCR when closed or will be verified to be open on a weekly basis unless analysis verifies that the alternate feeder and its source have the capability/capacity to carry the load for the worst case loading conditions. For the components where power supply alignment is critical (battery chargers, inverters, and component cooling water pump C-S) the alternate feeder breakers are verified open in accordance with the technical specifications. For the other components (spent fuel pit pump C-S and turbine driven auxiliary feedwater pump control power) where power supply alignment is not important, breaker position verification is not required.

8.3-5

WBN-1 A manual means of supplying power to the 480V Auxiliary Building common board (which is not normally supplied power from the diesel generators during a condition where offsite power is lost) is provided. Provisions have been made to manually connect this board to the 480V shutdown boards 1B2-B and 2B2-B. This is shown in Figure 8.3-15. The purpose of these feeders is to provide power to operate the ice condenser refrigeration units, located on the 480V Auxiliary Building common board and glycol pumps, located on the 480V Auxiliary Building MCC B and C, during the unlikely condition of a loss of offsite power that exceeds 2 to 3 days. The two normal bus feeder breakers must be moved from their normal compartments to the compartments which are connected to the 480V shutdown boards 1B2-B and 2B2-B. These feeders may also provide power to the Auxiliary Building 125 Ton Crane in order to place a loaded spent fuel cask in a safe condition as required during a loss of offsite power event.

System Instrumentation Remote instrumentation of the 6.9kV shutdown boards consist of transducer driven ammeters for the normal and alternate preferred feeders, diesel generator feeder, and all motor loads.

Also included are bus voltmeters and various annunciations which are located in the Main Control Room and Auxiliary Control Room. This is shown on Figures 8.3-16 through 8.3-19.

The diesel generator feeder has a watt transducer and a watt transducer mounted on the 6.9kV shutdown board which drives remotely located meters in the Main and Auxiliary Control Rooms.

The diesel generator feeder voltage is also monitored remotely.

All of this instrumentation is used in testing the diesel generator and in monitoring the 6.9kV shutdown boards during normal conditions and loss of offsite power conditions.

Remote instrumentation of the 480-volt shutdown boards consists of bus voltmeters and various annunciations all of which are located in the Main Control Room and Auxiliary Control room.

This is shown in Figures 8.3-20 through 8.3-23A. All the boards have locally mounted ammeters which monitor the normal and alternate feeders.

Remote instrumentation of the 480-volt motor control centers consists of annunciation in the Main and Auxiliary Control Rooms upon loss of board voltage.

System Reliability The redundant power trains shown in Table 8.3-1 and Figure 8.1-2a have loads connected to corresponding distribution boards in each train such that failure of any one component or the entire power train will not prevent the redundant system from performing the required safety function. The equipment requiring ac power during a loss of offsite power and/or accident condition is supplied from the 6.9kV shutdown board directly or indirectly through the transformers at a lower voltage. At the 480-volt level each power train has two 480-volt shutdown boards. Each 480-volt shutdown board is supplied power from the 6.9-kV shutdown board through a 2000kVA, 6900-480-volt transformer. A single spare transformer is provided for the two normal transformers and is manually placed in service when one of the normal transformers is taken out of service for maintenance.

Each 480-volt shutdown board supplies power to a group of motor control centers in addition to the large 480-volt motor loads. A motor control center is normally fed from one of the 480-volt shutdown boards and has an alternate feed from the other shutdown board of the same power train. Manual selection between the normal and alternate feeders is made at the motor control center.

8.3-6

WBN The pressurizer heaters are divided into four groups per unit. Two groups are supplied from each 6.9kV shutdown board through individual 500kVA, 6900-480-volt transformers. This is shown on Figures 8.3-16 through 8.3-19.

Equipment Identification Redundant major electrical equipment carries the same name in each power train with the exception that the board designation also has either -A or -B suffix depending upon the power train assignment. For example, 6.9kV shutdown board 1A-A and 6.9kV shutdown board 1B-B are redundant to each other. Similar designations are used for safety-related loads being supplied from safety- related (onsite) boards. For example, RHR (Residual Heat Removal) pump 1A-A and RHR pump 1B-B are redundant to each other. Further description of the equipment identification scheme used appears in Section 8.3.1.4.5.

Equipment Capacities Tables 8.3-4 through 8.3-7 present the bus rating for each electrical distribution board in the standby (onsite) power system. The diesel generator rating is 4400kW continuous or 4840kW for two hours out of 24 at a power factor of 0.8.

The equipment capacities used in Tables 8.3-4 through 8.3-7 are based on contract data or, when contract data is not available, typical data compiled from vendor literature and industry standards. Section 8.3.1.2.1 pertaining to the ac power system analysis will discuss the adequacy of the components in the system.

System Control Power Table 8.3-9 shows the vital 125V dc control power sources for each onsite shutdown board.

Each board has a normal and emergency (or backup) control bus, with each but having access to two 125V batteries by way of a manual transfer switch located in the boards. The normal control bus supplies power for Main Control Room operation. The emergency control bus supplies power for Auxiliary Control Room operating modes. This is shown on Figures 8.3-16 through 8.3-23A.

The control power for onsite motor control centers is single phase 120V ac supplied either from the center's own bus through a 480-120V transformer or from each individual load feeder through a 480-120V control power transformer.

8.3-7

WBN System Testing Located adjacent to each 6.9kV shutdown board is the 6.9kV shutdown relay logic panel equipped with the necessary selector switches, push button switches, and indicating lights for testing the automatic load stripping and load sequencing logic for that particular power train.

The tests are to be performed on only one of the four power trains per plant at any one time.

Testing of one power train does not prevent the remaining power trains from performing their intended safety function.

Testing of the onsite power distribution system is divided into three categories:

1. Simulated "Loss of Preferred Power" test.

2. Group tests for equipment that can be tested during power operation.

3. Group tests for equipment that cannot be tested during power operation.

Test 1 can be performed at any time since no equipment is actually operated and the test does not prevent an accident signal from performing the intended function. Indicating lights are used to verify the test.

Group tests (test 2) during power operation for testable type equipment will only be performed when the system parameters will permit the starting, stopping, and restarting of the loads within the power train under test. The testing of one group of functions within a power train does not prevent the other groups within the same or redundant power train from performing their intended safety function in the event of a simultaneous accident and/or loss of offsite power signal.

Group tests during power operation for nontestable type equipment will only be performed when the system parameters will permit blocking of the functions within the group under test. The testing of any one train does not prevent operation of any other train or redundant train in the event of a simultaneous accident and/or loss of preferred power.

Figures 8.3-6 through 8.3-13 show a schematic representation of the ability to test groups as described above.

Standby Diesel Generator Operation The diesel generator system is shown on single line diagram, Figure 8.3-24. The schematic of the engine start and stop circuits is shown in Figures 8.3-25B through 8.3-29E. Remote control of the engine from the Main Control Room is accomplished through interposing relays located in the diesel building. The schematic for this control is shown in Figure 8.3-29B through 29E.

8.3-8

WBN The 6.9kV shutdown boards in each power train derive power from preferred power from CSST C and D or from their respective standby power source. During conditions where the preferred (offsite) source is not available, each 6.9kV shutdown board is energized from a separate standby diesel generator set.

A loss of voltage on the 6.9kV shutdown board starts the diesel generator and initiates logic that trips the supply feeder breakers, all 6.9kV loads except the 480V shutdown board transformers, and the major 480V loads. The bypass breaker for the 480V shutdown-boards current-limiting reactor is also closed as part of this logic. Table 8.3-2 shows the loads that are automatically tripped. When the diesel generator set has reached 850 RPM or greater and not less than 95% of rated voltage, it is automatically connected to the 6.9kV shutdown board bus.

The return of voltage to the 6.9kV shutdown bus initiates logic which connects the required loads in sequence. In addition, each of the 480V Shutdown Boards has the necessary logic to trip the respective CRDM and Lower Compartment cooling fans supplied from the board and safety related MCCs have the logic to trip selected non-safety related loads. Table 8.3-3 shows the order in which loads are applied.

As shown in Table 8.3-3, there are two loading sequences. One, which is applied in the absence of a "safety injection signal (SIS)," the "non-accident condition," and the other, the "Accident condition," applied when a safety injection signal is received prior to or coincident with a sustained loss of voltage on the 6.9kV shutdown board. A loss of offsite power coincident with a safety injection signal is the design basis event; however, a safety injection signal received during the course of a non-accident shutdown loading sequence will cause the actions described below:

1. Loads already sequentially connected which are not required for an accident will be disconnected.

2. Loads already sequentially connected which are required for an accident will remain connected.

3. Loads awaiting sequential loading that are not required for an accident will not be connected.

4. Loads awaiting sequential loading that are required for an accident will either be sequentially loaded as a result of the non-accident loading sequence or have their sequential timers reset to time zero from which they will then be sequentially loaded in accordance with the accident sequence. Refer to Section 8.1.5.3 for the degree of compliance to Regulatory Guide 1.9.

A safety injection signal received in the absence of a sustained loss of voltage on a 6.9-kV shutdown board will start the diesel generators but will not connect them to the shutdown boards. There are no automatic transfers of shutdown boards between standby power supplies in compliance with Regulatory Guide 1.6. The events which initiate a safety injection signal are discussed in Chapter 7.

8.3-9

WBN For test and exercise purposes, a diesel generator may be manually paralleled with a normal or alternate (offsite) power source. A loss of offsite power will automatically override the manual controls and establish the appropriate alignment.

The diesel can be started by manually operated emergency start switches located on the unit control board in the main control room (MCR) and Auxiliary Control Room. (The diesel also has a local manual start switch as well as remote start from the MCR for test purposes). Automatic starting is from an accident signal or a loss of voltage or degraded voltage signal. All automatic and emergency start signals operate to deenergize a normally energized control circuit. These signals also operate a lockout relay that removes all manually operated stop signals except emergency stop, all protective relaying on the generator except generator differential and engine overspeed. The lockout relay must be manually reset to return the D/G to its standby alignment at the diesel generator relay panel in the diesel building. A local idle start switch is provided by the diesel manufacturer to start and run the engine at idle speed for periods of unloaded operation. The mode selector switch in the MCR must be in the local mode for the local idle-start switch to be enabled. The local idle-start-switch circuitry has normally open relay contacts from the normally energized control circuit that is deenergized by the automatic or emergency start signals. Therefore, during idle operation, any automatic or emergency start signals will disable the idle start circuitry and will command the engine to go to full speed. As part of the diesel generator testing required by Plant Technical Specifications, proper function of this bypass circuit is ensured.

Per manufacturers recommendations, after four hours of operation at less than 30% load, the diesel generator is run at a minimum of 50% load for at least 30 minutes.

At synchronous speed and loads less than 20% of rated, a 3000 hour0.0347 days <br />0.833 hours <br />0.00496 weeks <br />0.00114 months <br /> cumulative time limit has been placed on turbochargers. Between 20% and 50% load, there is 6000-hour cumulative time limit. After the time limit has been reached for a particular load level, this component will be replaced. If a unit is to be run in both the above load ranges, the 3000-hour time limit will be used.

In general, after starting, the diesel generators will continue to run until manually shutdown.

However, there are protective devices installed to shutdown a diesel generator automatically to prevent heavy damage in the event of a component malfunction. These protective devices are listed below. Protective devices marked with an asterisk (*) are operative at all times while the others are operative only during the test mode of operation. These devices must be manually reset before the engine can be restarted. The status and operability of the trip bypassed circuits can be tested and abnormal values of all bypassed parameters are alarmed in the Control Room.

8.3-10

WBN-1 Generator phase balance relay reverse power relay generator differential relay*

loss of field relay Engine overspeed switch (*)

low lube oil pressure switch high water jacket temperature switch Only one diesel is in the test mode (i.e., operated in parallel with the offsite power supply) at any one time unless both units are in cold shutdown; then, both diesel generators of the same train may be in test. One diesel generator may be stopped by its protective devices without jeopardizing the safe shutdown of a unit during all postulated design basis events. The protective devices will prevent excessive damage to a diesel generator and plant personnel will be able to return the diesel generator to its operating state with a minimum of outage time.

The diesel can be stopped by manually operated emergency stop switches located in the MCR, Auxiliary Control Room, and on the diesel control panel in the diesel building. A manual stop switch is provided in the MCR for stopping the engine under normal conditions. Under accident or loss of offsite power conditions this stop switch is automatically disconnected from the stop circuit. The normal stopping sequence of the engines allows the engines to continue to run at rated speed for 2 additional seconds at which time the 2301A electronic governor will control the idle speed of the engine. The sequence then runs the engines at idle for 10 minutes before shutting them down.

Emergency stopping bypasses this 10 minute idle speed time and brings the engine directly to zero speed. Should an emergency start signal be initiated during the 10 minutes idle speed time of a normal stop condition the engine will automatically return to synchronous speed and emergency operation.

Diesel engine speed may be manually controlled remotely from the MCR while the diesel generator is being operated unloaded. During testing when the diesel generator unit is connected in parallel to one of the offsite power supplies, the diesel loading may be varied by use of the speed control switch or voltage control switch. When in the test mode, an accident start signal will automatically trip the diesel generator supply breaker and switch the diesel generator unit to the operate mode.

8.3-11

WBN A "Local-Remote" manual selector switch, located in the diesel generator building must be in the "Remote" position for all manual remote control from the control room to be in effect, with the exception of emergency start. Similarly, for the manual controls located in the diesel building to be in effect the switch must be in the "Local" position with the exception of emergency stop. The switch is manually operated from the "Remote" to the "Local" position.

This operation, however, requires an electrical permissive interlock signal initiated from the MCR. These operations are shown in Figure 8.3-24.

Diesel Generator Description Each diesel-generator set is furnished by Power Systems-A Morrison-Knudsen Division and consists of two 16-cylinder engines (EMD 16-645E4 or E4B) directly connected to a 6.9kV Electric Products generator. The continuous rating of each set is 4400kW at 0.8 power factor, 6.9kV, 3-phase, and 60 Hz. Each diesel-generator set also has an additional rating of 4840kW for two hours out of 24. The normal operating speed of the set is 900 rpm. The diesel-generator set uses a tandem arrangement; that is, each set consists of two diesel engines with a generator between them connected together to form a common shaft. The generator sets are physically separated, electrically isolated from each other, and located above the water level of the probable maximum flood.

Governor Control of the Diesel-Generator Sets The governor consists of the following:

(a) Woodward EGB-13P actuator on each engine.

(b) 2301A Computer (reverse biased).

(c) Magnetic speed pickup.

The Woodward EGB-13P actuator used with the 2301A computer is a proportional governor which moves the fuel rack in inverse proportion to the voltage signal from the computer. There is a governor actuator on each engine and they are electrically connected in series so that the loss in signal to one would also be the loss in signal to the other. Based upon the input from the magnetic speed pickup, the electronic governor sends electric signals to the actuators on the two engines. This signal goes to the coils of each actuator that are connected in series so that each coil sees the same electric signal. The terminal shaft of each actuator will move exactly the same amount for each change in signal. This means that the fuel control shaft movement on each engine will be identical.

Attached to the fuel control shaft through an appropriate linkage is an injector rack for each cylinder which by its position meters the fuel injected into its cylinder. This rack is set with a standard factory gauge so that each cylinder will receive the same amount of fuel. Each injector rack is spring loaded to prevent any single injector that may stick from affecting the remaining racks on that engine..

8.3-12

WBN Two devices produce alarm signals should the two engines of a diesel-generator set receive different amounts of fuel. One of these devices is a synchro device that gives an alarm signal should the difference in the actuator control positions for the two engines exceed a certain tolerance. The other such device is an exhaust temperature difference alarm.

The mechanical governor is set to control the unit speed at a higher rpm than the 900 rpm of the electrical governor but below the mechanical trip point. Since the electrical system is reverse biased, a failure in the electrical system would cause the engine speed to increase until it reached the setpoint of the mechanical governor and at that point the mechanical governor would control the engine.

Diesel Generator Auxiliaries The four diesel generator auxiliaries are supplied power from the 480V diesel auxiliary boards located in the diesel building on 760.5 (see Figure 8.3-4). These boards and loads are shown on Figures 8.3-30 and 8.3-31.

This board and loads are shown on Figures 8.3-30A and 8.3-31A.

Diesel Fuel Oil System A complete description of the diesel fuel oil system is given in Section 9.5.4.

Diesel Cooling System A complete description of the cooling system for a diesel engine is given in Section 9.5.5.

Diesel Air Starting System A complete description of the diesel generator air starting system is given in Section 9.5.6.

Diesel Servicing A local switch at each diesel-generator set is provided that cuts out the remote starting equipment while the set is being serviced. A contact of this switch actuates an annunciator in the MCR when the switch is not in the automatic start position.

Diesel Generator Lubrication System A complete description of the diesel generator lubrication system is given in Section 9.5.7.

8.3-13

WBN Diesel Generator Instrumentation Instrumentation consists of voltmeters, wattmeters, varmeters, ammeters, and annunciation display panels located in the MCR, Auxiliary Control Room, and locally in the Diesel Generator Building. The instrumentation is not essential for automatic operation of the diesel.

Diesel Generator Control Power There is a diesel generator battery system for each diesel generator. Each system is comprised of a battery, battery charger, distribution center, and cabling. The battery provides control and field-flash power when the charger is unavailable. The charger, if 480V ac is available, supplies the normal dc loads, maintains the battery in a fully charged condition, and recharges the battery while supplying the required loads regardless of the status of the plant.

The batteries are physically and electrically independent. The diesel generator control power systems are ungrounded and have ground detection instrumentation.

The battery has sufficient capacity when fully charged to supply required loads for a minimum of four-hours following a loss of normal power. Battery capacity design requirements consider minimum required voltage for loads and the effects of aging and ambient temperature. Each battery is normally required to supply loads only during the time interval between loss of normal feed to its charger and the receipt of emergency power to the charger from its respective diesel-generator. The batteries, comprised of 58 cells, have adequate capacity considering the minimum terminal voltage of 105 volts and derating for 50°F temperature and aging.

The normal supply of dc current to the battery boards is from the battery charger. Each charger maintains a floating voltage of approximately 130 volts on the associated battery board bus (the battery is continuously connected to this bus also) and is capable of maintaining 135 volts during an equalizing charge period (all loads can tolerate approximately 135-volt equalizing voltage). Each charger has access to a normal and alternate ac supply (see Figures 8.3-30 and 8.3-31, typical), from the two respective 480V ac diesel generator auxiliary boards. If the normal circuit is unavailable, the alternate circuit is selected by a manual transfer. The charger is a solid-state type which converts a 3-phase 480V ac input to a nominal 125V dc output. The dc output voltage will vary no more than +/- 1.0% for a supply voltage amplitude variation of +/-

10% and frequency variation of +/- 2.0%. Some operational features of the chargers are: (1) an output voltage adjustable over the range of 125 to 135 volts, (2) equalize and float modes of operation (the charger normally operates in the float mode at 130 volts, but can be switched to the equalize mode with an output of 135 volts), (3) a current-limit feature which limits continuous overload operation to approximately 140% of rated output, (4) protective devices which prevent a failed charger from loading the battery, (5) metering and alarm circuits to monitor the charger output.

The diesel-generator 125V dc control and field flash circuits are supplied power from their respective dc distribution panels located in each diesel generator room. A typical panel and its associated loads are shown on Figure 8.3-55. Each circuit (including the battery charger input to the panel) is protected by a thermal-magnetic circuit breaker. The battery input circuit to the panel is protected by a thermal-magnetic circuit breaker and a coordinated fuse.

8.3-14

WBN Prior to placing the 125V dc diesel generator battery system into service, the system components will be tested to ensure their proper operation. The diesel-generator batteries will be preoperationally tested for the following conditions:

1. To verify that the diesel generator battery capacity will meet the manufacturer's guaranteed performance.

2. To verify that the diesel generator battery system has the ability to supply power during loss of the 480V ac power supply to the diesel generator battery charger for the design discharge period.

3. To verify that the battery charger will recharge the diesel generator battery to the nominally fully charged condition while supplying power to the normal control loads.

In order to verify proper operation of the diesel generator battery system the following items are alarmed in the MCR for each system: low and/or loss of battery charger output voltage, loss of 480V ac supply to the battery charger, blown fuse indication on the battery main fuses, battery main breaker open, battery discharge, battery bus overvoltage, battery system ground detection, and battery system distribution breaker open alarm (with exception of the battery charger tie breaker, which is monitored indirectly via the battery discharge alarm). Also, the MCR alarms are supplemented by the following local meter and alarms: battery and charger output current, battery and charger output voltage, and battery system ground detection. Refer to Figure 8.3-24 for further clarification on these items.

Analysis of Diesel Generator 125-Volt dc Control Power System The diesel generator 125V dc control power system is designed to comply with requirements set forth in General Design Criteria (GDC)s 2, 4, 5, 17, and 18. The design also conforms with Regulatory Guides 1.32 Revision 2, 1.6 Revision 0, and 1.155, Revision 0, and IEEE Std.

308-1971. Elsewhere in this chapter, Regulatory Guide 1.32 Revision 0 is the committed and met revision level. References in the text without revision level indicated is construed to be Revision 0. The following paragraphs discuss each of the requirements:

General Design Criteria 2 and 4 Each diesel generator 125V dc control power system is comprised of a physically and electrically independent battery system (see Figure 8.3-1). These systems are located in the associated diesel generator room which is a seismic Category I structure. This structure will provide protection from the effects of tornadoes, tornado missiles, and external floods.

All components of this system are seismically qualified and have been designated as Class 1E equipment. (Refer to Section 3.11.)

8.3-15

WBN General Design Criteria 5 The diesel generator 125V dc battery systems are located in individual rooms with the associated diesel generator. Each room is equipped with its own heating and ventilating system independent of the other battery rooms and each room is separated from the others by missile and fire barrier-type walls (see Section 9.5.1). Also, as stated above, the battery systems are electrically independent (one per diesel-generator set). Therefore, the structures, systems, and components important for safe operation are adequately separated, physically, and electrically.

General Design Criteria 17 The diesel generator 125V dc battery system's design, equipment location, separation, redundancy, and testability enables the standby power system to perform its intended safety function assuming a single failure.

General Design Criteria 18 The diesel generator 125V dc battery system is designed to permit appropriate periodic inspection and testing of important areas and features, in order to assess the continuity of the system and the condition of its components. In addition, prior to placing the system into service, it will be preoperationally tested and thereafter periodically tested to ensure the proper operation of all components.

Also, under conditions as close to design as practical, the full operational sequence that requires the battery system's operation will be tested as a part of the diesel generator periodic system testing program.

Regulatory Guide 1.32, Revision 2 The diesel generator 125V dc battery system's chargers have the capacity to continuously supply all steady-state loads and maintain the batteries in the design maximum charged state or to fully recharge the batteries from the design minimum discharge state within an acceptable time interval, irrespective of the status of the plant during which these demands occur. In addition, a capacity test will be performed periodically on each diesel generator battery system, as recommended by IEEE 450-1980 or IEEE 450-1995.

Regulatory Guide 1.6, Revision 0 Each of the diesel generator battery systems supply power only to the loads of the diesel generator with which it is associated. Therefore, the battery systems' safety loads are separated into redundant load groups such that loss of any one group will not prevent the minimum safety functions from being performed. Also, there are no provisions for manually or automatically interconnecting the redundant load groups of this system.

8.3-16

WBN Regulatory Guide 1.155, Revision 0 Each of the diesel generator battery systems has sufficient capacity to supply required loads for the four-hour station blackout (SBO) period. The batteries are periodically tested in accordance with the Technical Specifications to assure adequate capacity is maintained.

IEEE Std. 308-1971 As discussed in the previous paragraphs, the overall system design of the diesel generator 125V dc control power system incorporates appropriate functional requirements, redundancy, capability and surveillance in order to meet the intent of this criteria. In addition, the system design is such that the battery is immediately available during normal operations and following loss of power from the alternating-current system. Also, each battery has sufficient capacity to meet the power demand and time requirement of each connected load.

Prior to placing the 125V dc diesel generator battery system into service, the system components will be tested to ensure their proper operation. See the discussion under "Diesel Generator Control Power" for a test description.

Diesel Generator Capacity In compliance with Regulatory Guide 1.9, Rev. 2, the table below compares worst case loading of the diesel generators with their continuous rating and their 2-hour rating. Worst case loading occurs for a simultaneous loss of offsite power and a loss-of-coolant accident on the unit the diesel is associated with. Adequate margin exists between worst case loading and diesel capacity. To satisfy the continuous rating, it may be necessary for operator action to remove certain loads not required for accident mitigation within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of starting a diesel. Also refer to Section 8.1.5.3.

Diesel Generator 1A-A 1B-B 2A-A 2B-B Worst Case Loading(kW)* 4400 4400 4400 4400 Short Time (2-hr) rating (kW) 4840 4840 4840 4840 Continuous rating (kW) 4400 4400 4400 4400 Cold Engine Motor Start 4785 4785 4785 4785 Capability, first 3 minutes (kW)

Hot Engine Motor Start 5073 5073 5073 5073 Capability, fully Turbo-charged (kW)

• The worst case loading is less than or equal to the diesel generator rating.

8.3-17

WBN Diesel Generator Operational Testing The operational testing of the diesel generator is accomplished from the diesel generator control panel located in the powerhouse MCR. Full load test on a unit requires that the unit be paralleled with the offsite power system. Should a loss of offsite power occur while in the test mode, the diesel generator will switch to the emergency mode of operation with one exception.

The diesel generator will remain in the testing mode if the 6.9kV shutdown board's power feed is through the alternate feeder. In this case, the diesel generator's instantaneous overcurrent relays are active.

Tripping of the diesel generator feeder breaker:

(1) Places the diesel generator in an automatic asynchronous mode of operation.

(2) Creates a loss of offsite power condition on the 6.9kV shutdown board which will initiate its load shedding logic.

(3) As soon as the offsite power supply feeder breaker to the 6.9kV shutdown board is tripped and the under voltage load stripping relays operate, the diesel generator feeder breaker to the board will close and initiate the load sequencing logic.

Fuel Consumption Tests Each unit was loaded at loads of 1666.5, 3333, and 5000kW at .8 pf, and the time to consume 100 pounds of fuel was recorded. The duration of the test at each load after temperature stabilization was 1/2 hour with the time to consume 100 pounds of fuel varying from 5 minutes 41 seconds at 1666.5kW to 2 minutes 28 seconds at 5000kW.

Transient Tests Full load transient tests were made to verify that voltage and frequency transient characteristics of the system. Loads of 4400kW and 4750kW at 0.8 pf were picked up and dropped three times, each with the following characteristics results:

Peak Freq. Change %

Load change Unit 1 Unit 2 Unit 3 Unit 4

+4400 kW -1.6 -1.3 -1.3 -2.0

-4400 kW +1.6 +2.0 +1.3 +1.8

+4750 kW -1.6 -1.6 -1.3 -2.5

-4750 kW +2.0 +1.6 +2.0 +2.3 8.3-18

WBN Peak Voltage Change %

Load change Unit 1 Unit 2 Unit 3 Unit 4

+4400 kW -6.0 -6.9 -8.7 -13.0

-4400 kW +6.0 +8.7 +10.4 +10.4

+4750 kW -6.0 -8.7 -8.7 -17.4

-4750 kW +6.0 +8.7 +10.4 +13.0 72-Hour Tests The units were tested at rated voltage, rated frequency at a load of 4750kW, 0.8 pf for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> with engine and generator readings being recorded every half hour.

Demonstration of Equivalent Reliability Regulatory Guide 1.6 requires that for multiple prime movers driving a single generator, the applicant demonstrate a reliability equivalent to that of a single generator driven by a single prime mover. Accordingly, a testing program was carried out to demonstrate the capability of the diesel generator units to start from cold ambient conditions and accept at least 50 percent of the 30-minute rating within the design time limit of 30 seconds from diesel start signal. There were 306 cold starts successfully completed. There were seven void tests due to operator error or test stand malfunction. There were no failures. Refer to Sequoyah Nuclear Plant FSAR, Section 8.3.1.1, for the reliability test description.

During the tests, a minimum 2500kW load was applied within 11 seconds after the start signal.

The voltage and frequency stabilized within 13 seconds after the start signal.

This test was conducted following the completion of the 72-hour test run specified in the contract. The 300 cold starts were made on the first two units (150 starts per unit). The remaining two units were subjected to 25 consecutive starts as specified in the original contract.

120V Vital AC System The configuration of the ac control power system for both units is shown in Figure 8.1-3. Each unit has four identical power channels (designated as Channels I, II, III and IV), with the equipment of each channel being electrically and physically independent from the equipment of other channels. Each channel for both units consists of an inverter and a distribution panel which facilitates load grouping and provides circuit protection. Each channel has access to a normal, a standby, and a regulated transformer bypass source supply, as well as a spare inverter. The ac control power system is grounded.

8.3-19

WBN The spare inverters may be used as an alternate uninterruptible power supply for the distribution panels and may be shared between unit inverters of the same channel. A spare inverter cannot be used to supply both units simultaneously.

Physical Arrangement of Components The inverters are located in the Auxiliary Building at Elevation 772. The Channels I and II inverters are located in the Unit 1 area and the Channels III and IV inverters are located in the Unit 2 area. The Channels I and II inverters are separated from Channels III and IV inverters by an 8-inch reinforced concrete wall, extending to the ceiling. The Channel I and the Channel III inverters are separated from the Channel II and the Channel IV inverters respectively by a distance of 60 feet. The physical arrangement of the inverters is shown on Figure 8.3-36.

System Reliability The system incorporates features which serve to increase the overall reliability. Each channel has access to four power sources: two 480V ac sources, a 125V dc source, and a 120V ac regulated transformer bypass source. There are two unit inverters and a spare inverter for each channel capable of receiving power from either the 480V ac source or the 125V dc source. Each inverter has an auctioneered solid-state transfer switch between the 480V ac and 125V dc sources. The unit inverter output has an automatic make-before-break solid-state transfer to the regulated bypass source in the event of inverter failure or overload. An automatically synchronized manual transfer between the output of the inverter and the 120V regulated transformer bypass source and between the unit inverter system output and the spare inverter is provided so that the inverters may be taken out of service for maintenance without interrupting power to the loads. Spare inverters do not have a regulated transformer bypass source. The current limiting feature of the inverter provides self-protection from load faults.

The inverters and instrumentation power boards are monitored to alert the operator of abnormalities. The distribution bus is sectionalized with coordinated fuses to prevent losing the entire board due to failure of a single branch circuit breaker.

Loads Each channel supplies the following types of loads: reactor protection system, reactor systems instrumentation, separations and interlock relay panels, and other panels and equipment associated with reactor instrumentation and control systems. Figures 8.3-37 through 8.3-40 list the loads on each instrument power board and identify the safety and nonsafety-related loads.

The capability of the inverter to supply its connected load is discussed in Section 8.3.1.2.

Nonsafety-related loads are supplied from Class 1E circuit breakers located on the Class 1E instrument power board to provide qualified fault isolation.

Loads are assigned to each channel according to its divisional separation requirement. Those loads requiring four divisions of separation are assigned to the four channels. Those loads requiring two divisions of separation are assigned to Channels I and II (Trains A and B, respectively) for Unit 1 and Channels III and IV (Trains A and B, respectively) for Unit 2. The auxiliary feedwater pump turbines' components powered by this system, receive power from either Channel III or IV for Unit 1 and Channels I and II for Unit 2. Loads which do not require divisional separation are assigned among the four channels of each unit.

8.3-20

WBN Inverter The normal supply of ac power to the distribution panels is from the inverter for each channel.

The unit inverter system consists of four major subassemblies: a dc power supply, an auctioneering circuit, a regulated transformer bypass source circuit, and an inverter circuit. The alternate supply of ac power to the distribution panels is from the spare inverter for each channel which has all the same subassemblies except for the regulated transformer bypass source circuit. The dc power supply converts the 480V ac normal inverter input to direct current. The auctioneering circuit accepts the dc power supply (normal supply) and battery (emergency supply) inputs and permits a switchless bidirectional transfer between them in the event of 480V ac supply failure and restoration. The dc output of the auctioneering circuit is converted to ac by the inverter circuit. The regulated transformed bypass circuit on the unit inverters provides 120V ac output to the distribution panels by bypassing the inverter via an automatic static switch or manual transfer switch.

AC power input for each inverter is derived from the station auxiliary power system (see Figure 8.1-3) via two physically and electrically independent circuits. Each circuit has access to a preferred (offsite) and a standby (onsite) source. If the normal circuit supplying an inverter is unavailable, the other circuit is selected by a manual transfer. The emergency dc power input for each inverter is from the corresponding channel dc distribution panel.

The inverters are a solid-state type which converts 3-phase 480V ac and 125V dc inputs to a nominal 120V ac output having a rated capacity of 167 amperes for load power factors from 0.8 to 1.0. Over this output current range, the ac output voltage does not vary more than 2.0% for normal 480V ac supply voltage amplitude variations of +10/-15% and frequency variations of 2.0%, and an emergency supply voltage variation from 100V dc to 140V dc. The output frequency regulation is 60 Hz +0.5 Hz with a maximum harmonic distortion of 5% and a maximum rate of change of 1.0 Hz per second.

Some operational features of the inverters are: (1) an output voltage adjustable over the range of 115V to 125V, (2) synchronization of the unit inverter to the internal 120V ac regulated transformer bypass source and synchronization of the spare inverter to the output of the unit inverter, (3) automatic transfer with no loss of load from the unit inverter output to the regulated transformer bypass source upon unit inverter failure or overload through a static switch, (4) a current-limit feature which limits short circuit currents to 200% rated output, (5) protection devices which prevent a failed inverter from loading its associated normal and emergency power sources, and (6) metering and alarm circuits to monitor the inverter output.

Vital Instrument Power Board The eight vital instrument power boards (four per unit) are located in four separate rooms in the Auxiliary Building at Elevation 757. Mounted on each of these boards are: the distribution bus, subdistribution bus fuses, distribution bus disconnect switch, high speed branch circuit breakers, and various instruments for monitoring distribution bus ac voltage. On each of the distribution boards, there is an alternate supply transfer switch that aligns the spare inverter as the alternate power supply for either Unit 1 or Unit 2 boards on each channel.

8.3-21

WBN In addition, mounted on Boards I-III and I-IV is equipment for supplying the CO2 fire protection system with a source of ungrounded ac power.

Each branch circuit breaker is coordinated to its subdistribution bus fuse. The purpose of this coordination scheme is to prevent a fault on one branch feeder from causing damage to any branch feeder cable or a loss of the entire board due to a single branch feeder fault.

All of the branch circuit breakers are 100-ampere frame molded-case breakers with alarm contacts to alert the control room operator of an open or tripped breaker. The distribution bus is monitored by a panel mounted voltmeter and an undervoltage relay to warn the operator of a loss of distribution panel power.

Tests and Inspections Prior to placing the vital ac system in operation, the system components will be tested to ensure their proper operation. The inverters will be checked for output voltage and frequency, transfer between normal and emergency sources, and 100% output delivery while operating on either the normal or emergency supplies. In addition, the unit inverters will be checked for their ability to synchronize and automatically transfer by static switch to the regulated transformer bypass supply. Panel-mounted instruments monitoring the inverter will provide nominal indication.

Installed compliance instruments to meet Technical Specification requirements will be calibrated.

For the instrument power board, circuit breakers will be tested for proper trip operation using test sets that simulate a fault current, fuses will be checked to verify that the sizes and types specified on the master fuse report have been installed, and the board instruments will be calibrated. The vital 120V ac control power system will be periodically tested and inspected to ensure its continued capability to perform its operation. The unit inverter and auctioneering equipment may be removed from service for inspection and test by synchronizing and manually transferring to the regulated transformer bypass power source or a spare inverter. The surveillance instrumentation will provide continuous monitoring of the system.

Vital Power System Load Data Figures 8.3-37 through 8.3-40 list all loads supplied from the vital ac system. Table 8.3-11 contains a summary of the loading on each vital instrument power board/inverter. The basis for the load data was determined from manufacturer's data. The capability of the vital ac system to supply power to its loads is verified by analyses in Section 8.3.1.2.2.

Design Bases and Criteria for Safety-Related Motors, Switchgear Interrupting Capacity, Circuit Protection, and Grounding.

The design bases for safety-related motors are the applicable Onsite Power System design bases listed in Section 8.1.4. In particular, bases 1, 3, 4, 5, and 6 apply to safety-related motors.

The criteria which are applied to motor size, starting torque, and insulation are as follows.

8.3-22

WBN-1 Motor Size and Starting Torques Each motor has adequate capacity and operating characteristics for all conditions of starting and running which the connected equipment may impose.

The motor nameplate horsepower rating is not normally exceeded when the connected equipment is operating at rated capacity. The motor horsepower rating, based on nameplate or vendor data, may be exceeded on a continuous basis for specific cases after a design review to ensure that the temperature limits of the insulation system are not exceeded.

Motor Insulation For most applications insulation is Class B. Motors in areas which are subject to unusual operating conditions either during normal, emergency, or accident operation are designed to be suitable for operation in these environments. These include conditions such as gamma radiation and high humidity, temperature, and pressure.

Interrupting Capacity of Distribution Equipment The criteria for selecting the interrupting capacity of switchgear are as set forth in ANSI Standard C37.010 for 6900-volt circuits and C37.13, Section 13-9.3.5, for 480V circuits. No circuit interrupter is applied in a circuit where it would be required to interrupt a current exceeding its interrupting rating.

Motors rated at and above 400 horsepower are normally supplied at 6900 volts. The switchgear interrupting rating is 500 MVA, or a maximum of 41,000 amperes. Motors below 400 horsepower are supplied at 480 volts. The smaller motors, in general 50 horsepower and below, are fed from 480V motor control centers. Larger motors are usually fed from 480V metal-enclosed switchgear (load centers), unless frequency of operation or location of motor relative to a feeder board indicate otherwise. Current-limiting reactors are provided in the 480V shutdown boards, between the 3200A bus and the 1600A bus, to limit the maximum fault current on the 1600A bus and the load equipment (MCC's, etc). The current-limiting reactors are bypassed when the respective 6.9-kV bus is fed from the standby diesel generator since the maximum fault current from the diesel generator is within the equipment's ratings without the use of the reactors. This current-limiting reactor bypass provides acceptable voltage levels at the motor control centers for starting the 460V motors when the diesel generator supply breaker closes.

Electric Circuit Protection The auxiliary power system for each unit receives power from unit station service transformers and CSST's C and D. During startup, shutdown, and loss of the power supply to a Unit Station Service Transformer for any reason, the unit boards and the RCP boards will be supplied by the common station service transformers A and B. The shutdown boards will be supplied from CSSTs C and D.

8.3-23

WBN Whether the 6900V shutdown boards are being supplied by their normal sources or alternate sources, the entire ac auxiliary power system, from the station service transformer to the emergency load motor control center electrically farthest from the sources, is a coordinated selective trip system. An exception to this is for alternate feeders from 480V load centers to motor control centers, where current limiting fuses are required to limit downstream fault currents to within equipment ratings. An additional exception is for some non-safety-related breakers using Westinghouse Type LS amptectors.

Motor feeder protection is selected and set to protect the motor and its cable. It is backed up by the next upstream circuit breaker in the event it should fail to open its circuit under fault. Backup protection will isolate the board feeding the faulted circuit but will not necessarily protect the circuit with the failed breaker against damage.

The 6900V motors are protected by induction-type, inverse-time overcurrent relays specifically designed for protection of large motors. These relays have three individual contacts which respond to motor overloads, locked rotor currents and circuit faults. Motor overload contacts have inverse time-current characteristics with set points between approximately 1.15 and 1.40 times normal full load current. Time levers for motor overload contacts are selected to allow normal motor starts. Motor overloads are alarmed in the MCR. Locked rotor contacts will pickup instantaneously at about 2 times normal full load current. If a relay's locked rotor contact is picked up when the overload contact closes, the motor will be tripped off line. Fault contacts pick up instantaneously for currents above 3 times normal locked rotor currents, except for the reactor coolant pumps which are 2.1 times the normal locked rotor currents.

The incoming supply breaker on a 480V switchgear board has an inverse-time, induction-type overcurrent relay or a static-type overcurrent relay with both long time and short time settings.

Each motor feeder breaker has a static-type overcurrent relay with long time and instantaneous settings. The instantaneous current setting is for short-circuit protection and is selected as approximately twice the locked rotor current to avoid nuisance tripping on inrush starting current.

The long-time current setting is for motor overload protection and is slightly above the full-load current at rated service factor; the long-time delay setting is chosen to permit locked-rotor current for the accelerating time, if known, or according to the switchgear vendor's recommendation.

Each motor control center feeder breaker on the 480V switchgear board has a long-time setting and a short-time setting. These settings are selected such that the complete tripping time-current curve when plotted on coordination paper will be above the curve of the molded-case circuit breaker for the largest motor fed from the motor control center. This molded-case circuit breaker provides short-circuit protection. Motor overload protection is provided by overload heater elements in the motor starter. The incoming breaker in the motor control center is nonautomatic and thus has no trip settings.

8.3-24

WBN Grounding Requirements The 6900V secondary winding of each unit and common station service transformer is wye-connected, with the neutral grounded through a resistor which will limit ground fault current to 1600 amperes maximum. The neutral resistor serves to prevent overvoltage on the winding which could occur in the event of a ground fault if the 6900V system were not intentionally grounded. Since there is a deliberate ground current path, each 6600V motor and transformer feeder circuit is protected by ground overcurrent relays which will trip that circuit's feeder breaker. The common station service transformer neutral resistor has an overcurrent relay which will trip the 161kV breakers which supply that transformer from the 161kV system. This overcurrent relay is coordinated with the downstream 6900V start buses ground overcurrent relays. This coordination is necessary because each start bus automatically transfers to its alternate supply common station service transformer on low voltage. If a board ground fault should cause the common station service transformer to be deenergized before the fault is isolated by board supply breakers, the fault may be transferred to the other common station service transformer and cause it to be tripped also.

The ground overcurrent relays for 6900V load feeder circuits are electromechanical type used with a ground sensor current transformer which encircles all three conductors of the feeder cable. Thus the sensor is not subject to errors caused during high inrush currents on motor starting. The ground sensor relay is instantaneous in operation; it can detect ground fault currents as low as 15 amperes. The objective of the sensitivity and speed of this ground protector is to limit the damage to the motor iron in the event of a ground fault. The ground fault current level of 1600 amperes has been successfully used in TVA projects for at least 15 years. This fault level is selected because it is large enough to enable early detection and low enough to prevent excessive damage before fault clearing by the feeder breaker.

The diesel generator is 6900V, 3-phase, wye-connected with the neutral grounded through a relatively high ohmic resistance to keep ground fault currents to a low level. The maximum ground fault current available from the diesel generator is approximately 8 amperes. Ground faults are detected by a voltage relay across the neutral grounding resistor. Grounds cause an alarm but do not cause any breaker operation.

The Class 1E 480V systems are supplied through - transformers that are not grounded. This permits minimum disturbance to service continuity. Ground detectors are provided on each 480V load center to indicate the presence of a grounded-phase conductor. No ground fault relaying was required since there would be only a very small current flowing to a single-line-to-ground fault. A ground fault on more than one phase is a line-to-line fault and will trip the feeder breakers of the faulted circuits.

Sharing of the AC Distribution Systems and Standby Power Supplies The onsite ac power distribution system for Watts Bar Nuclear Plant is divided into two divisions or trains in each unit (A and B). Each power train is made up of a 6900V switchgear (6900V shutdown board), 480V power transformers and switchgear, and 480V motor control centers.

Each power train, through its 6900V shutdown board, has power connections to a unit generator, both offsite power circuits, and a dedicated diesel generator. Except for the offsite (preferred) power supplies, there are no ac power connections between the onsite power trains within a unit or between the two units.

Safety systems that are shared between the two Watts Bar units are discussed in Section 3.1.2 8.3-25

WBN under Criterion 5 (GDC-5) - Compliance. Therefore, there are electric motors powered by the onsite distribution system of one unit that drive safety-related machinery (i.e. essential raw cooling water pumps, component cooling system pumps) required for safe shutdown of the other unit. For example, the ERCW system is arranged in two headers (trains) each serving certain components in each unit (see Section 9.2.1.2). There are eight ERCW pumps arranged electrically so that two pumps are fed from each shutdown board (1A-A, 1B-B, 2A-A, 2B-B).

Only one pump per board can be automatically loaded on a DGU at any one time. The pumps supplied from the 'A' boards pump into the 'A' train header and likewise the 'B' pumps. The minimum combined safety requirements for one 'accident' unit and one 'non-accident' unit are met by only two pumps on one header (train) with one exception: If one unit is on RHR cooling and has been shutdown for not more than 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, and a LOCA occurs on the other unit with a concurrent loss of offsite power, the loss of one train as a single failure would require that three ERCW pumps be powered from the remaining train to provide the required heat removal.

Therefore control features are provided to allow the manual loading of a second ERCW pump on each diesel generator when a unit is in a shutdown condition.

8.3.1.2 Analysis 8.3.1.2.1 Standby AC Power Systems The standby ac power system is designed to comply with the requirements set forth in GDC 17 and 18. The design also conforms with Regulatory Guides 1.6 R0 and 1.9 R3 and IEEE Std 308-1971. The following paragraphs discuss each of the requirements.

Capacity, Capability, and Margin General Design Criteria 17 The standby ac power system is designed to provide sufficient capacity and capability to assure that (1) specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded as a result of anticipated operational occurrences, and (2) the core is cooled and containment integrity and other vital functions are maintained in the event of a postulated accident in one unit and to safely shutdown the other unit.

Regulatory Guide 1.9 R3 Per Regulatory Guide 1.9, Revision 3, during the design basis loading sequence the diesel generators shall be designed to maintain 95% of nominal frequency and 75% nominal voltage. During recovery from transients caused by disconnection of the largest single load, the diesel generator speed shall not exceed the nominal speed plus 75% of the difference between the nominal speed and the over speed trip setpoint or 115% of nominal, whichever is lower (corresponds to 1001 rpm for WBN diesel generators based on overspreed trip of 1035-1050 rpm per Vendor Drawings for Standby Diesel Generator System. Also, frequency shall be restored to within 2% of nominal for step load transients and disconnection of the largest single load in less than 3 and 4 seconds respectively. During recovery from transients caused by step load increases or resulting from disconnection of the largest single load, voltage shall be restored to within 10% of nominal within three (3) seconds. The transient following the complete loss of load should not cause the speed of the unit to attain the over speed trip setpoint and should not cause voltage to exceed 8880V.

IEEE Std 308-1971 8.3-26

WBN Each distribution circuit is capable of transmitting sufficient energy to start and operate all required loads in that circuit.

A failure of any unit of the standby power source (diesel) does not jeopardize the capability of the remaining standby power sources (diesels) to start and run the required shutdown systems, emergency systems, and engineered safety feature loads.

Diesel fuel storage at the site is sufficient to operate the standby power source (diesels) while supplying post-accident power requirements for seven days.

The total standby power source (diesel) capacity for the plant is sufficient to operate the engineered safety features for a LOCA in one unit and those systems required for concurrent safe shutdown on the remaining unit. No single failure of a standby power source unit (diesel) will jeopardize this capability.

Redundancy General Design Criteria 17 The onsite ac electrical power sources (diesels) and the onsite electrical distribution system have sufficient independence, redundancy, and testability to perform their safety function assuming a single failure.

Regulatory Guide 1.6, Revision 0 The electrically powered ac safety loads are separated into redundant load groups such that loss of any one group will not prevent the minimum safety functions from being performed.

IEEE Std 308-1971 Sufficient physical separation, electrical isolation, and redundancy is provided to prevent the occurrence of common failure mode in Class 1E systems. The Class 1E system design includes:

(1) Electric loads separated into two redundant load groups.

(2) The safety actions performed by each group of loads are redundant and independent of the safety actions provided by its redundant counterpart.

(3) Each of the redundant load groups has access to both a preferred and a standby power supply. Each power supply consists of one or more sources.

Independence Regulatory Guide 1.6, Revision 0 The design of the standby ac power system conforms with the independence requirements placed on redundant systems by Regulatory Guide 1.6. These include:

(a) The standby source of one load group cannot be automatically paralleled with the 8.3-27

WBN standby source of another load group or with the offsite system.

(b) No provisions exist for automatically connecting one load group to another load group (c) No provisions exist for automatically transferring loads between redundant power sources.

(d) Where means exist for manually connecting redundant load groups together, at least one interlock is provided to prevent an operator error that would parallel their standby power sources.

IEEE Std 308-1971 Class 1E electric equipment is physically separated from its redundant counterpart or mechanically protected as required to prevent the occurrence of common failure mode.

Each type of Class 1E electric equipment is qualified either by analysis, successful use under applicable conditions, or by actual test to demonstrate its ability to perform its function under normal and design basis events.

Distribution circuits to redundant equipment are physically and electrically independent of each other.

Auxiliary devices that are required to operate dependent equipment are supplied from a related bus section to prevent the loss of electric power in one load group from causing the loss of equipment in another load group.

Protective devices are provided to isolate failed equipment automatically. Sufficient indication is provided to identify the equipment that is made available.

By means of breakers located in Category I structures, it is possible to disconnect completely Class 1E systems from those portions located in other than Category I structures.

Surveillance and Testability General Design Criteria 18 Electric power systems important to safety are designed to permit appropriate periodic inspection and testing of important areas and features. In particular, the systems are designed with capability for periodic testing of the operability and functional performance of the components of the systems, such as onsite power sources, relays, switches, and buses, and also the operability of the systems as a whole. In addition, under conditions as close to design as practical, the full operational sequence that brings the systems into operation will be tested periodically including applicable portions of the protection system, and the transfer of power among the nuclear power unit, the offsite power systems, and the onsite power system.

The distribution system is monitored to the extent that it is shown to be ready to perform its intended function.

Status indicators are provided to monitor the standby power supply continuously. Annunciators are provided in the Control Room to monitor and alarm the status of the standby power supply.

8.3-28

WBN Availability IEEE Std 308-1971 The standby power supply is available following the loss of both preferred power supplies within a time consistent with the requirements of the engineered safety features and the shutdown system under normal and accident conditions.

8.3.1.2.2 Analysis of Vital 120V ac Control Power Systems AC Distribution Boards and Inverters General The 120V ac Class 1E electrical systems were designed, components fabricated, and have been or will be installed meeting the requirements of the NRC 10 CFR 50 Appendix A General Design Criteria 1-5, 17 and 18, IEEE Std 308-1971, NRC Regulatory Guide 1.6, IEEE Std 336-1971, and other applicable criteria as referenced herein.

The system for each unit consists of four uninterruptible power supply (UPS) systems and distribution boards, cable, and other hardware. The Unit 1 and Unit 2 Vital Instrument Power Boards for each channel are independent and supplied from a unitized UPS or regulated transformer bypass source. Additionally, each channel has a spare inverter which can be manually aligned to replace either unit inverter but cannot be used to supply both units simultaneously.

The distribution boards and UPS systems are grouped into four divisions of separation. The boards of each division are located in separate rooms at Elevation 757 of the Auxiliary Building which is designed as a Seismic Category I structure. Likewise, the inverters are located at Elevation 772 and are divisionally separated. Refer to Section 8.3.1.4.2 for separation conformance.

Since this equipment is outside the primary containment area, it will not be exposed to hostile environments or significant radiation due to a LOCA. The system design, equipment location, separation, and redundancy assure ability to meet the requirements for the applicable accident in Chapter 15 are in full compliance with NRC General Design Criteria 17 and Regulatory Guide 1.6, Revision 0.

120V AC Distribution Boards All load output circuit breakers used on the boards are high-speed hydraulic-magnetic type having the unique characteristic of high-speed tripping at low-fault currents. This type breaker is capable of providing low-fault current selective tripping when the board power source is from the inverter which has a low-fault current capability. The breakers are fed in groups from a stub bus with a current-limiting fuse and are capable of interrupting the fault currents available from all power sources. The fuses and breakers have current-time tripping characteristics which are coordinated with the load cable thermal characteristics to provide selective clearing of all faults.

The exact board distribution circuit and loads can be seen by referring to Figures 8.3-37 through Figure 8.3-40.

8.3-29

WBN The buswork within the board is sized electrically to supply the maximum load required and is capable of withstanding the electrical and mechanical forces resulting from the maximum short-circuit current available.

The normal or preferred power source to each distribution board on each channel is from its associated unit inverter system. A regulated transformer bypass source is available from the 120V ac regulated transformer supply which is derived from the 480V ac shutdown board system. The input power is delivered to the main bus via the same cable as the normal inverter output. The alternate source to the distribution boards is from the spare inverter. The input power is delivered via a manually operated transfer switch located in the distribution board. The switch has make-before-break contacts that permit transferring the bus feeder from either the normal or alternate source while maintaining circuit continuity.

Uninterruptible Power Supply (UPS)

The UPS delivers the required ac power via a 2-wire, 120V circuit. The electrical characteristics of the UPS units are sized and coordinated to maintain the required inverter output for the worst maximum or minimum operable input conditions. Each UPS system is capable of delivering 167 amperes continuously which is adequate to meet the maximum design load requirement. A non-automatic molded-case breaker with a current limit fuse in the inverter output circuit, provides thermal overload protection as well as short-circuit protection.

The normal ac input power is derived from either one or two 480V shutdown distribution boards.

The manually operated transfer switch through which the power is delivered is interlocked in such a manner as not to parallel the two shutdown boards in compliance with Regulatory Guide 1.6, Revision 0. The dc alternate input power source is derived directly from the dc distribution board. This input is biased against the normal rectified ac input by means of an 'auctioneered' diode circuit to permit use of the battery source only in the event the ac input voltage is lost.

Input protective devices for both sources are coordinated and sized in accordance with circuit requirements.

The regulated transformer bypass source circuit receives single-phase power derived from the same 480V ac shutdown board system as the normal ac input and can supply a 120V ac output from the UPS when the inverter subassembly is bypassed. The static switch that provides the automatic transfer to the regulated transformer bypass source upon unit inverter failure is a make-before-break type switch to ensure that power is not interrupted. Input protective devices are coordinated and sized in accordance with circuit requirements.

Surveillance and Monitoring Each distribution board and UPS system is equipped with the proper instruments to provide visual indication of the necessary electrical quantities. All circuit breakers and fuses are equipped with an alarm contact that closes for a blown fuse or automatic operation of a circuit breaker. Undervoltage alarm relays provide annunciation for loss of power on the buses or power input to the UPS. Annunciation is also provided for automatic transfer of the static switch on the unit inverters. Closure of any alarm contact provides annunciation in the MCR.

8.3-30

WBN Seismic Qualification One complete board assembly and one complete UPS system assembly have been subjected to the SSE conditions stipulated in the design criteria for the particular elevation at which they are installed (Refer to Section 3.10). The tests were performed in conformance to IEEE Std 344-1971, Guide for Seismic Qualification of Class 1E Equipment. One or more breakers of each type used on the equipment were operated under simulated fault conditions at the same time the assembly was experiencing seismic forces. Equipment surveillance and alarm components were energized and monitored during the test. The seismic test assures that the complete assembly will continue to function properly and continue to deliver the required power during and after any expected SSE condition.

Design Test All inverters were electrically tested to assure that each unit is capable of performing all requirements as specified.

All boards were subjected to and satisfactorily passed the following tests as specified under the indicated paragraphs of Section 20-5 of ANSI C37.20-1969:

20-5.3.2 - Mechanical Operation 20-5.3.4.1 - Control Wiring Continuity 20-5.3.4.2 - Control Wiring Insulation All molded-case circuit breakers comply with NEMA Publication No. AB-1-1964 requirements.

All control circuit wiring has self extinguishing insulation rated 600 volts in accordance with paragraph 6.1.3.1 of ANSI C37.20-1969. All equipment is certified to operate within the environmental requirement called for in the design criteria (Refer to Section 3.11). The arrangement of circuit interrupters and switches permits easy isolation of the installed assemblies for future test and maintenance purpose.

8.3.1.2.3 Safety-Related Equipment in a LOCA Environment Electrical equipment located inside containment has been designed to maintain equipment safety functions and to prevent unacceptable spurious actuations. All power cables feeding equipment inside containment are provided with individual breakers to protect the power sources (both 1E and non-1E) from the effects of electrical shorts. Reactor coolant pumps have two circuit breakers. All other power cables are provided with a cable protector fuse which, in the event of a breaker failure, is designed to protect the containment penetration.

These breakers and protector fuses ensure that, should an electrical short occur inside containment, the electrical power source will not be affected.

8.3-31

WBN A failure analysis has been made on the ability of the Class 1E electrical 6.9 kV and 480V auxiliary and control (120V ac and 125V dc) power systems to withstand failure of submerged electrical components from the postulated LOCA flood levels inside containment. Some of the identified components are automatically deenergized in event of a LOCA. The remaining components that are powered from a Class 1E source were assumed to have a high impedance fault for the analysis. The magnitude of the leakage currents used in the analysis is the maximum value of current that each protective device would carry for an indefinite period, i.e., the protective device's thermal rating. The results of the analysis show that for the Class 1E 6.9kV and 480V auxiliary power system, the post-LOCA flood will not cause breakers to trip out of sequence or the power system to be degraded. In addition, the results show that for the Class 1E 120V ac and 125V dc power system, any low impedance faults (short circuit) will be isolated by either the primary or backup protective device without tripping the main breaker. To emphasize, submergence of electrical components will not prevent the Class 1E electric (either AC or DC) systems from performing their intended safety function for the postulated submerged condition.

A listing of major electrical components located inside containment that may be inundated following a LOCA appears in Table 8.3-14 along with an explanation of the safety significance of the failure of the equipment due to flooding. The components listed in Table 8.3-14 are automatically de-energized by the accident signal, and the accident signal must be reset to remove the automatic trip signal from each component. Testing to ensure the operability of all of the components used in the design for automatic de-energization is performed in conjunction with the tests which verify ESFAS actuation circuitry. In addition to the electrical equipment listed in the table, the water level inside containment may also flood nonsafety-related local control stations, electrical sensors, electric motors for motor operated valves, and electric solenoids for air-operated valves. The flooding of this equipment will not affect the plant safety.

All local control stations located inside containment are provided with manual throw switches located outside containment at the motor control center. These manual switches are used to remove control power from the local control stations during normal operation. In order to utilize the local control stations during operating conditions where containment access is permitted, the manual switch must be closed to provide power to the local stations. Indications are provided in the MCR whenever the manual throw switches are in the closed position. Thus, spurious operation of safety-related equipment due to post-LOCA submergence of the local control station is prevented.

There are no electric motor-operated valves located inside containment below the maximum LOCA water level that are required to function for other than containment isolation. Valves used for containment isolation will receive a signal to close on the initiation of the accident signal. The valves will close in 10 seconds or less and will remain closed since failure of the control circuitry can only yield operation in the closed direction from the motors before the flooding takes place. Therefore, these valves will not be required to operate during or after the flooding.

8.3-32

WBN The control air supply is automatically isolated outside containment in the event of a LOCA.

Therefore, the submergence of electric solenoids serving air-operated valves cannot affect the safe positioning of these valves.

The plant operators are instructed to rely on the qualified post accident monitors following a LOCA so that any spurious indications from non-qualified electrical sensors that could become submerged would not jeopardize appropriate operator actions.

The safety-related electrical equipment that must operate in a LOCA environment during and/or subsequent to an accident is identified below.

Inside Primary Containment Low Voltage Power and Control Cables The single- and multiple-conductor cables, insulated and jacketed with flame-retardant thermoplastic and thermosetting compounds, are suitable for installation in a nuclear environment.

Auxiliary power, control power, and control cables at voltages not exceeding 600 volts between conductors, either DC or 60 Hertz AC, are insulated with silicone rubber, crosslinked polyethylene, or ethylene propylene rubber. The rated conductor temperature for silicone rubber is 125°C. (For 10 CFR 50.49 applications, the rating is 90°C). The rated conductor temperature for crosslinked polyethylene and ethylene propylene rubber is 90°C. Single conductor silicone rubber insulated cable is jacketed with asbestos, synthetic yarns, or aramid fibers. Single conductor crosslinked polyethylene or ethylene propylene rubber insulated cables are jacketed with chlorosulfonated polyethylene. Single conductors of a multi-conductor silicone rubber insulated cable are jacketed with a glass braid and have an overall jacket of asbestos braid, synthetic yarns, or aramid fibers. Single conductors of a multi-conductor crosslinked polyethylene or ethylene propylene rubber cable are not jacketed, but the multi-conductor assembly does have an overall chlorosulfonated polyethylene jacket.

Signal cable, at voltages not exceeding 600 volts, is insulated with cross-linked polyethylene (or other material meeting TVA approval) and jacketed with chlorosulfonated polyethylene (or other material meeting TVA approval). The conductors are twisted together and then an overall shield (with copper drain wire) applied under the jacket. The conductor temperature rating for signal cable is 90°C maximum.

Electrical Penetration Cables The cables are derated and sized according to their ampacities for the penetration ambient temperatures. The cables have passed tests conforming to IEEE Standards for Electrical Penetration Assemblies in Containment Structures for Nuclear Fueled Power Generating Stations, IEEE 317-1976.

8.3-33

WBN Electrical Penetrations The electrical penetration assemblies (see Section 8.1.5.3) are designed to maintain containment integrity during all design basis events including temperature rise under fault-current conditions. To assure that electric power is continuously available to operate required equipment, penetrations for redundant cables are located in two or more separate areas in the containment structure.

System Description

There are three basic types of electrical penetrations: medium voltage power, low voltage (power and control), and instrumentation types. Modular type penetrations are used for all electric conductors passing through the primary containment. A double pressure seal is formed within each module through which the conductors pass. The modules are inserted into header plates with factory attached weld rings that are field welded to the containment nozzle. The modules are retained in the header plate by a threaded midlock cap nut and are sealed to the header plates with a dual midlock ferrule arrangement except for the high voltage modules which use a double O-ring seal.

To provide suitable termination of cables at the penetration, junction boxes or dead-ended covered cable trays are provided inside containment. These enclosures serve as an electrical splicing box for field connection of conductors.

The penetration assemblies are designed, fabricated, and inspected in accordance with the latest edition at time of contract of the ASME Boiler and Pressure Vessel Code,Section III, subsection NE for Class MC vessels, and are code stamped.

Medium-Voltage Power Penetration Assembly The medium-voltage penetrations have six 8-kV Kerite insulated, 750 mcm conductors each supported in a sealed tube which is attached to the back of the header plate on the outboard end and a support plate on the inboard end. The conductors are terminated in ceramic bushings at each end. The conductors are sealed at the ends of the bushings with a midlock ferrule. There is a separate Kapton insulated 2/0 conductor for carrying cable shields through the penetration. The pressure retaining boundary includes the weld ring, header plate, bushings, bushing extension tubes, 'O' rings, and midlock ferrules.

Low-Voltage Power and Control Penetration Assembly Each low-voltage power and control penetration is suitable for 600V ac or less. The cables pass through the header plate and extend beyond each end of the nozzles as pigtails. Cables are terminated either with bolted connectors or crimp type in-line splices. All low voltage power conductors are insulated with Kapton and are sealed on the steel module shells by dual polysulfone seals.

8.3-34

WBN Instrumentation Penetration Assemblies Each assembly has either multi-conductor, twisted, shielded cables, triaxial cables, coaxial cables, thermocouple cables, or a combination thereof. The multi-conductor cables and thermocouple cables are insulated with Kapton and are rated at 600V ac or less. They pass through the header plates and support plates and extend beyond each end of the nozzle as pigtails. The shields are carried through the header plate ungrounded. The multi-conductor cables and thermocouple cables are terminated with insulated in line cable splice. The coaxial and triaxial cables are insulated with Kapton and polysulfone. They are carried through the penetration assemblies maintaining their concentric configuration. The two shields of the triaxial are not grounded or tied together through the assembly.

Fiber Optic Electrical Penetration Feed-Throughs Fiber optic feed-throughs used for non-Class 1E, non-10 CFR 50.49 circuits are installed in instrumentation and low voltage power and control penetration assemblies. The electrical criteria for voltage class are not applicable to optical fibers. The fibers are buffered with a polimide coating and sealed with polysulfone. The fiber pigtails extend beyond each end of the nozzle and are terminated using optical connectors.

Qualification Tests and Analysis Environmental qualification for Class 1E penetrations is addressed in Section 3.11.

Underground Cable Installation The design and installation of the underground cables conform to the applicable requirements of General Design Criteria 1, 2, 3, 4 and 17 and Section 5.2.1 of IEEE Std. 308-1971.

Compliance to the GDC's is discussed in Section 3.1. Also, conformance to GDC 17 and IEEE Standard 308-1971 is discussed in Sections 8.2.1.8, 8.3.1.4, and 8.3.1.2.1.

The Class 1E cables between the auxiliary building and the diesel generator building, and the intake pumping station are installed in Seismic Category I structures. A description of these manholes and duct runs is given in Section 3.8.4.1.4.

Conduit duct bank runs are generally long runs which can exceed standard cable reel lengths, thus requiring splices. The long runs may also cause cable pull tension to be exceeded unless the pulled length is shortened by splicing shorter cable sections together. Manholes in conduit duct bank runs provide the same function as junction boxes in other conduit runs by providing a cable pullpoint and a location for cable splices. Manholes are enclosed structures with very limited space. The cable tray raceway in the manhole provides support and protection of cables and splices from damage while in manholes. Also, redundant cable divisions are installed either in separate manholes or in the same manhole with a concrete barrier between the divisions.

8.3-35

WBN Sump pumps with level switches for automatic pump operation are located in the manholes to prevent water accumulation due to leakage into the manhole. Manholes will be included in the plant maintenance program and will be inspected every 12 months for sump pump operability and flooding.

Cables are designed to operate in wet conditions. The Class 1E cables required to operate the plant in the flooded condition are continuous or provided with a waterproof splice in a manhole.

Cables have been tested at the factory by the manufacturer according to TVA specifications, which invoke ICEA (formerly IPCEA) standards for cables installed in wet environments.

Each manhole or cable pull point is accessible for periodic visual inspection of cables during normal operations or preflood conditions for the life of the plant. The duct runs are designed such that inundated testing of redundant cables can be conducted.

TVA does not use directly buried conduit for any Class 1E cable installation. This avoids possible adverse effects if such conduit were to be buried under a roadway.

8.3.1.3 Physical Identification of Safety-Related Equipment in AC Power Systems The onsite power system equipment and associated field wiring is identified so that two factors are physically apparent to plant operating and maintenance personnel:

1. That equipment and wiring is safety-related, and

2. That equipment and wiring is properly identified as part of a particular division of separation.

The scheme used to physically identify safety-related ac electrical equipment employs a suffix label. The suffix label added to the equipment name is -A, or -B, which represents train A or train B diesel-generator power source. For example, 6900V shutdown board 1A-A is safety-related equipment, where the 1 indicates Unit 1, the A represents board A, and the -A is assigned to train A.

The 125V dc vital system is shared between both units and divided into four channels. The 125V vital charger, 125V vital battery board, and 125V vital battery of each channel is physically identified in its label by I, II, III, or IV.

In addition, 125V Vital Battery V, physically identified in its label by "S", may serve as a temporary replacement for either Battery I, II, III, or IV.

The 120V ac vital instrumentation and control power system for each unit is divided into four channels. The 120V ac vital inverters and vital instrument power boards are identified by Unit 1 or 2 prefix and a -I, -II, -III, or -IV suffix, respectively. For example, 120V ac vital instrument power 1-I is safety-related equipment, where the 1 indicates Unit 1, and the I is assigned to Channel I. The spare inverters have a Unit 0 prefix.

8.3-36

WBN To further physically identify the onsite power system equipment, a color coding scheme is used. Nameplates, tags, or markings on exterior surfaces of this equipment is color coded respective to its division of separation as described in Section 8.3.1.4.5, except in the unit control and auxiliary control rooms. The electrical mimic buses on the control boards are color coded based on functionality (i.e., 6.9kV, etc.) and not on division of separation. The switch modules on the control boards are color coded by systems. Except for post accident monitoring (PAM) channel C1, the component nameplates on the switch modules are white background with black characters. The PAM Channel C1 components have nameplates which are black and white characters. To indicate to the operator that a component in these rooms is safety-related, an appropriate symbol is added to those applicable nameplates. Examples of the symbols are: is for Train A, for Train B, and C1 for PAM C1. The physical identification of the field wiring and its raceway (conduit and cable tray) for the onsite power system equipment is described in Section 8.3.1.4.5.

8.3.1.4 Independence of Redundant AC Power Systems The criteria and their bases which have been used to establish the minimum requirements for preserving the independence of redundant Class 1E electric systems are stated in IEEE-308-1971 and Regulatory Guide 1.6, Revision 0. Chapter 17, 'Quality Assurance,' describes the administrative responsibility and control that has been provided to assure compliance with these criteria during the design and installation.

The nuclear power generating station protection system (GSPS) includes the reactor protection system (RPS), Engineered Safety Features (ESF), essential supporting auxiliary systems (ESAS) and Class 1E electric systems. These systems are required for the safe shutdown of the reactor. Redundant systems are provided so that single failures, including failure of a redundant subsystem, will not result in failure to safely shutdown the reactor.

The reactor protection system (RPS) is the overall complex of instrument channels, power supplies, logic channels, and actuators together with their interconnecting wiring, involved in producing a reactor trip.

The Engineered Safety Features (ESF) and essential supporting auxiliary systems (ESAS), as elements of the nuclear power generating station protection system, are the systems which take automatic action to isolate the reactor and to provide the cooling necessary to remove the thermal energy and thus enable the containment of fission products within the reactor vessel and primary containment in the event of a serious reactor accident. Certain ESAS systems are on continuous duty to prevent, as well as to mitigate, reactor accidents. Examples of ESAS systems are component cooling, ERCW, together with their supporting electrical power and control systems.

8.3-37

WBN These ESF systems consist of sensor instrument channels, power supplies, actuation channels, and actuators, together with their interconnecting wiring, involved in the operation of engineered safety features equipment. Redundant engineered safety features are actuated by the separate actuation channels. Each coincidence network energizes an engineered safety features actuation device that operates the associated safety features equipment (e.g., motor starter, valve operator, etc.).

The Class 1E electric systems provide the electric power used to safely shut down the reactor and limit the release of radioactive material following a design basis event. The electric systems included are comprised of the following interrelated systems:

1. Alternating-current power systems.

2. Direct-current power systems.

3. Vital instrumentation and control power systems.

8.3.1.4.1 Cable Derating and Raceway Fill Cables have been selected to minimize excessive deterioration due to temperature, humidity, and radiation during the design life of the plant. Environmental type tests have been performed on cables that are required to function during and following a loss of coolant accident (LOCA).

(See Section 3.11 for additional information).

Selection of conductor sizes is based on ICEA P-46-426 "Power Cable Ampacities," ICEA P 440 "Ampacities Cables in Open-Top Cable Trays," and the National Electrical Code (NFPA-70). The effects on cable ampacity of environmental conditions and cable installation configuration are considered in the conductor size selection process. Conductor sizing, in general, is accomplished by applying an appropriate multiplying factor to the load current for the specified load type. For power cables rated above 600V between conductors, the minimum size is 2/0 AWG with any exceptions and their justifications documented in the design criteria.

Power and control cables which are routed on cable trays carrying essential cables are capable of passing the ICEA standard vertical flame test.

Conduit containing only one cable is sized for a maximum of 53% cable fill. Conduit containing two cables is sized for a maximum of 31% cable fill, and conduit containing three or more is sized for a maximum of 40% cable fill of the inside area of the conduit. Any conduit exceeding 40% cable fill will be evaluated and justified by engineering. Medium-voltage (6900V) power cables are routed on trays with other cables of the same voltage. All 6900V cables larger than 2/0 AWG are grouped as a 3-phase circuit and are separated from other circuits by a nominal distance equal to the radius of the larger cable. TVA takes no credit for spacing of medium voltage cables for ampacity purposes. The 6900V cables which are 2/0 AWG may be laid at random on cable trays and are separated (as described above) from grouped 3-phase circuits.

The nominal spacing may be less where cables enter or exit a tray and at tray fittings where necessary to prevent exceeding the minimum cable bend radius. However, nominal spacing is restored as soon as practical.

8.3-38

WBN Low-voltage power cables rated 600V and below are routed on cable trays with other power cables of the same voltage. Low-voltage power cable tray fill is limited to a maximum of 30% of the cross-sectional area of the tray, except when a single layer of cable is used. Cable tray fill for control and instrumentation cables is limited to a maximum fill of 60% of the cross-sectional area of the tray. Cable trays that exceed the maximum fill require exceptions and their justifications to be documented and referenced in the design criteria.

8.3.1.4.2 Cable Routing and Separation Criteria Electrical wiring for the GSPS, which includes the RPS, ESF, ESAS, and Class 1E electric systems, are segregated into separate divisions of separation (channels or trains) such that no single event, such as a short circuit, fire, pipe rupture, missile, etc., is capable of disabling sufficient equipment to prevent safe shutdown of the reactor, removal of decay heat from the core, or to prevent isolation of the primary containment. The degree of separation required for GSPS electrical cables varies with the potential hazards in a particular zone or area of the power plant. Criteria separation distances are addressed by spatial means, or installation of approved barriers, or analysis, or a combination of these. Exceptions to the criteria require documented justification and are referenced in the design criteria document. These criteria do not attempt to classify every area of the nuclear plant, but specifies minimum requirements and guidelines that have been applied with good engineering judgment as an aid to prudent and conservative layout of electrical cable trays, wireways, conduits, etc., through the plant (both inside and outside the containment). When a variance to the following minimum requirements exists, an analysis and/or exception is issued.

Mechanical Damage (Missile) Zone Zones of potential missile damage exist in the vicinity of heavy rotating machinery or near other sources of mechanical energy, such as pipe whip, steam release, or pipes carrying liquids under high pressure. Layout and arrangement of cable trays, conduit, wireways, etc., are such that no locally generated force or missile can disable sufficient equipment to prevent safe shutdown of the reactor, removal of decay heat from the core, or to prevent isolation of the primary containment. In rooms or compartments having heavy rotating machinery, such as the reactor coolant pumps, the reactor feedwater turbines, or in rooms containing high pressure feedwater piping or high-pressure steam lines such as exist between the steam generators and the turbine, a minimum separation of 20 feet, or a minimum 6-inch-thick reinforced concrete wall is provided between trays containing cables of different divisions of separation. In an area containing an operating crane, such as the upper compartment of the reactor building, there is a minimum horizontal separation of 20 feet or a minimum 6-inch-thick reinforced concrete wall or barrier between trays containing cables of the different divisions of separation.

8.3-39

WBN Fire Hazard Zone Electrical cabling required to safely shutdown the plant in the event of a fire is protected in accordance with the separation criteria of 10 CFR 50, Appendix R, Section III.G.2 (see Fire Protection Report and UFSAR Section 9.5.1). Other ESF cabling are arranged so as to minimize the possibility of a fire in one division from damaging cables in another division.

Routing of cables for engineered safety features, power or control, through rooms or spaces where there is potential for accumulating large quantities (gallons) of oil or other combustible fluids through leakage or rupture of lube oil or cooling system has been avoided. In cases where it is impossible to provide other routing, only one division of engineered safety features cables is allowed in any such space, and the cables are protected from dripping oil by the use of conduits or flange covered cable trays designed to prevent oil from reaching the cables. No engineered safety features cables are routed through rooms containing oil storage tanks. In any room (except the cable spreading room, the auxiliary instrument room and the annulus) or space in which the only source of fire is of an electrical nature, cable trays carrying cables of different divisions of separation have a minimum horizontal separation of 3 feet if no physical barrier exists between the trays. If a horizontal separation of at least 3 feet is not attainable, a fire-resistant barrier is provided. This barrier extends at least 1 foot above (or to the ceiling) and 1 foot below (or to the floor) the line-of-sight communication between trays carrying redundant division cables. Vertical stacking of trays carrying cables of opposite separation divisions is avoided whenever possible. However, where it becomes necessary the following separation requirements are applied to open top ladder back trays stacked vertically, one above the other:

1. For vertical separation greater than 5 feet, tray covers are not required.

2. For vertical separation equal to 5 feet, the lower tray has a solid steel cover and the upper tray has a solid steel bottom or bottom cover.

3. For vertical separation less than 5 feet, an approved barrier installed between redundant trays extends a minimum of 3 feet (or to the nearest wall, floor, or ceiling) on each side of the tray edge (covers are not required).

The following vertical separation requirements are applied to crossings of open top ladder back trays carrying cables of different separation divisions:

1. For vertical separation greater than one foot, tray covers are not required. Circuit breaker testing for enhanced reliability of cable fault protection (as described in the "Open Cable Tray and Conduit" subsection) is the basis for reduced separation requirements at tray crossings.

2. For vertical separation equal to one foot, the lower tray has a solid steel cover and the upper tray has a solid steel bottom or bottom cover.

8.3-40

WBN

3. For vertical separation less than one foot, an approved barrier is installed between redundant trays (covers not required).

4. Separation barriers, tray covers, or enclosures extend a minimum of 3 feet (or to the nearest wall, floor, or ceiling) on each side of the tray edge.

Totally enclosed trays (solid cover and solid bottom on both trays) can cross or be stacked vertically or run side by side provided one inch or greater separation is maintained between the trays. An approved barrier is installed between enclosed trays separated less than one inch.

The total enclosure extends until there is a least 3 feet between the redundant trays.

Cable Spreading Room The cable spreading room is the area provided under the Main Control Room where cables leaving the various control board panels are dispersed into cable trays or conduits for routing to all parts of the plant. Since the cable spreading room is protected from missiles by its Seismic Category I walls and there are no internal sources of missiles, such as high-pressure piping and heavy rotating machinery, the only potential source of damage to redundant cables is from fire.

Smoke detectors and a sprinkler fire protection system have been installed ensuring that potential for fire damage to cables will be minimized in the cable spreading room. Where ESF cables of different divisions (train A or train B) of separation approach the same or adjacent unit control panel (see the Main Control Room discussion) with spacing less than 1 foot, these cables are run in metal (rigid or flexible) conduit or enclosed wireway to a point where 1 foot of separation exists. A minimum horizontal separation of 1 foot separates trays carrying cables of different divisions (channels or trains) if no physical barrier exists between the trays. Where a horizontal separation of 1 foot does not exist, a fire-resistant barrier extends at least 1 foot above (or to the ceiling) and 1 foot below (or to the floor) the line-of-sight communication between trays carrying redundant division cables. Vertical stacking of trays carrying cables of opposite separation divisions is avoided whenever possible. However, where it becomes necessary the following separation requirements are applied to open top ladder back trays stacked vertically, one above the other:

1. For vertical separation greater than 3 feet, tray covers are not required.

2. For vertical separation equal to 3 feet, the lower tray has a solid steel cover and the upper tray has a solid steel bottom or bottom cover.

3. For vertical separation less than 3 feet, an approved barrier installed between redundant trays extends a minimum of 3 feet (or to the nearest floor, or ceiling) on each side of the tray edge (covers are not required).

8.3-41

WBN The following vertical separation requirements are applied to crossings of open top ladder back trays carrying cables of different separation divisions:

1. For vertical separation greater than one foot, tray covers are not required. Circuit breaker testing for enhanced reliability of cable fault protection (as described in the "Open Cable Tray and Conduit" subsection) is the basis for reduced separation requirements at tray crossings.

2. For vertical separation equal to one foot, the lower tray has a solid steel cover and the upper tray has a solid steel bottom or bottom cover.

3. For vertical separation less than one foot, an approved barrier is installed between redundant trays (covers not required).

4. Separation barriers, tray covers, or enclosures extend a minimum of 3 feet (or to the nearest wall, floor, or ceiling) on each side of the tray edge.

Totally enclosed trays (solid cover and solid bottom on both trays) can cross or be stacked vertically or run side by side provided one inch or greater separation is maintained between the trays. An approved barrier is installed between enclosed trays separated less than one inch.

The total enclosure extends until there is at least 3 feet between the redundant trays.

Auxiliary Instrument Room The auxiliary instrument room is the area under the cable spreading room. Since the auxiliary instrument room is protected from missiles by its seismic Category I walls and there are no internal sources of missiles such as high-pressure piping or heavy rotating equipment, the only potential source of damage to redundant cables is from fire. No power cables with a protective device rated greater than 30 amperes are routed in this room unless they are in conduit. Fire and smoke detectors with control room alarm, and a carbon dioxide fire protection system, have been installed.

The auxiliary instrument room contains the process instrument racks, the solid-state protection racks, and associated instrument and relay racks.

A minimum horizontal separation of 1 foot is provided between trays carrying cables of different divisions channels or trains). When the minimum separation distance is not attainable, a fire-resistant barrier is utilized. The barrier extends at least 1 foot above (or to the ceiling) and 1 foot below (or to the floor) the line of communication between the trays carrying redundant division cables.

8.3-42

WBN Whenever it becomes necessary to stack open top train A or B trays vertically, one above the other, the following separation requirements are applied:

1. For vertical separation of 3 feet or greater, tray covers are not required.

2. For vertical separation equal to 3 feet, the lower tray has a solid steel cover and the upper tray has a solid steel bottom or bottom cover.

3. For vertical separation less than 3 feet, an approved barrier installed between redundant trays extends a minimum of 3 feet (or to the nearest wall, floor, or ceiling) on each side of the tray edge (covers are not required).

The following vertical separation requirements are applied to vertical stacking of Channel I, II, III, or IV one above the other and to crossings of open top ladder back trays carrying cables of different separation divisions, trains or channels:

1. For vertical separation greater than one foot, tray covers are not required. Circuit breaker testing for enhanced reliability of cable fault protection (as described in the "Open Cable Tray and Conduit" subsection) is the basis for reduced separation requirements at tray crossings.

2. For vertical separation equal to one foot, the lower tray has a solid steel cover and the upper tray has a solid steel bottom or bottom cover.

3. For vertical separation less than one foot, an approved barrier is installed between the redundant trays (covers are not required).

4. Separation barriers, tray covers, or enclosures extend a minimum distance equal to the normal required separation (or to the nearest wall, floor, or ceiling) on each side of the tray edge.

Totally enclosed trays (solid cover and solid bottom on both trays) can cross or be stacked vertically or run side by side provided one inch or greater separation is maintained between the trays. An approved barrier is installed between enclosed trays separated less than one inch.

The total enclosure extends until the normal separation distance is achieved.

Open Cable Tray and Conduit Conduits carrying cables of redundant divisions may cross or run parallel to each other provided a minimum separation of one inch exists between any portion of the raceway, (i.e., boxes, fittings, etc.). A conduit carrying cables of one division may cross or run parallel to a cable tray containing cables of a redundant division, provided a minimum separation greater than one inch exists between tray and conduit. Electrical protection provides additional assurance that cables in conduits carrying cables of one division will not be damaged by an electrical fault on cables in open top trays or cables in free air of a redundant division. The reliability of circuit breakers that provide the electrical protection for some of these cables is enhanced by periodic testing.

8.3-43

WBN The result of a protection device reliability analysis is discussed in Appendix 8C. This analysis, based on data taken from IEEE 500-1977, demonstrates that each of the following protective schemes has a reliability which is essentially equivalent to that of a single circuit breaker periodically tested:

1. A circuit breaker and fuse in series, or

2. Two circuit breakers in series.

In addition to these protective schemes, IEEE 500-1977 data verifies that for this application, a single fuse with no periodic testing, has a failure rate which is approximately equal to the failure rate of two circuit breakers in series (see Part B analysis of Appendix 8C). Therefore, a single fuse when used as an interrupting device for cables, does not require periodic testing due to its stability, high reliability, and lack of drift. WBNP concludes that any one of the following protective schemes provides a reliable means of protecting cables in conduits from electrical faults on cables in open top trays and cables in free air of the opposite train, thus, meeting the intent of Regulatory Guide 1.75 to not degrade redundant Class 1E cables.

1. A circuit breaker and fuse in series

2. Two circuit breakers in series

3. A single fuse

4. A single circuit breaker periodically tested.

The only exceptions to testing single Class 1E circuit breakers that protect cables in conduits from electrical faults on cables in open top trays and cables in free air of the opposite train, will be where physical separation of specific circuits is shown to meet the requirements identified in IEEE 384-1992. WBNP is not committed to IEEE 384-1992 but will use it as criteria for exempting individual circuits from circuit breaker testing.

Some Class 1E motor-operated-valve circuits were designed with two circuit breakers in series to maintain their safe operating position by administratively controlling one of the circuit breakers in the open position. Since the motor operators are electrically isolated from their power supply during normal operation, periodic testing will not be performed on the circuit breakers.

The molded case circuit breakers (MCCBs) actuated by fault currents that protect cables in conduits from electrical faults on cables in open top trays and cables in free air of the opposite train, will have at least 10% of each type breaker tested every 18 months and will have the recommended preventative maintenance performed on 100% of the Class 1E MCCBs within the past 72 months and non-Class 1E MCCBs within the past 96 months. For any breaker failure or breaker found inoperable, an additional 10% of that type will be tested until no more failures are found or all circuit breakers of that type have been tested. The test will ensure operability by simulating a fault current with an approved test set.

8.3-44

WBN A conduit carrying cables of one division may cross or run parallel to a cable tray containing cables of a redundant division with one inch separation, provided the tray has a cover, solid bottom or side adjacent to the conduit. The tray cover or solid bottom shall extend a minimum of three feet or to the nearest wall, floor, or ceiling on each side of the centerline of the conduit, for conduits that cross cable trays. Likewise, when conduits run parallel with cable trays, the tray cover or solid bottom shall extend a minimum three feet beyond each end of the influenced portion of conduit, or until the tray terminates or penetrates a wall, ceiling, or floor.

If the above separation requirements are not attainable, a barrier consisting of 1/2 inch minimum thickness of Marinite (or its equivalent) may be used between the raceways, provided the trays are enclosed as specified above. The barrier shall be continuous until spacial separation is attained and extend one inch on both sides of the raceway (tray or conduit) as applicable (or to the wall, floor, or ceiling, as applicable).

Main Control Room Redundant safety-related cables enter the Main Control Room through separate floor openings.

Each unit control panel, which has redundant components, has a minimum of three separate vertical and/or horizontal risers (enclosed wireways) from each of the respective terminal block groups to the control room floor (or bottom of walk space). Non-safety-related cables are routed through one or more riser(s), preferably near the center of the control panel. The redundant safety-related cables (train A or train B separation) are routed separately in each of the other two or more risers, preferably one near each end of the control panel. Where possible, risers of like trains of separation have been arranged such that the adjacent panel has a corresponding like train riser (i.e., train A in one panel has train A nearest it in the adjacent panel).

Separation of Class 1E Electric Equipment All Class 1E electric equipment has physical separation, redundancy, and a controlled environment to prevent the occurrence of an external event that would threaten the safe shutdown of the reactor. No internally generated fault can propagate from Class 1E equipment during any design basis event. All Class 1E electric equipment that has to operate during a flood has been located above maximum possible flood level unless it is designed to operate submerged in water.

The Class 1E electrical loads are separated into two or more redundant load divisions (channels or trains) of separations. The number of divisions has been determined by the number of independent sources of power required for a given function. The electric equipment that accommodates these redundant divisions is separated by sufficient physical distance or protective barriers. The separation distance has been determined by the severity and location of hazards. The environment in the vicinity of the equipment is controlled or protection provided such that no environmental change or accident will adversely affect the operation of the equipment.

The physical identification of safety-related electrical equipment is in accordance with Section 8.3.1.3.

8.3-45

WBN 6900V Equipment The diesel generators and 6900V shutdown boards are designed for a two-division (train A and train B) separation. The 6900V equipment is located in Seismic Category I structures. The diesel generators are located in the Diesel Generator Building at approximately Elevation 742 and have reinforced concrete barriers separating each unit from all other units and have no single credible hazard available that would jeopardize more than one unit. The diesel generator arrangements are shown in Figure 8.3-1.

The 6900-volt shutdown boards are located in the Auxiliary Building at approximately Elevation 757 (see Figure 8.3-3). An 8-inch reinforced concrete wall extending to the ceiling is used to separate 6900-volt shutdown boards 1A-A and 2A-A from shutdown boards 1B-B and 2B-B.

The 6900V diesel generator board C-S is located in the ADGU building at Elevation 742.0. The ADGU is a Seismic Category I structure.

480-Volt Equipment The 480V shutdown boards, 480V reactor MOV boards, 480V reactor vent boards, and control and auxiliary building vent boards are separated into train A and B groupings by 8-inch reinforced concrete walls extending to the ceiling between redundant trains. The 480V shutdown board transformers associated with each power train are separated from the transformers associated with other power trains by a 8-inch-thick, 8-foot tall reinforced concrete wall. The 480V equipment is located in the Auxiliary Building on Elevations 757 and 772. The location of these boards is shown in Figures 8.3-2 and 8.3-3.

125-Volt DC Equipment The 125V Vital Batteries I, II, III, and IV are located in the Auxiliary Building on Elevation 772 and are divided into four divisions (Channels I, II, III, and IV) of separation. Vital Battery V which serves as a temporary replacement for any of the other four vital batteries during their testing, maintenance, and other outages is also located in the Auxiliary Building on Elevation 772. Each 125V vital battery is separated from all other 125V vital batteries by providing individual rooms for each battery with 8-inch reinforced concrete walls extending to the ceiling.

The ventilation system is designed to remove and dissipate the hydrogen given off by the batteries (see Section 9.4 for ventilation system description). Vital Battery Boards I, II, III, and IV are located in the Auxiliary Building on Elevation 757 and are also divided into four divisions of separation. Each 125V Vital Battery Board (I, II, III and IV) is separated from all other 125V vital battery boards by 8-inch-reinforced concrete wall extending to the ceiling. The location of these batteries and boards is shown in Figure 8.3-36. Vital Battery Board V is located on Elevation 772 in the same room as Vital Battery V and is separated from the battery by a 7 feet high, 8-inch thick seismic wall (Figure 8.3-57).

8.3-46

WBN 120-Volt AC Equipment The vital inverters are located in the Auxiliary Building on Elevation 772 and are divided into four divisions (Channels I, II, III, and IV) of separation. The Channels I and II inverters are located in the Unit 1 area while the Channels III and IV inverters are located in the Unit 2 area.

The Channels I and II inverters are separated from the Channels III and IV inverters by an 8-inch reinforced concrete wall extending to the ceiling. The Channel I and the Channel III inverters are separated from the Channel II and the Channel IV inverters, respectively. The location of the inverters is shown in Figure 8.3-36.

Electrical Penetrations of Primary Containment Redundant essential cables enter the containment via separate electrical penetrations. Where possible, redundant essential cables utilize electrical penetrations spaced horizontally instead of vertically. Where redundant essential cables are installed in electrical penetrations spaced vertically, power cables carrying high energy are located above low level circuits, or barriers are provided between the high-energy and low-energy circuits where the vertical spacing is less than 3 feet. Areas have been provided for electrical penetrations so that redundant essential cables can be installed in separate penetration areas. Cables through penetrations of the primary containment are grouped in such an arrangement that failure of all cables in a single penetration cannot prevent a reactor scram or engineered safety features action. The penetration areas are shown on Figures 8.3-44 and 8.3-45.

8.3.1.4.3 Sharing of Cable Trays and Routing of Non-Safety Related Cables There are five different cable tray systems, namely: 6900V, 480V, control, medium-level signal, and low-level signal trays. The 6900V trays carry only 6900V cables and are located in the highest level position of stacked trays. The 480V power cables, and ac and dc power cables of 277 volts or less, that carry more than 10 amperes are run in 480V cable trays. These trays may also carry cables from 0 to 277 volts carrying 10 amps or less. Medium-level signal trays carry the following cables: signal cables for inputs to and outputs from the computer other than thermocouples; instrument transmitters, recorders, RTD's greater than 100 millivolts, tachometers, and indicators; rotor eccentricity and vibration detectors; fiber-optic cables; and shielded annunciator cables used with solid-state equipment. Signal cables for thermocouples, strain gauges, thermal converters, and RTD's that are 100 millivolts or less are run in low level signal trays which occupy the lowest level in a stack of trays. Other cables are run in control trays. Prior to July 13, 1988, these trays could carry cables operating at 277V or less and carrying up to 30 amperes. After this date, these trays are limited to cables carrying 10 amperes or less.

8.3-47

WBN Within a division the standard spacing between trays stacked vertically is 12 inches (1/2-inch tolerance), tray bottom to tray bottom. This spacing may be decreased to facilitate changes in elevation of the tray or to avoid interferences, e.g., pipes, pipe supports, heat and vent ducts, etc. The decrease from the 12 inch spacing must ensure adequate access for cable installation (typically 6 to 9 inches) is maintained and the bottom of the top tray is to have a solid bottom or the bottom tray has a top cover. Within a division, the standard spacing between trays installed side by side is 6 inches (1-inch tolerance). The trays are constructed of galvanized steel, 6 to 30 inches wide and approximately 4 inches deep. All cable tray systems located in Category I structures have seismic supports. These supports are described in Section 3.10.3.

RPS cables (Channels I, II, III, and IV), inside and outside containment, are routed in cable trays and/or conduits that are designated for their respective division of separation. ESF cables (trains A and B) are routed in 6900V, 480V, or control trays and/or conduits that are designated for their respective division of separation.

Vital instrument cables for the generating station protection system (GSPS) which includes the RPS and ESF may be routed in the same conduits, wireways, or cable trays provided the circuits have the same characteristics such as power supply and channel identity (I, II, III, or IV).

Automatic actuation and power circuits for the generating station protection system which includes the RPS and ESF may be routed in the same conduits, wireways, or cable trays provided the circuits have the same characteristics such as power supply and train identity (train A or train B).

Unit 1 analog circuits and Unit 2 analog circuits may be routed in the same conduits, cable trays, or wireways provided the circuits have the same characteristics such as power supply and channel identity (I, II, III, or IV). In like manner, Unit 1 train A cables may be routed in the same conduits, cable trays, and wireways as Unit 2 train A cables. Unit 1 train B cables may be routed in the same conduits, cable trays, or wireways as Unit 2 train B cables.

Cables for nonsafety related functions are not run in conduit used for essential circuits except at terminal equipment where only one conduit entrance is available. The nonsafety related cable is separated from the safety related cable as near the device as possible. Generally, the nonsafety related cables are for annunciator functions. Exposed conduits containing redundant cables are separated by a minimum 1-inch air gap or by a minimum 1/2-inch thickness of Marinite (or its equivalent) fire-resistant barrier between conduits. Non-safety related circuits routed in Category I structures are evaluated in order to determine if they are to be classified as an associated circuit, which requires one of the three protective schemes discussed below. As a result, no specific minimum separation distance is required between conduits carrying cables for non-safety related functions and conduits or cable trays carrying GSPS cables in Category I structures.

8.3-48

WBN Requirements for separation of GSPS and nonsafety related circuits in nonseismic structures are described below. Although there is no established minimum separation requirement between open top nondivisional cable trays and conduit containing redundant cables, it is concluded based on the following, that safety related cables are not degraded. Cables installed in trays prior to October 18, 1984 are coated with a fire resistant material. This coating significantly reduces the ignitability and combustibility of cable insulation.

TVA conducted fire tests, externally initiated by a propane burner, on a full scale mockup of trays loaded with cables coated with a fire-resistant material. No self-sustaining fire could be established until the coating was fractured and cables separated. The cable coating also protects against development of a fire from electrical faults since it restricts availability of oxygen needed for combustion. Therefore, TVA takes credit for the coating on cables not qualified to IEEE 383 flame test or equivalent, together with adequate circuit protective device(s) (as described below) as meeting the intent of Regulatory Guide 1.75 requirements to achieve independence between Class 1E and non-Class 1E cables routed in cable trays or conduits. Effective October 18, 1984, the use of coating on cables which meet IEEE Std. 383-1974 is not required except when the coating is used as part of the fire-related penetration seals required by the WBN Fire Protection Report. In all cable coating applications, up to 10 cables not qualified to the IEEE 383 flame test or equivalent may remain uncoated on cable trays, unless small gaps or cracks in the coating exist in the tray segment. In such cases, up to 9 cables not qualified to the IEEE 383 flame test or equivalent may remain uncoated.

There are certain safety related components which are located in a nonseismic structure and whose circuits extend into a Category I structure. The circuits for these components have the following separation. While in a Category I structure, these circuits are routed with circuits of the same redundant division of separation. When they leave the Category I structure, these circuits are routed in conduits identified as GSPS conduits as described in Section 8.3.1.4.5.

Conduits carrying these circuits are separated by a minimum 1-inch air gap from conduits or trays containing circuits of either redundant divisions or nonsafety related functions.

Tray and conduit systems located in Category I structures have seismic supports. In addition, a non-safety related cable may be routed with those for essential circuits, provided that the cable, or any cable in the same circuit, has not been subsequently routed onto another tray containing a different division of separation of essential cables.

Nondivisional associated cables that are routed in cable trays designated for Class 1E cables are treated the same as the Class 1E cables. The nondivisional cables are subject to the same flame retardant, cable derating, splicing restrictions, and cable tray fill as the Class 1E cables.

Furthermore, these non-Class 1E cables are qualified in the same manner as Class 1E cables and/or protected by one of the protective schemes discussed below. Based on the results of the analyses of associated circuits, it is demonstrated that Class 1E circuits are not degraded.

8.3-49

WBN These analyses include a review of protective devices for nondivisional associated medium voltage power, low voltage power, and control level cables routed in nondivisional raceways in Category I structures. Each of these cables is provided short circuit protection by either a single circuit breaker periodically tested, a single fuse, a circuit breaker and fuse in series, two circuit breakers in series, or two fuses. Energy produced by electrical faults in non-Class 1E cables routed in medium-level signal and low-level signal raceways is considered insignificant and is considered no challenge to Class 1E cables.

The results of the protective device application analysis for associated and non-Class 1E cables are discussed in Appendix 8C. This analysis, based on data taken from IEEE 500-1977, demonstrates that each of the following protective schemes has a reliability which is essentially equivalent to that of a single circuit breaker periodically tested:

1. A circuit breaker and fuse in series, or

2. Two circuit breakers in series.

In addition to these protective schemes, IEEE 500-1977 data verifies that for this application a single fuse with no periodic testing has a failure rate which is approximately equal to the failure rate of two circuit breakers in series (see Part B analysis of Appendix 8C). Therefore, a single fuse when used as an interrupting device for the above cables, does not require periodic testing due to its stability, high reliability, and lack of drift. To further support this position, TVA takes credit for installed cable coating as previously discussed. Thus, WBNP concludes that any one of the following protective schemes for associated and non-Class 1E cables provides a reliable means of meeting the intent of Regulatory Guide 1.75 to not degrade Class 1E cables:

1. A circuit breaker and fuse in series

2. Two circuit breakers in series

3. A single fuse

4. A single circuit breaker periodically tested All of the installed protective devices and those added to further protect the associated and non-Class 1E cables are of a high quality commensurate with their importance to safety. For non-Class 1E circuit breakers, this requires functional testing, and for new purchases, being controlled as TVA Quality Level III which requires receipt inspections and traceability.

The electrically operated circuit breaker and MCCBs actuated by a fault current and installed as an isolation device will have at least 10% of each type of breaker tested every 18 months.

Electrically operated circuit breakers and Class 1E MCCBs will have the recommended preventative maintenance performed on 100% of the breakers within the past 72 months. Non-Class 1E MCCBs will have the recommended preventative maintenance performed on 100% of the breakers within the past 96 months. For any breaker failure or breaker found inoperable, an additional 10% of that type of breaker will be tested until no more failures are found or all electrically operated circuit breakers of that type have been tested. The tests will ensure operability by simulating a fault current with an approved test set.

8.3-50

WBN There are certain safety-related components, such as the component cooling water pump C-S and the steam turbine-driven auxiliary feedwater pumps 1A-S and 2A-S, which receive power from redundant divisions (channels or trains) through manual transfer devices. In addition, there are certain safety- related components, such as the fifth vital battery which is capable of supplying power to redundant divisions (channels or trains) through manual transfer devices.

These components will have suffix S added to their labels. A suffix S will be added to their respective raceway and cable designations. The S cables from the transfer device to the component require special separation and are routed in separate raceways with no other circuits with the following exception. Cables with a suffix S may be routed together provided the following two conditions are satisfied: (1) voltage levels are compatible, and (2) circuits are designed such that under any design basis event all cables in the raceway will always be of the same divisions (channel or train) where energized. These circuits are identified by a suffix S added to their respective conduit and cable numbers. The redundant feeder supply cables to the transfer devices have channel or train identification and separation depending on their application.

The RPS, ESF, and ESAS receive their power from the preferred (offsite) and standby (onsite) sources. The normal power and control circuits from the preferred source are routed in conduits or cable trays separate from the alternate power and control circuits. These circuits are identified by a suffix P or R added to their respective cable numbers. See Section 8.2.1.6 for minimum spatial separation requirements.

The circuits associated with the standby power sources (Class 1E electric systems) are separated into two or more redundant divisions. The circuits between the diesel generators and the 6900V shutdown boards are designed for a two division separation (train A and train B).

The feeder circuits from the 125V dc vital battery boards to the control buses in the shutdown boards are separated into four divisions (Channels I, II, III, IV). Feeder cables to the control buses in the train A shutdown boards are supplied from Battery Boards I and III and feeder cables to the control buses in the train B shutdown boards are supplied from Battery Boards II and IV. The Channels I, II, III, and IV vital instrument power systems are supplied from Vital Battery Boards I, II, III, and IV, respectively, and have been physically separated and routed independently from each other. The vital battery board arrangement is shown in Figure 8.1-3.

8.3.1.4.4 Fire Detection and Protection in Areas Where Cables are Installed Fire detection and protection in areas where cables are installed are described in the WBN Fire Protection Report.

8.3.1.4.5 Cable and Cable Tray Markings Field wiring and its raceway (conduit and cable tray) of the Generating Station Protection System (GSPS), which includes RPS, ESF, and Class 1E electric systems, is identified so that two facts are physically apparent to plant operation and maintenance personnel:

1. That wiring is properly identified as being associated with the GSPS, and

2. That wiring is properly identified as part of a particular division (or grouping) of enforced segregation within the GSPS.

Each cable has been assigned a number consisting of a combination of letters and numbers.

8.3-51

WBN In addition, cables for equipment of the GSPS have been assigned special separation suffixes (A or B for train A or B; S for special; D, E, F, or G for Channels I, II, III, or IV, respectively; or J or K for postaccident monitoring channel 1 or 2 respectively; and P or R for normal or alternate offsite power). A computerized cable routing program is used to route cables and check raceway loading.

The main functions of this program are as follows:

1. To route and accumulate cable length through the tray system,

2. To maintain a predetermined maximum raceway loading,

3. To ensure proper separation of divisional cables is maintained on its respective tray assignment,

4. To separate circuit types (medium-voltage power, low-voltage power, control, signal, and thermocouple),

5. To provide cable installation data for electricians.

6. To provide various reports (e.g., raceway loading, cable routing, cables in a system, cables to specific components).

Inputs into the computer include the cable identifier, voltage level, and cable type that will be used. The cable types are identified by code-mark letters. The corresponding cross-sectional area (based on the maximum outside diameter of the cables) for each mark letter is also entered since the maximum tray loading is based on cross-sectional area except when a single layer of cable (or grouping of 3-phase circuits) is used. Prior to January 29, 1993, the nominal outside cable diameter was the basis for cross-sectional area values entered. The tray system lists each segment of tray, the from and to nodes, length between nodes, maximum allowable tray fill, and a node voltage level code letter which identifies it for a particular circuit type. The node voltage levels for the respective cable tray system are as follows:

NV-l Non-safety-related low level signal cables NV-2 Non-safety-related medium level signal cables NV-3 Non-safety-related control cables NV-4 Non-safety-related low-voltage power cables (480V power cables and all ac and dc power cables of 250V or less that carry continuous load current of more than 10 amperes)

NV-5 Non-safety-related 6.9 kV power cables NV-2D Reactor Protection System Channel I cables NV-2E Reactor Protection System Channel II cables NV-2F Reactor Protection System Channel III cables 8.3-52

WBN NV-2G Reactor Protection System Channel IV cables NV-3A Engineered Safety Features train A control cables NV-3B Engineered Safety Features train B control cables NV-4A Engineered Safety Features train A low-voltage power cables NV-4B Engineered Safety Features train B low-voltage power cables NV-5A Engineered Safety Features train A 6.9kV power cables NV-5B Engineered Safety Features train B 6.9 kV power cables Cables that are assigned node voltage numbers that are not included in the above tray system list will require special routing treatment. This will usually mean that these cables will be routed through conduit exclusively. In some cases, hand routing of cables to assure separation on nondivisional cable trays will be used.

The field wiring for the GSPS equipment and components have distinct color-coded tags at terminations for each division of separation (channels or trains). The conduits, conduit boxes, and cable trays for field wiring of the GSPS equipment are color coded (by tags, nameplates, or markings on exterior surfaces) at conspicuous intervals showing their respective division of separation. The color coding scheme used to identify divisions of separation is given in Section 7.1.2.3, except black lettering, may be used on conduit and cable tags at terminations for all but black background; white lettering is used on black background tags.

8.3.1.4.6 Spacing of Power and Control Wiring and Components Comprising the Class 1E Electrical Systems in Control Boards, Panels, and Relay Racks Redundant power and control wiring and components associated with Class 1E electrical systems in control boards, panels, and relay racks are separated by either a minimum of six inches of air space or an approved barrier. See Section 7.1.2.2 for more detail of spacing of wiring and components in control boards, panels, and relay racks.

8.3.1.4.7 Fire Barriers and Separation Between Redundant Trays The criteria for separation between redundant trays for various zones or areas of the plant is described in Section 8.3.1.4.2. For details of the fire protection system, see Section 9.5.1.

8.3.2 DC Power System 8.3.2.1 Description 8.3.2.1.1 Vital 125V dc Control Power System The vital 125V dc control power system is a Class 1E system whose safety function is to provide control power for engineered safety features equipment, emergency lighting, vital inverters, and other safety-related dc powered equipment for the entire plant. The system capacity is sufficient to supply these loads during normal operation and to permit safe shutdown and isolation of the reactor for the "loss of all ac power" condition. The system is designed to 8.3-53

WBN perform its safety function subject to a single failure.

The 125V dc vital power system shall be composed of the four redundant channels (designated as Channels I, II, III, and IV) and consists of four lead-acid-calcium batteries, eight battery chargers (including two pairs of spare chargers), four distribution boards, battery racks, and the required cabling, instrumentation and protective features. Each channel is electrically and physically independent from the equipment of all other channels so that a single failure in one channel will not cause a failure in another channel. Each channel consists of a battery charger which supplies normal dc power, a battery for emergency dc power, and a battery board which facilitates load grouping and provides circuit protection. These four channels are used to provide emergency power to the 120V ac vital power system which furnishes control power to the reactor protection system. No automatic connections are used between the four redundant channels.

Battery Boards I, II, III, and IV have a charger normally connected to them and also have manual access to two spare (backup) chargers for use upon loss of the normal charger. Each pair of spare chargers are mechanically interlocked such that only one charger in each pair can be utilized at one time. Additionally, Battery Boards I, II, III, and IV have manual access to the fifth vital battery system. The fifth 125V dc Vital Battery System is intended to serve as a replacement for any one of the four 125V dc vital batteries during their testing, maintenance, and outages with no loss of system reliability under any mode of operation. See Figure 8.3-56.

The process for substituting the fifth vital battery for a primary battery is administratively controlled through plant operating procedures.

In this mode of operation the fifth vital battery shall be maintained at the required nominal voltage level by the appropriate spare vital battery charger and shall be available, as needed, to supply all loads connected to the primary vital battery board. The substitution of Vital Battery V for a primary vital battery shall in no manner degrade either the reliability or the capacity of the 125V dc vital power system: all system requirements shall be satisfied and all parameters unchanged. (Note: to fulfill these requirements, the fifth vital battery and all associated cabling shall be sized such that the minimum primary vital battery board voltage with fifth vital battery connected is, under all circumstances, greater than or equal to the primary battery board voltage with the primary vital battery connected.)

System Design Requirements The requirements described below were implemented in the design of the Vital dc Power System.

Redundancy The system is composed of four redundant channels. These four channels are used to provide emergency power to the four vital 120V ac inverters for each unit which supply control power to the reactor protection system. Other loads are either two divisional or nondivisional loads. No automatic connections are used between the four redundant channels.

8.3-54

WBN Separations The four channels are electrically and physically separated so that a single failure in one channel will not cause a failure in another channel. Each channel has a charger, a battery, and a load distribution board.

Electrical separation for the fifth vital battery system is maintained through a series of interlocking breakers and through their administrative controls to prevent a single failure from accidentally connecting Vital Battery systems I, II, III, or IV to the fifth vital battery system.

Physical separation of the fifth vital battery system is maintained to the same standards as Vital Battery systems I, II, III, and IV. Each group of actions needed to replace one of the four vital batteries with the fifth vital Battery is annunciated in the MCR. Cables and conduits between the fifth vital Battery board and its distribution panels A and B are designated as S (See UFSAR section 8.3.1.4.3).

Capacity The system has the capacity to continuously supply all steady state loads and maintain the Battery in a fully charged condition. With the batteries in the fully charged condition, the system has the capacity to supply the required loads for a minimum of four hours with a loss of all ac power. The Battery has a maximum capacity to supply the bounding load currents during an SBO period as shown on Table 8.3-12. The Battery performance testing will be conducted in accordance with the Technical Specifications for both initial and periodic testing to assure the adequate battery capacity is maintained.

Charging Chargers I, II, III and IV have the capacity to continuously supply the steady state loads and maintain the batteries in the design maximum charged state or to recharge the batteries from the design discharge state within an acceptable time interval irrespective of the status of the plant during which these demands occur. Chargers I, II, III and IV may be replaced by a spare charger. Two spare chargers are provided for each two normal chargers.

The sole function of Seismic Category I(L) Charger V is to recharge and maintain proper voltage level to Battery V while it is in a standby mode. The charger is isolated from the fifth vital system when the system is replacing one of the four vital batteries. Isolation is accomplished by manually opening the charger load and supply breakers located on fifth vital battery board and 480-volt Auxiliary Building common motor control center, respectively.

8.3-55

WBN Ventilation Each battery room has ventilation systems as described in Section 9.4.3 to prevent the accumulation of explosive gases. In addition to the ventilation systems provided to prevent accumulation of the hydrogen produced by the battery, there are voltmeters, high voltage alarms, and administrative procedures for control of equalizing charges that will provide additional protection. Also, as an added precaution, all cells are of the sealed type and have a special safety vent that prevents the ignition of gases within the cell from a spark or flame outside the cell.

Loading Loads are assigned according to their divisional requirements. Loads requiring four divisions of separation are assigned to the four channels. Loads requiring two divisions of separation are assigned to Channels I or III and II or IV. Two-divisional loads primarily associated with Unit 1 are assigned to Channels I and II, while those primarily associated with Unit 2 are assigned to Channels III and IV. The nondivisional load assignments are distributed among the four channels.

Test and Inspections The system will be periodically tested and inspected in accordance with the Technical Specifications to assure the continued adequacy of the system to perform its intended function throughout the life of the plant. The system is equipped with ground detection and instrumentation to continuously monitor the system.

Identification In all documents pertaining to Class 1E systems, the method of distinguishing between the safety and non-safety loads are clearly defined on the document. Equipment identification is discussed in Section 8.3.1.3.

Load Time of Application The system has the capacity to continuously supply the normal and accident loads with ac power available, and all required loads for four hours with the loss of all AC power. A manual load shedding is not required during an SBO.

8.3-56

WBN System Structure The configuration of the dc control power system is shown on Figure 8.1-3. It is separated into four identical channels (designated as Channels I, II, III, and IV), with the equipment of each channel being electrically and physically independent from the equipment of all other channels.

Each channel consists of a battery charger which supplies normal dc power, a battery for emergency dc power which is normally in the float mode of operation, and a distribution board which facilitated load grouping and provides circuit protection. Each channel is ungrounded and incorporates ground detection devices with alarm in the Main Control Room.

Physical Arrangement of Components The battery boards, vital chargers, vital batteries, and diesel generator batteries comprising the dc power system are arranged to provide adequate physical isolation and electrical separations to prevent common mode failures. The analysis verifying the adequacy of independence appears in Section 8.3.2.2.

The specific arrangement of components is discussed below.

125-Volt Vital Batteries I, II, III, IV, and V

Reference:

Figures 8.3-36 and 8.3-57 These batteries are located in individual rooms on Elevation 772.0 of the Auxiliary Building.

Vital Battery V is located in the same room with Vital Battery Board V. The battery room heating and ventilating systems are discussed in detail in Section 9.4.3 125-Volt Vital Battery Boards I, II, III, IV, and V

Reference:

Figures 8.3-36 and 8.3-57 Boards I, II, III, and IV are located in individual rooms on Elevation 757.0 of the Auxiliary Building. Board V is located in the fifth vital battery room on Elevation 772.0 of the Auxiliary Building. The battery board room heating and ventilating systems are discussed in detail in Section 9.4.3.

Loads Each channel supplies the following types of loads: control circuits for the shutdown boards, relay panels, solenoid valve fuse panels, emergency lighting cabinets, inverters, annunciators, and panels associated with reactor instrumentation and control systems. Figures 8.3-47 through 8.3-50 list the loads on each battery board. Table 8.3-12 provides summary loading of the battery boards as supplied by the battery chargers for normal operation or the batteries for loss of all ac power or accident events.

8.3-57

WBN Loads are assigned to the systems according to the loads' divisional requirements. Four divisional loads are assigned to the four channels, two divisional loads are assigned to Channels I or III and II or IV. The loads primarily associated with Unit 1 are assigned to Channels I and II while loads primarily associated with Unit 2 are assigned to Channels III and IV. Nondivisional loads primarily associated with Unit 1 are assigned to Channels I or II.

Similarly, nondivisional loads associated with Unit 2 are assigned to Channels III or IV.

Nondivisional loads that are primarily associated with plant common services are distributed among the four channels. Some loads have a normal and alternate feeder. The normal feeder is from one channel while the alternate feeder is from another channel. These loads are listed in Figures 8.3-47 through 50. The transfer of the loads between the two feeders is manual and is interlocked to prevent paralleling the redundant power sources.

Maximum steady state dc loads (during battery recharge following an ac outage, the inverters and lighting loads are supplied from ac power) for each channel are supplied from a battery charger when it has either normal or standby ac power available from the 480V shutdown boards. If the normal charger is unavailable, the loads are supplied from either the associated battery or a spare charger which can be manually connected to the battery board.

125V Diesel Generator Batteries 1A-A, 1B-B, 2A-A, 2B-B

Reference:

Figure 8.3-46 For a detail description of the 125V diesel generator battery system, refer to the paragraph on diesel generator control power in Section 8.3.1.1. Also, statements of compliance of the 125V diesel generator battery system with the applicable GDCs, regulatory guides, and IEEE standards are included in Section 8.3.1.1.

Normal DC Supply

Reference:

Figure 8.1-3 The normal supply of dc current to the battery boards is from the battery charger in each channel. Each charger maintains a floating voltage of approximately 135 volts on the associated battery board bus (the battery is continuously connected to this bus also) and is capable of maintaining 140 volts during an equalizing charge period (all loads can tolerate the 140 volt equalizing voltage). The charger supplies normal steady state dc load demand on the battery board and maintains the battery in a charged state. Normal recharging of the battery from the design discharged condition can be accomplished in 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> (with accident loads being supplied) following a 30 minute alternating current power outage and in approximately 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> (with normal loads being supplied) following a 4-hour ac power outage. The battery chargers, including the spare chargers if in service, are automatically loaded on the diesel generators for a loss of offsite power. Two pairs of spare chargers are available for the four channels (two each for two channels). Each spare charger can be connected to either of its two assigned channels. It can substitute for or operate in parallel with the normal charger in that channel.

8.3-58

WBN AC power for each charger is derived from the station auxiliary power system via two 480V ac 3-phase circuits which are physically and electrically independent. Each circuit has access to a preferred (offsite) and a standby (onsite) source. If the normal circuit supplying a charger is unavailable, the alternate circuit is selected by a manual transfer. The transfer switches are mechanically interlocked to prevent closing switches in a manner to parallel both feeds. The alternate 480V feeder breakers are verified open in accordance with the technical specifications. Each charger is equipped with a dc voltmeter, dc ammeter, and charger abnormal alarm. Malfunction of a charger is annunciated in the Main Control Room. Upon loss of normal power to a charger, each may be energized from the standby power system.

Chargers I, II, III, IV, 6-S, 7-S, 8-S, and 9-S are solid-state type which convert a 3-phase 480V ac input to a nominal 125V dc output having a rated capacity of 200 amperes. Over this output current range the dc output voltage will vary no more than +1.0% for a supply voltage amplitude variation of +7.5% and frequency variation of + 2.0%.

Charger V is a solid-state type which converts a 3-phase 480V ac input to a nominal 125V dc output having a rated capacity of 200 amperes. Over this output current range the dc output voltage will vary no more than +1.0% for a supply voltage amplitude variation of +7.5% and frequency variation of +2.0%.

Some operational features of the chargers are (1) float and equalize modes of operation, (2) output voltage adjustable over the range of 125 to 140 volts, (3) a current limit feature which limits continuous overload operation to 125% of rated output, (4) protective devices which prevent a failed charger from discharging its associated battery and protect the charger from external overloads, (5) metering and alarm circuits to monitor the charger output, (6) parallel operation capability, (7) high voltage cutout function that will trip the output breaker in the event there is an over-voltage condition. The charger normally operates in the float mode at 135 volts for Batteries I-IV and 138.5 volts for Battery V. The maximum equalizing voltage for batteries I-IV is 140 volts when connected to the distribution system. The system configuration, using substitution of Battery V, permits off-line equalization at higher than normal values.

Emergency DC Supply The emergency supply of dc current to each distribution board is from its associated vital battery. There are five vital batteries for the plant--one associated with each channel and Vital Battery V which may serve as a temporary replacement for Vital Battery I, II, III or IV. These batteries are physically and electrically independent. The vital batteries supply the entire plant dc load in the event the normal power source is unavailable. With normal power unavailable, three vital batteries are capable of supplying continuously for 30 minutes all loads required for safe shutdown of both units. The batteries also have the capability to supply the essential loads required to maintain the plant in a safe shut-down condition for four hours following a loss of all normal and standby ac power, but no accident. Each battery is normally required to supply loads only during the time interval between loss of normal feed to its charger and the receipt of emergency power to the charger from the standby diesel generator.

8.3-59

WBN Vital Battery Boards Battery Boards I, II, III and IV consist of four metal-enclosed panels. Mounted on these panels are the main distribution bus, battery and charger input buses, load group fuses, load group buses, subdistribution circuit breakers, and various instruments for monitoring board loading.

Each load-group fuse and subdistribution circuit breaker is selectively coordinated with the 1000-ampere main-battery-supply circuit breaker and the 1600-ampere battery-supply fuse.

The load-group fuse is also coordinated with the subdistribution circuit breakers. The coordination between the load-group fuse and subdistribution circuit breakers is optimized to provide selective coordination for load-originated faults. The charger input breakers and fuses are considered a load group and are coordinated to the battery supply protective devices. The purpose of this coordination scheme is to prevent a fault on one subdistribution or charging feeder causing a loss of the emergency supply.

All of the subdistribution circuit breakers are 150-ampere frame molded-case types with the exception of the charger input, emergency lighting, and inverter breakers, which are 400-ampere frame molded-case types. The load groups are connected to the main distribution bus. The battery chargers, inverters, lighting-cabinet feeds and the non-safety-related load groups are connected to the main distribution bus with fuses.

All circuit breakers have trip alarm contacts to alert the control room operator of a tripped breaker. The ground indicator has an alarm contact to warn the operator of a distribution system ground. Metering on the distribution board for Vital Batteries I, II, III, and IV includes battery current, bus voltage, main and spare charger voltage, board charging current, and ground current. Metering for battery current and bus voltage for Vital Batteries I, II, III, and IV are also located on the main control board.

The Class 1E Vital Battery Board V consists of two metal-enclosed panels containing the main distribution bus, battery and charger input buses, battery main circuit breaker, charger main circuit breaker, subdistribution-interlocking-load circuit breakers, and various instruments for monitoring board loading.

Battery Board V contains metering for battery current, bus voltage, and ground current which indicates the fifth vital battery system parameters in the standby or replacement mode. The MCR battery ammeter of the replaced battery system will be manually switched to indicate Battery V current. The MCR bus voltmeter of the replaced battery system will continue to indicate the bus voltage of the replaced battery system.

Tests and Inspections Prior to placing the vital dc system in operation, the system components will be tested in accordance with the requirements for the dc power system in Chapter 14. Subsequent to the vital dc system being declared operable, system testing will be conducted in accordance with the Technical Specifications.

8.3-60

WBN The batteries are tested by discharging them with a load which simulates their loading during an ac power outage. The test is performed in accordance with IEEE Standard 450-1980, "IEEE Recommended Practice for Maintenance, Testing and Replacement of Large Lead Storage Batteries for Generating Stations and Substations," Sections 5.1 and 5.2. A variable load is connected to the batteries, and a constant current drain is maintained until conclusion of the tests. The battery capacity is then determined using the procedure outlined in IEEE Standard 450-1980, Section 6.5.

A battery service test, conducted in accordance with the procedures of Section 6.6 of IEEE Std. 450-1980 or modified performance test based on Section 5.4 of IEEE Std. 450-1995, is also used to test the batteries under conditions as close to design as practical. The batteries are discharged through the simulated design loads for the required discharge period. The time required to return to normal conditions is established by recharging the batteries from discharged condition to a nominally fully charged state. The design loads will be confirmed by field measurements as part of the preoperational testing program.

The charger will be checked for normal and equalizing voltage adjustability, 100% output capability, specified regulation with and without the battery connected, and panel instruments calibration. For the distribution board, circuit breakers will be tested for proper trip operation, fuses have been checked to verify that the sizes and types specified on the single-line diagram (see Figures 8.3-47 through 8.3-50, and Figure 8.3-56) have been installed, and the board instruments will be calibrated.

Vital DC Power System Load Data Figures 8.3-47 through 8.3-50 identify the safety-related and nonsafety-related connected loads. Table 8.3-12 provides summary loading of the batteries/battery chargers based on manufacturers' data. Capacity and capability of the vital power system are verified in Section 8.3.2.2.

8.3.2.1.2 Non-Safety-Related DC Power Systems There are five non-safety-related dc systems: (1) the 24V dc Microwave Power Supply, (2) the 48V dc Telephone Power Supply, (3) the 48V Battery Systems, (4) the 250V Battery System, and (5) 24V dc coding, alarm, and paging (CAP) Power Supply. These systems supply power primarily for balance-of-plant loads.

24V DC Microwave Power Supply This system consists of parallel-connected, redundant dc-dc converters powered from the 48Vdc Telephone Battery System. It supplies power to the microwave equipment.

8.3-61

WBN 48V dc Telephone and Power Supply This system consists of a 24-cell 48V telephone battery, a 48V telephone battery charger, a spare battery charger shared with the 48V plant battery system, and a 200A power distribution board. The telephone power supply provides power to such loads as the telephone switching system, and other communication equipment including microwave equipment.

48V Plant Battery System This system consists of a 24-cell 48V plant battery, a 48V plant battery charger, a spare charger shared with the 48V telephone power system, a battery board, and electrical control room distribution panel. This system provides power for various switchyard control functions and static carrier relaying equipment. Loads supplied by this system are not safety-related.

24V DC CAP Power Supply This system consists of a 12-cell battery, two 24V dc 300A parallel connected chargers, and a 450A power distribution panel. It supplies power to portions of the coding, alarm, and paging (CAP) equipment.

250-Volt DC Power System This system provides power for non-safety-related loads such as turbine auxiliaries, computer, and switchyard control and relaying equipment. The circuits supplying power for switchyard control are discussed in Section 8.2.1.4.

8.3.2.2 Analysis of Vital 125V DC Control Power Supply System The 125V dc Class 1E electrical systems were designed, components fabricated, and are or will be installed meeting the requirements of the NRC 10 CFR 50 Appendix A General Design Criteria, IEEE Standard 308-1971, NRC Regulatory Guides 1.6 (Revision 0) and 1.32 (Revision 0), and other applicable criteria as enumerated herein.

The I, II, III, and IV vital battery system consists of four lead-acid-calcium batteries (60 cells each), eight 200-ampere battery chargers, four distribution boards, cable, and hardware. Each distribution board is supplied from its own battery and charger. However, there are two pairs of spare chargers for supplemental and/or backup capacity. Each spare charger is connected so as to be available for use on either of two of the distribution boards for supplying load or charging the batteries. Manually operated switches transfer the spare charger from one board to another, and it is interlocked to prevent accidental parallel connection of the vital power systems.

The fifth vital battery system consists of 125V Vital Battery V, Battery Board V, Charger V, Distribution Panel A, Distribution Panel B, and four Panels 0 (one each for Vital Battery Boards I, II, III and IV).

8.3-62

WBN The distribution Boards I, II, III and IV are each located in separate rooms at Elevation 757 of the Auxiliary Building, which is designed as a seismic Category I structure, and they are protected from potential missile hazards. The batteries are located in separate rooms, and the chargers are located in groups of three in separate room at Elevation 772 of this same building.

Therefore, this equipment will not be exposed to hostile environments and, since it is outside the primary containment area, it will not be exposed to significant radiation due to a LOCA.

The Fifth Vital Battery System components are located as follows:

Component Location Battery V Auxiliary Bldg, A4-U, El 772 Charger V Auxiliary Bldg, A5-S, El 772 125-V Vital Distribution Board V Auxiliary Bldg, A5-T, El 772 125-V Vital Distribution Panel A Auxiliary Bldg, A5-R, El 757 125-V Vital Distribution Panel B Auxiliary Bldg, All-R, El 757 Panel 0, Battery Board I Auxiliary Bldg, A5-R, El 757 Panel 0, Battery Board II Auxiliary Bldg, A5-R, El 757 Panel 0, Battery Board III Auxiliary Bldg, All-R, El 757 Panel 0, Battery Board IV Auxiliary Bldg, A12-R, El 757 Thus, the system design, equipment location, separation, and redundancy assure ability to meet the requirements for the applicable accident events described and evaluated in Chapter 15 and is in full compliance with NRC General Design Criteria 17 and Regulatory Guide 1.6, Revision 0.

Analysis of Vital 125-Volt dc System for Compliance to Regulatory Guide 1.81Position C2 The following results were obtained in an analysis of the vital 125V dc system with respect to position C2 of Regulatory Guide 1.81 (each item is addressed in the order it appears in position C2 of the Regulatory Guide):

(a) Watts Bar is a two-unit plant (b) The vital 125V dc batteries are designed to supply all required loads. This includes the safety system loads energized by a spurious accident signal (single failure) in a non-accident unit concurrent with the safety loads energized in an accident unit. Therefore, assuming a loss of offsite power, a false or spurious accident signal in the non-accident unit concurrent with an accident in the other unit will not preclude the vital 125V dc system from performing its intended safety function.

8.3-63

WBN (c) Assuming the loss of offsite power, a design-basis accident and a single failure (loss of a vital battery), sufficient capacity is available in the remaining vital 125V dc batteries to support a safe and orderly shutdown of the plant.

(d) Only one of the four vital 125V batteries will be removed from service for maintenance or testing at any one time. Therefore, this condition will not preclude the ability to safely shutdown both units, assuming the loss of offsite power.

(e) No interface between the unit operators is required to meet items b and c above since the batteries are designed to supply all required loads for the events identified in b and c.

(f) Status indications for the vital 125V dc system are provided in each unit's main control room (MCR).

The normal or preferred power source to each distribution board is from the battery charger which is supplied from either one of two 480-volt ac shutdown distribution boards. The battery serves as an emergency source in the event the battery charger source is lost or is inadequate for the load required. Table 8.3-12 provides maximum loading for each board for normal, loss of all ac power, and accident conditions. With 480 VAC available, the primary charger supplying each board has the capacity to supply load currents and recharge the battery from a minimum design discharge state. Each battery has an adequate rating at the minimum design o

temperature (60 F) and when derated for aging, for a minimum of 105 volts (108.5 volts for Battery V) at the battery terminals. Under emergency conditions, including 480 VAC unavailable, the battery capacity exceeds the maximum design load requirements for each board. The capability of the battery system is verified by the DC power system tests discussed in Chapter 14, and by system testing conducted in accordance with the Technical Specifications.

Each dc control bus on the 6.9kV and 480V shutdown boards has a normal and alternate supply. The alternate supply is redundant and electrically separate from the normal supply.

The normal and alternate power supplies for Train A shutdown boards control buses are Batteries I and III and for Train B shutdown boards, Batteries II and IV. The supply cables are routed so as to provide complete physical separation from the two supplies to each load. The overall design of the system (including batteries, chargers, distribution boards, and cabling) incorporates sufficient capacity and capability to deliver the maximum design load currents required at each remote point and also to clear any possible short-circuit fault currents.

The load demand from Battery Boards I, II, III and IV can be grouped into essentially three categories for analysis purposes. These are (1) the vital inverters, (2) 6900V and 480V shutdown board control power, and (3) miscellaneous control and instrumentation loads. The output fuse and breaker trip ratings and trip times are coordinated to provide protection and isolation for the cables leaving the board.

Referring to Figure 8.1-3, it can be seen that each of the three groups of loads are supplied from the main distribution bus to a stub bus from which the power is delivered to each load circuit by a molded-case automatic circuit breaker. The non-safety-related stub buses are connected to the main distribution bus through fuses. Each stub bus may supply one or more circuit breakers. Figures 8.3-47 through 8.3-50 show the exact circuit distribution. Each circuit breaker or fuse has a current-interrupting rating greater than the maximum short-circuit current capability of the battery and charger combined. Each circuit breaker and fuse is sized in accordance with the circuit requirements. The circuit breakers and fuses are also sized to coordinate with the battery protective devices.

8.3-64

WBN The fuse is likewise coordinated with the main bus supply protective devices. The one panel of the distribution board that is devoted entirely to fused load circuits is powered from the main bus through a molded-case breaker which provides redundant protection and serves as an isolating disconnect switch.

Chargers I, II, III and IV are all identical and are rated for a load duty as dictated by the battery board distribution and battery charging requirements. The output load of the charger is delivered through a 2-pole molded-case breaker that is capable of interrupting the battery backfeed into the charger as necessary. The trip setting of the breaker is chosen to permit the charger to operate at its maximum output capability without experiencing a false trip.

The electrical characteristics of the charger provide the necessary output power regulated and filtered as required by the load for the worst maximum and minimum input power conditions.

The charging capacity exceeds that required to restore the battery from the design minimum charge state to the fully-charged state under worse case load conditions in compliance with Regulatory Guide 1.32. The input circuit of the charger is protected from the source power by a molded-case breaker that also serves as an isolating or disconnect switch. The input power is derived from either one of two 480-volt shutdown distribution boards. The manually-operated transfer switch through which the power is delivered is interlocked in such a manner so as not to parallel the two shutdown boards in compliance with Regulatory Guide 1.6, Revision 0.

Seismic Category I(L) Battery Charger V is intended solely to maintain Vital Battery V in its fully charged state and to recharge it following its use or testing. At no time will battery charger V be used to supply vital battery system loads. Battery charger V has sufficient capacity to restore Vital Battery V from design minimum charge state to the fully charged state in approximately 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br />. The output load of the charger is delivered through a 2-pole molded-case breaker capable of interrupting battery back feed current into the charger as necessary. The breaker trip setting is chosen to permit maximum charger output without experiencing false trip. The electrical characteristics of the charger provide the necessary filtered and regulated output power for battery recharge. The input circuit of the charger is protected from the source power by a molded-case breaker which serves also as an isolating or disconnect switch. The input power is from the 480V Auxiliary Building Common MCC.

Surveillance and Monitoring Each distribution board and charger is equipped with the proper instruments to provide visual indication of the necessary electrical quantities. An alarm contact is provided on all circuit breakers and on all fuses located on the fuse distribution board that closes for a blown fuse or automatic opening of the breaker. Undervoltage alarm relays provide annunciation for loss of power on the buses or power input to the chargers. Overvoltage alarm relays in charger provide annunciation for protection of system loads. A ground indication alarm meter provides annunciation for ground faults. Closure of any contact provides annunciation in the MCR. Also, a battery current ammeter (charge/discharge) and a battery bus voltmeter are provided in the MCR and locally to verify proper operation of each system. The fifth battery charger does not supply dc system loads; therefore, the overvoltage and failure alarm relays do not serve any safety or protective function and consequently are not required for alarms.

The overall system design (including function requirements, redundancy, capability, availability, surveillance, and energy storage capacity) is in full conformance with IEEE Standard 308-1971 criteria for Class 1E Systems.

8.3-65

WBN Seismic Qualification One complete board assembly and one complete battery charger assembly have been subjected to the safe shutdown earthquake (SSE) conditions stipulated in the design criteria for the particular elevation at which they are installed. (Refer to Section 3.10.) The tests for Vital Battery Boards I, II, III, and IV were performed in conformance to IEEE Standard 344-1971, Guide for Seismic Qualification of Class 1E Equipment. Chargers I, II, III, and IV (including spare chargers 6-S, 7-S, 8-S and 9-S) were tested to IEEE Standard 344-1975. [Although charger V is Seismic Category I(L), it has been procured and tested in compliance with IEEE Standard 344-1975 to reduce the spare parts inventory.] The tests for vital battery boards I, II, III, and IV and charger I, II, III, and IV were performed in conformance to IEEE Standard 344-1971, Guide for Seismic Qualification of Class 1E Equipment. [Charger V is Seismic Category I(L)]. For Vital Battery Boards I, II, III, and IV, one breaker of each type used on the equipment was operated under simulated fault conditions at the same time the assembly was experiencing the seismic forces. The seismic test results assure that the complete assembly will continue to function properly and continue to deliver the required power during and after any expected SSE condition.

A seismic test was performed on Vital Battery Board V and distribution panels A, B, and 0 in accordance with IEEE Standard 344-1975. The board and panels were verified to maintain electrical function and structural integrity before, during, and after the test. No malfunctions of equipment were exhibited.

Design Test All battery chargers were electrically tested to assure that each unit is capable of performing all requirements as specified. All boards were subjected to and satisfactorily passed the following tests as specified under the indicated paragraphs of Section 20-5 of ANSI C37.20-1969 (ANSI C37.20-1974 for fifth vital battery system):

20-5.2.8 - Flame Resistance for Barrier, Bus, and Wire Insulation 20-5.3.2 - Mechanical operation 20-5.3.4.1 - Control Wiring Continuity 20-5.3.4.2 - Control Wiring Insulation All molded-case circuit breakers comply with NEMA Publication No. AB-1-1964 (AB-1-1975 for fifth vital battery system) requirements, and all drawout low-voltage circuit breakers comply with NEMA Publication No. SG3-1965. All control circuit wiring has self-extinguishing insulation rated 600 volts in accordance with paragraph 6.1.3.1 of ANSI C37.20-1969 (ANSI C37.20-1974 for fifth vital battery system). All equipment is certified to operate within the environmental requirement called for in the Design Criteria (Refer to Section 3.11).

Quality Assurance A Quality Assurance program implemented from the beginning of the specification for this equipment and continued throughout installation and final checkout assures that the equipment meets all applicable design and operable criteria. The specifications require that suppliers of this equipment maintain a Quality Assurance program throughout the duration of the contract and that the program conform to the essential elements as defined in NRC Appendix B of 10 CFR, Part 50. An in-plant examination of each contractor's Quality Assurance program assures 8.3-66

WBN compliance with these requirements. The design, specification, and any design changes are reviewed by designated staff engineers to assure compliance with Quality Assurance procedures and design criteria. All records, drawings, test reports, etc., depicting quality assurance review are maintained in appropriate files in accordance with established procedures.

8.3.2.3 Physical Identification of Safety-Related Equipment in DC Power Systems The physical identification of the onsite dc power systems is combined with the onsite ac power systems and is described in Section 8.3.1.3.

8.3.2.4 Independence of Redundant DC Power Systems The treatment of the redundant onsite dc power systems is included in Section 8.3.1.4 with the onsite ac power systems.

The 125-V dc power required for engineered safety features is arranged as follows:

Unit 1 'A' Train - Vital Battery I Unit 1 'B' Train - Vital Battery II Unit 2 'A' Train - Vital Battery III Unit 2 'B' Train - Vital Battery IV Four channel 120V ac vital instrument power is supplied from eight (four per unit) uninterruptable power supplies. The normal input to these supplies is from the 480V shutdown system with backup power coming from the vital batteries. The 480V ac input is rectified and biased against the dc by means of an auctioneered diode circuit to permit use of the battery source if the ac input voltage is lost.

The safety loads supplied from these units have been grouped as follows:

Unit 1, Channel I - Unit 1 RPS Channel I input relays, ESF 'A' Train output relays.

Unit 1, Channel II - Unit 1 RPS Channel II input relays, ESF 'B' Train output relays.

Unit 1. Channel III - Unit I RPS Channel III input relays.

Unit 1, Channel IV - Unit 1 RPS Channel IV input relays.

Unit 2, Channel I - Unit 2 RPS Channel I input relays.

Unit 2, Channel II - Unit 2 RPS Channel II input relays.

Unit 2, Channel III - Unit 2 RPS Channel III input relays, ESF 'A' Train output relays.

Unit 2, Channel IV - Unit 2 RPS Channel IV input relays, ESF 'B' Train output relays.

The limiting conditions studies was the loss of offsite power concurrent with the failure of one battery. Table 8.3-13 shows the results of this study.

8.3-67

WBN Conformance with General Design Criteria, Regulatory Guides, and Branch Technical Position.

GDC 5 The failure of a vital battery does not significantly impair the ability of systems and components important to safety to perform their safety functions, including, in the event of an accident in one unit an orderly shutdown and cooldown of the remaining unit.

RG 1.6, There are no provisions for automatically connecting one Revision 0 load group to another load group. There are no provisions for automatically transferring loads between redundant load groups.

RG-1.81 and BTP EICSB 7 The design of the Watts Bar 125V Vital DC System meets all the requirements for multi-unit generating stations for which construction permit application were mad before June 1, 1973, as described in RG-1.81 and BTP EICSB 7.

RG 1.155 The design of the vital battery systems complies with the regulatory requirements and the NUMARC 87-00 guidelines for 10CFR 50.63, Station Blackout. Load shedding of the non-required loads may be performed to achieve the required four-hour coping duration.

8.3.3 Fire Protection for Cable Systems Refer to the WBN Fire Protection Report for discussion of fire protection for cable systems.

REFERENCES

1. NRC letter to TVA, Watts Bar Nuclear Plant, Unit 1 - Issuance of Amendment Regarding Increase in Allowed Outage times for Emergency Diesel Generators (TAC No. MB 2720), dated July 1, 2002.

2 TVA letter to NRC, Watts Bar Nuclear Plant - Technical Specification Change TS-01-04, Diesel Generator Risk Informed Allowed Outage Time (AOT) Extension, dated August 7, 2001.

3. TVA letter to NRC, Watts Bar Nuclear Plant - Technical Specification Change TS-01-04, Diesel Generator Risk Informed Allowed Outage Time (AOT) Extension - Request for Additional Information and Supplement to Amendment Request, dated December 14, 2001.

4. TVA letter to NRC, Watts Bar Nuclear Plant - Technical Specification Change TS-01-04, Diesel Generator Risk Informed Allowed Outage Time (AOT) Extension - Additional Information, dated April 1, 2002.

8.3-68

WBN TABLE 8.3-1 SAFETY-RELATED STANDBY (ONSITE) POWER SOURCES AND DISTRIBUTION BOARDS UNIT 2 UNIT 1 Power Train B Power Train A Power Train B Power Train A Diesel Gen 2B-B Diesel Gen 2A-A Diesel Gen 1B-B Diesel Gen 1A-A 6.9kV Shdn Bd 2B-B 6.9kV Shdn Bd 2A-A 6.9kV Shdn Bd 1B-B 6.9 kV Shdn Bd 1A-A 480V Shdn Bd 2B1-B 480V Shdn Bd 2A1-A 480V Shdn Bd 1B1-B 480V Shdn Bd 1A1-A 480V Shdn Bd 2B2-B 480V Shdn Bd 2A2-A 480V Shdn Bd 1B2-B 480V Shdn Bd 1A2-A Reactor MOV Reactor MOV Reactor MOV Reactor MOV Bd 2B1-B Bd 2A1-A Bd 1B1-B Bd 1A1-A Reactor MOV Reactor MOV Reactor MOV Reactor MOV Bd 2B2-B Bd 2A2-A Bd 1B2-B Bd 1A2-A Cont & Aux Bldg Cont & Aux Bldg Cont & Aux Bldg Cont & Aux Bldg Vent Bd 2B1-B Vent Bd 2A1-A Vent Bd 1B1-B Vent Bd 1A1-A Cont & Aux Bldg Cont & Aux Bldg Cont & Aux Bldg Cont & Aux Bldg Vent Bd 2B2-B Vent Bd 2A2-A Vent Bd 1B2-B Vent Bd 1A2-A Reactor Vent Reactor Vent Reactor Vent Reactor Vent Bd 2B-B Bd 2A-A Bd 1B-B Bd 1A-A Diesel Aux Diesel Aux Diesel Aux Diesel Aux Bd 2B1-B Bd 2A1-A Bd 1B1-B Bd 1A1-A Diesel Aux Diesel Aux Diesel Aux Diesel Aux Bd 2B2-B Bd 2A2-A Bd 1B2-B Bd 1A2-A Abbreviations: Aux - Auxiliary Cont - Control Shdn - Shutdown Bd - Board Gen - Generator Vent - Ventilation Bldg - Building MOV - Motor Operated Valve

WBN TABLE 8.3-2 SHUTDOWN BOARD LOADS AUTOMATICALLY TRIPPED FOLLOWING A LOSS OF PREFERRED (OFFSITE) POWER Power Train 3

Equipment Name Quantity 2B 2A 1B 1A Pressurizer Heater 4 x x x x Containment Spray Pump 4 x x x x Centrifugal Charging Pump 4 x x x x Essential Raw Cooling Water Pump 8 xx xx xx xx Safety Injection Pump 4 x x x x Auxiliary Feedwater Pump 4 x x x x Residual Heat Removal Pump 4 x x x x Component Cooling System Pump 4 x x x x Component Cooling System Pump C-S 1 x---------or----------x Spent Fuel Pit Pump 2 x x Spent Fuel Pit Pump (Spare) 1 x---------or---------x Service Air Compressor 2 x x Fire Pump 4 x x x x Auxiliary Building General Supply Fan 4 x x x x Auxiliary Building General Exhaust Fan 4 x x x x Fuel Handling Area Exhaust Fan 2 x x Cont & Aux Building Vent Board 2 4 x x x x Reactor Vent Board 4 x x x x Shutdown Board Room Chiller Package 2 x x Control Rod Drive Mech. Coolers 81 xx xx xx xx Reactor Lower Compt. Cooler Fan 8 xx xx xx xx Reactor Building Polar Crane 2 x x Notes:

1. Each Unit 1 CRDM Cooler has 2 motors and each Unit 2 CRDM Cooler has 1 motor.

2. For horsepower or KW rating see the single line diagram.

3. Some of the Non-Safety Related Loads connected to Safety Related Motor Control Centers are also stripped and are not automatically reconnected.

WBN-1 TABLE 8.3-3 DIESEL GENERATOR LOAD SEQUENTIALLY APPLIED FOLLOWING A LOSS OF PREFERRED (OFFSITE) POWER(1)(9)

Load Applied Time Non-in Starting accident Accident Equipment Name Secs(2) kVA Condition Condition SIA SIB Miscellaneous Loads 0 4170 Yes Yes Yes Centrifugal Charging Pump &

5 3117 Yes Yes Yes AHU Safety Injection Pump & AHU 10 2537 No Yes Yes Residual Heat Removal Pump 15 2177 No Yes Yes

& AHU Essential Raw Cooling Water 20 3932 Yes Yes Yes Pump Component Cooling System (3) 35 1660 Yes Yes Yes Pump Auxiliary Feedwater Pump 25 3429 Yes Yes Yes (4) (5)

Fire Pump 40 939 Yes No No Pressurizer Heaters 90 485 kW Yes No No Containment Spray Pump &

184 3409 No No Yes AHU (6)

Shutdown BD Rm Chiller Pkg 360 963 Yes Yes Yes Cont'mt Air Return Fan 540 692 No No Yes (7)

Main Control Rm Chiller Pkg 1260 1454 Yes Yes Yes (8)

Electrical Bd Rm Chiller Pkg 1260 1454 Yes Yes Yes Diesel Generator Set Rating: 4400 kW continuous and 4840kW for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> out of 24.

AHU - Air Handling Unit NOTES:

(1) The sequence times given apply to WBN Unit 1.

(2) Time is measured from the time of closing of the generator breaker connecting the diesel generator to the shutdown board. Values given are nominal.

(3) Diesel generator 1A or 2B will have two component cooling system pumps loaded.

(4) Initial Train A pump, subsequent pumps delayed by 10 seconds each.

(5) Fire pumps receiving power from the Unit with an accident.

(6) On diesel generator 1B and 2A only (7) On diesel generator 1A and 1B only (8) On diesel generator 2A and 2B only (9) For load nameplate horsepower, see the single line diagram.

WBN TABLE 8.3-4 UNIT 1 POWER TRAIN A BOARD LOADING Board Bus Rating kVA 6.9kV Shutdown Bd 1A-A 14,300 480V Shutdown Bd 1A1-A 2660/1330 (3200/1600 a bus) 480V Shutdown Bd 1A2-A 2660/1330 (3200/1600 a bus)

Reactor MOV Bd 1A1-A 498.8 Reactor MOV Bd 1A2-A 498.8 Con & Aux Bldg Vent Bd 1A1-A 498.8 Con & Aux Bldg Vent Bd 1A2-A 498.8 Reactor Vent Bd 1A-A 498.8 Diesel Aux Bd 1A1-A 498.8 Diesel Aux Bd 1A2-A 498.8

WBN TABLE 8.3-5 UNIT 1 POWER TRAIN B BOARD RATING Board Bus Rating kVA 6.9-kV Shutdown Bd 1B-B 14,300 480V Shutdown Bd 1B1-B (3200/1600 a bus) 2660/1330 480V Shutdown Bd 1B2-B (3200/1600 a bus) 2660/1330 Reactor MOV Bd 1B1-B 498.8 Reactor MOV Bd 1B2-B 498.8 Con & Aux Bldg Vent Bd 1B1-B 498.8 Con & Aux Bldg Vent Bd 1B2-B 498.8 Reactor Vent Bd 1B-B 498.8 Diesel Aux Bd 1B1-B 498.8 Diesel Aux Bd 1B2-B 498.8

WBN TABLE 8.3-6 UNIT 2 POWER TRAIN A BOARD RATING Board Bus Rating kVA 6.9kV Shutdown Bd 2A-A 14,300 480V Shutdown Bd 2A1-A (3200/1600 a bus) 2660/1330 480V Shutdown Bd 2A2-A (3200/1600 a bus) 2600/1330 Reactor MOV Bd 2A1-A 498.8 Reactor MOV Bd 2A2-A 498.8 Con & Aux Bldg Vent Bd 2A1-A 498.8 Con & Aux Bldg Vent Bd 2A2-A 498.8 Reactor Vent Bd 2A-A 498.8 Diesel Aux Bd 2A1-A 498.8 Diesel Aux Bd 2A2-A 498.8

WBN TABLE 8.3-7 UNIT 2 POWER TRAIN B BOARD RATINGS Board Bus Rating kVA 6.9-kV Shutdown Bd 2B-B 14,300 480-V Shutdown Bd 2B1-B (3200/1600 a bus) 2660/1330 480-V shutdown Bd 2B2-B (3200/1600 a bus) 2600/1330 Reactor MOV Bd 2B1-B 498.8 Reactor MOV Bd 2B2-B 498.8 Con & Aux Bldg Vent Bd 2B1-B 498.8 Con & Aux Bldg Vent Bd 2B2-B 498.8 Reactor Vent Bd 2B-B 498.8 Diesel Aux Bd 2B1-B 498.8 Diesel Aux Bd 2B2-B 498.8

WBN TABLE 8.3-8 SHUTDOWN TRANSFORMER RATING All transformer Ratings Are; 2000 kVA at 55 C or 2240 kVA at 65 C

WBN TABLE 8.3-9 D. C. CONTROL POWER FOR SAFETY-RELATED STANDBY (ONSITE)

POWER DISTRIBUTION BOARDS 125-Volt vital Battery Supply Nor Bus Emerg Bus Board Name Nor Fdr Alt Fdr Nor Fdr Alt Fdr 6.9-kV Shutdown Board 1A-A I III III I 6.9-kV Shutdown Board 1B-B II IV IV II 6.9-kV Shutdown Board 2A-A III I I III 6.9-kV Shutdown board 2B-B IV II II IV 480-Volt Shutdown Board 1A1-A I III III I 480-Volt Shutdown Board 1A2-A I III III I 480-Volt Shutdown Board 1B1-A II IV IV II 480-Volt Shutdown Board 1B2-B II IV IV II 480-Volt Shutdown Board 2A1-A III I I III 480-Volt Shutdown Board 2A2-A III I I III 480-Volt Shutdown Board 2B1-B IV II II IV 480-Volt Shutdown Board 2B2-B IV II II IV

WBN Table 8.3-10 COMPONENTS HAVING MANUAL TRANSFER BETWEEN POWER DIVISIONS Component Normal Supply Alternate Supply 125V Bat Chgr I & Inverters 480V Shutdown Bd 1A2-A 480V Shutdown Bd 1B1-B 125V Bat Chgr II & Inverters 480V Shutdown Bd 1B2-B 480V Shutdown Bd 1A1-A 125V Bat Chgr III & Inverters 480V Shutdown Bd 2A2-A 480V Shutdown Bd 2B1-B 125V Bat Chgr IV & Inverters 480V Shutdown Bd 2B2-B 480V Shutdown Bd 2A1-A 125V Spare Bat Chgr 6 & 8**** Reactor MOV Bd 1A2-A* Reactor MOV Bd 1B2-B*

125V Spare Bat Chgr 7 & 9**** Reactor MOV Bd 2A2-A* Reactor MOV Bd 2B2-B*

Component Cooling System 480V Shutdown Bd 2B2-B 480V Shutdown Bd 1A2-A Pump C-S Spent Fuel Pit Pump C-S 480V Shutdown Bd 1A1-A 480V Shutdown Bd 2B1-B Unit 1 125V Aux Feedwater 125V DC Vital Battery Board 125V DC Vital Battery Turbine (AFWT), DC Control III** Board IV**

Power Unit 1 120V AFWT, AC Control 120V AC Vital Instrument 120V AC Vital Instrument Power Power Board 1-III Power Board 1-IV Unit 2 125 AFWT, DC Control 125V DC Vital Battery Board 125V DC Vital Battery Power I** Board II**

Unit 2 120V AFWT, AC Control 120V AC Vital Instrument 120V AC Vital Instrument Power Power Board 2-I Power Board 2-II Spare 125V DC Chargers DC 125V DC Vital Battery Board 125V Vital Battery Board (6-S & 8-S)**** I*** II***

Spare 125V DC Chargers DC 125V DC Vital Battery Board 125 DC Vital Battery Board (7-S & 9-S)**** III*** IV***

• These boards are neither the normal nor alternate supply but are the available boards from which the loads can be supplied.

• • During station blackout, the 125V AFWT DC control power manual transfer switch (unit 1) must be placed and maintained in the normal position.

• • • These boards are neither the normal nor alternate supply but are boards (loads) which can be connected via these switches to the spare battery chargers.

• • • • These switch panels contain a second manually interlocked transfer switch to select the charger being utilized. Correct alignment both AC and DC transfer switch panels is required for proper operation of the utilized charger.

WBN TABLE 8.3-11 120V A.C. Vital Instrument Power Board Load Data Channel 1-I 1-II 1-III 1-IV 2-I 2-II 2-III 2-IV Max Load Rating 20.0 20.0 20.0 20.0 20.0 20.0 20.0 20.0 (KVA)

Load Limits 14.0 14.0 10.5 10.5 14.0 14.0 10.5 10.5 (KVA)

WBN TABLE 8.3-12 125 VDC VITAL BATTERY CAPACITY DATA Coping time in minutes/

PLANT CONDITION BATTERY Battery Capacity in AMPS 0-1 1-30 30-239 239-240 LOSS OF ALL AC POWER I-V 575 350 350 355 ACCIDENT I-V 575 575 N/A N/A NOTES:

1. Battery chargers are rated at 200 amps and require less than 80 amps for battery charging.

2. Maximum battery charging load other than charging is less than 120 amps.

WBN TABLE 8.3-13 VITAL 125V D.C. BATTERY LOSS CONCURRENT WITH LOSS OF OFFSITE POWER Safety-related 120V A.C.

Instrument Power Board Failure Effect Battery D.C. Control Power Failure Effect Multiple Failures Channels I 'A' Train Class 1E Power System SSPS(A) & (B) Ch I Input Relays 1-I, 2-I (Unit 1 & Unit 2) NIS Ch 1 Volt Reg Inst Power 1-I, 2-I NIS Control Power Ch I 1-I, 2-I Process Protection Set I 1-I, 2-I II 'B' Train Class 1E Power System SSPS(A) &(B) Ch II Input Relays 1-II, 2-II (Unit 1 & Unit 2) NIS Ch II Volt Reg Inst. Power 1-II, 2-II NIS Control Power Ch II 1-II, 2-II Process Protection Set II 1-II, 2-II III 'A' Train Class 1E Power System SSPS(A) & (B) Ch III Input Relays 1-III, 2-III (Unit 1 & Unit 2) NIS Ch III Volt Reg Inst Relays 1-III, 2-III NIS Cont Power Ch III 1-III, 2-III Process Protection Set III 1-III, 2-III IV 'B' Train Class 1E Power System SSPS(A) & (B) Ch IV Input Relays 1-IV, 2-IV (Unit 1 & Unit 2) NIS Ch IV Volt Reg Inst. Relays 1-IV, 2-IV NIS Cont Power CH IV 1-IV, 2-IV Process Protection Set IV 1-IV, 2-IV

WBN TABLE 8.3-14 MAJOR ELECTRICAL EQUIPMENT THAT COULD BECOME SUBMERGED FOLLOWING A LOCA Equipment Evaluation Motors for the fans of the control rod These coolers are used to maintain the drive mechanism coolers ambient temperature in the area of the control rod drives within an acceptable range during normal operation. The CRDM coolers are required for safe shutdown per 10 CFR 50 , Appendix R. Their function is not required for LOCA mitigation (Ref. Section 9.4.7)

Reactor Coolant Drain Tank Pumps These pumps remove from inside containment the normal leakage of the reactor coolant system that has been collected in the reactor coolant drain tank.

This is not a safety function. The discharge path of the pumps is automatically isolated in a LOCA. (Ref. Section 9.3.3.3)

Floor and Equipment Drain These pumps remove from inside Sump Pumps containment any leakage inside containment that is not collected in the reactor coolant drain tank. This is not a safety function.

The discharge path of the pumps is automatically isolated in a LOCA (Ref.

Section 9.3.3.3)

Pressurizer Heaters Automatically deenergized in the event of a LOCA.

Reactor Lower Compartment Cooler These fans are required for safe shutdown Fans per 10 CFR 50, Appendix R. Also, they are required to perform the safety-related function of operating after a non-LOCA accident to recirculate air through lower containment and equipment compartments.

This system is not required to perform after a LOCA (refer to Section 9.4.7).

SECURITY-RELATED INFORMATION, WITHHELD UNDER 10CFR2.390 FIGURE 8.3-1

SECURITY-RELATED INFORMATION, WITHHELD UNDER 10CFR2.390 FIGURE 8.3-2

SECURITY-RELATED INFORMATION, WITHHELD UNDER 10CFR2.390 FIGURE 8.3-3

FUNCTIONS DEGRADED VOLTAGE 27 DAT 10 TRIP BREAKERS AND SEC. INITIATE LOAD SHED 96% 27 DBT 2/3 OR 10 MCR DEGRADED 27 DCT SEC. VOLTAGE ALARM (LOW)

LOSS OF VOLTAGE 27 LVA 0.75 SEC.

87% 27 LVB 2/3 OR TRIP SUPPLY BREAKERS 0.75

}

27 LVC SEC. 59 A HIGH 6.9 KV MCR DEGRADED SHUTDOWN BUS OR VOLTAGE ALARM VOLTAGE (HIGH) 27S A 59 C LOAD SHED 70%

27S A 1/2 INITIATE LOAD SHED (3.0 INTERNAL TIME DELAY AT ZERO VOLTS) 27S C *

• TAKEN TWICE 27S C 27S A DG START 1/2 START DIESEL (0.5 INTERNAL TIME DELAY AT ZERO VOLTS 70%

27S C WATTS BAR NUCLEAR PLANT FINAL SAFETY ANALYSIS REPORT Second Level Voltage Protection FIGURE 8.3.5a

FIGURE 8.3-14a Deleted

FIGURE 8.3-25a Deleted

FIGURE 8.3-26a Deleted

FIGURE 8.3-27a Deleted

FIGURE 8.3-28a Deleted

FIGURE 8.3-29a Deleted

FIGURES 8.3-41 THRU 8.3-43 DELETED

SECURITY-RELATED INFORMATION, WITHHELD UNDER 10CFR2.390 FIGURE 8.3-46

FIGURE 8.3-49 Deleted

FIGURES 8.3-51 THRU 8.3-54 DELETED

TO BATTERY GROUND

{ DETECTOR 150-0 150V MAIN BREAKER AM 0-150A 150 AF 10,000 10,000 150 AT OHMS OHMS AUX SWITCHES FOR MAIN BKR 150A VM 0-150V 150A 50MV 20 AT 100 AF 100 AF 80 AT DIESEL ENGINE CONTROL PANEL { } EXCITATION PANEL 20 AT 100 AF 100 AF 40 AT GENERATOR PROTECTIVE RELAY

{ } BATTERY CHARGER 20 AT 100 AF 100 AF 20 AT DC LUBE OIL CIRC PUMPS 1&2

{ } MCC BREAKER SHUNT TRIP WATTS BAR NUCLEAR PLANT FINAL SAFETY ANALYSIS REPORT Schematic Diagram DC Distribution Panel FIGURE 8.3-55

FIGURE 8.3-58 DELETED

SECURITY-RELATED INFORMATION, WITHHELD UNDER 10CFR2.390 FIGURE 8.3-59

WBN APPENDIX 8A ANALYSIS OF SUBMERGED ELECRTRICAL EQUIPMENET (DURING POST LOCA)

POWERED FROM AUXILIARY POWER SYTSTEM Purpose The purpose of this analysis was to evaluate the response of the Class 1E Auxiliary Power System (APS) to the submergence and subsequent fault of electrical equipment inside the containment vessel during post-LOCA flooding. The effect of flooding on the non-Class 1E power system was not analyzed since its failure would not affect the Class 1E power system or any electric equipment required to mitigate the accident.

Assumptions Conductivity of the water used in flooding the containment is sufficient that the magnitude of the leakage current is the maximum value of current that the protective device would carry for an indefinite period of time.

Reference Letter from L. M. Mills (TVA) to Ms. E. Adensam (NRC), dated March 3, 1982, which included additional information concerning power systems at Watts Bar Nuclear Plant.

Procedure The Class 1E devices of the APS located below the anticipated maximum flood level were identified. These devices were examined to determine if they would be tripped (deenergized) due to the plant's operating mode or if they would be energized and faulted due to flooding.

The following effects on the 1E auxiliary power system and boards due to the submersion of the energized devices were evaluated:

(1) Increased board loading due to leakage currents flowing thru the floodwater and the additional mechanical drag on rotating equipment due to flooding.

(2) Main circuit breaker trip settings.

(3) Board voltages supplying equipment required for safe shutdown during flooding of non-required equipment.

Analysis To determine the effects of flooding on the auxiliary power buses/boards, the following actions were performed:

(a) The worst case full load current on the bus, excluding the submerged equipment, was determined.

(b) The maximum possible overload due to each submerged component was determined, e.g., the leakage current in a heater was considered to be equal to the upper trip limit of the protective device.

(c) The total bus current, including the effects of the submerged loads, was calculated and compared with the main breaker's tripping Characteristics.

Conclusion The post-LOCA flood will not cause breakers to trip out of sequence or degrade the 6900V ac or 480V ac voltage levels of the Class 1E Auxiliary Power System.

8A-1

WBN APPENDIX 8B ANALYSIS OF SUBMERGED ELECRTRICAL EQUIPMENET (DURING POST LOCA)

POWERED FROM INSTRUMENTATION AND CONTROL POWER SYTSTEM Purpose The purpose of this analysis was to evaluate the response of the Class 1E instrument and control (I&C) power system (125 volts dc and 120 volts ac) to the submergence and subsequent fault of certain electrical equipment inside containment during post-LOCA flooding.

Assumptions (1) The conductivity of the post-LOCA flood water is sufficient that the magnitude of the leakage current is the maximum value of current that the protective device would carry for an indefinite period of time.

(2) All components are submerged at the same time; therefore, the worst case condition will be imposed on the I&C power system.

(3) Only the submerged I&C components powered from the Class 1E I&C power system were evaluated.

Reference Letter from L. M. Mills (TVA) to Ms. E. Adensam (NRC), dated March 3, 1982, which included additional information concerning power systems at Watts Bar Nuclear Plant.

Method of Analysis The devices that receive power from the Class 1E (I&C) power system and are located below the anticipated maximum flood level were identified. These devices were categorized into two groups:

(1) Components de-energized as a result of the safety injection signal.

(2) Components energized due to plant operating mode, accident and/or failure.

To determine the effects that the submerged I&C loads would have on the Class 1E I&C control power systems/boards, the following actions were performed:

(a) The worst case full load current on the board, excluding the leakage currents of the submerged components, was determined.

(b) The maximum possible leakage current for each submerged component was determined and added to the full load current above.

(c) The acceptability on the I&C system of the resultant bus/board loading with the submerged loads was determined.

(d) The trip settings of the main/supply breakers were compared with the loading to ensure that tripping does not occur and de-energize all connected loads.

Conclusion The results of this analysis show that the submergence of the electrical components will not prevent the Class 1E 120V ac and 125V dc I&C power systems from performing their intended safety functions. The submergence of multiple components from the same power system will not exceed the Class 1E I&C power system's capacity rating. Any low impendence faults (short circuit) will be isolated by either the primary or backup protective devices without tripping the main breaker.

8B-1

WBN APPENDIX 8C PROBABLITY/RELIABILITY ANALYSIS OF PROTECTION DEVICE SCHEMES FOR ASSOCIATED AND NON-CLASS 1E CABLES Purpose The purpose of this analysis is to verify that the reliability of (1) a circuit breaker and a fuse in series, or (2) two circuit breakers in series (without periodic testing) is essentially equal to the reliability of a single circuit breaker periodically tested.

It also verifies that the probability of a single fuse's failure is essentially equivalent to the probability of simultaneous failure of two series circuit breakers (without regard to periodic testing).

Assumptions

1. Each circuit breaker is tested every 18 months.

2. The circuit is taken out of service during the circuit breaker test.

3. Testing does not decrease the reliability of the device tested.

4. Redundant protection devices have a mission time of 40 years (350,400 hours0.00463 days <br />0.111 hours <br />6.613757e-4 weeks <br />1.522e-4 months <br />); based on a 40-year plant life.

5. Tested circuit breakers have a mission time of 18 month (13,140 hours0.00162 days <br />0.0389 hours <br />2.314815e-4 weeks <br />5.327e-5 months <br />), assuming all failures are detected by the test.

6. Failure data for reliability calculations are the recommended failure data obtained from IEEE 500-1977.

7. Failure data for probability of failure calculations are the maximum failure data obtained from IEEE 500-1977.

Part A - Reliability Analysis Method of Analysis For this part of the analysis a reliability calculation was made on each redundant protective device scheme and a single circuit breaker periodically tested. As defined in IEEE 352-1975, reliability is the characteristic of an item expressed as the probability that it will perform a required mission under stated conditions for a stated mission time. Mathematically, this is shown as:

Reliability = exp [- t], where = failure rate t = mission time Analysis Utilizing the above assumptions and mathematical formula and the following recommended failure rates obtained from IEEE 500-1977, the reliability calculation for each protection scheme was made.

Component (Recommended Value) Failure Mode D. C. Circuit Breaker 0.139 per 106 hrs. All 6

A. C. Circuit Breaker 0.144 per 10 hrs. All 6

Fuse 0.03 per 10 hrs. All 8C-1

WBN Therefore, the reliability for each type of periodically tested circuit breaker follows:

Component Reliability DC Breaker R = exp [-1.39x10-7 (13140)] = 0.9982

-7 AC Breaker (Low Voltage) R = exp [-1.44x10 (13140)] = 0.9981 In order to calculate the reliability of the possible redundant protective schemes, the unreliability of each device must be determined which is simply:

Unreliability (R) = 1-Reliability = 1-exp [- t]

Based on the above formula and a mission time of 40 years the unreliability is:

Component Unreliability (R)

-7 DC Breaker R = 1-R = 1-exp[-1.39 x 10 (350400)]

= 1-0.951 = 0.048

-7 AC Breaker (Low Voltage) R = 1-exp[-1.44 x 10 (350400)]

= 1-0.951 = 0.049

-8 Fuse R = 1-exp[-3.00 x 10 (350400)]

= 1-0.990 = 0.010 The reliability for each redundant scheme will be calculated as the product of each component's unreliability subtracted from one, which is formulated as:

R = 1-[R(A) x R(B)]; where A and B are the respective components for each redundant scheme.

The reliabilities for each redundant protection scheme are:

Redundant Scheme Reliability (R)

Two A.C. Breakers (Low Voltage) R = 1-[R(A)xR(B)]

= 1-[(0.049) (0.049)] = 0.9976 Fuse w/A.C. Breaker (Low Voltage) R = 1-[(0.049) (0.010)] = 0.9995 Fuse w/D.C. Breaker R = 1-[(0.048) (0.01)] = 0.9995 Two D. C. Breakers R = 1-[(0.048) (0.048)] = 0.9977 Results:

PROTECTION APPLICATION SCHEME D.C. A.C.

One circuit breaker periodically tested 0.9982 0.9981 8C-2

WBN Two circuit breakers with no testing 0.9977 0.9976 Circuit breaker & fuse with no testing 0.9995 0.9995 These results indicate very little difference between the reliability of two redundant protective devices and a single device periodically tested. Their reliability is essentially equal. A fuse and circuit breaker combination appears to be somewhat more reliable than a periodically tested breaker which appears to be somewhat more reliable than two series circuit breaker.

Several assumptions were made to simplify this analysis. In all cases the assumptions were conservatively stated in favor of periodically testing. That is, the reliability figures for a single device with periodic testing are inflated in proportion to the stated assumptions.

When the conservative assumptions are considered along with the numerical results, it is obvious that redundant protective devices are at least as reliable as a single periodically tested device. Therefore, it is concluded that any of these protective schemes are viable, and the selection for each application should be based on feasibility and economic considerations.

Part B - Probability of Failure Analysis Method of Analysis The probability of failure approach was used to compare a single fuse with two low voltage A.C.

circuit breakers (without regard to periodic testing). This allows a straightforward comparison based on failure rates of these components. Also, this approach allows a more direct evaluation for the condition of most concern (i.e., failure of a protective device to open).

Therefore, the probability of failure for the fuse (low-voltage) to open on a given operation is obtained from the IEEE 500-1977 maximum failure rate data. For the above redundant scheme, the maximum probability of failure (PF) to open of both series components is the PF(A) times the PF(B); where A=B=maximum failure rate of low voltage A.C. breaker.

Analysis IEEE 500-1977 lists the following maximum failure rates ():

Component Maximum Value (Failure to Open) 6 Fuse (Low-voltage) 10 per 10 operations 6

AC Breaker (Low-voltage) 2265 per 10 operations Based on the above failure data, the probability of failure for the two protection schemes is:

Event PF (Failure to Open)

-6 Fuse failure (Low-voltage) = 10x10 /Operation Simultaneous failure of Two A.C. Breakers (Low-voltage)

= 5.13x10-6 /operation 8C-3

WBN Results:

This analysis verifies that a fuse has a very low probability of failure. Being a passive device with no moving parts and requiring no energy source other than the fault itself, a fuse is much less likely to fail than a circuit breaker. In fact, the results of this analysis show that the probability of a fuse failure is about the same as the probability of two circuit breakers failing simultaneously. Therefore, it is concluded that a single fuse provides the same level protection as two circuit breakers in series.

==

Conclusion:==

This analysis clearly demonstrates that each of the following protective schemes provides cable protection which is at least as reliable as a single circuit breaker with periodic testing:

1. a circuit breaker and a fuse in series,

2. two circuit breakers in series, or

3. a single fuse.

Therefore, any of these protection schemes may be selected in lieu of periodically testing a single circuit breaker. The selection can be made on a feasibility and economic basis since the level of protection is essentially the same. Any of these protection schemes will adequately protect the non-Class 1E or associated cables and prevent degradation of the Class 1E cables.

8C-4