ML18127A073

Proposed License Amendment Request Open Phase Protection Per NRC Bulletin 2012-01

ML18127A073
Person / Time
Site:	North Anna
Issue date:	04/30/2018
From:	Mark D. Sartain Dominion Energy Virginia, Virginia Electric & Power Co (VEPCO)
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
BL-12-001
Download: ML18127A073 (73)

Text

,.,,.

VIRGINIA ELECTRICAND POWER COMPANY RICHMOND, VIRGINIA 23261

• April 30, 2018 U. S. Nuclear Regulatory Commission Attention: Document Control Desk Washington, DC 20555-0001 VIRGINIA ELECTRIC AND POWER COMPANY NORTH ANNA POWER STATION UNITS 1 AND 2 PROPOSED LICENSE AMENDMENT REQUEST Serial No.:

NRA/DPM:

Docket Nos.:

License Nos.:

OPEN PHASE PROTECTION PER NRC BULLETIN 2012-01 10CFR50.90 18-072 R1 50-338/339 NPF-4/7 Industry operating experience and NRC Bu.lletin (NRCB) 2012-01, "Design Vulnerability in Electric Power System," identified industry issues involving the loss of one or two phases of an off-site power circuit (i.e., an open phase condition) at certain nuclear power stations both nationally and internationally. In response to an NRC request for additional information (RAI) associated with NRCB 2012-01, Virginia Electric and Power Company (Dominion Energy Virginia) informed the NRC that plant design changes were being planned to address the potential for an* open phase condition (OPC) at North Anna Power Station (North Anna) Units 1 and 2. Furthermore, by letters dated October 9, 2013 and March 16, 2015, the Nuclear Energy Institute (NEI) notified the NRC that the industry's Chief Nuclear Officers (CNOs) had approved a formal initiative to address OPCs, and that the initiative represented a formal commitment among nuclear power plant licensees to address the OPC design vulnerability for operating reactors.

A voltage unbalance protection system is being installed on the North Anna Units 1 and 2 4160V emergency buses to address the potential for an OPC to exist on one or two phases of a primary off-site power source that would not currently be detected and mitigated by the existing station electrical protection scheme. Therefore, pursuant to 1 O CFR 50.90, Dominion Energy Virginia is submitting a license amendment request for North Anna Units 1 and 2 to add operability requirements, required actions, and surveillance requirements to the Technical Specifications (TS) for the 4160V emergency bus voltage unbalance function. Attachment 1 provides a discussion and evaluation of the proposed change.

Marked-up TS pages and typed TS pages indicating the proposed change are provided in Attachments 2 and 3, respectively. Attachment 4 provides marked-up TS Bases pages (for information only).

We have evaluated the proposed change request and have determined that it does not involve a significant hazards consideration as defined in 10 CFR 50.92. The basis for this determination is included in Attachment 1. We have also determined that operation with the proposed change will not result in any significant increase in the amount of effluents that may be released off-site or any significant increase in individual or cumulative occupational radiation exposure. Therefore, the proposed change is eligible for categorical exclusion from an environmental assessment as set forth in 10 CFR 51.22(c)(9). Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment is needed in connection with the approval of the proposed,

~obi

'\\

,J Serial No.18-072 Docket Nos.: 50-338/339 Page 2 of 3 change. The proposed TS change has been reviewed and approved by the Facility Safety Review Committee.

Dominion Energy Virginia requests approval of the proposed TS change by June 30, 2019. Thirty days after issuance is a typical time frame for implementing license amendments.

The 4160V emergency bus voltage unbalance (open phase) protection function will be implemented during a different outage for each unit; thereby necessitating a different implementation schedule for North Anna Units 1 and 2.

Accordingly, Dominion Energy Virginia requests implementation of the proposed TS revisions to coincide with the completion of the fall 2019 refueling outage for North Anna Unit 1 and the fall 2020 refueling outage for North Anna Unit 2.

Should you have any questions or require additional information, please contact Ms. Diane E. Aitken at (804) 273-2694.

Respectfully, Mark D. Sartain Vice President - Nuclear Engineering and Fleet Support Commitments contained in this letter: None Attachments:

1. Discussion of Change

2. Marked-up Technical Specifications Pages

3. Proposed Technical Specifications Pages

4. Marked-up Technical Specification Bases Pages (For Information Only)

COMMONWEALTH OF VIRGINIA

)

)

COUNTY OF HENRICO

)

The foregoing document was acknowledged before me, in and for the County and Commonwealth aforesaid, today by Mr. Mark D. Sartain, who is Vice President - Nuclear Engineering and Fleet Support, of Virginia Electric and Power Company.

He has affirmed before me that he is duly authorized to execute and.file the foregoing document in behalf of that company, and that the statements in the document are true to the best of his knowledge and belief.

Acknowledged before me this 3o Vday of 4r;I ' 2018.

My Commission Expires: 5 -3 / -~a VICKI L. HULL NOTARY PUBLIC REG. # 140542 COMMONWEALTH OF VIRGINIA MY COMMISSION EXPIRES 5131/2022

~-L~

Notary Public

Serial No.18-072 Docket Nos.: 50-338/339 Page 3 of 3 cc:

U.S. Nuclear Regulatory Commission - Region II Marquis One Tower 245 Peachtree Center Avenue, NE Suite 1200 Atlanta, GA 30303-1257 State Health Commissioner Virginia Department of Health James Madison Building..::. ?1h *floor.*

109 Governor Street Suite 730 Richmond, VA 23219 Ms. Karen R. Cotton Gross NRC Project Manager - Surry U.S. Nuclear Regulatory Commission One White Flint North Mail Stop 08 G-9A 11555 Rockville Pike Rockville, MD 20852-2738 Mr. James R. Hall NRC Senior Project Manager - North Anna U.S. Nuclear Regulatory Commission One White Flint North Mail Stop 08 G-9A 11555 Rockville Pike Rockville, MD 20852-2738 NRC Senior Resident Inspector North Anna Power Station DISCUSSION OF CHANGE Virginia Electric and Power Company (Dominion Energy Virginia)

North Anna Units 1 and 2 Serial No.18-072 Docket Nos. 50-338/339 Page 1 of 44

1.0 Summary Description 2.0 Detailed Description TABLE OF CONTENTS 2.1 Existing System Design and Operation 2.2 Current Technical Specifications Requirements 2.3 Reason for Proposed Change 2.4 Description of Proposed Change 2.5 OPC Relay Surveillance Frequencies 3.0 Technical Evaluation 3.1 Open Phase Conditions Case Summary 3.1.1 Open Phase Conditions Considered 3.1.2 Open Phase Locations Considered 3.1.3 Generating Conditions Considered 3.1.4 Loading Conditions Considered 3.2 Calculations and Plant Analysis Methodology 3.2.1 Negative Sequence Analysis 3.2.2 Motor Analysis 3.2.3 Open Phase Event Timing 3.2.4 Security Cases 3.2.5 Setpoints 3.3 Design Solution 3.3.1 Class 1 E Design Solution Page 2 of 43 3.3.2 Existing Plant Protection and Unique Operating Conditions 3.3.2.1 GSU Transformer Operating Conditions 3.3.2.2 EDG Test Configuration 3.3.3 Non-Class 1 E Design Solution 3.4 Failure Modes and Effects Analysis 4.0 Regulatory Evaluation

4.1 Background

4.2 Applicable Regulatory Requirements/Criteria 4.2.1 Comparison to 10 CFR 50.36 Criteria for TS Inclusion 4.2.2 General Design Criteria 4.2.3 10 CFR 50.55a(h)(2) Protection Systems 4.2.4 NRC Generic Letter 79-36 4.2.5 NRC Branch Technical Position (BTP) 8-9 Open Phase Conditions in Electric Power System 4.3 No Significant Hazards Consideration Analysis 5.0 Environmental Consideration 6.0 Conclusion 7.0 References

DISCUSSION OF CHANGE 1.0

SUMMARY

DESCRIPTION Page 3 of 43 Industry operating experience and NRC Bulletin (NRCB) 2012-01, "Design Vulnerability in Electric Power System," (Reference 7.1) have identified industry issues that involve the loss of one or two phases of an off-site power circuit (i.e., an open phase condition) at certain nuclear power stations both nationally and internationally. In response to an NRC request for additional information (RAI) associated with NRCB 2012-01 (Reference 7.2), Virginia Electric and Power Company (Dominion Energy Virginia) stated that plant design changes were being planned to address the potential for an open phase condition (OPC) at North Anna Power Station (North Anna) Units 1 and 2.

By letters dated October 9, 2013 and March 16, 2015 (References 7.3 and 7.4), the Nuclear Energy Institute (NEI) notified the NRC that the industry's Chief Nuclear Officers (CNOs) had approved a formal initiative to address OPCs, and that the initiative represented a formal commitment among nuclear power plant licensees to address the OPC design vulnerability for operating reactors.

As discussed below, a Class 1 E voltage unbalance protection system is being installed on the North Anna Units 1 and 2 4160V emergency buses to address the potential for an OPC to exist on one or two phases of a primary off-site power source that would not currently be detected and mitigated by the existing station electrical protection scheme.

Consequently, appropriate operability requirements, required actions, and surveillance requirements (SRs) are being added to the North Anna Technical Specifications (TS) to address this additional level of voltage unbalance protection for OPCs.

2.0 DETAILED DESCRIPTION 2.1 EXISTING SYSTEM DESIGN AND OPERATION The North Anna station electrical power distribution system is shown in Figure 1. The 230/500kV switchyard, is an integral part of the transmission network and is the preferred source of offsite power to the station Class 1 E electrical system.

The offsite circuit consists of all breakers, transformers, switches, interrupting devices, cabling, and controls required to transmit power from the off-site transmission network to the onsite Class. 1 E Engineered Safety Feature (ESF) bus(es). Each one is qualified to meet the requirements of 10CFR50, Appendix A, General Design Criteria (GDC) 17.

The distribution system to the station Class 1 E electrical distribution system is comprised of a minimum of two qualified off-site circuits between the 230/500kV switchyard and the onsite Class 1 E Electrical Power System and two separate and independent Emergency Diesel Generators (EDGs) per unit. These systems supply power to the redundant trains for each unit to ensure and maintain it in a safe shutdown Page 4 of 43 condition after an anticipated operation occurrence or a postulated Design Basis Accident (OBA).

Qualified offsite circuits include the two 500kV-34.5kV transformers and one 230kV-34.5kV transformer (collectively referred to as the Station Reserve Transformers (SRTs) that feed three independent 34.5kV buses which supply the three Reserve Station Service Transformers (RSSTs). The RSSTs are used to step down from 34.5kV to 4.16kV for the Emergency Buses. Each RSST is protected by overload relay schemes, and the cables are protected by pilot wire differentials. The RSSTs are fully capable of powering Station Service loads in the event of a loss of the normal power supply.

In addition, there are two 500kV lines from the switchyard to the Unit 1 and Unit 2 Generator Step-Up Transformers (GSUs).

• The Generator side of the GS Us is connected to the Station Service Transformers (SSTs). The SSTs are used to step.

down the 22kV from the main generator to 4.16kV for the Station Service Buses.

Three sets of potential transformers (PTs) are installed on each Emergency Bus (phase to ground). The transformers feed undervoltage (UV) relays and are provided on each Class 1 E bus at the 4160V level for detecting a loss of bus voltage or a sustained degraded voltage (DV) condition. Each set of relays are combined in a two-out-of-three logic to generate a Loss of Offsite Power (LOOP) signal. A loss of voltage start of the EOG is initiated when the voltage is less than 74 percent of rated voltage and lasts for approximately 2 seconds. A degraded voltage start of the EOG is produced when the voltage is less than 90 percent of rated voltage sustained for approximately 56 seconds.

The time delay for the degraded voltage signal is reduced to approximately 7.5 seconds with the presence of a Safety Injection on the unit.

In the event of a loss of the preferred power supply, the standby EOG supplies power to safety-related equipment within 10 seconds of a start signal. The Class 1 E loads are loaded onto the EDGs sequentially. The EDGs are rated at 3000kW for 2000 hours0.0231 days <br />0.556 hours <br />0.00331 weeks <br />7.61e-4 months <br />.

Also, the automatic load sequencing timing relays must be OPERABLE. A required load sequencing timing relay is one whose host component is capable of automatically loading onto an emergency bus. Each independent qualified off-site source must be capable of maintaining rated frequency and voltage, and accepting required loads during an accident, while connected to the ESF bus.

2.2 CURRENT TECHNICAL SPECIFICATIONS REQUIREMENTS North Anna Units 1 and.2 TS 3.3.5 provide operability requirements, required actions, and SRs for the Loss of Power (LOP) Emergency Diesel Generator (EOG) Start Instrumentation. Specifically, TS Limiting Condition for Operation (LCO) 3.3.5 requires:

Three channels per bus of the loss of voltage Function and three channels per bus of the degraded voltage Function for the following 4160 VAC buses shall be OPERABLE:

a. The Train H and J buses;

ii

b. One bus on the other unit for each required shared component.

Page 5 of 43 The Required Action for one or more Functions with one channel per bus inoperable is to place the channel in trip with a Completion Time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The Required Action for one or more Functions with two or more channels per bus inoperable is to restore all but one channel to OPERABLE status with a Completion Time of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />.

With the Required Action and Completion Time not met, immediately enter applicable Condition(s) and Required Action(s) for the associated EOG made inoperable by LOP EDG start instrumentation.

Surveillance Requirement (SR) 3.3.5.1 requires the Trip Actuating Device Operational Test (TADOT) be performed for LCO 3.3.5.a and 3.3.5.b Functions. SR 3.3.5.2 requires performance of a Channel Calibration with specified Allowable Values. SR 3.3.5.3 requires verification ESF Response Times are within limit for LCO 3.3.5.a and LCO 3.3.5.b Functions. The frequency for the surveillance Requirements is in accordance with the Surveillance Frequency Control Program.

As discussed in Section 2.4, the proposed TS LCOs and SRs to address the new voltage unbalance protection function will be included in TS 3.3.5.

2.3 REASON FOR PROPOSED CHANGE An OPC is a single or double open electrical phase in a three phase circuit, with or without ground, which is located on the primary or high voltage side of a transformer connecting a credited off-site power circuit to the on-site transmission system. The potential for an OPC to exist in an off-site power source was not previously recognized as a design vulnerability in the nuclear power industry, therefore, was not considered in the original design of the North Anna electrical power distribution system. However, based on an internal review of the January 2012 event at the Byron Nuclear Power Station, and the issuance of and response to NRC Bulletin 2012-01, Dominion Energy Virginia determined that North Anna Power Station could also be susceptible to an OPC. Specifically, a consequential OPC could result in the affected off-site power source (i.e., the primary or preferred power source) being incapable of supplying sufficient power to perform its safety function.

While many OPCs would be addressed by the existing UV relays, some consequential OPCs are not readily detectable by the existing station electrical protection scheme at North Anna Units 1 and 2. Without the implementation of design modifications, these OPCs may go undetected and unisolated using existing plant protection equipment. If the failed circuit remains connected to the Class 1 E ESF 4160V buses downstream, it could render the downstream onsite emergency power system incapable of performing its designated safety function.

As a result, as part of its design effort to detect and mitigate a potentially undetected consequential OPC, North Anna is installing a Class 1 E protective relaying scheme on the ESF buses that provides an additional pathway for actuating tbe existing undervoltage protection functions and directly interfaces with the ESF actuation logic.

Therefore, the necessary operability requirements, required actions, and SRs for the Page 6 of 43 voltage unbalance function are being incorporated into the North Anna TS to ensure this protection circuitry is capable of performing its design safety function.

2.4 DESCRIPTION

OF PROPOSED CHANGE The proposed TS change adds negative sequence voltage function operability requirements, required actions, and SRs to the TS. A description of the proposed revision is provided below:

North Anna TS 3.3.5, Loss of Power (LOP) Emergency Diesel Generator (EOG)

Start Instrumentation, is revised to require three channels per bus of the negative sequence voltage function to be OPERABLE.

The existing Required Actions will also be applicable to the new negative sequence voltage function.

North Anna SR 3.3.5.1 requires the performance of a Trip Actuating Device Operational Test (TADOT) for LCO 3.3.5.a and 3.3.5.b UV/DV Functions.

North Anna SR 3.3.5.2 is being revised to require the performance of a Trip Actuating Device Operational Test (TADOT) for LCO 3.3.5a and 3.3.5b for Negative Sequence Relay Functions.

North Anna SR 3.3.5.2 is being renumbered to North Anna SR 3.3.5.3 and revised to include performance of a CHANNEL CALIBRATION with the following Allowable Values for the negative sequence voltage function:

c.

Negative Sequence Voltage ~ 2.894% and :5. 5.106% for LCO 3.3.5.a and 3.3.5.b Functions.

North Anna SR 3.3.5.3,which is being renumbered to North Anna SR 3.3.5.4, requires verification ESF Response Times are within limits for LCO 3.3.5.a and LCO 3.3.5.b Functions. The negative sequence voltage function will also be part of the SR.

A mark-up of TS 3.3.5 indicating the proposed changes and the typed proposed TS pages are provided in Attachments 2 and 3, respectively. A mark-up of the proposed TS Bases pages is provided in Attachment 4 and is included for information only.

2.5 OPC RELAY SURVEILLANCE FREQUENCIES Surveillance of the negative sequence voltage relays is required as defined in 10 CFR 50.36(c)(3) to "assure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions for operation will be met." The proposed change revises TS 3.3.5, Loss of Power (LOP) Emergency Diesel Generator (EOG) Start Instrumentation and adds surveillance requirements for the negative sequence voltage function. The negative sequence relays are subject to performance of the Trip Actuating Device Operational Test (TADOT), channel calibration and ESF Response Time Testing in accordance with the Surveillance Frequency Control Program (SFCP). The proposed negative sequence voltage relays' calibration and testing frequencies to be included in the SFCP are "once

Page 7 of 43 per 18 months." As discussed in Section 3.0, Basler BE1-47N relays are being used in the negative sequence voltage (open phase) protection circuitry.

The negative sequence voltage function channel calibration frequency to be included in the SFCP will be once per 18 months. This channel calibration frequency is consistent with the existing Loss of Voltage and Degraded Voltage channel calibration frequency.

The verification of ESF Response Times for the negative sequence voltage function will be performed once per 18 months on a Staggered Test Basis. This is consistent with the verification of ESF Response Times for the existing Loss of Voltage and Degraded Voltage function test frequency. However, while the existing TADOT frequency for the loss of voltage and degraded voltage protective circuitry is "once per 92 days" in the SFCP, a test frequency of "once per 18 months" will be specified for the negative sequence voltage relays based on the following considerations:

1) To trip the emergency bus and start the EOG, the negative sequence voltage relay scheme uses existing Loss of Voltage auxiliary relays which are tested every 92 days in accordance with the surveillance requirements for that relay scheme.

2) In accordance with the Basler relay instruction manual (Reference 7.10), the negative sequence voltage relays require no preventive maintenance other than a periodic operational check. Although the manufacturer does not specify a periodicity for the operational check, the following information supports the selection of an 18-month test frequency for the negative sequence voltage relays:

The Basler relay being used (Model No. BE1-47N) is a solid state relay (SSR) device that has certain advantages over the electro-mechanical relays (EMR) used in the Loss of Voltage / Degraded Voltage protection schemes. These advantages include the absence of mechanical moving parts, less heat generation, less susceptibility to shock and seismic events, no inrush current, and no contact resistance issues. Also, SSRs are not susceptible to open and shorted coils, which can be a mechanism for mechanical relay failure. In addition, contacts on EMRs can have contact contamination, bounce, and arcing. These particular issues do not apply to the Basler SSRs.

The maximum electrical life of an EMR is the maximum permissible number of switch operations at a specified contact load under specified conditions.

SSR data sheets do not carry an electrical life specification like EMRs. Unlike the EMR, where life is dependent on actual switching load and number of cycles, SSR reliability is not associated with the number of switching cycles.

An SSR's lifetime expectation is considered "very long" versus "medium" for EMRs.

Therefore, although the proposed TADOT frequency for the negative sequence voltage relays is longer than the Loss of Voltage and Degraded Voltage relays' TADOT frequency, the "once per 18 months" test frequency is reasonable and justified based on these considerations.

I

3.0 TECHNICAL EVALUATION

Page 8 of 43 At Byron Nuclear Power Station (BNPS), both off-site and onsite electric systems were not able to perform their intended safety functions due to the OPC design vulnerability, and manual actions were necessary to restore ESF functions. Following the OPC events at BNPS in 2012, the NRG issued Bulletin 2012-01, "Design Vulnerability in Electric Power Systems" (Reference 7.1 ).Bulletin 2012-01 requested information regarding the facilities' electric power system design in light of the OPC events that involved the loss of one of the three phases of the off-site power circuits at BNPS Unit 2.Bulletin 2012-01 required licensees to "comprehensively verify their compliance with the regulatory requirements of General Design Criterion (GDC) 17, 'Electric Power Systems,' in Appendix A, General Design Criteria for Nuclear Power Plants, to 10 CFR Part 50 or the applicable principal design criteria in the updated final safety analysis report; and the design criteria for protection systems under 10 CFR 50.55a(h)(2) and 10 CFR 50.55a(h)(3)."

Consistent with the current North Anna licensing basis and GDC 17 requirements, existing protective circuitry is sufficiently sensitive to detect design basis conditions such as a loss of voltage condition or a sustained degraded grid voltage condition and will separate the ESF buses from a connected failed source. However, the existing protection schemes at North Anna may not detect some consequential single or double OPCs on an off-site. power source, and this design vulnerability may preclude electric power systems from adequately performing their intended safety functions.

By letters dated October 9, 2013 and March 16, 2015, NEI notified the NRG that the industry's CNOs had approved a formal initiative to address OPCs (References 7.3 and 7.4).

To address the possibility of an OPC on an off-site power source at North Anna, design changes are being developed to implement a new protection scheme to protect plant equipment from a consequential OPC event, thus ensuring safety functions are preserved during an OPC. Specifically, Dominion Energy Virginia is installing an open phase detection and protection system at North Anna utilizing Class 1 E voltage unbalance (negative sequence) relays (Basler BE1-47N relays) (Reference 7.10) that will provide consequential OPC detection and protection on the 4160V Emergency Switchgear 1 H, 1J, 2H, and 2J buses. The relays will be configured in a two-out-of-three logic scheme that will detect consequential OPCs, trigger an annunciator in the control room indicating an OPC exists, and automatically initiate protection actions to mitigate the event.

The Basler BE1-47N is an inverse time relay. At a minimum of 4 percent negative sequence, the BE1-47N relay will energize and send a start signal in approximately 11 seconds with a larger percent negative sequence generating a faster start signal.

Guidance per National Electrical Manufacturers Association (NEMA) Standard (MG-1)

(Reference 7.5) states motors should be secured when the voltage unbalance is 5 percent or greater. The 4 percent minimum pickup of the BE1-47N relay ensures the relay will not cause nuisance trips while ensuring the guidance of NEMA MG-1 is met.

Page 9 of 43 The time delay setpoint of the BE1-47N relay ensures the bus will trip before the pump overcurrent relays energize.

Upon receiving a sustained degraded voltage, undervoltage, or voltage unbalance condition while exceeding their time delay setpoints, the following conditions will result:

1. The EOG is started,

2. The Emergency Bus is isolated,

3. All loads are stripped from the 4160V Emergency Bus and the 480V load centers except the Charging Pumps, the Low Head Safety Injection Pumps, and the feeds to the 480V Motor Control Center Load,

4. Once the EOG reaches 95% of its nominal output voltage and no residual voltage exists, the EOG output breaker closes automatically,

5. Loads are sequentially connected to the Emergency Bus.

In addition, a blocking feature is also being included in the logic scheme to enhance the reliability of the protection system and to prevent undesired actuation in the event of a fuse failure on a potential transformer (PT) or failure of a PT as further discussed below.

In support of the planned OPC design changes, Dominion Energy Virginia developed a series of models and analyses to determine: 1) the OPC vulnerabilities of the existing North Anna onsite protection schemes for the safety buses, non-safety buses, and off-site power sources given various power source alignments and operating conditions, and 2) the plant and component responses to a consequential OPC. The models and analyses are discussed below and provide the technical bases for the implementation of the planned voltage unbalance (open phase) protection function.

3.1 OPEN PHASE CONDITIONS CASE

SUMMARY

NRC Branch Technical Position (BTP) 8-9 (Reference 7.9) provides guidance that was used to define North Anna's OPC vulnerabilities. An OPC occurs when one or two phase conductor(s) become(s) disconnected from the transmission interconnections while the other phase conductor(s) remain(s) intact resulting in one of the following three conditions:

1. The energized line shorts to ground on the transmission side, so there is fault current to be detected and cleared by the switchyard protection scheme. Since the switchyard protection scheme adequately protects against this condition, no further analysis is necessary.

2. The energized line does not short to ground on the transmission side, so there may not be enough fault current to be detected and cleared by the switchyard protection scheme. The disconnected phase conductor(s) short(s) to ground on the transformer end, connecting the transformer high-voltage (HV) winding to ground. In those cases where two phase conductors open, one or two phase conductors may be connected to ground.

Page 10 of 43 3., The energized line does not short to ground on the transmission side, so there is no fault current to be detected and cleared by the switchyard protection scheme.

The disconnected phase conductor(s) remains suspended above the ground at the transformer end and does *not short to ground on the transformer end.

Each power source alignment or operating condition represents a unique case with the cases collectively representing the known configurations and alignments encountered during licensed operations. The OPCs, locations, generating conditions, and loading conditions considered in the cases are provided in the following sections. To address the potential OPCs and locations, the North Anna licensed operating electrical system configurations and loading conditions were considered with and without a high impedance ground fault condition. OPCs concurrent with an accident were also considered.

3.1.1 Open Phase Conditions Considered The following open phase conditions were considered:

Single open phase without a ground connection Single open phase with a 3500 grounded connection Single open phase with a solid grounded connection Double open phase conditions were considered and simulated for both transformer styles (Wye Solid Grounded-Delta and Delta-Wye solid grounded). In both cases it was found that these cases produced a higher negative sequence voltage than their comparative single open phase conditions. Therefore, single open phase conditions were considered to be bounding and an in depth analysis of double open phase conditions. was not performed.

A single open phase condition was considered and simulated for each phase for both transformer styles (Wye solid grounded-Delta and Delta-Wye solid grounded).

In these cases it is shown that the negative sequence voltage for each phase is comparable to the others when the switchyard is balanced. Therefore, only one of the three phases is evaluated for each open phase event configuration.

3.1.2 Open Phase Locations Considered The analyses considered the following OPC locations:

High side terminals of the #1 Switchyard Transformer (TX-1)

High side terminals of the #2 Switchyard Transformer (TX-2)

High side terminals of the #3 Switchyard Transformer (TX-3)

High side terminals of the RSST A Transformer High side terminals of the RSST B Transformer High side terminals of the RSST C Transformer Page 11 of 43 High side terminals of the Unit 1 Generator (Main) Step-Up (GSU) Transformer High side terminals of the Unit 2 Generator (Main) Step-Up (GSU) Transformer 3.1.3 Generating Conditions Considered Open phase events were considered with North Anna Units 1 and 2 at 0% power and North Anna Units 1 and 2 at 100% power.

For accident scenarios, the open phase event is assumed to occur coincident with Safety Injection and Containment Depressurization Actuation. For large motor starts, the open phase event is assumed to occur coincident with a Reactor Coolant Pump start or tandem Main Feedwater Pump start.

3.1.4 Loading Conditions Considered Two emergency bus loading initial conditions were considered: 1) minimum emergency bus loading and 2) normal emergency bus loading. Minimum emergency bus loading consists of the Service Water, Charging and Component Cooling Pumps secured on the evaluated bus with the opposite train in operation. Normal emergency bus loading consists of the Service Water, Charging and Component Cooling Pumps in operation on the evaluated bus with the opposite train secured.

3.2 CALCULATIONS AND PLANT ANALYSIS METHODOLOGY The models and analyses developed to determine and evaluate the North Anna OPC vulnerabilities are discussed below.

3.2.1 Negative Sequence Analysis Calculations were prepared to analyze the above OPCs to determine the levels of voltage unbalance on the ESF buses from a connected failed source due to a single or double OPC. The levels of unbalanced voltage determined to potentially affect plant operating equipment are discussed below.

A model was developed using the ElectroMagnetic Transients Program -

Restructured Version (EMTP-RV). EMTP-RV numerically solves the differential equations of the circuit to compute the actual time-domain waveforms for the voltages and currents. This approach has advantages over single-phase, frequency domain analysis software or other conventional transient stability programs, in that it can model arbitrary unbalanced phase arrangements, such as an open phase condition. This model includes a 3-phase representation of the system components Page 12 of 43 including the transmission system source, generators, transformers, cables, and plant loads. The model is used to determine the emergency system (Switchgear 1 H, 1 J, 2H, and 2J) voltages during various station events (faults, open phase, motor start, etc.). The various plant configurations, which include motor starts, diesel testing, and open phase events under various loading levels and operating scenarios, were evaluated.

The analytical limits and time delay ofthe negative sequence voltage (open phase) relays were also developed. These limits and time delays are used as input for the open phase relay setting calculation. The negative sequence voltage relay settings should protect important to safety equipment on the 4kV emergency buses from consequential OPCs (with the exception of some OPCs on the primary side of non-safety-related Switchyard Transformers TX-1 and TX-2, discussed in proceeding sections) and remain secure for the maximum level of steady-state voltage unbalance at the switchyard bus.

This analysis determines the analytical limits for the negative sequence voltage protection relay settings that will ensure the safety functions are preserved during an open phase condition. The cases considered and signals monitored are selected for testing the open phase protection relays.

The following steps were used to determine open phase detection analytical limits for the protection negative sequence voltage relays on the emergency system buses for the open phase events described above:

Determine the case list to test the negative sequence voltage protection relaying scheme for an open phase condition concurrent with a LOCA.

Simulate these cases using the EMTP-RV model.

Analyze and tabulate the auxiliary system behavior (e.g. voltages, motor heating, and existing protective relay response) for each case.

Determine the analytical limits for the negative sequence overvoltage protection relays to ensure the safety functions are preserved during an open phase condition.

An OPC causes a voltage unbalance to the induction motors and motor-operated valves (MOVs), which introduces a negative sequence voltage. This negative sequence voltage produces a flux in the air gap that opposes the rotation of the rotor. The resulting induced currents in the rotor are at twice the line frequency, which can cause additional heating in the rotor due to the skin effect (for higher frequency currents, the skin effect will increase the apparent rotor resistance, resulting in additional rotor heating).

This thermal capability also has to consider that Class 1 E motors restart on the EDGs after tripping from the unhealthy source. To account for this motor starting sequence, a total thermal limit (12

• t) of less than or equal to 20 per unit (pu)

I Page 13 of 43 (40 pu/2 starts) for Class 1 E motors during the open phase event concurrent with a LOCA is used as a bounding condition to ensure the motors have enough thermal capability to perform their safety functions.

According to NEMA MG-1, for a voltage unbalance between 1 % and 5% (percent of motor nameplate voltage), the motor horsepower should be de-rated to account for additional heating. Operation of the motor above 5% voltage unbalance is not recommended. Therefore, for voltage unbalance greater than 5%, the negative sequence voltage relays should isolate the motor loads before the (12

• t) value is equal to 20 pu to allow for sufficient remaining thermal capability for the motors to restart on the EDGs.

For a voltage unbalance between 1 % and 5%, the NEMA MG-1 de-rating factor was applied to the motor rating. If the brake horsepower (BHP) of the motor is less than the de-rated horsepower rating, then continuous operation of the motor was determined to be acceptable. In cases where the BHP is greater than the de-rated horsepower rating, the motor must be isolated from the faulted source. The calculation quantifies the time duration for which the motor may be operated on the faulted source before the negative sequence current heating capability is exhausted.

The resulting time duration was used to determine if manual action (alarm) is acceptable or if automatic action (trip) is necessary.

3.2.2 Motor Analysis Based on IEEE report "Design Features and Protection of Valve Actuator Motors in Nuclear Power Plants", and vendor information, it is conservatively assumed that motor-operated valve (MOV) motors can withstand a locked rotor condition for up to 5 seconds and have adequate remaining capability to restart on the emergency diesel generator.

For cases where voltage unbalance is greater than 5%, the results indicate the BE1-47N relays trip and isolate the motor loads before the integrated (1 2

• t) values reach 20 pu and before the motor load's associated overcurrent relay trips (when applicable).

The BE1-47N relays did not actuate for many ungrounded open phase events on the high voltage side of switchyard transformers TX-1 and TX-2. For these conditions, the analysis determined that thermal damage may occur to the Auxiliary Feedwater (AFW) Pump Motors and Inside Recirculation Spray (ISRS) Pump Motors if they are operated continuously under accident loading conditions. For these cases, the Alstom open phase detection relays (described in Section 3.3) will detect the open phase event and initiate a trip of its associated transformer within 5 seconds to provide protection to the downstream loads and to be within the time frames considered in the accident analysis.

The BE1-47N relays did not actuate for ungrounded open phase events on the high voltage side of GSU 1 and GSU 2 when Class1 E Bus is aligned and Units are offline. For these conditions, additional analysis was performed to determine if

Page 14 of 43 thermal damage may occur to the AFW Pump Motors and ISRS Pump Motors if they are operated continuously under accident loading conditions. Further analysis documents that the AFW and ISRS pump motor insulation will be capable of performing their design function on the most limiting case. Therefore no protection is required for this condition.

3.2.3 Open Phase Event Timing For an open phase event coincident with a Safety Injection or Containment Depressurization Actuation signal, the emergency buses shall be re-energized by the Emergency Diesel Generator within 10 seconds. To be within the time-frame considered in the accident analysis, the open phase protection relay tripping time delay should be less than or equal to 7 seconds. This is consistent with the time delay used for degraded voltage protection during accident conditions (7.5 seconds).

Analysis results show that for most open phase events in which the BE1-47N relays trip, the tripping time is less than 6 seconds after the open phase event occurs. For cases in which the BE1-47N does not trip in less than 6 seconds, the Alstom open phase detection relay will detect the open phase event and initiate a trip of the offsite source. This is within the time considered in the accident analysis for a loss of offsite power coincident with an accident.

For open phase conditions not detected by the BE1-47N relays, the Alstom open phase detection relay will detect the open phase event and initiate a trip of the offsite source. A tripping time delay of less than or equal to 5 seconds will be employed by the Alstom relay to be within the time considered in the accident analysis for a loss of offsite power coincident with an accident. Analysis results provide phase current and sequence current magnitudes and angles for Switchyard Transformers TX-1 and TX-2 for use in setting the Alstom open phase detection relays. Sequence currents are sampled at t = 6 seconds to observe currents at 5 seconds post-event.

It should be noted the channel statistical analysis (CSA) for the negative sequence voltage relay may delay the relay response time. A 4% relay pickup setting with a 10.0 time delay setting account for both positive and negative CSA and will ensure the relay would trip within the time considered in the accident analysis for a loss of off-site power coincident with an accident.

3.2.4 Security Cases The design of the voltage unbalance (open phase) function needs to ensure that it will not actuate for non-OPCs, such as during normal operating conditions, unbalanced faults on the auxiliary system, and motor starts under various loading conditions. These normal operating conditions need to consider both time and magnitude of the negative sequence generated. Plant cases identified in supporting calculations were used with the various transmission system unbalances discussed in Section 3.1 to test the negative sequence voltage (open phase) function algorithm's security.

Page 15 of 43 The negative sequence voltage relay includes an inverse timing characteristic feature that is adjustable from 01 to 99 in increments of 1. The timing is based on the percent difference from the nominal system voltage. The calculated results show that with a time dial setting of 10.0, the negative sequence voltage relay was secure (i.e., would not issue an alarm) for the simulated unbalanced faults on the medium-voltage and low-voltage systems. The time dial setting of 10.0 provides sufficient time to allow existing overcurrent relaying to trip on the unbalanced fault condition.

3.2.5 Setpoints Table 1 provides a summary of the maximum and minimum steady-state negative sequence voltages seen at Buses 1 H, 1 J, 2H, and 2J for open phase events on the high side of each transformer, which was then used to determine the appropriate setpoints.

Table 1 - Summary of Negative Sequence Voltages for Open Phase Conditions on Each Transformer Negative Sequence Voltage (L-N rms, at 4200:120 PT Secondaries)

Time = 8secconds Open Phase SWGR1H SWGR 1J SWGR2H SWGR2J Location Min V2 MaxV2 Min V2 MaxV2 Min V2 MaxV2 Min V2 MaxV2 TX-1 1.871V 19.110V 0.297V 0.422V 0.300V 0.848V 1.872V 19.116V TX-2 0.297V 0.420V 0.299V 0.418V 2.398V 18.898V 0.297V 0.420V TX-3 0.275V 0.369V 17.360V 35.023V 0.283V 0.370V 0.278V 0.369V RSST-A 0.285V 0.386V 16.661V 34.788V 0.290V 0.386V 0.287V 0.386V RSST-B 0.226V 0.440V 0.248V 0.424V 13.108V 29.112V 0.226V 0.440V RSST-C 12.318V 26.817V 0.321V 0.455V 0.327V 0.444V 12.365V 26.921V GSU 1 -1 H 0.937V 15.560V 0.300V 1.143V 0.321V 1.106V 0.306V 1.100V GSU 1 -2J 0.343V 1.027V 0.322V 1.151V 0.322V 1.081V 0.966V 15.370V GSU 2-1J 0.328V 1.685V 0.654V 25.691V 0.303V 1.615V 0.329V 1.685V GSU 2-2H 0.326V 1.647V 0.351V 1.514V 0.693V 15.030V 0.322V 1.191 V

Table 1 above shows the following:

Page 16 of 43 For open phase conditions on Transformers TX-1 and TX-2 (Wye Solid Grounded-Delta Transformers) the minimum negative sequence voltage on the impacted emergency buses is insufficient to actuate the BE1-47N relay. The minimum negative sequence voltage is 1.871V (2.7%) for TX-1 and 2.398 (3.46%) for TX-2 and the minimum setting on the BE1-47N relay is 2% on a 69.28V base. These cases shall be detected by the proposed Alstom open phase detection relays on Switchyard Transformers TX-1 and TX-2.

For open phase conditions on Transformers TX-3, RSST A, RSST B, and RSST C (Delta-Wye Transformers) the minimum negative sequence voltage on the impacted emergency buses is above the minimum possible setting for the BE1-47N relay. The minimum observed negative sequence voltage was 12.318V (17.78%), located on Bus 1H for an open phase condition on RSST C.

For open phase conditions on Transformers GSU 1 and GSU 2, the minimum negative sequence voltage is insufficient to actuate the BE1-47N relay. The minimum negative sequence voltage is 0.937V (1.35%) for GSU 1 and 0.654V (0.94%) for GSU 2 and the minimum setting on the BE1-47N relay is 2% on a 69.28V base. Additional evaluation of these conditions was required and is summarized in Section 3.3.2.1.

Considering the uncertainty of the channel, the lowest negative sequence voltage, and the highest security case negative sequence voltage, a setpoint of 4% was selected. A calculation was performed to determine the CSA for the Basler BE1-47N voltage phase sequence relays. The relay and PT inaccuracies and the final relay settings for the negative sequence voltage detection scheme were evaluated.

The maximum uncertainty (i.e., CSA) for the Basler relay at the 4kV emergency buses was calculated to be +/-1.106% of span. With a 4% relay pickup setting, the relay may energize in the range of 2.894% to 5.106% negative sequence voltage.

3.3 DESIGN SOLUTION Two separate OPC systems are required to ensure important to safety components are protected and remain available to perform their design basis functions. These systems are the Class 1 E Basler voltage unbalance relays for protection of the 4kV emergency buses, and a non-Class 1 E Alstrom Open Phase Detection (OPD) System for OPC protection at switchyard transformers TX-1 and TX-2.

3.3.1 Class 1 E Design Solution The new North Anna voltage unbalance protection system design is similar to the UV/DV protection scheme. The new protection system will measure a voltage unbalance using negative sequence voltage with twelve Basler BE1-47N negative sequence relays arranged such that three relays are connected to the secondary side of each of the Emergency Bus (1 H, 1 J, 2H, and 2J) PTs. The new protective Page 17 of 43 relays will be installed on a new set of protection/control fuses, parallel to the bus protection and metering circuits.

The Basler BE1-47N relays are negative sequence relays designed to protect the equipment from damage caused by phase failure, reverse phase sequence, phase unbalance, undervoltage, or overvoltage. The BE1-47N relays utilize the negative sequence voltage protection only since there is currently undervoltage and overvoltage protection already installed on the emergency buses. Similar to the configuration of the existing degraded -and undervoltage protection, the voltage unbalance protection will require two-out-of-three relays to detect a condition in order to trip an emergency bus.

The Basler BE1-47N negative sequence relays contain an internal timer. In order to ensure the BE1-47N relay picks up and trips the bus before the motor overcurrent protection picks up, an inverse time is desired. Therefore, the BE1-47N relays will be procured with an inverse time characteristic.

Because the BE1-47N relays are capable of multiple protective functions (negative sequence, overvoltage, and undervoltage), the output contacts for the negative sequence function are limited to only two. Additional contacts are required for the two-out-of-three scheme. Therefore, a Cutler Hammer ARD relay is being installed downstream of the main output contact as a multiplier relay for each BE1-47N relay.

The output of each multiplier relay is configured into the required two-out-of-three logic. A final ARD relay will be installed downstream of the new two-out-of-three logic to ultimately energize the existing Undervoltage/Degraded Voltage circuit. The Undervoltage/Degraded Voltage circuit trips the bus feeder breakers and automatically starts and loads the EOG. This relay will also send a signal to an existing spare annunciator window for a voltage unbalance trip.

A feature that blocks actuation of the voltage unbalance (open phase) protection function is also included in the logic scheme. This feature enhances the reliability of the protection system and prevents the protection scheme from automatically starting and loading an EOG in the event of a failed fuse on a PT or failed PT. To achieve this feature, one ASEA Brown Boveri (ABB) 60 relay will be installed per bus in the new voltage unbalance circuit.

The ABB-60 balance relay is a differential voltage monitoring relay. It receives two different voltage source inputs and compares them to each other. When the voltage of one input changes with respect to the other beyond the setpoint, the relay will energize, and only its set of contacts will change state.

A Cutler Hammer ARD relay will be installed downstream of the ABB-60 relay. One output from the ARD relay will be used to block the negative sequence two-out-of-three circuits from energizing. This relay will also send a signal to an existing spare annunciator window to indicate a 4KV PT fuse is blown.

Page 18 of 43 As previously discussed, the new PT Blown Fuse Alarm will be used to indicate when there is a blown fuse upstream of the BE1-47N relays. In order to ease troubleshooting for the location of the blown fuse, the one-out-of-three output from the degraded voltage relays will be used to send a signal to the new PT Fuse Blown Alarm via a new ARD relay.

Test switches will be installed for flexibility during testing, maintenance and troubleshooting. The test switches are ABB "Flexitest" models that are Class 1 E and rated for up to 30 amps at 600 volts: One blade from one of the new test switches will be used as a means to block the new voltage unbalance scheme from inadvertently isolating the Emergency Bus during online functional testing.

• The ARD relays are used as multiplier relays since the BE1-47N and ABB-60 relays do not come with enough contacts. The inductive rating of the ARD relays is greater than its control power therefore, the ARD relays are acceptable for this application.

The BE1-47N and ABB-60 relays pickup an ARD relay. Since the inductive contact rating of the BE1-47N and ABB-60 relays is greater than the rated control power of the ARD relay, the BE1-47N and ABB-60 relays are acceptable for the application.

The last ARD relays are used to bring in an annunciator in the Control Room and pickup the undervoltage multiplier relays. The undervoltage multiplier relays are GE series HFA relays rated for 7.5W at 125VDC. Since the inductive rating of the ARD output is greater than the rating of the HFA relays, the ARD relays are acceptable for this application.

Page 19 of 43 See table below for new relay channel characteristics Characteristic BE1-47N ABB-60 ARD Voltage Sensing Input, Nominal 120VAC Voltage Sensing 160% of Nominal Input, Maximum 160VAC Continuous (192VAC)

Rated Control Voltage 125VDC 125VDC 125VDC Rated Control 65% - 100% of Voltage Range 24 -1so voe 100-140 voe Nominal (81.25-137.SVDC)

Rated Control Power 4.6W 5W 14W Output Contact 1 - Form A (NO)

Line A: 1 - Form C Interchangeable Configuration 1 - Form B (NC)

Line B: 1 - Form C Contact Rating, Continuous 3A 5A 5A Contract Rating, Tripping 30A 30A Contact Rating, Inductive 0.3A 0.3A PT Burden

~2VA 0.2VA at 1.0pf Relay Type See Below Solid State The degraded and undervoltage circuits have remote indication on the Control Room Diesel Control Cabinet and EOG Room Isolation Cabinet which indicates control power is available to the degraded and undervoltage circuits. The existing circuits use white lights for providing control power availability. The new voltage unbalance protection will also have remote indication of control power availability in the manner as the existing degraded and undervoltage circuits.

Page 20 of 43 In addition to the white lights in the Control Room and EOG Room, control power availability is also indicated by existing annunciator alarm 1 K-F4, LOSS CONT PWR SFGDS UV CKTS. In the existing undervoltage circuits, an alarm relay is kept normally energized. When control power is lost, the alarm relay de-energizes and brings in the alarm. A new alarm relay will be installed in the voltage unbalance control circuit. The output of the new alarm relay will be tied into the logic for alarm 1 K-F4 so loss of control power is known in a timely manner.

3.3.2 Existing Plant Protection and Unique Operating Conditions 3.3.2.1 GSU Transformer Operating Conditions With the generator online, an OPC on the high voltage side of a GSU transformer results in a voltage unbalance at the switchyard bus, which can be seen at the 4kV emergency buses fed from the RSSTs. The generators have negative sequence current protection and impedance relay schemes which would operate and mitigate single and double OPCs on the high voltage side of a GSU transformer to trip the generator and clear the unbalance.

For single ungrounded open phase events on the high side of

. transformers GSU 1 and GSU 2 there is insufficient negative sequence voltage to actuate the BE1-47N relays. However the negative sequence voltage is greater than 1 % when the open phase event is coincident with a pre-existing 3% switchyard unbalance. The most limiting accident and non-accident cases are discussed below:

The highest non-transient negative sequence voltage for an ungrounded open phase at GSU 1 or GSU 2 for a non-accident condition occurs with 3% Switchyard Unbalance which results in a negative sequence voltage of 2.323V at the 4200V:120V PT secondary. This converts to a 3.353%

voltage unbalance.

According to NEMA MG-1, a voltage unbalance motor de-rating factor at 3.353% voltage unbalance is approximately 86.88% for motors with 1.0 service factor and 99.91 % for motors with a 1.15 service factor.

The highest non-transient negative sequence voltage for an accident condition (i.e. on the accident unit) for an ungrounded open phase at GSU 1 or GSU 2 occurs with 3% Switchyard Unbalance cases, which results in a negative sequence voltage of 2.020V at the 4200V:120V PT secondary.

This converts to 2.916% voltage unbalance.*

According to NEMA MG-1, a voltage unbalance motor de-rating factor at 2.916% voltage unbalance is approximately 89.5% for motors with 1.0 service factor and 102.93% for motors with a 1.15 service factor.

Page 21 of 43 A comparison of the motor loading brake horsepower to the NEMA MG-1 de-rating factor identified that the AFW Pumps prior to throttling (111 %

BHP, SF 1.15) and the ISRS Pumps (98.33% BHP, SF 1.0) are loaded above the NEMA MG-1 de-rating factor during accident conditions. The open phase event would introduce additional motor heating which may damage these motors if they are operated continuously at these conditions. The results show that during the open phase event the Auxiliary Feedwater Pumps draw approximately 0.139 pu negative sequence current. This will lead the Auxiliary Feedwater Pump to reach 20pu in approximately 17 minutes, 11 seconds.

The Inside Recirculation Spray Pumps are not considered since they start approximately 15 minutes after the accident signal.

These are conservative estimates as they do not account for cooling. The 12

• t limit of 20 pu would allow for an immediate re-start of the pump on the diesel generator.

The results also show that the phase currents drawn by the Auxiliary Feedwater Pump Motors in steady-state are less than the 740A pickup setting of their associated Overcurrent Relays. Therefore an overcurrent protection trip is not expected for this case or cases that result in a lower negative sequence voltage at the bus. These cases could result in motor thermal damage after several minutes of operation, which could degrade the expected life of the motor; therefore additional analysis is required.

An evaluation of Auxiliary Feedwater and Inside Recirculation Spray Pump Motor thermal margin during unbalanced conditions was performed. The results of this evaluation determined that the AFW pump motor will be capable of performing their design function with a concurrent negative sequence voltage of 3.176V (4.6% unbalance) at the secondary of the 4200: 120V potential transformer. Under the same voltage unbalance condition, the ISRS motors will have a service life of greater than 30 days during a design basis event occurring at the 60 year operating point.

As the negative sequence voltage used in this evaluation bounds the most limiting negative sequence voltage seen by transformers GSU 1 and GSU 2 that do not actuate the BE1-47N relays and/or existing Undervoltage relays, no additional protection is needed for these cases.

3.3.2.2 EOG Test Configuration For an EOG test concurrent with a single ungrounded OPC, the diesel test could mask the OPC by balancing the voltage at the 4kV buses.

Consequently, the negative sequence voltage relays would not mitigate the voltage unbalance during a parallel EOG test. However, the OPC would only affect one 4kV emergency bus per unit since the off-site power Page 22 of 43 sources are independent of one another. If an accident were to occur during EOG testing, the alternate 4kV emergency bus would be available to mitigate the accident. When the EOG is taken offline after completion of testing, the voltage unbalance at the 4kV emergency bus would increase above the 4% pickup setting and initiate protection of the bus.

During non-accident conditions, the operating safety related motors have a BHP of less than or equal to nameplate horsepower. Therefore, the motors would be capable of operating continuously for an OPC during non-accident conditions. This conclusion is based on the negative sequence voltage unbalance expected at the bus, the corresponding NEMA MG-1 de-rating factor, motor service factor, and nameplate horsepower.

3.3.3 Non-Class 1 E Design Solution For Switchyard Transformers TX-1 and TX-2, there are OPCs that result in a minimum negative sequence voltage on the impacted emergency buses that is insufficient to actuate the BE1-47N relays. These cases shall be detected by the proposed Alstom open phase detection relays on Switchyard Transformers TX-1 and TX-2.

3.4 FAILURE MODES AND EFFECTS ANALYSIS The purpose of the Failure Modes and Effects Analysis is to identify potential voltage unbalance protection function failure modes and evaluate their impact on the design to preclude subsequent operational concerns.

The failure mechanisms for relays are very specific. The new Basler BE1-47N relays will be energized from the DC source. If the power source to the new relays is removed, the relay contacts will not change state when there is a voltage unbalance condition, in which case the voltage unbalance two-out-of-three logic scheme would fail to start the EOG. However, there is an annunciator (1 K-4F, LOSS CONT PWR SFGDS UV CKTS) that notifies the Control Room if voltage is not available on degraded/undervoltage circuits. An auxiliary relay will be installed in the new circuit which will be tied into the existing alarm and will notify Operations if DC power is not available on the new circuit.

In addition, to the overhead alarm, a white light is being installed on the EOG Control Panel in the Control Room and the Diesel Isolation Panel in the EOG Room which will also give indication that control power is available to the voltage unbalance circuit. In the event one of the three relays fail due to loss of DC power (i.e., a power supply failure), then reliance would be on.the other two functional relays to make up the two-out-of-three logic scheme. This failure is no different than the degraded or undervoltage relay failure scenario; and is similar to what happens in the existing design with the time delay of the degraded and undervoltage relays.

The new Basler BE1-47N relays will be continuously de-energized and change state when the voltage unbalance (negative sequence) is equal or greater than the minimum Page 23 of 43 pickup setting for a set amount of time. In the event of a true voltage unbalance condition, a minimum of two-out-of-three relays will be required to energize and time out, then bring in the EOG start signal. An annunciator is being installed in the Control Room if the voltage unbalance scheme actuates. The use of the two-out-of-three logic scheme is used throughout the emergency buses due to the added assurance. One indicating light per relay will be installed on the front of the new panel. In the event of actuation from a signal (true or inadvertent), the new indicating lights will go out and the target light on the front of each relay will be lit. If both the indicating light and the relay target lights are out (and the power status lights on the front of the relay is on), this will cause a loss of indication only and require replacement of the light bulb.

The new protection scheme will be installed downstream of new fuses on both AC and DC circuits. Fuses can fail open or fail shorted (fails to blow). A failure mode of a fuse to fail open is the desired outcome since it protects the components and ensures the upstream breaker, which provides control power to the Emergency Switchgear, does not open. In the event a fuse fails to open, there is a potential for the upstream breaker to open instead, which is not a desired effect, but unavoidable. However, there is an annunciator (LOSS CONT PWR SFGDS UV CKTS) that notifies the Control Room if voltage is not available on the DC side for the existing components. The new control circuit will be tied into the existing annunciator. This will also be apparent by the indicating lights on the front of the relay being out as well as the indicating lights of the Control Room Diesel Control Cabinet and the EOG Room Isolation Panel.

On the AC sensing side, there is a single set of fuses on the primary side of the PTs.

There will also be a new set of fuses on the secondary side dedicated for the new protection scheme (there i~ already a set of fuses for the UV/DV and metering circuits).

If any of these fuses blow, there will be enough negative sequence generated to inadvertently actuate the BE1-47N relays. The primary cause of the blown fuse would be a power supply failure or a faulted cable. Currently, the existing undervoltage and degraded voltage relays remain continuously energized (i.e., picked up), and change state when the voltage drops below the setpoint. In the event of a blown fuse (either primary or secondary side of the PTs) or a failed PT, only one of the undervoltage and one phase in the degraded voltage relays drop out, but the two-out-of-three logic required to isolate the bus and start the EOG is not present. In the new scheme, a primary side fuse failure (or upstream secondary) will cause all three BE1-47N relays to pick up, time out, isolate the bus and start the EOG. This outcome is significantly different than the existing UV/DV protection scheme. In order to ensure a fuse failure does not lead to actuating of the BE1-47N relays on a false signal, an ABB-60 (voltage balance relay) will be installed on the 4kV and 480V PTs. In the event of a blown PT fuse or a failed PT, an annunciator (4KV PT FUSE BLOWN) will alarm in the Control Room. As part of the new alarm, an auxiliary alarm relay will be installed downstream of the contacts from the degraded voltage relay, which will tie into the alarm. This will support Operations with determining which circuit (or both) has the blown fuse.

The ABB-60 relay is being installed to block the new voltage unbalance scheme in the event of a blown fuse or failed PT. Similar to the relay discussion above, the relay power, coil, or contacts can fail. Any one of these failures can prevent blocking of the Page 24 of 43 new voltage unbalance protection scheme. A normally closed output contact is being installed from the ABB-60 relay in order to ensure the new voltage unbalance protection scheme actuates in the event of a true event concurrent with a failed ABB-60 relay.

Periodic testing will to identify a failed ABB-60 relay.

The BE1-47N relays can also inadvertently pick up due to a fault upstream of the emergency bus. Even though there is overcurrent protection which will clear the fault, the BE1-47N relays may isolate the bus before the overcurrent protection trips the feeder breaker. This is acceptable since the outcome would be the same in both scenarios. Additionally, if the BE1-47N relay isolates the bus before the breaker trips on an overcurrent condition, the fault will still clear since the overcurrent relays will still see the fault. In the event of a fault during a paralleled EOG run, the new voltage unbalance relays will pick up. However, the time delay of the existing directional overcurrent protection will pick up and trip the bus feeder breaker before the BE1-47N relay will pick up and time out.

The BE1-47N relays can also fail to output on a true voltage unbalance signal. On an electrical failure, the relay will fail in the shelf (non-trip) state. For this reason, three voltage unbalance relays are being installed in a two-out-of-three scheme downstream of the bus PTs on each emergency bus, which provides a high level of assurance the circuit will operate on a voltage unbalance condition whether or not a relay failure has occurred.

In the event two relays fail to output on a true voltage unbalance signal, then the scheme will not operate and motors will either fail to continue running (i.e., overheat and trip due to overcurrent) or fail to start. This is no different than the existing configuration, which does not have this protection. Voltage unbalance protection is being installed on the H and J emergency buses. Therefore, a failure of one train is acceptable since there is a redundant train which is fully capable of maintaining safe shutdown capability.

Periodic tests will identify a potential failure of a relay.

Cutler Hammer ARD auxiliary relays are being installed downstream of the output contacts from the protective relays. ARD auxiliary relays are being installed downstream as an interlock of the two-out-of-three scheme, which will energize the 27NX-relay. The 27NX-relay is a GE HFA relay. The Cutler Hammer style ARD and GE style HFA relays power, coils, or contacts can fail. Any one of these failures can prevent the voltage unbalance scheme (or undervoltage in the case of the HFA). This is no different than the Agastat time delay failure mechanisms in the degraded voltage scheme or the failure of the internal timer in the ABB-27N relays.

The transient voltage surge suppressor diode can fail in one of three modes. These are shorts, opens, and degraded devices. A short will result in a blown control circuit fuse and a failure of the voltage unbalance protection circuit. The existing UV/DV circuit has auxiliary relays which do not have transient voltage surge suppressors. Therefore, an opened or degraded transient voltage surge suppressor will have the same effect as the existing auxiliary relay that does not have transient voltage surge suppression.

Page 25 of 43 New test switches are being installed to provide a convenient method of negative sequence and testing voltage balance relays as well as provide isolation of the relays for troubleshooting and/or replacement. These switches are manually operated. Once placed in the closed position, they act as current carrying components only. The failure mechanism is passive, similar to a cable in a circuit. Manual test switches are used throughout the industry as well as the station. There are very few incidents of failure.

However, there are two ways a test switch can fail. The test switch blades can be physically broken preventing closure, or the human element of not positioning the switch correctly will cause an open circuit. In the AC sensing circuit, an open circuit will cause inadvertent operation of a single negative sequence relay. In the DC control circuit, an open circuit will prevent the operation of the two-out-of-three scheme from energizing the final negative sequence multiplier auxiliary relay or energize 74 percent loss of voltage circuitry. However, a failure of his type is not likely since the cover of the test switches contains a divider, which ensures the test position cannot be changed without human interaction.

4.1 BACKGROUND

NRC Bulletin 2012 At Byron Nuclear Power Station (BNPS), both off-site and onsite electric systems were not able to perform their intended safety functions due to the OPC design vulnerability. Manual actions were necessary to restore ESF functions.

Following the OPC events at BNPS in 2012, the NRC issued Bulletin 2012-01, "Design Vulnerability in Electric Power Systems" (Reference 7.1). NRC Bulletin (NRCB) 2012-01 requested information regarding the facilitie$' electric power system design in light of the OPC events that involved the loss of one of the three phases of the off-site power circuits at BNPS Unit 2. The bulletin required licensees to "comprehensively verify their compliance with the regulatory requirements of General Design Criterion (GDC) 17, 'Electric Power Systems,' in Appendix A, General Design Criteria for Nuclear Power Plants, to 10 CFR Part 50 or the applicable principal design criteria in the updated final safety analysis report; and the design criteria for protection systems under 1 O CFR 50.55a(h)(2) and 10 CFR 50.55a(h)(3)."

In accordance with the North Anna licensing basis and consistent with GDC 17, existing protective circuitry will separate the ESF buses from a connected failed source due to a loss of voltage or a sustained, degraded grid voltage. However, while the existing protective devices are sufficiently sensitive to detect design basis conditions such as loss of voltage or degraded voltage, they were not designed to detect consequential single or double voltage unbalance conditions.

NEI Industry Initiative on Open Phase Condition - By letters dated October 9, 2013 and March 16, 2015 (References 7.3 and 7.4), NEI notified the NRC that the industry's CNOs had approved a formal. initiative to address OPCs, and that the initiative represented a formal commitment among nuclear power plant licensees to address the OPC design vulnerability for operating reactors. An OPC is defined by the initiative as an open phase, with or without a ground, which is located on the high voltage side of a Page 26 of 43 transformer connecting a GDC 17 off-site power circuit to the transmission system. The initiative provides the following criteria for dealing with an adverse OPC:

Detection, Alarms, and General Criteria, Actuation Circuits, and Protective Actions.

Table 1 provides a comparison of the North Anna negative sequence voltage (open phase) protection function design to the NEI industry initiative criteria.

The March 16, 2015 NEI letter specified December 31, 2018 as the completion date for implementation of the actions required to resolve the OPC design vulnerability. As noted in the initiative, this date assumed license amendments are not required to install any design changes. This is not the case for North Anna as a Class 1 E modification is being installed, with the commensurate need for additional TS requirements. In addition, in North Anna's response to the NRC request for additional information (RAI) associated with NRCB 2012-01 (Reference 7.2), Dominion stated that the NEI initiative completion date could not be met for the OPC modifications at North Anna and instead specified completion dates of the end of the fall 2019 refueling outage for North Anna Unit 1 and the end of the fall 2020 refueling outage for North Anna Unit 2.

4.2 APPLICABLE REGULATORY REQUIREMENTS/CRITERIA 4.2.1 Comparison to 10 CFR 50.36 Criteria for TS Inclusion The need to include the proposed negative sequence voltage (open phase) protection function operability and surveillance requirements into the North Anna TS was evaluated against the 10 CFR p0.36(c) criteria, and it was it was determined to meet Criterion 3 of 10 CFR 50.36(c)(2)(ii) as discussed below.

Criterion 3 states:

A structure, system, or component that is part of the primary success path and which functions or actuates to mitigate a design basis accident or transient that either assumes the failure of or presents a challenge to the integrity of a fission product barrier.

The operability of the station electric power sources is part of the primary success path for mitigating an accident assuming a loss of all onsite AC power sources (e.g.,

loss of all EDGs). An operable off-site power circuit must be capable of maintaining rated frequency and voltage while connected to the Engineered Safety Feature (ESF) buses and accepting required loads during an accident. Similar to the loss of voltage and degraded voltage protective circuitry, the voltage unbalance (open phase) protection circuitry is integral to the operability of the off-site power system and ensuring that it is capable of performing its design function of powering the 4kV ESF buses.

Page 27 of 43 Therefore, the North Anna voltage unbalance (open phase) protection circuitry satisfies Criterion 3 for inclusion in the TS.

4.2.2 General Design Criteria The regulations in Appendix A to Title 10 of the Code of Federal Regulations (10 CFR) Part 50 establish minimum principal design criteria for water-cooled nuclear power plants, while 10 CFR 50 Appendix B and the licensee quality assurance programs establish quality assurance requirements for the design, manufacture, construction, and operation of structures, systems, and components. The current regulatory requirement of 10 CFR 50, Appendix A, applicable to the proposed change is GDC 17 (Electric Power Systems).

GDC 17 requires that all current operating plants have at least two operable circuits between the off-site transmission network and the onsite Class 1 E (safety related)

AC electrical power distribution system. In addition, the surveillance requirements require licensees to verify correct breaker alignment and indicated power availability for each required off-site circuit. Consistent with the current North Anna licensing basis and GDC 17 requirements, existing protective circuitry will separate the ESF buses from a connected failed source due to a loss of voltage or a sustained, balanced degraded grid voltage. To address the potential for a consequential OPC to exist on an off-site power source, a voltage unbalance (open phase) protection function is being installed at North Anna, and associated TS are being implemented as described in Section 2.4.

The purpose of the voltage unbalance (open phase) protection function is to mitigate the potential vulnerability of an OPC on a GDC 17 off-site power source. This is achieved with the implementation of the voltage unbalance (open phase) protection function, which addresses OPCs on the high voltage side of the RSSTs, GSU transformers, and switchyard transformers. The voltage unbalance (open phase) protection-circuitry is a Class 1 E design, and the two-out-of-three logic open phase protection scheme ensures a single failure in the equipment installed will not prevent the Electric Power (EP) system from independently supplying the electric power required for operation of safety* related systems. The capacity, capability, and redundancy of the EP system are not changed by the implementation of the negative sequence voltage (open phase) protection function; therefore, the station's ability to meet the requirements of GDC 17 is maintained and enhanced.

4.2.3 10 CFR 50.55a(h)(2) Protection Systems 10 CFR 50.55a(h)(2) requires nuclear power plants with construction permits issued after January 1, 1971, but before May 13, 1999, to have protection systems that meet the requirements stated in either Institute of Electrical and Electronics Engineers (IEEE) Standard 279, "Criteria for Protection Systems for Nuclear Power Generating Stations," or IEEE Standard 603-1991, "Criteria for Safety Systems for Nuclear Power Generating Stations," and the correction sheet dated January 30, 1995. For nuclear power plants with construction permits issued before January 1, Page 28 of 43 1971, protection systems must be consistent with their licensing basis or meet the requirements of IEEE Standard 603-1991 and the correction sheet dated January 30, 1995. The construction permits for North Anna Units 1 and 2 were issued after January 1, 1971; consequently, the protection systems must meet the requirements of IEEE 279 or IEEE 603-1991 and the correction sheet dated January 30, 1995.

4.2.4 NRC Generic Letter 79-36 In accordance with the NRC Generic Letter 79-36 dated August 8, 1979, "Adequacy of Station Electrical Distribution System Voltages" (Reference 7.6) analyses were performed to determine the adequacy of the North Anna electrical distribution system. The review consisted of:

1. Determining analytically the capacity and capability of the off-site power system and onsite distribution system to automatically start and operate the required loads within their required voltage ratings in the event.of: (1) an anticipated transient or (2) an accident (such as a LOCA) without manual shedding of any electric loads.

2. Determining if there are any events or conditions that could result in the simultaneous or consequential loss of both required circuits from the off-site network to the onsite electrical distribution system and thus violate the requirement of GDC 17.

The NRC determined that the North Anna off-site power system and the onsite distribution system are capable of providing acceptable voltages for worst case station electric load and grid voltages (References 7.7 and 7.8). The criteria the NRC used in performing their technical evaluation of the analysis included GDC 5, Sharing of Structures, Systems, and Components, GDC 13, Instrumentation and Control, and GDC 17, Electric Power System of Appendix A to 10 CFR 50, IEEE Standard 308-1974, ANSI C84.1-1977, and the staff positions and guidelines included in Generic Letter 79-36.

4.2.5 NRC Branch Technical Position (BTP) 8-9 Open Phase Conditions in Electric Power System As noted above, since no regulatory requirements or guidance documents describing the treatment of an OPC previously existed, the NRC issued BTP 8-9 in July 2015 (Reference 7.9) to provide NRC reviewer guidance for evaluating the adequacy of a licensee's design for addressing the potential for an OPC in their off-site electric power system. North Anna used the BTP as guidance during the development of the negative sequence voltage (open phase) protection circuitry.

Table 1 compares the North Anna design to the BTP criteria.

4.3 NO SIGNIFICANT HAZARDS CONSIDERATION ANALYSIS Page 29 of 43 Virginia Electric and Power Company (Dominion Energy Virginia) proposes a change to the North Anna Units 1 and 2 Technical Specifications (TS) pursuant to 1 O CFR 50.90. The proposed change adds operability requirements, required actions, and surveillance requirements for the voltage unbalance (open phase) protection function associated with the 4kV emergency buses. The voltage unbalance (open phase) protection function provides detection and isolation of one or two open phases (i.e., an open phase condition) on a TS required off-site primary (preferred) power source and initiates transfer to the onsite emergency power source (i.e., the emergency diesel generators (EDGs)).

In accordance with the criteria set forth in 10 CFR 50.92, Dominion Energy Virginia has performed an analysis of the proposed TS change and concluded that it does not represent a significant hazards consideration. The following discussion is provided in support of this conclusion:

1. Does the change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed change adds operability requirements, required actions, and surveillance requirements for the voltage unbalance (open phase) protection function associated with the 4kV emergency buses. This system provides an additional level of undervoltage protection for Class 1 E electrical equipment. The proposed change will promote reliability of the voltage unbalance (open phase) protection circuitry in the performance of its design function of detecting and mitigating a voltage unbalance condition on a required off-site primary power source and initiating transfer to the onsite emergency power source.

The new voltage unbalance (open phase) protection function will further ensure the normally operating Class 1 E motors/equipment, which are powered from the Class 1 E buses, are appropriately isolated from a primary off-site power source experiencing a consequential voltage unbalance and will not be damaged. The addition of the voltage unbalance (open phase) protection function will continue to allow the existing undervoltage protection circuitry to function as originally designed (i.e., degraded and loss of voltage protection will remain in place and be unaffected by this change). The proposed change does not affect the probability of any accident resulting in a loss of voltage or degraded voltage condition on the Class 1 E electrical buses and will enhance station response to mitigating the consequences of accidents previously evaluated as this change further ensures continued operation of Class 1 E equipment throughout accident scenarios.

Specific models and analyses were performed and demonstrated that the proposed voltage unbalance (open phase) protection function, with the specified operability requirements, required actions, and surveillance requirements, will ensure the Class Page 30 of 43 1 E system will be isolated from the off-site power source should a consequential voltage unbalance condition occur. The Class 1 E motors will be subsequently sequenced back onto the Class 1 E buses powered by the EDGs and will therefore not be damaged in the event of a consequential voltage unbalance under both accident and non-accident conditions. Therefore, the Class 1 E loads will be available to perform their design basis functions should a loss of coolant accident (LOCA) occur concurrent with a loss of offsite power (LOOP) following a voltage unbalance condition. The loading sequence (i.e., timing) of Class 1 E equipment back onto the ESF bus, powered by the EOG, is within the existing degraded voltage time delay.

The addition of the new voltage unbalance (open phase) protection function will have no impact on accident initiators or precursors and does not alter the accident analysis assumptions.

Based on the above, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed change does not alter the requirements for the availability of the 4kV emergency buses during accident conditions. The proposed change does not alter assumptions made in the safety analysis and is consistent with those assumptions.

The addition of the voltage unbalance (open phase) protection function TS enhances the ability of plant operators to identify and respond to a voltage unbalance condition in an off-site, primary power source, thereby ensuring the station electric distribution system will perform its intended safety function as designed. The proposed TS change will promote voltage unbalance (open phase) protection function performance reliability in a manner similar to the existing loss of voltage and degraded voltage protective circuitry.

The proposed change does not result in the creation of any new accident precursors; does not result in changes to any existing accident scenarios; and does not introduce any operational changes or mechanisms that would create the possibility of a new or different kind of accident. A failure mode and effects review was completed for postulated failure mechanisms of the new voltage unbalance protection function and concluded that the addition of this protection function would not: 1) affect the existing loss of voltage and degraded voltage protection schemes,

2) affect the number of occurrences of degraded voltage conditions that would cause the actuation of the existing Loss of Voltage, Degraded Voltage or negative sequence voltage protection relays, 3) would not affect the failure rate of the existing protection relays, and 4) would not impact the assumptions in any existing accident scenario.

Page 31 of 43 Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does this change involve a significant reduction in a margin of safety?

Response: No.

The proposed change enhances the ability of the plant to identify and isolate a voltage unbalance in an off-site, primary power source and transfer the power source for the 4kV emergency buses to the onsite emergency power system. The proposed change does not affect the dose analysis acceptance criteria, does not result in plant operation in a configuration outside the analyses or design basis, and does not adversely affect systems that respond to safely shutdown the plant and to maintain the plant in a safe shutdown condition.

With the addition of the new voltage unbalance (open phase) protection function, the capability of Class 1 E equipment to perform its safety function will be further assured and the equipment will remain capable of mitigating the consequences of previously analyzed accidents while maintaining the existing margin to safety currently assumed in the accident analyses.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Based on the discussion above, Dominion Energy Virginia concludes that the proposed TS change presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and, accordingly, a determination of "no significant hazards consideration" is justified.

5.0 ENVIRONMENTAL CONSIDERATION

The proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9) as follows:

(i)

The proposed change involves no significant hazards consideration.

As described in Section 4.3 above, the proposed change involves no significant hazards consideration.

(ii)

There are no significant changes in the types or significant increase in the amounts of any effluents that may be released off-site.

The proposed change implements new TS requirements for the voltage unbalance (open phase) protection function and as such does not involve the installation of any new equipment or the modification of any equipment that may affect the types or amounts of effluents that may be released off-site. The proposed change will Page 32 of 43 have no impact on normal plant releases and will not increase the predicted radiological consequences of accidents postulated in the UFSAR. There are no significant changes in the types or significant increase in the amounts of any effluents that may be released off..:site.

(iii) There is no significant increase in individual or cumulative occupation radiation exposure.

The proposed change implements new TS requirements to enhance the ability of the plant to identify and isolate a voltage unbalance condition in an off-site, primary power source and transfer the power source for the 4kV emergency buses to the onsite emergency power system. The proposed TS change does not implement plant physical changes or result in plant operation in a configuration outside the plant safety analyses or design basis. Therefore, there is no significant increase in individual or cumulative occupational radiation exposure associated with the proposed change.

Based on the above, Dominion Energy Virginia concludes that, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

6.0 CONCLUSION

The proposed TS change adds operability requirements, required actions, and SRs for the 4kV emergency bus negative sequence voltage relays in TS 3.3.5. The design function of the Emergency Power System and the station's compliance with GDC 17 are being enhanced by the proposed change as it facilitates the detection of and protection from a voltage unbalance condition on the primary off-site power source. Therefore, Dominion Energy Virginia concludes, based on the considerations discussed herein, that (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

7.0 REFERENCES Page 33 of 43 7.1 NRC Bulletin 2012-01, "Design Vulnerability in Electric Power System," dated July 27, 2012. (ML12074A115) 7.2 Letter from Virginia Electric and Power Company to the NRC, "Response to Request for Additional Information (RAI) Regarding Initial Response to NRC Bulletin 2012-01, Design Vulnerability in Electric Power System," dated February 3, 2014 (Serial No.13-678). (ML14035A458) 7.3 Letter from NEI to NRC, "Industry Initiative on Open Phase Condition," dated October 9, 2013. (ML13333A147) 7.4 Letter from NEI to NRC, "Industry Initiative on Open Phase Condition, Revision 1," dated March 16, 2015 (ML15075A455/6).

7.5 NEMA MG-1-2009, Motors and Generators.

7.6 NRC Generic Letter 79-36, "Adequacy of Station Electrical Distribution Systems Voltages," dated August 8, 1979.

7.7 Letter from NRC to Virginia Electric and Power Company dated January 11, 1983 providing the Safety Evaluation for North Anna Power Station Units 1 and 2 regarding the Adequacy of Station Electric Distribution System Voltages.

7.8 Letter from NRC to Virginia Electric and Power Company dated November 13, 1984 providing the Updated Safety Evaluation for North Anna Units 1 and 2 regarding the Adequacy of Station Electric Distribution System Voltages.

7.9 NRC Standard Review Plan, Rev. 0, "Branch Technical Position (BTP) 8-9",

July 2015.

7.10 Basler Electric Instruction Manual for BE1-47N Voltage Phase Sequence Relay, Publication 9170400990, Revision K.

7.11 Letter from Anthony R. Pietrangelo of NEI to William M. Dean of the NRC dated March 22, 2016, "

Subject:

Industry Position on Open Phase Conditions (OPC) in Electronic Power System which Lead to Loss of Safety Functions of both Off-site and Onsite Power Systems (NRC Bulletin 2012-01)."

rd=

L1f.J Figure 1 i'!:f

---

~,c--------<O--

~

l..!.Ll

"~

~~

___J__

1-£11'-(.*>1*

.,,.,o,-n,

""".. bolo,...-... -

.. oc_.. *.,,._.

t. lNf OIAC"AAM

• Page 34 of 43 a I

lf(TRFt.1 Ol~Jr.ilat,Jll

" f Slf..,

l'\\()Q TH e:;t,,t¢ PC-..['R Sr 4 lT tNfl~ 1 l

An open phase condition must be detected and alarmed in the control room unless it can be shown that the open phase condition does not prevent functioning of important-to-safety structures, systems, and components.

For example, transformers that are oversized for their loading conditions may compensate for the open phase condition. Where such credit is taken, sufficient "robust" calculational bases or tests must be provided to show that the open phase condition will not adversely affect important-to-safety equipment performance.

If it is demonstrated that an open phase condition does not prevent the functioning of important-to-safety structures, systems, and components, then detection of the open phase condition should occur within a reasonably short period of time (e.g.

24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />). How the open phase condition is detected and corrected must be documented.

The open phase condition should be automatically detected and alarmed in the main control room under all operating electrical system configurations and plant loading conditions.

If the plant auxiliaries are supplied from the main generator and the off-site power circuit to the ESF bus is configured as a standby power source, then any failure (i.e., open phase condition) should be alarmed in the main control room for operators to take corrective action within a reasonable time. In such cases, the consequences of not immediately isolating the degraded power source should be evaluated to demonstrate that any subsequent design bases Page 35 of 43 North Anna is installing voltage unbalance (open phase) protection circuitry to enhance the ability of plant operators to identify and respond to an OPC in an off-site, primary power source. Events that produce unbalanced voltages above the protective circuitry relay setpoint will result in annunciator alarms in the Main Control Room and on the Plant Computer System (PCS).

Consequential voltage unbalance events that prevent the functioning of important-to-safety SSCs will be continuously monitored and alarmed by the protection schemes being implemented.

Inconsequential voltage unbalance events not automatically detected are shown through analyses to consist of high impedance-to-ground faults which produce voltage unbalance conditions that can reasonably be expected to be detected by observation of a broken Page 36 of 43 conditions that rely on off-site power bus or insulator. The voltage circuit(s) for safe shutdown do not unbalance conditions are monitored by create plant transients or abnormal the new protection scheme, PCS operating conditions. Also, the voltage unbalance points, and PT remaining power source(s) can be blown fuse alarms.

connected to the ESF buses within the The implementing design changes time assumed in the accident analysis.

document and implement the protection schemes at the 4kV Emergency Buses for voltage unbalance events utilizing Basler BE1-4 7N relays. Automatic emergency bus functions are implemented to protect against voltage unbalance events.

Analyses documents that not all voltage unbalance events can be detected by the Basler BE1-47N relays. Design changes are being implemented to provide a voltage unbalance detection and protection scheme at switchyard TX-1-1 and TX-2 using the Alstom OPD System on each transformer. For voltage unbalances detected on the high side of transformers TX-1 and TX-2, the transformer will be isolated. Existing protection will isolate the emergency buses and start/load the respective emergency diesel generator.

NEI Op~11 Phase lnitiad~e

, NRC,eranch te<::hnicalPositiqn 8-9

• C'

• ~.

C Detection circuits for the open phase condition, which prevents the functioning of important-to-safety structures, systems, and components, must be sensitive enough to identify an open phase condition for credited loading conditions (i.e., high and low loading).

Some transformers have very low or no loading when in standby mode.

Automatic detection may not be possible in this condition; however, automatic detection must happen as soon as loads are transferred to this standby source.

If automatic detection is not possible, shiftly surveillance requirements must be established to look for evidence of an open phase.

If open phase condition actuation circuits are required, the design should minimize misoperation or spurious The detection circuits should be sensitive enough to identify open phase conditions under all operating electrical system configurations and plant loading conditions for which the off-site power supplies are required to be operable in accordance with plant technical specifications {TSs) for safe shutdown.

The detection circuit should minimize spurious indications for an operable power source in the range of voltage Page 37 of 43 Modeling and analysis calculations determined and validated that the relay schemes, settings, and time delays are of sufficient sensitivity to only identify actual voltage unbalance events.

Automatic protection is available 100%

of the time at the emergency buses, regardless of the power source for the Emergency Buses.

Technical Specification 3.5.5 is being revised. In the event the BE1-47N negative sequence relays or the ABB-60 relay is disabled or unavailable, the applicable LCO will be entered and the protection scheme will be restored in the time allowed.

Three relays per emergency bus are configured in a 2-out-of-3 logic scheme to minimize misoperation or spurious Page 38 of 43

~,t

':~t t.&_

-"=--

0

~,,

-~-*

's-"

'"'/'7,iJX

"\\>,

.::,4C;7_:

-,c,

• ~~c:afaWc11t~*c.~,r.ic~(e*o$iti;~~ g{g

• "* ;' foe~ign D.i~Po$itio~t*:

action that could cause separation from an operable offsite GDC-17 source.

The protective scheme should not separate the operable GDC-17 source in the range of voltage unbalance normally expected in the transmission system.

It must be demonstrated that the additional actuation circuit design does not result in lower overall plant operation reliability.

perturbations such as switching surges, transformer inrush currents, load or generation variations, lightning strikes, etc., normally expected in the transmission system.

Protection scheme design should minimize misoperation, ma/operation, and spurious actuation of an operable off-site power source. Additionally, the protective scheme should not separate the operable off-site power source in the range of voltage perturbations such as switching surges, load or generation variations, etc., normally expected in the transmission system.

action of separation from operable off-site GDC-17 sources. Failure of a single relay makes the system operate in 2-out-of-2 logic for protection.

Modeling and analysis were used to determine and validate that relay setpoints are not within the range of normal voltage unbalances expected in the transmission system.

Plant operation reliability is maintained with safety-related equipment installed in a manner consistent with existing safety-related voltage protection schemes (i.e., the new protection scheme is being installed in parallel to the existing undervoltage and degraded voltage relays) which does not result in a lower plant operation reliability. Non-voltage unbalance event cases, such as unbalanced faults on the auxilia s stem and lar e Page 39 of 43 TABL~.1{:-DESIGN*:coMPLIAN~~ WITH THE:.NEI OPEN '.~H.ASE INITIA"FIVE ANP*.~RC BTP 8-~}3U1DANCE'.::,...

f

.*);*

NEH:~p~n phaseJ"r~tative

,:;; '. _NRC Br~n~h TechniC,~.1 ~:Qsition _8~:!t

.. ~pesign [)~~,~.~ition Devices must be coordinated with other protective devices in both the transmission system and the plant's electrical system (e.g., fault protection, overcurrent, etc.).

Detection and actuation circuits may be non-Class-1 E. While it is recognized that a Class-1 E solution is preferable, a non-Class-1 E solution may be more effective. A non-Class-1 E solution will enable timely implementation and will provide Protection scheme should comply with applicable requirements including single failure criteria for ESF systems as specified in 10 CFR Part 50, Appendix A, GDC17, and 10 CFR

50. 55a(h)(2) or 10 CFR 50. 55a(h)(3),

which require compliance with IEEE motor starts under various loading conditions, were used with various transmission system unbalances to demonstrate the protection algorithm's security.

Additionally, the new protection scheme will be installed during an 18-month monitoring period where the relays will be connected to the station's PTs and control power; however, the trip signal will be blocked. This will ensure the protection scheme does not inadvertently actuate during normal plant evolutions.

Modeling and analysis were used to coordinate the relay setpoints with existing station protective relaying.

The solution implemented by this Design Change is Safety-Related and complies with applicable requirements for single failure criteria for ESF systems, and does not replace any existing Class 1 E circuits.

Page 40 of 43

• J~E{L1z;li~oe~£f~.:cd~iltA.N~j~1Tµ;f~E N~L~~~r~)~,~s

, 1A r1~:~l~NP}&~c ~::;

{g G.f nJANJit~,

. *Y:~li~ijtC>[f~:Pt,~j:**,n,tia"ti+~i

,\\fNRg\\[i~n~h*:f~~hhi,~~);6si~I,8~:;~Cg:.

c:j[)e~ig6:"l)ls~~~,,~~.,*

reasonable levels of reliable functionality given the low likelihood of adverse impacts from open phase events. Additionally, there is regulatory precedent in using non-Class-1 E circuits in newly identified nuclear plant vulnerabilities (e.g.,

anticipated transient without scram (A TWS) circuits). New non-Class-1 E circuits will not be allowed to replace existing Class-1 E circuits.

The Updated Final Safety Analysis Report (UFSAR) must be updated to discuss design features and analyses related to the effects of, and protection for, any open phase condition design vulnerability. This update would typically be to chapter 8.

Std 279-1971 "Criteria for Protection Systems for Nuclear Power Generating Stations" or IEEE Std 603-1991, "Standard Criteria for Safety Systems for Nuclear Power Generating Stations." RG 1. 153, "Criteria for Power, Instrumentation, and Control Portions of Safety Systems," provides additional guidance on this topic.

If protective features are provided in a non-Class 1 E system only, a failure of the non-Class 1 E scheme should not preclude the onsite electrical power system from performing its safety function given a single failure in the onsite power system.

A UFSAR change request has been initiated to revise the UFSAR to describe the voltage unbalance analysis and detection/protection scheme implemented by this modification..

With no accident condition signal present, the open phase condition must not adversely affect the function of important to safety structures, systems, and components.

With an accident condition signal present, automatic detection and actuation will transfer loads required to mitigate postulated accidents to an alternate source and ensure that safety functions are preserved, as required by the current licensing The design of the protection features for OPCs should address power quality issues caused by open phase conditions such as unbalanced voltages and currents, sequence voltages and currents, phase angle shifts, and harmonic distortion that could affect redundant ESF buses.

The ESF loads should not be subjected to power quality conditions specified in industry standards such as Institute of Electrical and Electronic Engineers (IEEE) Standard (Std) 308-2001, "Criteria for Class 1 E Power Systems for Nuclear Power Generating Stations," Section 4.5, "Power Quality,"

with respect to the design and operation of electrical systems as indicated in Regulatory Guide (RG)

1. 32 "Criteria for Power Systems for Nuclear Plants."

Page 41 of 43 The voltage unbalance detection/protection scheme being implemented ensures functionality of Safety-Related equipment for initiating consequential voltage unbalance events on the transmission lines from the switchyard to the RSST and GSU transformers and interconnecting onsite auxiliary power circuits.

Modeling and analysis for negative sequence relay setting coordination ensures important to safety SSCs are not adversely affected.

An ABB-60 voltage balance relay is installed in the new voltage unbalance protection in order to ensure the BE1-4 7N relays do not cause the Emergency Bus to be isolated from its preferred source in the event of a false signal.

Voltage unbalance events in steady state and concurrent with a Loss of Coolant Accident (LOCA) were evaluated to develop analytical limits for the protection negative sequence relays. Impact on safety related motors, of block start of emer enc

Actuation times needed to maintain equipment safety functions should be short enough to provide reasonable assurance that accident mitigation functions are maintained.

If off-site power circuit(s) is (are) functionally degraded due to open phase conditions, and safe shutdown capability is not assured, then the ESF buses should be designed to be transferred automatically to the alternate reliable off-site power source or onsite standby power system within the time assumed in the accident analysis and without actuating any protective devices, given a concurrent design basis event.

Page 42 of 43 loads, and of isolating emergency loads from the affected transformer during a LOCA starting sequence and then restarting the emergency loads on the emergency sources were considered.

Time delays have been established by modeling and analysis utilizing coordination with existing protective relaying as well as accident mitigation considerations to ensure accident mitigation functions and capabilities are maintained.

For a voltage unbalance condition detected at the ESF buses, the new voltage unbalance protection logic energizes an existing undervoltage protection auxiliary relay for the associated bus which isolates the Emergency Bus, starts the EOG, and transfers power following the same process as the existing Undervoltage /

Degraded Voltage protection scheme.

/NEI Op~,n*Phase lnitiatiye

> -,,Jj° "> >'

-~1-Periodic tests, calibrations, setpoint verifications or inspections (as applicable) must be established for any new protective features. The surveillance requirements must be added to the plant Technical Specifications if necessary to meet the provisions of 1 OCFR50. 36.

The unbalanced voltage/current conditions for ESF components expected during various operating and loading conditions should not exceed motor manufacturer's recommendations. The International Electrotechnical Commission (/EC)

Standard /EC 60034-26, National Electrical Manufacturers Association (NEMA) Standard (MG 1) Parts 14.36 and 20.24, and IEEE Std C37.96-2012 (Guide for AC Motor Protection),

Section 5. 7.2.6, "Unbalanced Protection and Phase Failures," may be used for general guidance.

Technical Specification Surveillance Requirements and Limiting Conditions of Operation for equipment used for mitigation of open phase conditions should be identified and implemented consistent with the operability requirements specified in the plant TSs and in accordance with 10 CFR 50.36(c)(2) and 10 CFR 50.36(c)(3).

RG 1. 93 Availability of Electric Power Sources," provides additional guidance on this topic.

Page 43 of 43

..,Design Dispo~1t.ion NEMA Standard MG 1 was used as guidance for the calculations performed in support of the voltage unbalance detection and protection design change.

Technical Specification 3.3.5 is revised to add voltage unbalance relays as part of the loss of power Emergency Diesel start. The basis for Technical Specification 3.3.5 is being revised to document the BE1-47N negative sequence relay setpoint. TRM tables 4.5-1 and 4.9-1 are also being revised to document the BE1-47N relay setpoint.

Serial No.18-072 Docket Nos. 50-338/339 MARKED-UP TECHNICAL SPECIFICATIONS PAGES Virginia Electric and Power Company (Dominion Energy Virginia)

North Anna Units 1 and 2

LOP EOG Start Instrumentation 3.3.5 3.3 INSTRUMENTATION 3.3.5 Loss of Power (LOP) Emergency Diesel Generator (EOG) Start Instrumentation Three channels per bus of the loss of voltage Function and~~

three channels per bus of the degraded voltage Function\\'"'ft>~

the following 4160 VAC buses shall be 10PERABLE:

The Train Hand Train J buses; and

b. One bus on the other unit for each required shared component.

APPLICABILITY:

MODES 1, 2, 3, and 4,.

\\olhen associated EOG is required to be OPERABLE by LCO 3.8.2, "AC Sources-Shutdown."

ACTIONS

- - - - - - - - - - - - - - -. NOTE - - - - - - - - - - - - - - - -

Separate Condition entry is allo\\'1ed for each Function.

CONDITION REQUIRED ACTION COMPLETION TIME A.

One or more Functions A. l

---

NOTE---------

with one channel per The inoperable channel bus inoperable.

may be bypassed for up to 12 hour*s for surveillance testing of other channels.

Place channel in trip.

72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />

• • :)el. t.\\,"t-a.....~,.~3 *~ r p$<>71.3 /11 :'.H'"/GC/f)

B.

One or more Functions B.l Restore all but one 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> with b10 or more channel to OPERABLE channels per bus status.

i n*operab le.

North Anna Units 1 and 2 3.3.5-1

---Am@ndmen:ts-***2-31-/2 B.1

---

N OT E ------------------------------------------------------------------

If the negative sequence voltage protection function cannot be performed (e.g. the 4160V to 480V Balance Relay is tripped), the negative sequence voltage protection does not have to be declared inoperable provided verification is performed at least once per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> that an open phase condition does not exist on the primary side of transformer TX-3 and the Reserve Station Service Transformers, as well as the Unit 1/Unit 2 Main Step-up Transformers when power is supplied by the dependable alternate source. The negative sequence voltage protection function shall be restored within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

LOP EOG Start Instrumentation

3. 3. 5 ACTIONS CONDITION REQUIRED ACTION COMPLETION TI ME C.

Required Action and C.l Enter applicable Immediately associated Completion Condition(s) and Time not met.

Required Action(s) for the associated EOG made inoperable by LOP EDG start instrumentation.

SURVEILLANCE REQUIREMENTS SR 3.3.5.1 uv/ov _

S(t s.3.5,;L SR 3.3.5.~3 SURVEILLANCE

---

NOTE-------------

Verification of setpoint is not required.

Perform TADOT for LCO 3.3;5.a and LCO 3.3.5.b:i'Functions.

• • .s,ae,

(!\\ e.,l(+

ea.,1 e_ f., r V\\ c,-\\.1&., V\\A.<IA" l,,.. Uf Perform CHANNEL CA[IBRATION with Allowable Values as follows:

a. Loss of voltage Allowable Values

~ 2935 V and~ 3225 V with a time delay of 2 +/-1 seconds for LCO 3.3.5.a and LCO 3.3.5.b Functions.

b. Degraded voltage Allowable Values

~ 3720 V and~ 3772 V with:

1. A time delay of 7.5 +/-1.5 seconds with a Safety Injection (SI) signal for LCO 3.3.5.a Function; and

2. A time delay of 56 +/-7 seconds without an SI signal for LCO 3.3.5.a and LCO 3.3.5.b Functions.

l..

+i tie,

(_

e... rJ FREQUENCY In accordance with t the Surveillance Frequency Control Program In accordance with l the Surveillance Frequency Control Program

z. J.. iq i,il* O.IAJ. !:_ S.f ob'lt t,,

(.Lo 3,3, 5' a.. o.1/1. A LCO 3,3,S'b t="u~c:~MS North Anna Units 1 and 2 3.3.5-2 Amendments 262/243

LOP EOG Start Instrumentation 3.3.5 SURVEILLANCE REQUIREMENTS SR 3.3.5./

If SURVEILLANCE Verify ESF RESPONSE TIMES are within limit for LCO 3.3.5.a and LCO 3.3.5,b Functions.

Yc:.r-',...._ t,.A.i:)o-r ~r LLD 3.3.?"""ct

()..v\\J.. Ll. o 3. 5. S-b /J e;Jr:;,..tw.e S ei~c.i!..

i)..elo,.y Fw,-.,J; c ~

FREQUENCY In accordance with J the Surveillance Frequency Control Program

-::Z:-V\\.

~C..(J:i r~vtC. e. ~ lf*ln

~

Sc,\\. ll"v e't \\\\01..vac (.

Fr~IM-r'<<./

(..e.,.,._ 4.-o I froi:;ru,.v-

---

JV6Tl::A*:-* --------

Ne.j,,dir1 e,..Se jlM>>\\"e.. II~ l~ e.., 1 s c.C(.lt""- (~ /~

~.s o...

~.a..-c_,e.v~.:\\.~ e o + 11\\.oV'"J-l vtA.. / * \\lo 1-\\-0d e.

North Anna Units 1 and 2 3.3.5-3 Amendments 262/243 Serial No.18-072 Docket Nos. 50-338/339 PROPOSED TECHNICAL SPECIFICATIONS PAGES Virginia Electric and Power Company (Dominion Energy Virginia)

North Anna Units 1 and 2

LOP EOG Start Instrumentation 3.3.5 3.3 INSTRUMENTATION 3.3.5 Loss of Power (LOP) Emergency Diesel Generator (EOG} Start Instrumentation LCO

3. 3'. 5 Three channels per bus of the loss of voltage Function and three channels per bus of the degraded voltage Function, and three channels per bus of the negative sequence Function for the following 4160 VAC buses shall be OPERABLE:

a. The Train Hand Train J buses; and

b. One bus on the other unit for each required shared component.

APPLICABILITY:

MODES 1, 2, 3, and 4, When associated EOG is required to be OPERABLE by LCO 3.8.2, "AC Sources-Shutdown."

ACTIONS

- - - - - - - - - - - - - - - - NOTE - - - - - - - - - - - -

Separate Condition entry is allowed for each Function.

CONDITION A.

One or more A.1 Functions with one channel per bus inoperable.

North Anna Units 1 and 2 REQUIRED ACTION

---

NOTE---------

The inoperable channel may be bypassed for up to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for surveillance testing of other channels.

Place channel in trip.

3.3.5-1 COMPLETION TIME 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Amendments

ACTIONS CONDITION B.

One or more B.1 Functions with two or more channels per bus inoperable.

C.

Required Action and C.1 associated Completion Time not met.

North Anna Units 1 and 2 LOP EOG Start Instrumentation 3.3.5 REQUIRED ACTION COMPLETION TIME

---

NOTE-----------

1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> If the negative sequence voltage protection function cannot be performed (e.g.,

the 4160V to 480V Balance Relay is tripped), the negative sequence voltage protection does not have to be declared inoperable provided verification is performed at least once per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> that an open phase condition does not exist on the primary side of transformer TX-3 and the Reserve Station Service Transformers, as well as the Unit I/Unit 2 Main Step-up Transformers when power is supplied by the dependable alternate source. The negative sequence voltage protection function shall be restored within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

Restore all but one channel to OPERABLE status.

Enter applicable Immediately Condition(s) and Required Action(s) for the associated EOG made inoperable by LOP EOG start instrumentation.

3.3.5-2 Amendments

LOP EDG Start Instrumentation 3.3.5 SURVEILLANCE REQUIREMENTS SR 3.3.5.1 SR 3.3.5.2 SR 3.3.5.3 SURVEILLANCE

---

NOTE----------------

Verification of setpoint is not required.

Perform TADOT for LCO 3.3.5.a and LCO 3.3.5.b UV/DV Functions.

---

NOTE----------------

Verification of setpoint is not required.

Perform TADOT for LCD 3.3.5.a and LCO 3.3.5.b Negative Sequence Relay Functions.

---

NOTE----------------

Negative Sequence Voltage is calculated as a percentage of nominal voltage.

. Perform CHANNEL CALIBRATION with Allowable Values as follows:

a. Loss of voltage Allowable Values

~ 2935 V and~ 3225 V with a time delay of 2 +/-1 seconds for LCO 3.3.5.a and LCO 3.3.5.b Functions.

b. Degraded voltage Allowable Values

~ 3720 V ands 3772 V with:

1. A time delay of 7.5 +/-1.5 seconds with a Safety Injection (SI) signal for LCD 3.3.5.a Function; and

2. A time delay of 56 +/-7 seconds without an SI signal for LCO 3.3.5.a and LCO 3.3.5.b Functions.

c. Negative Sequence Voltage~ 2.894%

ands 5.106% for LCO 3.3.5.a and LCO 3.3.5.b Functions.

North Anna Units 1 and 2 3.3.5-3 FREQUENCY In accordance with the Surveillance Frequency Control Program In accordance with the Surveillance Frequency Control Program In accordance with the Surveillance Frequency Control Program Amendments

LOP EOG Start Instrumentation 3.3.5 SURVEILLANCE REQUIREMENTS SR 3.3.5.4 SURVEILLANCE Verify ESF RESPONSE TIMES are within limit for LCO 3.3.5.a and LCO 3.3.5.b Functions.

North Anna Units 1 and 2 3.3.5-4 FREQUENCY In accordance with the Surveillance Frequency Control Program Amendments Serial No.18-072 Docket Nos. 50-338/339 MARKED-UP TECHNICAL SPECIFICATIONS BASES PAGES (FOR INFORMATION ONLY}

Virginia Electric and Power Company (Dominion Energy Virginia}

North Anna Units 1 and 2

LOP EOG Start Instrumentation B 3.3.5 B 3~3 INSTRUMENTATION B 3.3.5 Loss of Power (LOP) Emergency Diesel Generator (EOG) Start Instrumentation

.BASES N e ""'.\\,'l11 e s *q, I.MJ,V\\t. e '(' e. \\lit~ s ti

-.~

i,,.

Cl re..

'?rov' l ol..!!..dl O II ett,c.

111 &o I} C/EJSS 1.lf bw.s i

,.,.;, J.. e, "--:?: 1-<v e The EDGs provide a source of emergency power when offsite power is either unavailable or is insufficiently stable to allow safe unit operation. Undervoltage protection will generate an LOP start if a loss of voltage or degraded voltage condition occurs on the emergency buses.~There are \\

..two:°r~gui red LOP start signals for each 4.16 kV emergency l

bus':' -three Undervoltage relays are provided on each 4160 V Class lE bus for detecting a loss of bus voltage or a sustained degraded voltage condition. The relays are combined in a two-out-of-three logic to generate a LOP signal. A loss of voltage start of the EDG is initiated when the voltage is less than 74% of rated voltage and lasts for approximately 2 seconds. A degraded voltage start of the EOG is produced when the voltage is less than 90% of rated voltage sustained for approximately 56 seconds. The time delay for the degraded voltage start signal is reduced to approximately

.5 seconds with the presence of a Safety Injection signal or the Hand J bus on this unit.

sei~rl,e. vol 9 e.. +*

?rol-ec..+i.ov') t \\A ll\\-e.j~ \\Ve.

.e IM,,lf)Ge v"l~,e. :s+~r+

ne 4160 VAC bus from the other unit is needed to support S-+ Z ~ EV bi i. s ~..... ~-\\;"'.JeJ. perat ion of each required Service Water (SW) pump, Main o

• ~

Control Room/Emergency Switchgear Room (MCR/ESGR) Emergency wV\\e.V"l+\\.-..e. ll'\\~i"1:4we_

Ventilation System (EVS) fan, Auxiliary Building central Seq,~,e 11ot"t"l'-j c.. 1

'=-'

exhaust fan, and Component Cooling Water (CC) pump. SW,

-e_;:,..-k-r ~Ol,V"\\

o< e..i/AA,{

MCR/ESGR EVS, Auxiliary Building central exhaust system, and u*f, r

'vital CC are shared systems.

~t

• o""I" VI0~ 1 110 /+o..4e.. "'11,-\\<.-

11e.Jfif..J..,ve.

The Allowable Value in conjunction with the trip setpoint tJ,t vo/i.J.-~,H.

and LCO establishes the threshold for Engineered Safety Se..itM-iW

~ d, IA.~re Features Actuation System (ESFAS) action to prevent

xo

• ec.A'L~v> v>' l' et \\

xceedi ng acceptable 1 imi ts such that the consequences of

~-\\.,..,

A-~oJ;~-t\\\\.re.e...

(4l-CI.\\J> esign Basis Accidents (DBAs) will be acceptable. The o-ev,; ~

Lot' si_y"'d. llowable Value is considered a limiting value such that a te> c5 t.V\\ V"

,e

(;>.

channel is OPERABLE if the set point is found not to exceed the Allowable Value during the CHANNEL CALIBRATION. Note that, although a channel is OPERABLE under these circumstances, the setpoint must be left adjusted to within the established calibration.tolerance band of the setpoint (continued)

North Anna Units 1 and 2 B 3.3.5-1

BASES BACKGROUND (continued)

LOP EOG Start Instrumentation B 3.3.5 in accordance with uncertainty assumptions stated in the referenced setpoint methodology, (as-left-criteria) and

.confirmed to be operating with the statistical allowances of the uncertainty terms assigned.

Allowable Values and LOP EOG Start Instrumentation Setpoints The trip setpoints are summarized in Reference 3. The selection of the Allowable Values is such that adequate protection is provided when all sensor and processing time delays are taken into account.

Setpoints adjusted consistent with the requirement of the Allowable Value ensure that the consequences of accidents will be acceptable, providing the unit is operated from within the LCOs at the onset of the accident and that the equipment functions as designed.

Allowable Values are specified for each Function in SR 3.3.5.2. Nominal trip setpoints are also specified in the unit specific setpoint calculations and listed in the Technical Requirements Manual (TRM) (Ref. 2). The trip setpoints are selected to ensure that the setpoint measured by the surveillance procedure does not exceed the Allowable Value if the relay is performing as required. If the measured setpoint does not exceed the Allowable Value, the relay is considered OPERABLE. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within the Allowable Value, is acceptable provided that operation and

.testing is consistent with the assumptions of the unit specific setpoint calculation (Ref. 3).

APPLICABLE The LOP EOG start instrumentation is required for the SAFETY ANALYSES Engineered Safety Features (ESF) Systems to function in any accident with a loss of offsite power. Its design basis is that of the ESFAS.

Accident analyses credit the loading of the EOG based on the loss of offsite power during a loss of coolant accident (LOCA). The actual EOG start has historically been associated with the ESFAS actuation. The EOG loading has been included in the delay time associ.ated with each safety system component requiring EOG supplied power following a loss of offsite power. The analyses assume a non-mechanistic (continued)

North Anna Units 1 and 2 B 3.3.5-2

BASES APPLICABLE° SAFETY ANALYSES (continued)

LCO Q1,e~ 1'\\cy1Alv e se1L~.;:1Lc

\\j O \\ -\\-o,_ c;y--

LOP EOG Start Instrumentation B 3.3.5 EOG loading, which does not explicitly account *for each individual component of loss of power detection and subsequent actions.

The required channels of LOP EOG start instrumentation, in conjunction with the ESF systems powered from the EOGs, provide unit protection in the event of any of the analyzed accidents discussed in Reference 5, in which a loss of offsite power is assumed.

The delay times assumed in the safety analysis for the ESF equipment include the 10 second EDG start delay, and the appropriate sequencing delay, if applicable. The response times for ESFAS actuated equipment in LCO 3.3.2, "Engineered Safety Feature Actuation System (ESFAS) Instrumentation, 11 include the appropriate EOG loading and sequencing delay if applicable.

The LOP EOG start instrumentation channels satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

The LCO for LOP EOG start instrumentatiori requires that three channels per bus of J;etti the 1 oss of vo.l tage).--a-rtd-degraded voltageJ'Functions shall be OPERABLE in MODES 1, 2, 3, and 4 when the LOP EOG start instrumentation supports safety systems associated with the ESFAS; This is associated with the requirement of LCO 3.3.5.a for this unit's Hand J buses. LCO 3.3.5.b specifies that for~ required Hand/or J bus on the other unit that is needed to support a required shared component for this unit, the LOP EOG start instrumentation for the required bus must be OPERABLE. The other unit's required Hand/or J bus are required to be OPERABLE to support the SW, MCR/ESGR EVS, Auxiliary Building*

central exhaust, and CC functions needed for this unit.

These Functions share components, pumps, or fans, which are electrically powered from both units. A channel is OPERABLE with a trip setpoint value outside its calibration tolerance band provided the trip setpoint "as-found" value does not exceed its associated Allowable Value and provided the trip setpoint 11as-left" value is adjusted to a value within the 11as-left 11 calibration tolerance band of the trip setpoint. A trip setpoint may be set more conservative than the trip setpoint specified in the TRM (Ref. 2) as necessary in response to unit conditions. In MODES 5 or 6, the three channels must be OPERABLE whenever the associated EOG is required to be OPERABLE to ensure that the automatic start of (continued)

North Anna Units 1 and 2 B 3.3.5-3

BASES LCO (continued)

APPLICABILITY ACTIONS LOP EDG Start Instrumentation B 3.3. 5 the EOG is available when needed. Loss of the LOP EOG Start Instrumentation Function could result in the delay of safety systems initiation when required. This could lead to unacceptable consequences during accidents. During the loss of offsite power the EDG powers the motor driven auxiliary feedwater pumps. Failure of these pumps to start would leave only one turbine driven pump, as*well as an increased potential for a loss of decay heat removal through the secondary system.

The LOP EOG Start Instrumentation Functions are required in MODES l, 2, 3, and 4 because ESF Functions are designed to provide protection in these MODES. Actuation in MODE 5 or 6 is required whenever the required EOG must be OPERABLE so that it can perform its function on a LOP or degraded power to the emergency bus.

In the event a channel I s trip setpoint is found nonconservative with respect to the Allowable Value, or the channel is found inoperable, then the function that channel provides must be declared inoperable and the LCO Condition entered for the particular protection function affected.

Because the required channels are specified on a per bus basis, the Condition may be entered separately for each bus as appropriate.

A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed in the LCO and for each emergency bus. The Completion Time(s) of the inoperable channel (s) of a Function will. be tracked separately for each Function starting from the time the Condition was entered for that Function for the associated emergency bus.

Condition A applies to the LOP EDG start Function with 1 ass of voltage,~ degraded vol tagef eh-anrre-l-per bus inoperable.

If one channel is inopefable, Required Action A.1 requires that channel to be placed in trip within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. A plant-specific risk assessment, consistent with Reference 4, (continued)

North Anna Units 1 and 2 B 3.3.5-4

BASES ACTIONS A.1 (continued)

LOP EDG Start Instrumentation B 3.3.5 was performed to justify the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time. With a.

channel in trip, the LOP EOG start instrumentation channels are configured to provide a one-out-of-two logic to initiate a trip of the incoming offsite power.

A Note is added to *allow bypassing an inoperable channel for up to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for surveillance testing of other channels. A plant-specifi~ risk assessment, consistent wJth Reference 4, was performed to justify the 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> time limit. This allowance is made where bypassing the channel does not cause an actuation and where normally, excluding required testing, two other channels are monitoring that parameter.

The specified Completion Time and time allowed for bypassing one channel are reasonable considering the Function remains fully OPERABLE on every bus and the low probability of an event occurring during these intervals.

8.1 Condition B applies when more than one loss of voltage, 'b-y,.

\\

more than one degraded voltag~Vchannel on an emergency bus is inoperable.

Required Action 8.1 requires restoring all but one channel to OPERABLE status. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time should allow ample time to repair most failures and takes into account the low probability of an event requiring an LOP start occurring during this interval.

C.1 Condition C applies to each of the LOP EOG start Functions when the Required Action and associated Completion Time for Condition A or Bare not met.

In these circumstances the Conditions specified in LCO 3.8.1, 11 AC Sources-Operating, 11 or LCO 3.8.2, 11 AC Sources-Shutdown, 11 for the EDG made inoperable by failure of the LOP EOG start instrumentation are required to be entered immediately. The actions of those LCOs provide for adequate compensatory actions to assure unit safety.

North Anna Units 1 and 2 B 3.3.5-5

BASES SURVEILLANCE REQUIREMENTS tol' uv/Dv

+v..l'\\C..~ ~ 0 rt'$,

SR 3.3.5.1 LOP EDG Start Instrumentation B 3.3.5 SR 3.3.5.1 is the performance of a TADOT for channels required by LCO 3.3.5.a and LCO 3.3.5.b.&A successful test of the required contact(s} of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable TADOT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at-an 18 month frequency with applicable extensions. The test checks trip devices that f

provide actuation signals directly, bypassing the analog process control equipment.

The SR is modified by a Note that excludes verification _of setpoints from the TADOT. Since this SR applies to the loss of voltage and degraded voltage relays for the 4160 VAC emergency buses, setpoint verification requires elaborate bench calibration and is accomplished during the CHANNEL CALIBRATION. Each train or logic channel shall be functionally tested up to and including input coil SR 3,3,S'. d.

Frequency is based on operating experience, equipment continuity testing of the ESF slave relay. The Surveillance j reliability, and plant risk and is controlled under the

~

1t S.:: c.

~...\\..\\.a.<.J.,..cJ. _____

S 7

urvei 11 ance Frequency Control Program.

\\

~

i""-c:..r\\'-uf c,. \\At

a.

V\\ "'.j "-.\\-~ v e SC1,(}..c..l'\\C.e. VO \\\\a.~~

SR 3.3.5./~

SR 3.3.5.1 is the performance of a CHANNEL CALIBRATION for channels required by LCO 3.3.5.a and LCO 3.3.5.b.

The setRoints. as well 1_as the response to a loss of voltage,

...a-no* a degraded voltagi;vtest,, shall include a single point verification that the trip occurs within the required time delay, as shown in Reference 1.

CHANNEL CALIBRATION is a complete check of the instrument J

loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary. range and accuracy. The verification of degraded voltage with a SI signal is not required by LCO 3.3.5.b.

(continued)

North Anna Units 1 and 2 B 3.3.5-6

• SR 3.3.5.2 SR 3.3.5.2 is the performance of a TADOT for channels required by LCO 3.3.5.a and LCO 3.3.5.b.

for Negative Sequence Relay Functions. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This. clarifies what is an acceptable TADOT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at an 18 month frequency with applicable extensions. The test checks trip devices that provide actuation signals directly, bypassing the analog process control equipment.

The SR is modified by a Note that excludes verification of setpoints from the TADOT. Since this SR applies to the negative sequence voltage relays for the 4160 VAC emergency buses, setpoint verification requires elaborate bench calibration and is accomplished during the CHANNEL CALIBRATION. Each train or logic channel shall be functionally tested up to and including input coil continuity testing of the ESF slave rela*y. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

BASES SURVEILLANCE REQUIREMENTS 3

SR 3.3.5vt (continued)

LOP EOG Start Instrumentation B 3.3.5 equipment reliability, and plant risk and is controlled

~

The Survei 11 a nee Frequency is based on operating experience, 1*

under the Surveillance Frequency Control Program.

l/

SR 3.3.5:J

\\

This SR ensures the individual channel ESF RESPONSE TIMES are less than or equal to the maximum values assumed in the accident analysis for channels required by LCO 3.3.5.a and LCO 3.3.5.b. Response Time testing acceptance criteria are included in the TRM (Ref. 2).

Individual component respon$e times are not modeled in the analyses. The analyses model the overall or total elapsed time, from the point at which the parameter exceeds the trip setpoint value at the sensor, to the point at which the equipment in both trains reaches the required functional state (e.g., pumps at rated discharge pressure, valves in full open or closed position).

• For channels that include dynamic transfer functions (e.g.,

lag, lead/lag, rate/lag, etc.), the response time test may be performed with the transfer functions set to one with the resulting measured response time compared to the appropriate TRM response time. Alternately, the response time test can be performed with the time constants set to their nominal value provided the required response time is analytically calculated assuming the time constants are set at their nominal values. The response time may be measured by a series of overlapping tests such that the entire response time is measured.

Response time may be verified by actual response time test in any series of sequential, overlapping or total channel.

measurements, or by the summation of allocated sensor, signal processing and actuation logic resp6nse times ~ith actual response* time tests on the remainder of the channel.

Testing of the final actuation devices, which make up the

~

bulk of the response ti~e. is included in the testing of each' channel.

1*

The Surveillance Frequency is based on operating experience,

~

equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

11 North Anna Units 1 and 2 B 3.3.5-7

BASES REFERENCES 1.. UFSAR, Section 8.3.

LOP EDG Start Instrumentation B 3.3. 5

2. Technical Requirements Manual.

3. RTS/ESFAS Setpoint Methodology Study (Technical Report EE-0116).

4. WCAP 14333-P-A, Rev. l, October 1998.

5. UFSAR, Chapter 15.

LP. rv r

.... l. r,; <d 1 (.~..-\\. ~ I" J-o I J - o \\

North Anna Units 1 and 2

• B 3.3.5-8

f-l BASES BACKGROUND (continued)

AC Sources-Operating B 3.8.1 The 230/500 kV switchyard, which is an integral part of the transmission network, is the source of offsite (preferred) power to the station Class lE electrical system. From the 230/500 kV switchyard, five electrically and physically separated circuit~ are available to provide AC power, through either the system reserve transformers (SRTs) and RSSTs or.the station service transformers (SSTs), to the 4.16 kV ESF buses. A detailed description of the offsite power network and the circuits to the Class lE ESF buses is found in the UFSAR, Chapter 8 (Ref. 2).

An offsite circuit consists of all breakers, transformers, switches, interrupting devices, cabling, and controls required to transmit power from the offsite transmission

~etworfk to 1the onsit 1e Class lE ESF bus(es). Each one is 1*:.'

quali ied' via ana ysis to show that they meet the requirements of GDc 17.

Certain required unit loads are energized in a predetermined sequence in order to prevent overloading the transformers t

supplying offsite power to the onsite Class lE Distribution System. After the initiating signal is received, permanently connected loads and all automatically connected loads, via the load sequencing timing relays, needed to recover the unit or maintain it in a safe condition are energized.

The ons ite standby power source for each 4.16 kV ESF bus is a dedicated EDG.* EDGs Hand J are dedicated to ESF b~ses H and J, respectively. An EDG starts automatically on a safety.

injection (SI) signal (i.e., low pressurizer pressure or high containment pressure signals) or on an ESF bus degraded voltagE;J, cm undervoltage,Vsignal (refer to LCO 3.3.5, "Loss of Power tLOP) Emergency Diesel Generator (EOG) Start Instrumentation"). After the EOG has started, it will automatically tie to its respective bus after offsite power is isolated as a consequence of ESF bus undervoltage or f

degraded voltage, independent of or coincident with an SI*

signal. The EOGs will also start and operate in the standby mode without tying to the ESF bus on an SI signal or a momentary undervoltage condition. Following the loss of 1

offsite power, an undervoltage signal strips nonpermanent loads from the ESF bus. When the EDG is tied to the ESF bus,

.. loads are then sequentially connected to their respective ESF bus by the sequencing timing relays. The specific ESF equipment's sequencing timer controls the permissive and starting signals to motor breakers to prevent overloading the EOG by automatic load application.

(continued)

North Anna Units 1 and 2 B 3.8.1-2

BASES BACKGROUND (continued)

APPLICABLE SAFETY ANALYSES LCO AC Sources-Operating B 3.8.1 I~ the event of a loss of preferred (offsite) power, the ESF g electrical loads are automatically connected to the EDGs in t

sufficient time to provide for safe reactor shutdown and to mitigate the consequences of a Design Basis Accident (OBA) such as a loss of coolant accident (LOCA) without overloading the EDGs.

Ratings for Train Hand Train J EDGs satisfy the requirements of Safety Guide 9 (Ref. 3). The continuous service rating of each EOG is 2750 kW with 3000 kW allowable for up to 2000 hours0.0231 days <br />0.556 hours <br />0.00331 weeks <br />7.61e-4 months <br /> per year. The ESF loads that are powered from the 4.16 kV ESF buses are listed in Reference 2.

The initial conditions of OBA and transient analyses in the UFSAR, Chapter 6 (Ref. 4) and Chapter 15 (Ref. 5), assume ESF systems are OPERABLE. The AC electrical power sources are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System (RCS), and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.4, Reactor Coolant System (RCS); and Section 3.6, Containment Systems.

The OPERABILITY of the AC electrical power sources is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit. This result~ in maintaining at least one train of the onsite or offsite AC sources OPERABLE during accident conditions in the event of:

a.* An assumed loss of all off site power or all onsite AC power; and

b. A worst case single failure.

The AC sources satisfy Criterion 3 of 10 CFR 50.36(c) (2) (ii).

A minimum of two qualified offsite circuits between the l~

230/500 kV switchyard and the onsite Class lE Electrical Power System and two separate and independent EDGs for supplying.the redundant trains for each unit ensure (continued)

North Anna, Uni ts 1 and 2 B 3.8.1-3

-itevt"S"i-oo-H3

BASES LCD (con ti n*ued)

AC Sources-Operating B 3.8. 1 availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an anticipated operational occurrence (AOO) or a postulated OBA.

Qualified offsite circuits include the two 500-34.5 kV transformers and one 230-34.5 kV transformers (collectively referred to as the SRTs) that feed three independent 34.5 kV buses which supply the RSSTs. In addition, there are two 500 kV lines from the switchyard to the Unit 1 and Unit 2 generator step-up transformers and SSTs. These circuits are described ih the UFSAR and are part of the licensing basis for the unit.

In addition, the required automatic load sequencing timing relays must be OPERABLE. A 11 requiredl1 load sequencing timing relay is one whose host component is capable of automatically loading onto an emergency bus.

Each independent qua 1 ifi ed offs i te source must be capab 1 e ot'v maintaining rated frequency and voltage, and accepting required loads during an accident, while connected to the ESF buses.

Normally, the qualified offsite sources for the Unit 1. and 2 ESF buses are from the 34.5 kV buses 3, 4, and 5 which supply the RSSTs which feed the transfer buses. RSSTs A and B may be fed from the same 34.5 kV bus, but RSST C must be fed from a different 34.5 kV bus than RSST A and RSST B. The 0, E, and F transfer buses supply the onsite electrical power to the four ESF buses for the two unit~. In addition to the normal alignment, the D and E transfer buses can be tied together via the 4160 V bus OL installed as part of the AAC modifications.

ESF bus lH is normally fed through the F transfer bus from RSST C. Station service bus 18 can provide an alternate preferred feed for the bus ESF lH.

ESF bus lJ is normally fed through the D transfer bus from RSST A. Bus lJ has an alternate preferred feed from station service bus 2B. In addition, ESF bus lJ can be fed through D transfer bus from RSST s*with breakers 05Ll and 05L3 on AAC bus OL closed (backup alternate feed).

ESF bus 2H is normally fed through the E transfer bus from

).

)

RSST B. Station service bus 2C can provide an alternate 7

preferred feed for bus 2H. In addition, ESF bus 2H can be fed through E transfer bus from RSST A with breakers 05Ll and 05L3 on AAC bus OL closed (backup alternate feed)..

ESF bus 2J is normally fed through the F transfer bus from RSST C. Station service bus lA can provide an alternate preferred feed for Bus 2J.

(continued)

North Anna Units 1 and 2 B 3.8.1-4

BASES LCO (continued)

AC Sources-Operating B 3.8.1 The two 500 kV lines connecting each unit's main step-up and SSTs with the switchyard are the remaining qualified sources of offsite (preferred) power that are available to power ESF buses. For Unit 1, this soufce is normally available following a unit trip since there is an installed main generator breaker. Therefore, station service bus lA and lB,,.

which provide the preferred alternate feeds to the 2J and lH ESF buses, respectively, normally will not be affected. For Unit 2, where there is no installed main generator breaker, station ser.vice bus 28 and 2C, which provide the preferred L~

alternate feeds to ESF buses lJ and 2H, respectively~ will automatically transfer to RSST B and RSST C following a unit *~

trip.

'~

Each EOG must be capable of starting, accelerating to rated speed and voltage, and connecting to its respective ESF bus

\\'

on detection ot*bus undervoltage_ib~ degraded voltag~~ This will be accomplished within 10 seconds. Each EDG must also be capable of accepting required loads within the assumed loading sequence intervals, and continue to operate until offsite power can be restored to the ESF buses. These capabilities ~re required to be met from a variety of initial conditions such as EDG in standby with the engine hot and EDG in standby with the engine at ambient conditions. Additional EOG capabilities must be demonstrated to meet required Surveillances.

Proper sequencing of loads is a required function for EOG OPERABILITY.

In the event of a loss of offsite (preferred) power supply to the emergency bus, the EOG will auto start and re-energize its associated bus. In this configuration the EDG will become inoperable due to the defeat of load seguencing timers. Upon completion.of guidance in abnormal procedures for reconfigur*ation of the affected electrical bus to tontrol loads, TS 3.8.l Condition K may be exited as sequencing timing relays are no longer required as long as the associated emergency bus is not subsequently paralleled to another bus. The diesel can be considered operable which would allow exiting TS 3.8.1 Conditions Band Hand remaining in TS 3.8.1 Condition A.

The other unit 1s offsite circuit(s) and EDG(s) are required to be OPERABLE to support the S\\~, MCR/ESGR EVS, Auxiliary Building central exhaust, and CC functions needed for this unit. These functions share components, pump or fans, which are electrically powered from both units.

(continued)

North Anna Units 1 and 2 B 3.8.1-5 Revision 58

I,,

BASES AC Sources-Operat i ng B 3.8.1 SURVEILLANCE SR 3.8.1.1 RE~~~~{~~~JJ)

-+:1,~s &R ens1:1res pro~er GirGuit contiirnity fop.t,r,e offsite At:

~ -e-:1 ectri-e-a~ 15ower s1:1-p13~:Y to the or:.isU~ dis-t-1::.HH.i.:t;.:i-efl~

..ar:i~ avan abil it:;' of. e#site l\\C e.l-ectri cal 13e\\'ler. The 13reak-er

{l.\\l.) s~ e\\l\\Sv..r-es

...alignrne+it 11e-Fifies that each breaker is in i~s eerreet C.o r re(....\\, lo r ee...~i--

~sit i oo to en1s.ure th.a.t-di stri but-i-e-R-131:1s es and leads a-r-e

\\ *s

,:.,A,.\\..(;. (" e.at.c..'...

~eonn~ praferred or-alte-r-na-te pmter sot1~ces ~er Ol ~ ".'"WI J.

.{:+'sr~ c..' f

• ~ -1:ffii t r o-r Un~ t 2, and tl:iat appropriate i r:1Ele13endence e-f

('~v.A~e o

~I. ~;\\,. -effl-i-i:e ci io~d. The Survei 11 ance Frequency

~erAS(A,'l'"'(.4,\\il.a.4-d,:STf\\ ~"viis based on operating experience, equipment reliability, and i l d,s t.).f(!..

plant risk and is controlled under the Surveillance lllV.':ie~ ai.1M~ ~a.

Frequency Control Program.

C. 0 VI.LI\\,er..,~ -e J.

'\\-'ei

~e \\ i

? re.I; e.rr t?J..

0.:- ~\\\\c.r11Ww+e. SR 3. 8.1. 2 and SR 3. 8.1. 7

'rov.,er ~ou.rc.es a.v.J...

These SRs help to ensure the availability of the standby

+ :-\\-

f'\\°".\\:e.

electrical power supply to mitigate DBAs and transients and

~~

CA.~c=iro

. *\\ to maintain the unit in a safe shutdown condition.

\\v,.~e((,V"\\?'ew.e o.i; {:)~ e

• +;,,s lf'J\\O:\\~m~tl\\e.},

To m, mm, ze the wear on moving parts that do not get C\\rt~,

lubricated when the engine is not running, these SRs are 1'"','i.') S(l.- o...\\:.C> vef1~\\eS modified by a Note (Note 1 for SR 3.8.1.2) to indicate that ti

• l '-T*-i a 11 EDG starts for these Surveillances may be preceded by an

'"t~e. *1.'v'\\J.1..c..o..\\-e.a.. a."d-1 Gl.'ll* ~ 1 engine prel ube period and followed by a warmup period prior

". 11-

\\.\\v.,s; e. vC\\ (..

to 1 oadi ng.

O'\\"",\\f\\.(,e.e.~?

e\\-tdC\\t"'-\\ '?ov..:1e (' ~\\o-

~

~Vl,ir~J. o~~~i\\e c.i.tc.u.'i. ~ -\\,o J&.(. o~":>~~e Ai:c;J c~ !ovv<\\-i UV' "<to~ °'"'0 r ~

• For the purposes of SR 3.8.1.2 and SR 3.8.1.7 testing, the EDGs are started from standby conditions. Standby conditions for an EOG mean that the diesel engine coolant and oil are being continuously circulated, as required, and temperature is being maintained consistent with manufacturer recommendations.

In order to reduce stress and wear on diesel engines, the manufacturer recommends a modified start in which the starting speed of EDGs is limited, warmup is limited to this lower speed, and the EDGs are gradually accelerated to synchronous speed prior to loading. These start procedures are the intent of Note 2.

SR 3.8.1.7 requires that the EOG starts from standby conditions and achieves required voltage and frequency within 10 seconds. The 10 second start requirement supports the assumptions of the design basis LOCA analysis in the UFSAR, Chapter 15 (Ref. 5).

(continued)

North Anna Units 1 and 2 B 3.8.1~22

I BASES APPLICABLE SAFETY ANALYSES (continued)

LCO AC Sources-Shutdown B 3.8.2 minimal consequences. These deviations from DBA analysis assumptions and design requirements during shutdown conditions are ~llowed by the LCO for required systems.

During MODES l, 2, 3, and 4, various deviations from the analysis assumptions and design requirements are allowed within the Required Actions. This allowance is in recognition that certain testing and maintenance activities must be conducted provjded an acceptable level of risk is not exceeded. During MODES 5 and 6, performance of a significant number of required testing and maintenance activities is also required. In-MODES 5 and 6, the activities are generally planned and administratively controlled.

Relaxations from MODE 1, 2, 3, and 4'LCO requirements are acceptable during shutdown modes based on:

a. The fact that time in an outage is limited. This is a risk prudent.goal as well as a utility economic consideration.

b. Requiring appropriate compensatory measures for certain conditions. These may include administrative controls, reliance on systems that do not necessarily meet typical design requirements applied to systems credited in operating MODE analyses, O( both.

c. Prudent utility consideration of the risk associated with multiple activities that could affect multipl~ systems.

d. Maintaining, to the extent practical, the ability to perform required functions (even if not meeting MODE 1, 2, 3, and 4 OPERABILITY requirements) with systems assumed to function during an event.

In the event of an accident during shutdown, this LCO ensures the capability to support systems necessary to avoid immediate difficulty, assuming either a loss of all offsite power or a loss of all onsite emergency diesel generator (EOG) power.

The AC sources satisfy Criterion 3 of 10 CFR 50.36(c) (2) (ii).

. One offsite circuit capable of supplying the onsite Class lE power distribution subsystem(s) of LCO 3.8.10, 11 Distribution Systems-Sh0tdown," ensures that all required loads are (continued)

North Anna Units 1 and 2 B 3.8.2-2 Revision 0

BASES LCO (continued) 0, h\\J\\, ~'\\.e5tt+ive.

Sc.iU~VJ.L v',J*\\*u.~ O<

AC Sour~es-Shutdown B 3.8.2 powered from offsite power. An OPERABLE EOG, associated with the distribution system trains required to be OPERABLE by LCO 3.8.10, ensures a diverse power source is available to provide electrical power support, assuming a loss of the offsite circuit. Together, OPERABILITY of the required offsite circuit and EDG ensures the availability of sufficient AC sources to operate the unit in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents involving handling recently irradiated fuel).*

The qualified offsite circuit must be capable of'l1maintaining \\

rated frequency and voltage, and accepting required 1 oads during an accident, while connected to the Engineered Safety Feature (ESF) bus(es). Qualified offsite circuits are those that are described in the UFSAR and are part of the licensing basis for the unit.

Offsite circuits consist of 34.5 kV buses 3, 4, and 5 supplying the Reserve Station Service Transformer(s) (RSST) which feed the transfer buses. The 0, E, and F transfer buses supply the onsite electrical power to the four.emergency buses for the two units. Unit 1 emergency bus His fed through the F transfer bus from the C RSST. Unit 1 emergency bus J is fed through the D transfer bus from the A RSST.

Unit 1 station service bus lB can be an alternate feed for Unit 1 H emergency bus, while Unit 1 J bus may be fed from Unit 2 station service bus 2B. Unit 2 emergency bus H is fed through the E transfer bus from the B RSST. Unit 2 emergency bus J is fed through the F transfer bus from the C RSST.

Unit 2 station service bus 2C can be an alternate feed for t~'*

Unit 2 H emergency bus, while Unit 2 J bus may be fed from Unit 1 station service bus lA. In addition, E transfer bus can be a backup alternate feed to Unit 2 H bus (fed from RSST A through the O transfer bus and OL bus). The RSSTs can be fed by any 34.5 kV bus (3, 4, or 5) provided RSSTs A and B are fed from a different 34.5 kV bus than RSST C.

The EOG must be capable of starting, accelerating to rated

_____s_~.d_an.d_ypJ_tsuJ.e_, and connecting to its_r..e$pective ESF bus on detection of. bus undervoltage1 ~ degraded voltage0'The EOG must be capable of accepting required loads within the assumed loading sequence intervals, and continue to operate until offsite power can be restored to the ESF b~s. These capabilities are*required to be met from a variety of initial conditions such as EDG in standby with the engine hot and the EDG in *standby at ambient conditions.

Proper sequencing of loads is a req~ired function for EOG OPERABILITY.

(continued)

North Anna Units 1 and 2 B 3.8.2-3 Revision 58

VIRGINIA ELECTRICAND POWER COMPANY RICHMOND, VIRGINIA 23261

• April 30, 2018 U. S. Nuclear Regulatory Commission Attention: Document Control Desk Washington, DC 20555-0001 VIRGINIA ELECTRIC AND POWER COMPANY NORTH ANNA POWER STATION UNITS 1 AND 2 PROPOSED LICENSE AMENDMENT REQUEST Serial No.:

NRA/DPM:

Docket Nos.:

License Nos.:

OPEN PHASE PROTECTION PER NRC BULLETIN 2012-01 10CFR50.90 18-072 R1 50-338/339 NPF-4/7 Industry operating experience and NRC Bu.lletin (NRCB) 2012-01, "Design Vulnerability in Electric Power System," identified industry issues involving the loss of one or two phases of an off-site power circuit (i.e., an open phase condition) at certain nuclear power stations both nationally and internationally. In response to an NRC request for additional information (RAI) associated with NRCB 2012-01, Virginia Electric and Power Company (Dominion Energy Virginia) informed the NRC that plant design changes were being planned to address the potential for an* open phase condition (OPC) at North Anna Power Station (North Anna) Units 1 and 2. Furthermore, by letters dated October 9, 2013 and March 16, 2015, the Nuclear Energy Institute (NEI) notified the NRC that the industry's Chief Nuclear Officers (CNOs) had approved a formal initiative to address OPCs, and that the initiative represented a formal commitment among nuclear power plant licensees to address the OPC design vulnerability for operating reactors.

A voltage unbalance protection system is being installed on the North Anna Units 1 and 2 4160V emergency buses to address the potential for an OPC to exist on one or two phases of a primary off-site power source that would not currently be detected and mitigated by the existing station electrical protection scheme. Therefore, pursuant to 1 O CFR 50.90, Dominion Energy Virginia is submitting a license amendment request for North Anna Units 1 and 2 to add operability requirements, required actions, and surveillance requirements to the Technical Specifications (TS) for the 4160V emergency bus voltage unbalance function. Attachment 1 provides a discussion and evaluation of the proposed change.

Marked-up TS pages and typed TS pages indicating the proposed change are provided in Attachments 2 and 3, respectively. Attachment 4 provides marked-up TS Bases pages (for information only).

We have evaluated the proposed change request and have determined that it does not involve a significant hazards consideration as defined in 10 CFR 50.92. The basis for this determination is included in Attachment 1. We have also determined that operation with the proposed change will not result in any significant increase in the amount of effluents that may be released off-site or any significant increase in individual or cumulative occupational radiation exposure. Therefore, the proposed change is eligible for categorical exclusion from an environmental assessment as set forth in 10 CFR 51.22(c)(9). Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment is needed in connection with the approval of the proposed,

~obi

'\\

,J Serial No.18-072 Docket Nos.: 50-338/339 Page 2 of 3 change. The proposed TS change has been reviewed and approved by the Facility Safety Review Committee.

Dominion Energy Virginia requests approval of the proposed TS change by June 30, 2019. Thirty days after issuance is a typical time frame for implementing license amendments.

The 4160V emergency bus voltage unbalance (open phase) protection function will be implemented during a different outage for each unit; thereby necessitating a different implementation schedule for North Anna Units 1 and 2.

Accordingly, Dominion Energy Virginia requests implementation of the proposed TS revisions to coincide with the completion of the fall 2019 refueling outage for North Anna Unit 1 and the fall 2020 refueling outage for North Anna Unit 2.

Should you have any questions or require additional information, please contact Ms. Diane E. Aitken at (804) 273-2694.

Respectfully, Mark D. Sartain Vice President - Nuclear Engineering and Fleet Support Commitments contained in this letter: None Attachments:

1. Discussion of Change

2. Marked-up Technical Specifications Pages

3. Proposed Technical Specifications Pages

4. Marked-up Technical Specification Bases Pages (For Information Only)

COMMONWEALTH OF VIRGINIA

)

)

COUNTY OF HENRICO

)

The foregoing document was acknowledged before me, in and for the County and Commonwealth aforesaid, today by Mr. Mark D. Sartain, who is Vice President - Nuclear Engineering and Fleet Support, of Virginia Electric and Power Company.

He has affirmed before me that he is duly authorized to execute and.file the foregoing document in behalf of that company, and that the statements in the document are true to the best of his knowledge and belief.

Acknowledged before me this 3o Vday of 4r;I ' 2018.

My Commission Expires: 5 -3 / -~a VICKI L. HULL NOTARY PUBLIC REG. # 140542 COMMONWEALTH OF VIRGINIA MY COMMISSION EXPIRES 5131/2022

~-L~

Notary Public

Serial No.18-072 Docket Nos.: 50-338/339 Page 3 of 3 cc:

U.S. Nuclear Regulatory Commission - Region II Marquis One Tower 245 Peachtree Center Avenue, NE Suite 1200 Atlanta, GA 30303-1257 State Health Commissioner Virginia Department of Health James Madison Building..::. ?1h *floor.*

109 Governor Street Suite 730 Richmond, VA 23219 Ms. Karen R. Cotton Gross NRC Project Manager - Surry U.S. Nuclear Regulatory Commission One White Flint North Mail Stop 08 G-9A 11555 Rockville Pike Rockville, MD 20852-2738 Mr. James R. Hall NRC Senior Project Manager - North Anna U.S. Nuclear Regulatory Commission One White Flint North Mail Stop 08 G-9A 11555 Rockville Pike Rockville, MD 20852-2738 NRC Senior Resident Inspector North Anna Power Station DISCUSSION OF CHANGE Virginia Electric and Power Company (Dominion Energy Virginia)

North Anna Units 1 and 2 Serial No.18-072 Docket Nos. 50-338/339 Page 1 of 44

1.0 Summary Description 2.0 Detailed Description TABLE OF CONTENTS 2.1 Existing System Design and Operation 2.2 Current Technical Specifications Requirements 2.3 Reason for Proposed Change 2.4 Description of Proposed Change 2.5 OPC Relay Surveillance Frequencies 3.0 Technical Evaluation 3.1 Open Phase Conditions Case Summary 3.1.1 Open Phase Conditions Considered 3.1.2 Open Phase Locations Considered 3.1.3 Generating Conditions Considered 3.1.4 Loading Conditions Considered 3.2 Calculations and Plant Analysis Methodology 3.2.1 Negative Sequence Analysis 3.2.2 Motor Analysis 3.2.3 Open Phase Event Timing 3.2.4 Security Cases 3.2.5 Setpoints 3.3 Design Solution 3.3.1 Class 1 E Design Solution Page 2 of 43 3.3.2 Existing Plant Protection and Unique Operating Conditions 3.3.2.1 GSU Transformer Operating Conditions 3.3.2.2 EDG Test Configuration 3.3.3 Non-Class 1 E Design Solution 3.4 Failure Modes and Effects Analysis 4.0 Regulatory Evaluation

4.1 Background

4.2 Applicable Regulatory Requirements/Criteria 4.2.1 Comparison to 10 CFR 50.36 Criteria for TS Inclusion 4.2.2 General Design Criteria 4.2.3 10 CFR 50.55a(h)(2) Protection Systems 4.2.4 NRC Generic Letter 79-36 4.2.5 NRC Branch Technical Position (BTP) 8-9 Open Phase Conditions in Electric Power System 4.3 No Significant Hazards Consideration Analysis 5.0 Environmental Consideration 6.0 Conclusion 7.0 References

DISCUSSION OF CHANGE 1.0

SUMMARY

DESCRIPTION Page 3 of 43 Industry operating experience and NRC Bulletin (NRCB) 2012-01, "Design Vulnerability in Electric Power System," (Reference 7.1) have identified industry issues that involve the loss of one or two phases of an off-site power circuit (i.e., an open phase condition) at certain nuclear power stations both nationally and internationally. In response to an NRC request for additional information (RAI) associated with NRCB 2012-01 (Reference 7.2), Virginia Electric and Power Company (Dominion Energy Virginia) stated that plant design changes were being planned to address the potential for an open phase condition (OPC) at North Anna Power Station (North Anna) Units 1 and 2.

By letters dated October 9, 2013 and March 16, 2015 (References 7.3 and 7.4), the Nuclear Energy Institute (NEI) notified the NRC that the industry's Chief Nuclear Officers (CNOs) had approved a formal initiative to address OPCs, and that the initiative represented a formal commitment among nuclear power plant licensees to address the OPC design vulnerability for operating reactors.

As discussed below, a Class 1 E voltage unbalance protection system is being installed on the North Anna Units 1 and 2 4160V emergency buses to address the potential for an OPC to exist on one or two phases of a primary off-site power source that would not currently be detected and mitigated by the existing station electrical protection scheme.

Consequently, appropriate operability requirements, required actions, and surveillance requirements (SRs) are being added to the North Anna Technical Specifications (TS) to address this additional level of voltage unbalance protection for OPCs.

2.0 DETAILED DESCRIPTION 2.1 EXISTING SYSTEM DESIGN AND OPERATION The North Anna station electrical power distribution system is shown in Figure 1. The 230/500kV switchyard, is an integral part of the transmission network and is the preferred source of offsite power to the station Class 1 E electrical system.

The offsite circuit consists of all breakers, transformers, switches, interrupting devices, cabling, and controls required to transmit power from the off-site transmission network to the onsite Class. 1 E Engineered Safety Feature (ESF) bus(es). Each one is qualified to meet the requirements of 10CFR50, Appendix A, General Design Criteria (GDC) 17.

The distribution system to the station Class 1 E electrical distribution system is comprised of a minimum of two qualified off-site circuits between the 230/500kV switchyard and the onsite Class 1 E Electrical Power System and two separate and independent Emergency Diesel Generators (EDGs) per unit. These systems supply power to the redundant trains for each unit to ensure and maintain it in a safe shutdown Page 4 of 43 condition after an anticipated operation occurrence or a postulated Design Basis Accident (OBA).

Qualified offsite circuits include the two 500kV-34.5kV transformers and one 230kV-34.5kV transformer (collectively referred to as the Station Reserve Transformers (SRTs) that feed three independent 34.5kV buses which supply the three Reserve Station Service Transformers (RSSTs). The RSSTs are used to step down from 34.5kV to 4.16kV for the Emergency Buses. Each RSST is protected by overload relay schemes, and the cables are protected by pilot wire differentials. The RSSTs are fully capable of powering Station Service loads in the event of a loss of the normal power supply.

In addition, there are two 500kV lines from the switchyard to the Unit 1 and Unit 2 Generator Step-Up Transformers (GSUs).

• The Generator side of the GS Us is connected to the Station Service Transformers (SSTs). The SSTs are used to step.

down the 22kV from the main generator to 4.16kV for the Station Service Buses.

Three sets of potential transformers (PTs) are installed on each Emergency Bus (phase to ground). The transformers feed undervoltage (UV) relays and are provided on each Class 1 E bus at the 4160V level for detecting a loss of bus voltage or a sustained degraded voltage (DV) condition. Each set of relays are combined in a two-out-of-three logic to generate a Loss of Offsite Power (LOOP) signal. A loss of voltage start of the EOG is initiated when the voltage is less than 74 percent of rated voltage and lasts for approximately 2 seconds. A degraded voltage start of the EOG is produced when the voltage is less than 90 percent of rated voltage sustained for approximately 56 seconds.

The time delay for the degraded voltage signal is reduced to approximately 7.5 seconds with the presence of a Safety Injection on the unit.

In the event of a loss of the preferred power supply, the standby EOG supplies power to safety-related equipment within 10 seconds of a start signal. The Class 1 E loads are loaded onto the EDGs sequentially. The EDGs are rated at 3000kW for 2000 hours0.0231 days <br />0.556 hours <br />0.00331 weeks <br />7.61e-4 months <br />.

Also, the automatic load sequencing timing relays must be OPERABLE. A required load sequencing timing relay is one whose host component is capable of automatically loading onto an emergency bus. Each independent qualified off-site source must be capable of maintaining rated frequency and voltage, and accepting required loads during an accident, while connected to the ESF bus.

2.2 CURRENT TECHNICAL SPECIFICATIONS REQUIREMENTS North Anna Units 1 and.2 TS 3.3.5 provide operability requirements, required actions, and SRs for the Loss of Power (LOP) Emergency Diesel Generator (EOG) Start Instrumentation. Specifically, TS Limiting Condition for Operation (LCO) 3.3.5 requires:

Three channels per bus of the loss of voltage Function and three channels per bus of the degraded voltage Function for the following 4160 VAC buses shall be OPERABLE:

a. The Train H and J buses;

ii

b. One bus on the other unit for each required shared component.

Page 5 of 43 The Required Action for one or more Functions with one channel per bus inoperable is to place the channel in trip with a Completion Time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The Required Action for one or more Functions with two or more channels per bus inoperable is to restore all but one channel to OPERABLE status with a Completion Time of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />.

With the Required Action and Completion Time not met, immediately enter applicable Condition(s) and Required Action(s) for the associated EOG made inoperable by LOP EDG start instrumentation.

Surveillance Requirement (SR) 3.3.5.1 requires the Trip Actuating Device Operational Test (TADOT) be performed for LCO 3.3.5.a and 3.3.5.b Functions. SR 3.3.5.2 requires performance of a Channel Calibration with specified Allowable Values. SR 3.3.5.3 requires verification ESF Response Times are within limit for LCO 3.3.5.a and LCO 3.3.5.b Functions. The frequency for the surveillance Requirements is in accordance with the Surveillance Frequency Control Program.

As discussed in Section 2.4, the proposed TS LCOs and SRs to address the new voltage unbalance protection function will be included in TS 3.3.5.

2.3 REASON FOR PROPOSED CHANGE An OPC is a single or double open electrical phase in a three phase circuit, with or without ground, which is located on the primary or high voltage side of a transformer connecting a credited off-site power circuit to the on-site transmission system. The potential for an OPC to exist in an off-site power source was not previously recognized as a design vulnerability in the nuclear power industry, therefore, was not considered in the original design of the North Anna electrical power distribution system. However, based on an internal review of the January 2012 event at the Byron Nuclear Power Station, and the issuance of and response to NRC Bulletin 2012-01, Dominion Energy Virginia determined that North Anna Power Station could also be susceptible to an OPC. Specifically, a consequential OPC could result in the affected off-site power source (i.e., the primary or preferred power source) being incapable of supplying sufficient power to perform its safety function.

While many OPCs would be addressed by the existing UV relays, some consequential OPCs are not readily detectable by the existing station electrical protection scheme at North Anna Units 1 and 2. Without the implementation of design modifications, these OPCs may go undetected and unisolated using existing plant protection equipment. If the failed circuit remains connected to the Class 1 E ESF 4160V buses downstream, it could render the downstream onsite emergency power system incapable of performing its designated safety function.

As a result, as part of its design effort to detect and mitigate a potentially undetected consequential OPC, North Anna is installing a Class 1 E protective relaying scheme on the ESF buses that provides an additional pathway for actuating tbe existing undervoltage protection functions and directly interfaces with the ESF actuation logic.

Therefore, the necessary operability requirements, required actions, and SRs for the Page 6 of 43 voltage unbalance function are being incorporated into the North Anna TS to ensure this protection circuitry is capable of performing its design safety function.

2.4 DESCRIPTION

OF PROPOSED CHANGE The proposed TS change adds negative sequence voltage function operability requirements, required actions, and SRs to the TS. A description of the proposed revision is provided below:

North Anna TS 3.3.5, Loss of Power (LOP) Emergency Diesel Generator (EOG)

Start Instrumentation, is revised to require three channels per bus of the negative sequence voltage function to be OPERABLE.

The existing Required Actions will also be applicable to the new negative sequence voltage function.

North Anna SR 3.3.5.1 requires the performance of a Trip Actuating Device Operational Test (TADOT) for LCO 3.3.5.a and 3.3.5.b UV/DV Functions.

North Anna SR 3.3.5.2 is being revised to require the performance of a Trip Actuating Device Operational Test (TADOT) for LCO 3.3.5a and 3.3.5b for Negative Sequence Relay Functions.

North Anna SR 3.3.5.2 is being renumbered to North Anna SR 3.3.5.3 and revised to include performance of a CHANNEL CALIBRATION with the following Allowable Values for the negative sequence voltage function:

c.

Negative Sequence Voltage ~ 2.894% and :5. 5.106% for LCO 3.3.5.a and 3.3.5.b Functions.

North Anna SR 3.3.5.3,which is being renumbered to North Anna SR 3.3.5.4, requires verification ESF Response Times are within limits for LCO 3.3.5.a and LCO 3.3.5.b Functions. The negative sequence voltage function will also be part of the SR.

A mark-up of TS 3.3.5 indicating the proposed changes and the typed proposed TS pages are provided in Attachments 2 and 3, respectively. A mark-up of the proposed TS Bases pages is provided in Attachment 4 and is included for information only.

2.5 OPC RELAY SURVEILLANCE FREQUENCIES Surveillance of the negative sequence voltage relays is required as defined in 10 CFR 50.36(c)(3) to "assure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions for operation will be met." The proposed change revises TS 3.3.5, Loss of Power (LOP) Emergency Diesel Generator (EOG) Start Instrumentation and adds surveillance requirements for the negative sequence voltage function. The negative sequence relays are subject to performance of the Trip Actuating Device Operational Test (TADOT), channel calibration and ESF Response Time Testing in accordance with the Surveillance Frequency Control Program (SFCP). The proposed negative sequence voltage relays' calibration and testing frequencies to be included in the SFCP are "once

Page 7 of 43 per 18 months." As discussed in Section 3.0, Basler BE1-47N relays are being used in the negative sequence voltage (open phase) protection circuitry.

The negative sequence voltage function channel calibration frequency to be included in the SFCP will be once per 18 months. This channel calibration frequency is consistent with the existing Loss of Voltage and Degraded Voltage channel calibration frequency.

The verification of ESF Response Times for the negative sequence voltage function will be performed once per 18 months on a Staggered Test Basis. This is consistent with the verification of ESF Response Times for the existing Loss of Voltage and Degraded Voltage function test frequency. However, while the existing TADOT frequency for the loss of voltage and degraded voltage protective circuitry is "once per 92 days" in the SFCP, a test frequency of "once per 18 months" will be specified for the negative sequence voltage relays based on the following considerations:

1) To trip the emergency bus and start the EOG, the negative sequence voltage relay scheme uses existing Loss of Voltage auxiliary relays which are tested every 92 days in accordance with the surveillance requirements for that relay scheme.

2) In accordance with the Basler relay instruction manual (Reference 7.10), the negative sequence voltage relays require no preventive maintenance other than a periodic operational check. Although the manufacturer does not specify a periodicity for the operational check, the following information supports the selection of an 18-month test frequency for the negative sequence voltage relays:

The Basler relay being used (Model No. BE1-47N) is a solid state relay (SSR) device that has certain advantages over the electro-mechanical relays (EMR) used in the Loss of Voltage / Degraded Voltage protection schemes. These advantages include the absence of mechanical moving parts, less heat generation, less susceptibility to shock and seismic events, no inrush current, and no contact resistance issues. Also, SSRs are not susceptible to open and shorted coils, which can be a mechanism for mechanical relay failure. In addition, contacts on EMRs can have contact contamination, bounce, and arcing. These particular issues do not apply to the Basler SSRs.

The maximum electrical life of an EMR is the maximum permissible number of switch operations at a specified contact load under specified conditions.

SSR data sheets do not carry an electrical life specification like EMRs. Unlike the EMR, where life is dependent on actual switching load and number of cycles, SSR reliability is not associated with the number of switching cycles.

An SSR's lifetime expectation is considered "very long" versus "medium" for EMRs.

Therefore, although the proposed TADOT frequency for the negative sequence voltage relays is longer than the Loss of Voltage and Degraded Voltage relays' TADOT frequency, the "once per 18 months" test frequency is reasonable and justified based on these considerations.

I

3.0 TECHNICAL EVALUATION

Page 8 of 43 At Byron Nuclear Power Station (BNPS), both off-site and onsite electric systems were not able to perform their intended safety functions due to the OPC design vulnerability, and manual actions were necessary to restore ESF functions. Following the OPC events at BNPS in 2012, the NRG issued Bulletin 2012-01, "Design Vulnerability in Electric Power Systems" (Reference 7.1 ).Bulletin 2012-01 requested information regarding the facilities' electric power system design in light of the OPC events that involved the loss of one of the three phases of the off-site power circuits at BNPS Unit 2.Bulletin 2012-01 required licensees to "comprehensively verify their compliance with the regulatory requirements of General Design Criterion (GDC) 17, 'Electric Power Systems,' in Appendix A, General Design Criteria for Nuclear Power Plants, to 10 CFR Part 50 or the applicable principal design criteria in the updated final safety analysis report; and the design criteria for protection systems under 10 CFR 50.55a(h)(2) and 10 CFR 50.55a(h)(3)."

Consistent with the current North Anna licensing basis and GDC 17 requirements, existing protective circuitry is sufficiently sensitive to detect design basis conditions such as a loss of voltage condition or a sustained degraded grid voltage condition and will separate the ESF buses from a connected failed source. However, the existing protection schemes at North Anna may not detect some consequential single or double OPCs on an off-site. power source, and this design vulnerability may preclude electric power systems from adequately performing their intended safety functions.

By letters dated October 9, 2013 and March 16, 2015, NEI notified the NRG that the industry's CNOs had approved a formal initiative to address OPCs (References 7.3 and 7.4).

To address the possibility of an OPC on an off-site power source at North Anna, design changes are being developed to implement a new protection scheme to protect plant equipment from a consequential OPC event, thus ensuring safety functions are preserved during an OPC. Specifically, Dominion Energy Virginia is installing an open phase detection and protection system at North Anna utilizing Class 1 E voltage unbalance (negative sequence) relays (Basler BE1-47N relays) (Reference 7.10) that will provide consequential OPC detection and protection on the 4160V Emergency Switchgear 1 H, 1J, 2H, and 2J buses. The relays will be configured in a two-out-of-three logic scheme that will detect consequential OPCs, trigger an annunciator in the control room indicating an OPC exists, and automatically initiate protection actions to mitigate the event.

The Basler BE1-47N is an inverse time relay. At a minimum of 4 percent negative sequence, the BE1-47N relay will energize and send a start signal in approximately 11 seconds with a larger percent negative sequence generating a faster start signal.

Guidance per National Electrical Manufacturers Association (NEMA) Standard (MG-1)

(Reference 7.5) states motors should be secured when the voltage unbalance is 5 percent or greater. The 4 percent minimum pickup of the BE1-47N relay ensures the relay will not cause nuisance trips while ensuring the guidance of NEMA MG-1 is met.

Page 9 of 43 The time delay setpoint of the BE1-47N relay ensures the bus will trip before the pump overcurrent relays energize.

Upon receiving a sustained degraded voltage, undervoltage, or voltage unbalance condition while exceeding their time delay setpoints, the following conditions will result:

1. The EOG is started,

2. The Emergency Bus is isolated,

3. All loads are stripped from the 4160V Emergency Bus and the 480V load centers except the Charging Pumps, the Low Head Safety Injection Pumps, and the feeds to the 480V Motor Control Center Load,

4. Once the EOG reaches 95% of its nominal output voltage and no residual voltage exists, the EOG output breaker closes automatically,

5. Loads are sequentially connected to the Emergency Bus.

In addition, a blocking feature is also being included in the logic scheme to enhance the reliability of the protection system and to prevent undesired actuation in the event of a fuse failure on a potential transformer (PT) or failure of a PT as further discussed below.

In support of the planned OPC design changes, Dominion Energy Virginia developed a series of models and analyses to determine: 1) the OPC vulnerabilities of the existing North Anna onsite protection schemes for the safety buses, non-safety buses, and off-site power sources given various power source alignments and operating conditions, and 2) the plant and component responses to a consequential OPC. The models and analyses are discussed below and provide the technical bases for the implementation of the planned voltage unbalance (open phase) protection function.

3.1 OPEN PHASE CONDITIONS CASE

SUMMARY

NRC Branch Technical Position (BTP) 8-9 (Reference 7.9) provides guidance that was used to define North Anna's OPC vulnerabilities. An OPC occurs when one or two phase conductor(s) become(s) disconnected from the transmission interconnections while the other phase conductor(s) remain(s) intact resulting in one of the following three conditions:

1. The energized line shorts to ground on the transmission side, so there is fault current to be detected and cleared by the switchyard protection scheme. Since the switchyard protection scheme adequately protects against this condition, no further analysis is necessary.

2. The energized line does not short to ground on the transmission side, so there may not be enough fault current to be detected and cleared by the switchyard protection scheme. The disconnected phase conductor(s) short(s) to ground on the transformer end, connecting the transformer high-voltage (HV) winding to ground. In those cases where two phase conductors open, one or two phase conductors may be connected to ground.

Page 10 of 43 3., The energized line does not short to ground on the transmission side, so there is no fault current to be detected and cleared by the switchyard protection scheme.

The disconnected phase conductor(s) remains suspended above the ground at the transformer end and does *not short to ground on the transformer end.

Each power source alignment or operating condition represents a unique case with the cases collectively representing the known configurations and alignments encountered during licensed operations. The OPCs, locations, generating conditions, and loading conditions considered in the cases are provided in the following sections. To address the potential OPCs and locations, the North Anna licensed operating electrical system configurations and loading conditions were considered with and without a high impedance ground fault condition. OPCs concurrent with an accident were also considered.

3.1.1 Open Phase Conditions Considered The following open phase conditions were considered:

Single open phase without a ground connection Single open phase with a 3500 grounded connection Single open phase with a solid grounded connection Double open phase conditions were considered and simulated for both transformer styles (Wye Solid Grounded-Delta and Delta-Wye solid grounded). In both cases it was found that these cases produced a higher negative sequence voltage than their comparative single open phase conditions. Therefore, single open phase conditions were considered to be bounding and an in depth analysis of double open phase conditions. was not performed.

A single open phase condition was considered and simulated for each phase for both transformer styles (Wye solid grounded-Delta and Delta-Wye solid grounded).

In these cases it is shown that the negative sequence voltage for each phase is comparable to the others when the switchyard is balanced. Therefore, only one of the three phases is evaluated for each open phase event configuration.

3.1.2 Open Phase Locations Considered The analyses considered the following OPC locations:

High side terminals of the #1 Switchyard Transformer (TX-1)

High side terminals of the #2 Switchyard Transformer (TX-2)

High side terminals of the #3 Switchyard Transformer (TX-3)

High side terminals of the RSST A Transformer High side terminals of the RSST B Transformer High side terminals of the RSST C Transformer Page 11 of 43 High side terminals of the Unit 1 Generator (Main) Step-Up (GSU) Transformer High side terminals of the Unit 2 Generator (Main) Step-Up (GSU) Transformer 3.1.3 Generating Conditions Considered Open phase events were considered with North Anna Units 1 and 2 at 0% power and North Anna Units 1 and 2 at 100% power.

For accident scenarios, the open phase event is assumed to occur coincident with Safety Injection and Containment Depressurization Actuation. For large motor starts, the open phase event is assumed to occur coincident with a Reactor Coolant Pump start or tandem Main Feedwater Pump start.

3.1.4 Loading Conditions Considered Two emergency bus loading initial conditions were considered: 1) minimum emergency bus loading and 2) normal emergency bus loading. Minimum emergency bus loading consists of the Service Water, Charging and Component Cooling Pumps secured on the evaluated bus with the opposite train in operation. Normal emergency bus loading consists of the Service Water, Charging and Component Cooling Pumps in operation on the evaluated bus with the opposite train secured.

3.2 CALCULATIONS AND PLANT ANALYSIS METHODOLOGY The models and analyses developed to determine and evaluate the North Anna OPC vulnerabilities are discussed below.

3.2.1 Negative Sequence Analysis Calculations were prepared to analyze the above OPCs to determine the levels of voltage unbalance on the ESF buses from a connected failed source due to a single or double OPC. The levels of unbalanced voltage determined to potentially affect plant operating equipment are discussed below.

A model was developed using the ElectroMagnetic Transients Program -

Restructured Version (EMTP-RV). EMTP-RV numerically solves the differential equations of the circuit to compute the actual time-domain waveforms for the voltages and currents. This approach has advantages over single-phase, frequency domain analysis software or other conventional transient stability programs, in that it can model arbitrary unbalanced phase arrangements, such as an open phase condition. This model includes a 3-phase representation of the system components Page 12 of 43 including the transmission system source, generators, transformers, cables, and plant loads. The model is used to determine the emergency system (Switchgear 1 H, 1 J, 2H, and 2J) voltages during various station events (faults, open phase, motor start, etc.). The various plant configurations, which include motor starts, diesel testing, and open phase events under various loading levels and operating scenarios, were evaluated.

The analytical limits and time delay ofthe negative sequence voltage (open phase) relays were also developed. These limits and time delays are used as input for the open phase relay setting calculation. The negative sequence voltage relay settings should protect important to safety equipment on the 4kV emergency buses from consequential OPCs (with the exception of some OPCs on the primary side of non-safety-related Switchyard Transformers TX-1 and TX-2, discussed in proceeding sections) and remain secure for the maximum level of steady-state voltage unbalance at the switchyard bus.

This analysis determines the analytical limits for the negative sequence voltage protection relay settings that will ensure the safety functions are preserved during an open phase condition. The cases considered and signals monitored are selected for testing the open phase protection relays.

The following steps were used to determine open phase detection analytical limits for the protection negative sequence voltage relays on the emergency system buses for the open phase events described above:

Determine the case list to test the negative sequence voltage protection relaying scheme for an open phase condition concurrent with a LOCA.

Simulate these cases using the EMTP-RV model.

Analyze and tabulate the auxiliary system behavior (e.g. voltages, motor heating, and existing protective relay response) for each case.

Determine the analytical limits for the negative sequence overvoltage protection relays to ensure the safety functions are preserved during an open phase condition.

An OPC causes a voltage unbalance to the induction motors and motor-operated valves (MOVs), which introduces a negative sequence voltage. This negative sequence voltage produces a flux in the air gap that opposes the rotation of the rotor. The resulting induced currents in the rotor are at twice the line frequency, which can cause additional heating in the rotor due to the skin effect (for higher frequency currents, the skin effect will increase the apparent rotor resistance, resulting in additional rotor heating).

This thermal capability also has to consider that Class 1 E motors restart on the EDGs after tripping from the unhealthy source. To account for this motor starting sequence, a total thermal limit (12

• t) of less than or equal to 20 per unit (pu)

I Page 13 of 43 (40 pu/2 starts) for Class 1 E motors during the open phase event concurrent with a LOCA is used as a bounding condition to ensure the motors have enough thermal capability to perform their safety functions.

According to NEMA MG-1, for a voltage unbalance between 1 % and 5% (percent of motor nameplate voltage), the motor horsepower should be de-rated to account for additional heating. Operation of the motor above 5% voltage unbalance is not recommended. Therefore, for voltage unbalance greater than 5%, the negative sequence voltage relays should isolate the motor loads before the (12

• t) value is equal to 20 pu to allow for sufficient remaining thermal capability for the motors to restart on the EDGs.

For a voltage unbalance between 1 % and 5%, the NEMA MG-1 de-rating factor was applied to the motor rating. If the brake horsepower (BHP) of the motor is less than the de-rated horsepower rating, then continuous operation of the motor was determined to be acceptable. In cases where the BHP is greater than the de-rated horsepower rating, the motor must be isolated from the faulted source. The calculation quantifies the time duration for which the motor may be operated on the faulted source before the negative sequence current heating capability is exhausted.

The resulting time duration was used to determine if manual action (alarm) is acceptable or if automatic action (trip) is necessary.

3.2.2 Motor Analysis Based on IEEE report "Design Features and Protection of Valve Actuator Motors in Nuclear Power Plants", and vendor information, it is conservatively assumed that motor-operated valve (MOV) motors can withstand a locked rotor condition for up to 5 seconds and have adequate remaining capability to restart on the emergency diesel generator.

For cases where voltage unbalance is greater than 5%, the results indicate the BE1-47N relays trip and isolate the motor loads before the integrated (1 2

• t) values reach 20 pu and before the motor load's associated overcurrent relay trips (when applicable).

The BE1-47N relays did not actuate for many ungrounded open phase events on the high voltage side of switchyard transformers TX-1 and TX-2. For these conditions, the analysis determined that thermal damage may occur to the Auxiliary Feedwater (AFW) Pump Motors and Inside Recirculation Spray (ISRS) Pump Motors if they are operated continuously under accident loading conditions. For these cases, the Alstom open phase detection relays (described in Section 3.3) will detect the open phase event and initiate a trip of its associated transformer within 5 seconds to provide protection to the downstream loads and to be within the time frames considered in the accident analysis.

The BE1-47N relays did not actuate for ungrounded open phase events on the high voltage side of GSU 1 and GSU 2 when Class1 E Bus is aligned and Units are offline. For these conditions, additional analysis was performed to determine if

Page 14 of 43 thermal damage may occur to the AFW Pump Motors and ISRS Pump Motors if they are operated continuously under accident loading conditions. Further analysis documents that the AFW and ISRS pump motor insulation will be capable of performing their design function on the most limiting case. Therefore no protection is required for this condition.

3.2.3 Open Phase Event Timing For an open phase event coincident with a Safety Injection or Containment Depressurization Actuation signal, the emergency buses shall be re-energized by the Emergency Diesel Generator within 10 seconds. To be within the time-frame considered in the accident analysis, the open phase protection relay tripping time delay should be less than or equal to 7 seconds. This is consistent with the time delay used for degraded voltage protection during accident conditions (7.5 seconds).

Analysis results show that for most open phase events in which the BE1-47N relays trip, the tripping time is less than 6 seconds after the open phase event occurs. For cases in which the BE1-47N does not trip in less than 6 seconds, the Alstom open phase detection relay will detect the open phase event and initiate a trip of the offsite source. This is within the time considered in the accident analysis for a loss of offsite power coincident with an accident.

For open phase conditions not detected by the BE1-47N relays, the Alstom open phase detection relay will detect the open phase event and initiate a trip of the offsite source. A tripping time delay of less than or equal to 5 seconds will be employed by the Alstom relay to be within the time considered in the accident analysis for a loss of offsite power coincident with an accident. Analysis results provide phase current and sequence current magnitudes and angles for Switchyard Transformers TX-1 and TX-2 for use in setting the Alstom open phase detection relays. Sequence currents are sampled at t = 6 seconds to observe currents at 5 seconds post-event.

It should be noted the channel statistical analysis (CSA) for the negative sequence voltage relay may delay the relay response time. A 4% relay pickup setting with a 10.0 time delay setting account for both positive and negative CSA and will ensure the relay would trip within the time considered in the accident analysis for a loss of off-site power coincident with an accident.

3.2.4 Security Cases The design of the voltage unbalance (open phase) function needs to ensure that it will not actuate for non-OPCs, such as during normal operating conditions, unbalanced faults on the auxiliary system, and motor starts under various loading conditions. These normal operating conditions need to consider both time and magnitude of the negative sequence generated. Plant cases identified in supporting calculations were used with the various transmission system unbalances discussed in Section 3.1 to test the negative sequence voltage (open phase) function algorithm's security.

Page 15 of 43 The negative sequence voltage relay includes an inverse timing characteristic feature that is adjustable from 01 to 99 in increments of 1. The timing is based on the percent difference from the nominal system voltage. The calculated results show that with a time dial setting of 10.0, the negative sequence voltage relay was secure (i.e., would not issue an alarm) for the simulated unbalanced faults on the medium-voltage and low-voltage systems. The time dial setting of 10.0 provides sufficient time to allow existing overcurrent relaying to trip on the unbalanced fault condition.

3.2.5 Setpoints Table 1 provides a summary of the maximum and minimum steady-state negative sequence voltages seen at Buses 1 H, 1 J, 2H, and 2J for open phase events on the high side of each transformer, which was then used to determine the appropriate setpoints.

Table 1 - Summary of Negative Sequence Voltages for Open Phase Conditions on Each Transformer Negative Sequence Voltage (L-N rms, at 4200:120 PT Secondaries)

Time = 8secconds Open Phase SWGR1H SWGR 1J SWGR2H SWGR2J Location Min V2 MaxV2 Min V2 MaxV2 Min V2 MaxV2 Min V2 MaxV2 TX-1 1.871V 19.110V 0.297V 0.422V 0.300V 0.848V 1.872V 19.116V TX-2 0.297V 0.420V 0.299V 0.418V 2.398V 18.898V 0.297V 0.420V TX-3 0.275V 0.369V 17.360V 35.023V 0.283V 0.370V 0.278V 0.369V RSST-A 0.285V 0.386V 16.661V 34.788V 0.290V 0.386V 0.287V 0.386V RSST-B 0.226V 0.440V 0.248V 0.424V 13.108V 29.112V 0.226V 0.440V RSST-C 12.318V 26.817V 0.321V 0.455V 0.327V 0.444V 12.365V 26.921V GSU 1 -1 H 0.937V 15.560V 0.300V 1.143V 0.321V 1.106V 0.306V 1.100V GSU 1 -2J 0.343V 1.027V 0.322V 1.151V 0.322V 1.081V 0.966V 15.370V GSU 2-1J 0.328V 1.685V 0.654V 25.691V 0.303V 1.615V 0.329V 1.685V GSU 2-2H 0.326V 1.647V 0.351V 1.514V 0.693V 15.030V 0.322V 1.191 V

Table 1 above shows the following:

Page 16 of 43 For open phase conditions on Transformers TX-1 and TX-2 (Wye Solid Grounded-Delta Transformers) the minimum negative sequence voltage on the impacted emergency buses is insufficient to actuate the BE1-47N relay. The minimum negative sequence voltage is 1.871V (2.7%) for TX-1 and 2.398 (3.46%) for TX-2 and the minimum setting on the BE1-47N relay is 2% on a 69.28V base. These cases shall be detected by the proposed Alstom open phase detection relays on Switchyard Transformers TX-1 and TX-2.

For open phase conditions on Transformers TX-3, RSST A, RSST B, and RSST C (Delta-Wye Transformers) the minimum negative sequence voltage on the impacted emergency buses is above the minimum possible setting for the BE1-47N relay. The minimum observed negative sequence voltage was 12.318V (17.78%), located on Bus 1H for an open phase condition on RSST C.

For open phase conditions on Transformers GSU 1 and GSU 2, the minimum negative sequence voltage is insufficient to actuate the BE1-47N relay. The minimum negative sequence voltage is 0.937V (1.35%) for GSU 1 and 0.654V (0.94%) for GSU 2 and the minimum setting on the BE1-47N relay is 2% on a 69.28V base. Additional evaluation of these conditions was required and is summarized in Section 3.3.2.1.

Considering the uncertainty of the channel, the lowest negative sequence voltage, and the highest security case negative sequence voltage, a setpoint of 4% was selected. A calculation was performed to determine the CSA for the Basler BE1-47N voltage phase sequence relays. The relay and PT inaccuracies and the final relay settings for the negative sequence voltage detection scheme were evaluated.

The maximum uncertainty (i.e., CSA) for the Basler relay at the 4kV emergency buses was calculated to be +/-1.106% of span. With a 4% relay pickup setting, the relay may energize in the range of 2.894% to 5.106% negative sequence voltage.

3.3 DESIGN SOLUTION Two separate OPC systems are required to ensure important to safety components are protected and remain available to perform their design basis functions. These systems are the Class 1 E Basler voltage unbalance relays for protection of the 4kV emergency buses, and a non-Class 1 E Alstrom Open Phase Detection (OPD) System for OPC protection at switchyard transformers TX-1 and TX-2.

3.3.1 Class 1 E Design Solution The new North Anna voltage unbalance protection system design is similar to the UV/DV protection scheme. The new protection system will measure a voltage unbalance using negative sequence voltage with twelve Basler BE1-47N negative sequence relays arranged such that three relays are connected to the secondary side of each of the Emergency Bus (1 H, 1 J, 2H, and 2J) PTs. The new protective Page 17 of 43 relays will be installed on a new set of protection/control fuses, parallel to the bus protection and metering circuits.

The Basler BE1-47N relays are negative sequence relays designed to protect the equipment from damage caused by phase failure, reverse phase sequence, phase unbalance, undervoltage, or overvoltage. The BE1-47N relays utilize the negative sequence voltage protection only since there is currently undervoltage and overvoltage protection already installed on the emergency buses. Similar to the configuration of the existing degraded -and undervoltage protection, the voltage unbalance protection will require two-out-of-three relays to detect a condition in order to trip an emergency bus.

The Basler BE1-47N negative sequence relays contain an internal timer. In order to ensure the BE1-47N relay picks up and trips the bus before the motor overcurrent protection picks up, an inverse time is desired. Therefore, the BE1-47N relays will be procured with an inverse time characteristic.

Because the BE1-47N relays are capable of multiple protective functions (negative sequence, overvoltage, and undervoltage), the output contacts for the negative sequence function are limited to only two. Additional contacts are required for the two-out-of-three scheme. Therefore, a Cutler Hammer ARD relay is being installed downstream of the main output contact as a multiplier relay for each BE1-47N relay.

The output of each multiplier relay is configured into the required two-out-of-three logic. A final ARD relay will be installed downstream of the new two-out-of-three logic to ultimately energize the existing Undervoltage/Degraded Voltage circuit. The Undervoltage/Degraded Voltage circuit trips the bus feeder breakers and automatically starts and loads the EOG. This relay will also send a signal to an existing spare annunciator window for a voltage unbalance trip.

A feature that blocks actuation of the voltage unbalance (open phase) protection function is also included in the logic scheme. This feature enhances the reliability of the protection system and prevents the protection scheme from automatically starting and loading an EOG in the event of a failed fuse on a PT or failed PT. To achieve this feature, one ASEA Brown Boveri (ABB) 60 relay will be installed per bus in the new voltage unbalance circuit.

The ABB-60 balance relay is a differential voltage monitoring relay. It receives two different voltage source inputs and compares them to each other. When the voltage of one input changes with respect to the other beyond the setpoint, the relay will energize, and only its set of contacts will change state.

A Cutler Hammer ARD relay will be installed downstream of the ABB-60 relay. One output from the ARD relay will be used to block the negative sequence two-out-of-three circuits from energizing. This relay will also send a signal to an existing spare annunciator window to indicate a 4KV PT fuse is blown.

Page 18 of 43 As previously discussed, the new PT Blown Fuse Alarm will be used to indicate when there is a blown fuse upstream of the BE1-47N relays. In order to ease troubleshooting for the location of the blown fuse, the one-out-of-three output from the degraded voltage relays will be used to send a signal to the new PT Fuse Blown Alarm via a new ARD relay.

Test switches will be installed for flexibility during testing, maintenance and troubleshooting. The test switches are ABB "Flexitest" models that are Class 1 E and rated for up to 30 amps at 600 volts: One blade from one of the new test switches will be used as a means to block the new voltage unbalance scheme from inadvertently isolating the Emergency Bus during online functional testing.

• The ARD relays are used as multiplier relays since the BE1-47N and ABB-60 relays do not come with enough contacts. The inductive rating of the ARD relays is greater than its control power therefore, the ARD relays are acceptable for this application.

The BE1-47N and ABB-60 relays pickup an ARD relay. Since the inductive contact rating of the BE1-47N and ABB-60 relays is greater than the rated control power of the ARD relay, the BE1-47N and ABB-60 relays are acceptable for the application.

The last ARD relays are used to bring in an annunciator in the Control Room and pickup the undervoltage multiplier relays. The undervoltage multiplier relays are GE series HFA relays rated for 7.5W at 125VDC. Since the inductive rating of the ARD output is greater than the rating of the HFA relays, the ARD relays are acceptable for this application.

Page 19 of 43 See table below for new relay channel characteristics Characteristic BE1-47N ABB-60 ARD Voltage Sensing Input, Nominal 120VAC Voltage Sensing 160% of Nominal Input, Maximum 160VAC Continuous (192VAC)

Rated Control Voltage 125VDC 125VDC 125VDC Rated Control 65% - 100% of Voltage Range 24 -1so voe 100-140 voe Nominal (81.25-137.SVDC)

Rated Control Power 4.6W 5W 14W Output Contact 1 - Form A (NO)

Line A: 1 - Form C Interchangeable Configuration 1 - Form B (NC)

Line B: 1 - Form C Contact Rating, Continuous 3A 5A 5A Contract Rating, Tripping 30A 30A Contact Rating, Inductive 0.3A 0.3A PT Burden

~2VA 0.2VA at 1.0pf Relay Type See Below Solid State The degraded and undervoltage circuits have remote indication on the Control Room Diesel Control Cabinet and EOG Room Isolation Cabinet which indicates control power is available to the degraded and undervoltage circuits. The existing circuits use white lights for providing control power availability. The new voltage unbalance protection will also have remote indication of control power availability in the manner as the existing degraded and undervoltage circuits.

Page 20 of 43 In addition to the white lights in the Control Room and EOG Room, control power availability is also indicated by existing annunciator alarm 1 K-F4, LOSS CONT PWR SFGDS UV CKTS. In the existing undervoltage circuits, an alarm relay is kept normally energized. When control power is lost, the alarm relay de-energizes and brings in the alarm. A new alarm relay will be installed in the voltage unbalance control circuit. The output of the new alarm relay will be tied into the logic for alarm 1 K-F4 so loss of control power is known in a timely manner.

3.3.2 Existing Plant Protection and Unique Operating Conditions 3.3.2.1 GSU Transformer Operating Conditions With the generator online, an OPC on the high voltage side of a GSU transformer results in a voltage unbalance at the switchyard bus, which can be seen at the 4kV emergency buses fed from the RSSTs. The generators have negative sequence current protection and impedance relay schemes which would operate and mitigate single and double OPCs on the high voltage side of a GSU transformer to trip the generator and clear the unbalance.

For single ungrounded open phase events on the high side of

. transformers GSU 1 and GSU 2 there is insufficient negative sequence voltage to actuate the BE1-47N relays. However the negative sequence voltage is greater than 1 % when the open phase event is coincident with a pre-existing 3% switchyard unbalance. The most limiting accident and non-accident cases are discussed below:

The highest non-transient negative sequence voltage for an ungrounded open phase at GSU 1 or GSU 2 for a non-accident condition occurs with 3% Switchyard Unbalance which results in a negative sequence voltage of 2.323V at the 4200V:120V PT secondary. This converts to a 3.353%

voltage unbalance.

According to NEMA MG-1, a voltage unbalance motor de-rating factor at 3.353% voltage unbalance is approximately 86.88% for motors with 1.0 service factor and 99.91 % for motors with a 1.15 service factor.

The highest non-transient negative sequence voltage for an accident condition (i.e. on the accident unit) for an ungrounded open phase at GSU 1 or GSU 2 occurs with 3% Switchyard Unbalance cases, which results in a negative sequence voltage of 2.020V at the 4200V:120V PT secondary.

This converts to 2.916% voltage unbalance.*

According to NEMA MG-1, a voltage unbalance motor de-rating factor at 2.916% voltage unbalance is approximately 89.5% for motors with 1.0 service factor and 102.93% for motors with a 1.15 service factor.

Page 21 of 43 A comparison of the motor loading brake horsepower to the NEMA MG-1 de-rating factor identified that the AFW Pumps prior to throttling (111 %

BHP, SF 1.15) and the ISRS Pumps (98.33% BHP, SF 1.0) are loaded above the NEMA MG-1 de-rating factor during accident conditions. The open phase event would introduce additional motor heating which may damage these motors if they are operated continuously at these conditions. The results show that during the open phase event the Auxiliary Feedwater Pumps draw approximately 0.139 pu negative sequence current. This will lead the Auxiliary Feedwater Pump to reach 20pu in approximately 17 minutes, 11 seconds.

The Inside Recirculation Spray Pumps are not considered since they start approximately 15 minutes after the accident signal.

These are conservative estimates as they do not account for cooling. The 12

• t limit of 20 pu would allow for an immediate re-start of the pump on the diesel generator.

The results also show that the phase currents drawn by the Auxiliary Feedwater Pump Motors in steady-state are less than the 740A pickup setting of their associated Overcurrent Relays. Therefore an overcurrent protection trip is not expected for this case or cases that result in a lower negative sequence voltage at the bus. These cases could result in motor thermal damage after several minutes of operation, which could degrade the expected life of the motor; therefore additional analysis is required.

An evaluation of Auxiliary Feedwater and Inside Recirculation Spray Pump Motor thermal margin during unbalanced conditions was performed. The results of this evaluation determined that the AFW pump motor will be capable of performing their design function with a concurrent negative sequence voltage of 3.176V (4.6% unbalance) at the secondary of the 4200: 120V potential transformer. Under the same voltage unbalance condition, the ISRS motors will have a service life of greater than 30 days during a design basis event occurring at the 60 year operating point.

As the negative sequence voltage used in this evaluation bounds the most limiting negative sequence voltage seen by transformers GSU 1 and GSU 2 that do not actuate the BE1-47N relays and/or existing Undervoltage relays, no additional protection is needed for these cases.

3.3.2.2 EOG Test Configuration For an EOG test concurrent with a single ungrounded OPC, the diesel test could mask the OPC by balancing the voltage at the 4kV buses.

Consequently, the negative sequence voltage relays would not mitigate the voltage unbalance during a parallel EOG test. However, the OPC would only affect one 4kV emergency bus per unit since the off-site power Page 22 of 43 sources are independent of one another. If an accident were to occur during EOG testing, the alternate 4kV emergency bus would be available to mitigate the accident. When the EOG is taken offline after completion of testing, the voltage unbalance at the 4kV emergency bus would increase above the 4% pickup setting and initiate protection of the bus.

During non-accident conditions, the operating safety related motors have a BHP of less than or equal to nameplate horsepower. Therefore, the motors would be capable of operating continuously for an OPC during non-accident conditions. This conclusion is based on the negative sequence voltage unbalance expected at the bus, the corresponding NEMA MG-1 de-rating factor, motor service factor, and nameplate horsepower.

3.3.3 Non-Class 1 E Design Solution For Switchyard Transformers TX-1 and TX-2, there are OPCs that result in a minimum negative sequence voltage on the impacted emergency buses that is insufficient to actuate the BE1-47N relays. These cases shall be detected by the proposed Alstom open phase detection relays on Switchyard Transformers TX-1 and TX-2.

3.4 FAILURE MODES AND EFFECTS ANALYSIS The purpose of the Failure Modes and Effects Analysis is to identify potential voltage unbalance protection function failure modes and evaluate their impact on the design to preclude subsequent operational concerns.

The failure mechanisms for relays are very specific. The new Basler BE1-47N relays will be energized from the DC source. If the power source to the new relays is removed, the relay contacts will not change state when there is a voltage unbalance condition, in which case the voltage unbalance two-out-of-three logic scheme would fail to start the EOG. However, there is an annunciator (1 K-4F, LOSS CONT PWR SFGDS UV CKTS) that notifies the Control Room if voltage is not available on degraded/undervoltage circuits. An auxiliary relay will be installed in the new circuit which will be tied into the existing alarm and will notify Operations if DC power is not available on the new circuit.

In addition, to the overhead alarm, a white light is being installed on the EOG Control Panel in the Control Room and the Diesel Isolation Panel in the EOG Room which will also give indication that control power is available to the voltage unbalance circuit. In the event one of the three relays fail due to loss of DC power (i.e., a power supply failure), then reliance would be on.the other two functional relays to make up the two-out-of-three logic scheme. This failure is no different than the degraded or undervoltage relay failure scenario; and is similar to what happens in the existing design with the time delay of the degraded and undervoltage relays.

The new Basler BE1-47N relays will be continuously de-energized and change state when the voltage unbalance (negative sequence) is equal or greater than the minimum Page 23 of 43 pickup setting for a set amount of time. In the event of a true voltage unbalance condition, a minimum of two-out-of-three relays will be required to energize and time out, then bring in the EOG start signal. An annunciator is being installed in the Control Room if the voltage unbalance scheme actuates. The use of the two-out-of-three logic scheme is used throughout the emergency buses due to the added assurance. One indicating light per relay will be installed on the front of the new panel. In the event of actuation from a signal (true or inadvertent), the new indicating lights will go out and the target light on the front of each relay will be lit. If both the indicating light and the relay target lights are out (and the power status lights on the front of the relay is on), this will cause a loss of indication only and require replacement of the light bulb.

The new protection scheme will be installed downstream of new fuses on both AC and DC circuits. Fuses can fail open or fail shorted (fails to blow). A failure mode of a fuse to fail open is the desired outcome since it protects the components and ensures the upstream breaker, which provides control power to the Emergency Switchgear, does not open. In the event a fuse fails to open, there is a potential for the upstream breaker to open instead, which is not a desired effect, but unavoidable. However, there is an annunciator (LOSS CONT PWR SFGDS UV CKTS) that notifies the Control Room if voltage is not available on the DC side for the existing components. The new control circuit will be tied into the existing annunciator. This will also be apparent by the indicating lights on the front of the relay being out as well as the indicating lights of the Control Room Diesel Control Cabinet and the EOG Room Isolation Panel.

On the AC sensing side, there is a single set of fuses on the primary side of the PTs.

There will also be a new set of fuses on the secondary side dedicated for the new protection scheme (there i~ already a set of fuses for the UV/DV and metering circuits).

If any of these fuses blow, there will be enough negative sequence generated to inadvertently actuate the BE1-47N relays. The primary cause of the blown fuse would be a power supply failure or a faulted cable. Currently, the existing undervoltage and degraded voltage relays remain continuously energized (i.e., picked up), and change state when the voltage drops below the setpoint. In the event of a blown fuse (either primary or secondary side of the PTs) or a failed PT, only one of the undervoltage and one phase in the degraded voltage relays drop out, but the two-out-of-three logic required to isolate the bus and start the EOG is not present. In the new scheme, a primary side fuse failure (or upstream secondary) will cause all three BE1-47N relays to pick up, time out, isolate the bus and start the EOG. This outcome is significantly different than the existing UV/DV protection scheme. In order to ensure a fuse failure does not lead to actuating of the BE1-47N relays on a false signal, an ABB-60 (voltage balance relay) will be installed on the 4kV and 480V PTs. In the event of a blown PT fuse or a failed PT, an annunciator (4KV PT FUSE BLOWN) will alarm in the Control Room. As part of the new alarm, an auxiliary alarm relay will be installed downstream of the contacts from the degraded voltage relay, which will tie into the alarm. This will support Operations with determining which circuit (or both) has the blown fuse.

The ABB-60 relay is being installed to block the new voltage unbalance scheme in the event of a blown fuse or failed PT. Similar to the relay discussion above, the relay power, coil, or contacts can fail. Any one of these failures can prevent blocking of the Page 24 of 43 new voltage unbalance protection scheme. A normally closed output contact is being installed from the ABB-60 relay in order to ensure the new voltage unbalance protection scheme actuates in the event of a true event concurrent with a failed ABB-60 relay.

Periodic testing will to identify a failed ABB-60 relay.

The BE1-47N relays can also inadvertently pick up due to a fault upstream of the emergency bus. Even though there is overcurrent protection which will clear the fault, the BE1-47N relays may isolate the bus before the overcurrent protection trips the feeder breaker. This is acceptable since the outcome would be the same in both scenarios. Additionally, if the BE1-47N relay isolates the bus before the breaker trips on an overcurrent condition, the fault will still clear since the overcurrent relays will still see the fault. In the event of a fault during a paralleled EOG run, the new voltage unbalance relays will pick up. However, the time delay of the existing directional overcurrent protection will pick up and trip the bus feeder breaker before the BE1-47N relay will pick up and time out.

The BE1-47N relays can also fail to output on a true voltage unbalance signal. On an electrical failure, the relay will fail in the shelf (non-trip) state. For this reason, three voltage unbalance relays are being installed in a two-out-of-three scheme downstream of the bus PTs on each emergency bus, which provides a high level of assurance the circuit will operate on a voltage unbalance condition whether or not a relay failure has occurred.

In the event two relays fail to output on a true voltage unbalance signal, then the scheme will not operate and motors will either fail to continue running (i.e., overheat and trip due to overcurrent) or fail to start. This is no different than the existing configuration, which does not have this protection. Voltage unbalance protection is being installed on the H and J emergency buses. Therefore, a failure of one train is acceptable since there is a redundant train which is fully capable of maintaining safe shutdown capability.

Periodic tests will identify a potential failure of a relay.

Cutler Hammer ARD auxiliary relays are being installed downstream of the output contacts from the protective relays. ARD auxiliary relays are being installed downstream as an interlock of the two-out-of-three scheme, which will energize the 27NX-relay. The 27NX-relay is a GE HFA relay. The Cutler Hammer style ARD and GE style HFA relays power, coils, or contacts can fail. Any one of these failures can prevent the voltage unbalance scheme (or undervoltage in the case of the HFA). This is no different than the Agastat time delay failure mechanisms in the degraded voltage scheme or the failure of the internal timer in the ABB-27N relays.

The transient voltage surge suppressor diode can fail in one of three modes. These are shorts, opens, and degraded devices. A short will result in a blown control circuit fuse and a failure of the voltage unbalance protection circuit. The existing UV/DV circuit has auxiliary relays which do not have transient voltage surge suppressors. Therefore, an opened or degraded transient voltage surge suppressor will have the same effect as the existing auxiliary relay that does not have transient voltage surge suppression.

Page 25 of 43 New test switches are being installed to provide a convenient method of negative sequence and testing voltage balance relays as well as provide isolation of the relays for troubleshooting and/or replacement. These switches are manually operated. Once placed in the closed position, they act as current carrying components only. The failure mechanism is passive, similar to a cable in a circuit. Manual test switches are used throughout the industry as well as the station. There are very few incidents of failure.

However, there are two ways a test switch can fail. The test switch blades can be physically broken preventing closure, or the human element of not positioning the switch correctly will cause an open circuit. In the AC sensing circuit, an open circuit will cause inadvertent operation of a single negative sequence relay. In the DC control circuit, an open circuit will prevent the operation of the two-out-of-three scheme from energizing the final negative sequence multiplier auxiliary relay or energize 74 percent loss of voltage circuitry. However, a failure of his type is not likely since the cover of the test switches contains a divider, which ensures the test position cannot be changed without human interaction.

4.1 BACKGROUND

NRC Bulletin 2012 At Byron Nuclear Power Station (BNPS), both off-site and onsite electric systems were not able to perform their intended safety functions due to the OPC design vulnerability. Manual actions were necessary to restore ESF functions.

Following the OPC events at BNPS in 2012, the NRC issued Bulletin 2012-01, "Design Vulnerability in Electric Power Systems" (Reference 7.1). NRC Bulletin (NRCB) 2012-01 requested information regarding the facilitie$' electric power system design in light of the OPC events that involved the loss of one of the three phases of the off-site power circuits at BNPS Unit 2. The bulletin required licensees to "comprehensively verify their compliance with the regulatory requirements of General Design Criterion (GDC) 17, 'Electric Power Systems,' in Appendix A, General Design Criteria for Nuclear Power Plants, to 10 CFR Part 50 or the applicable principal design criteria in the updated final safety analysis report; and the design criteria for protection systems under 1 O CFR 50.55a(h)(2) and 10 CFR 50.55a(h)(3)."

In accordance with the North Anna licensing basis and consistent with GDC 17, existing protective circuitry will separate the ESF buses from a connected failed source due to a loss of voltage or a sustained, degraded grid voltage. However, while the existing protective devices are sufficiently sensitive to detect design basis conditions such as loss of voltage or degraded voltage, they were not designed to detect consequential single or double voltage unbalance conditions.

NEI Industry Initiative on Open Phase Condition - By letters dated October 9, 2013 and March 16, 2015 (References 7.3 and 7.4), NEI notified the NRC that the industry's CNOs had approved a formal. initiative to address OPCs, and that the initiative represented a formal commitment among nuclear power plant licensees to address the OPC design vulnerability for operating reactors. An OPC is defined by the initiative as an open phase, with or without a ground, which is located on the high voltage side of a Page 26 of 43 transformer connecting a GDC 17 off-site power circuit to the transmission system. The initiative provides the following criteria for dealing with an adverse OPC:

Detection, Alarms, and General Criteria, Actuation Circuits, and Protective Actions.

Table 1 provides a comparison of the North Anna negative sequence voltage (open phase) protection function design to the NEI industry initiative criteria.

The March 16, 2015 NEI letter specified December 31, 2018 as the completion date for implementation of the actions required to resolve the OPC design vulnerability. As noted in the initiative, this date assumed license amendments are not required to install any design changes. This is not the case for North Anna as a Class 1 E modification is being installed, with the commensurate need for additional TS requirements. In addition, in North Anna's response to the NRC request for additional information (RAI) associated with NRCB 2012-01 (Reference 7.2), Dominion stated that the NEI initiative completion date could not be met for the OPC modifications at North Anna and instead specified completion dates of the end of the fall 2019 refueling outage for North Anna Unit 1 and the end of the fall 2020 refueling outage for North Anna Unit 2.

4.2 APPLICABLE REGULATORY REQUIREMENTS/CRITERIA 4.2.1 Comparison to 10 CFR 50.36 Criteria for TS Inclusion The need to include the proposed negative sequence voltage (open phase) protection function operability and surveillance requirements into the North Anna TS was evaluated against the 10 CFR p0.36(c) criteria, and it was it was determined to meet Criterion 3 of 10 CFR 50.36(c)(2)(ii) as discussed below.

Criterion 3 states:

A structure, system, or component that is part of the primary success path and which functions or actuates to mitigate a design basis accident or transient that either assumes the failure of or presents a challenge to the integrity of a fission product barrier.

The operability of the station electric power sources is part of the primary success path for mitigating an accident assuming a loss of all onsite AC power sources (e.g.,

loss of all EDGs). An operable off-site power circuit must be capable of maintaining rated frequency and voltage while connected to the Engineered Safety Feature (ESF) buses and accepting required loads during an accident. Similar to the loss of voltage and degraded voltage protective circuitry, the voltage unbalance (open phase) protection circuitry is integral to the operability of the off-site power system and ensuring that it is capable of performing its design function of powering the 4kV ESF buses.

Page 27 of 43 Therefore, the North Anna voltage unbalance (open phase) protection circuitry satisfies Criterion 3 for inclusion in the TS.

4.2.2 General Design Criteria The regulations in Appendix A to Title 10 of the Code of Federal Regulations (10 CFR) Part 50 establish minimum principal design criteria for water-cooled nuclear power plants, while 10 CFR 50 Appendix B and the licensee quality assurance programs establish quality assurance requirements for the design, manufacture, construction, and operation of structures, systems, and components. The current regulatory requirement of 10 CFR 50, Appendix A, applicable to the proposed change is GDC 17 (Electric Power Systems).

GDC 17 requires that all current operating plants have at least two operable circuits between the off-site transmission network and the onsite Class 1 E (safety related)

AC electrical power distribution system. In addition, the surveillance requirements require licensees to verify correct breaker alignment and indicated power availability for each required off-site circuit. Consistent with the current North Anna licensing basis and GDC 17 requirements, existing protective circuitry will separate the ESF buses from a connected failed source due to a loss of voltage or a sustained, balanced degraded grid voltage. To address the potential for a consequential OPC to exist on an off-site power source, a voltage unbalance (open phase) protection function is being installed at North Anna, and associated TS are being implemented as described in Section 2.4.

The purpose of the voltage unbalance (open phase) protection function is to mitigate the potential vulnerability of an OPC on a GDC 17 off-site power source. This is achieved with the implementation of the voltage unbalance (open phase) protection function, which addresses OPCs on the high voltage side of the RSSTs, GSU transformers, and switchyard transformers. The voltage unbalance (open phase) protection-circuitry is a Class 1 E design, and the two-out-of-three logic open phase protection scheme ensures a single failure in the equipment installed will not prevent the Electric Power (EP) system from independently supplying the electric power required for operation of safety* related systems. The capacity, capability, and redundancy of the EP system are not changed by the implementation of the negative sequence voltage (open phase) protection function; therefore, the station's ability to meet the requirements of GDC 17 is maintained and enhanced.

4.2.3 10 CFR 50.55a(h)(2) Protection Systems 10 CFR 50.55a(h)(2) requires nuclear power plants with construction permits issued after January 1, 1971, but before May 13, 1999, to have protection systems that meet the requirements stated in either Institute of Electrical and Electronics Engineers (IEEE) Standard 279, "Criteria for Protection Systems for Nuclear Power Generating Stations," or IEEE Standard 603-1991, "Criteria for Safety Systems for Nuclear Power Generating Stations," and the correction sheet dated January 30, 1995. For nuclear power plants with construction permits issued before January 1, Page 28 of 43 1971, protection systems must be consistent with their licensing basis or meet the requirements of IEEE Standard 603-1991 and the correction sheet dated January 30, 1995. The construction permits for North Anna Units 1 and 2 were issued after January 1, 1971; consequently, the protection systems must meet the requirements of IEEE 279 or IEEE 603-1991 and the correction sheet dated January 30, 1995.

4.2.4 NRC Generic Letter 79-36 In accordance with the NRC Generic Letter 79-36 dated August 8, 1979, "Adequacy of Station Electrical Distribution System Voltages" (Reference 7.6) analyses were performed to determine the adequacy of the North Anna electrical distribution system. The review consisted of:

1. Determining analytically the capacity and capability of the off-site power system and onsite distribution system to automatically start and operate the required loads within their required voltage ratings in the event.of: (1) an anticipated transient or (2) an accident (such as a LOCA) without manual shedding of any electric loads.

2. Determining if there are any events or conditions that could result in the simultaneous or consequential loss of both required circuits from the off-site network to the onsite electrical distribution system and thus violate the requirement of GDC 17.

The NRC determined that the North Anna off-site power system and the onsite distribution system are capable of providing acceptable voltages for worst case station electric load and grid voltages (References 7.7 and 7.8). The criteria the NRC used in performing their technical evaluation of the analysis included GDC 5, Sharing of Structures, Systems, and Components, GDC 13, Instrumentation and Control, and GDC 17, Electric Power System of Appendix A to 10 CFR 50, IEEE Standard 308-1974, ANSI C84.1-1977, and the staff positions and guidelines included in Generic Letter 79-36.

4.2.5 NRC Branch Technical Position (BTP) 8-9 Open Phase Conditions in Electric Power System As noted above, since no regulatory requirements or guidance documents describing the treatment of an OPC previously existed, the NRC issued BTP 8-9 in July 2015 (Reference 7.9) to provide NRC reviewer guidance for evaluating the adequacy of a licensee's design for addressing the potential for an OPC in their off-site electric power system. North Anna used the BTP as guidance during the development of the negative sequence voltage (open phase) protection circuitry.

Table 1 compares the North Anna design to the BTP criteria.

4.3 NO SIGNIFICANT HAZARDS CONSIDERATION ANALYSIS Page 29 of 43 Virginia Electric and Power Company (Dominion Energy Virginia) proposes a change to the North Anna Units 1 and 2 Technical Specifications (TS) pursuant to 1 O CFR 50.90. The proposed change adds operability requirements, required actions, and surveillance requirements for the voltage unbalance (open phase) protection function associated with the 4kV emergency buses. The voltage unbalance (open phase) protection function provides detection and isolation of one or two open phases (i.e., an open phase condition) on a TS required off-site primary (preferred) power source and initiates transfer to the onsite emergency power source (i.e., the emergency diesel generators (EDGs)).

In accordance with the criteria set forth in 10 CFR 50.92, Dominion Energy Virginia has performed an analysis of the proposed TS change and concluded that it does not represent a significant hazards consideration. The following discussion is provided in support of this conclusion:

1. Does the change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed change adds operability requirements, required actions, and surveillance requirements for the voltage unbalance (open phase) protection function associated with the 4kV emergency buses. This system provides an additional level of undervoltage protection for Class 1 E electrical equipment. The proposed change will promote reliability of the voltage unbalance (open phase) protection circuitry in the performance of its design function of detecting and mitigating a voltage unbalance condition on a required off-site primary power source and initiating transfer to the onsite emergency power source.

The new voltage unbalance (open phase) protection function will further ensure the normally operating Class 1 E motors/equipment, which are powered from the Class 1 E buses, are appropriately isolated from a primary off-site power source experiencing a consequential voltage unbalance and will not be damaged. The addition of the voltage unbalance (open phase) protection function will continue to allow the existing undervoltage protection circuitry to function as originally designed (i.e., degraded and loss of voltage protection will remain in place and be unaffected by this change). The proposed change does not affect the probability of any accident resulting in a loss of voltage or degraded voltage condition on the Class 1 E electrical buses and will enhance station response to mitigating the consequences of accidents previously evaluated as this change further ensures continued operation of Class 1 E equipment throughout accident scenarios.

Specific models and analyses were performed and demonstrated that the proposed voltage unbalance (open phase) protection function, with the specified operability requirements, required actions, and surveillance requirements, will ensure the Class Page 30 of 43 1 E system will be isolated from the off-site power source should a consequential voltage unbalance condition occur. The Class 1 E motors will be subsequently sequenced back onto the Class 1 E buses powered by the EDGs and will therefore not be damaged in the event of a consequential voltage unbalance under both accident and non-accident conditions. Therefore, the Class 1 E loads will be available to perform their design basis functions should a loss of coolant accident (LOCA) occur concurrent with a loss of offsite power (LOOP) following a voltage unbalance condition. The loading sequence (i.e., timing) of Class 1 E equipment back onto the ESF bus, powered by the EOG, is within the existing degraded voltage time delay.

The addition of the new voltage unbalance (open phase) protection function will have no impact on accident initiators or precursors and does not alter the accident analysis assumptions.

Based on the above, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed change does not alter the requirements for the availability of the 4kV emergency buses during accident conditions. The proposed change does not alter assumptions made in the safety analysis and is consistent with those assumptions.

The addition of the voltage unbalance (open phase) protection function TS enhances the ability of plant operators to identify and respond to a voltage unbalance condition in an off-site, primary power source, thereby ensuring the station electric distribution system will perform its intended safety function as designed. The proposed TS change will promote voltage unbalance (open phase) protection function performance reliability in a manner similar to the existing loss of voltage and degraded voltage protective circuitry.

The proposed change does not result in the creation of any new accident precursors; does not result in changes to any existing accident scenarios; and does not introduce any operational changes or mechanisms that would create the possibility of a new or different kind of accident. A failure mode and effects review was completed for postulated failure mechanisms of the new voltage unbalance protection function and concluded that the addition of this protection function would not: 1) affect the existing loss of voltage and degraded voltage protection schemes,

2) affect the number of occurrences of degraded voltage conditions that would cause the actuation of the existing Loss of Voltage, Degraded Voltage or negative sequence voltage protection relays, 3) would not affect the failure rate of the existing protection relays, and 4) would not impact the assumptions in any existing accident scenario.

Page 31 of 43 Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does this change involve a significant reduction in a margin of safety?

Response: No.

The proposed change enhances the ability of the plant to identify and isolate a voltage unbalance in an off-site, primary power source and transfer the power source for the 4kV emergency buses to the onsite emergency power system. The proposed change does not affect the dose analysis acceptance criteria, does not result in plant operation in a configuration outside the analyses or design basis, and does not adversely affect systems that respond to safely shutdown the plant and to maintain the plant in a safe shutdown condition.

With the addition of the new voltage unbalance (open phase) protection function, the capability of Class 1 E equipment to perform its safety function will be further assured and the equipment will remain capable of mitigating the consequences of previously analyzed accidents while maintaining the existing margin to safety currently assumed in the accident analyses.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Based on the discussion above, Dominion Energy Virginia concludes that the proposed TS change presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and, accordingly, a determination of "no significant hazards consideration" is justified.

5.0 ENVIRONMENTAL CONSIDERATION

The proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9) as follows:

(i)

The proposed change involves no significant hazards consideration.

As described in Section 4.3 above, the proposed change involves no significant hazards consideration.

(ii)

There are no significant changes in the types or significant increase in the amounts of any effluents that may be released off-site.

The proposed change implements new TS requirements for the voltage unbalance (open phase) protection function and as such does not involve the installation of any new equipment or the modification of any equipment that may affect the types or amounts of effluents that may be released off-site. The proposed change will Page 32 of 43 have no impact on normal plant releases and will not increase the predicted radiological consequences of accidents postulated in the UFSAR. There are no significant changes in the types or significant increase in the amounts of any effluents that may be released off..:site.

(iii) There is no significant increase in individual or cumulative occupation radiation exposure.

The proposed change implements new TS requirements to enhance the ability of the plant to identify and isolate a voltage unbalance condition in an off-site, primary power source and transfer the power source for the 4kV emergency buses to the onsite emergency power system. The proposed TS change does not implement plant physical changes or result in plant operation in a configuration outside the plant safety analyses or design basis. Therefore, there is no significant increase in individual or cumulative occupational radiation exposure associated with the proposed change.

Based on the above, Dominion Energy Virginia concludes that, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

6.0 CONCLUSION

The proposed TS change adds operability requirements, required actions, and SRs for the 4kV emergency bus negative sequence voltage relays in TS 3.3.5. The design function of the Emergency Power System and the station's compliance with GDC 17 are being enhanced by the proposed change as it facilitates the detection of and protection from a voltage unbalance condition on the primary off-site power source. Therefore, Dominion Energy Virginia concludes, based on the considerations discussed herein, that (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

7.0 REFERENCES Page 33 of 43 7.1 NRC Bulletin 2012-01, "Design Vulnerability in Electric Power System," dated July 27, 2012. (ML12074A115) 7.2 Letter from Virginia Electric and Power Company to the NRC, "Response to Request for Additional Information (RAI) Regarding Initial Response to NRC Bulletin 2012-01, Design Vulnerability in Electric Power System," dated February 3, 2014 (Serial No.13-678). (ML14035A458) 7.3 Letter from NEI to NRC, "Industry Initiative on Open Phase Condition," dated October 9, 2013. (ML13333A147) 7.4 Letter from NEI to NRC, "Industry Initiative on Open Phase Condition, Revision 1," dated March 16, 2015 (ML15075A455/6).

7.5 NEMA MG-1-2009, Motors and Generators.

7.6 NRC Generic Letter 79-36, "Adequacy of Station Electrical Distribution Systems Voltages," dated August 8, 1979.

7.7 Letter from NRC to Virginia Electric and Power Company dated January 11, 1983 providing the Safety Evaluation for North Anna Power Station Units 1 and 2 regarding the Adequacy of Station Electric Distribution System Voltages.

7.8 Letter from NRC to Virginia Electric and Power Company dated November 13, 1984 providing the Updated Safety Evaluation for North Anna Units 1 and 2 regarding the Adequacy of Station Electric Distribution System Voltages.

7.9 NRC Standard Review Plan, Rev. 0, "Branch Technical Position (BTP) 8-9",

July 2015.

7.10 Basler Electric Instruction Manual for BE1-47N Voltage Phase Sequence Relay, Publication 9170400990, Revision K.

7.11 Letter from Anthony R. Pietrangelo of NEI to William M. Dean of the NRC dated March 22, 2016, "

Subject:

Industry Position on Open Phase Conditions (OPC) in Electronic Power System which Lead to Loss of Safety Functions of both Off-site and Onsite Power Systems (NRC Bulletin 2012-01)."

rd=

L1f.J Figure 1 i'!:f

---

~,c--------<O--

~

l..!.Ll

"~

~~

___J__

1-£11'-(.*>1*

.,,.,o,-n,

""".. bolo,...-... -

.. oc_.. *.,,._.

t. lNf OIAC"AAM

• Page 34 of 43 a I

lf(TRFt.1 Ol~Jr.ilat,Jll

" f Slf..,

l'\\()Q TH e:;t,,t¢ PC-..['R Sr 4 lT tNfl~ 1 l

An open phase condition must be detected and alarmed in the control room unless it can be shown that the open phase condition does not prevent functioning of important-to-safety structures, systems, and components.

For example, transformers that are oversized for their loading conditions may compensate for the open phase condition. Where such credit is taken, sufficient "robust" calculational bases or tests must be provided to show that the open phase condition will not adversely affect important-to-safety equipment performance.

If it is demonstrated that an open phase condition does not prevent the functioning of important-to-safety structures, systems, and components, then detection of the open phase condition should occur within a reasonably short period of time (e.g.

24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />). How the open phase condition is detected and corrected must be documented.

The open phase condition should be automatically detected and alarmed in the main control room under all operating electrical system configurations and plant loading conditions.

If the plant auxiliaries are supplied from the main generator and the off-site power circuit to the ESF bus is configured as a standby power source, then any failure (i.e., open phase condition) should be alarmed in the main control room for operators to take corrective action within a reasonable time. In such cases, the consequences of not immediately isolating the degraded power source should be evaluated to demonstrate that any subsequent design bases Page 35 of 43 North Anna is installing voltage unbalance (open phase) protection circuitry to enhance the ability of plant operators to identify and respond to an OPC in an off-site, primary power source. Events that produce unbalanced voltages above the protective circuitry relay setpoint will result in annunciator alarms in the Main Control Room and on the Plant Computer System (PCS).

Consequential voltage unbalance events that prevent the functioning of important-to-safety SSCs will be continuously monitored and alarmed by the protection schemes being implemented.

Inconsequential voltage unbalance events not automatically detected are shown through analyses to consist of high impedance-to-ground faults which produce voltage unbalance conditions that can reasonably be expected to be detected by observation of a broken Page 36 of 43 conditions that rely on off-site power bus or insulator. The voltage circuit(s) for safe shutdown do not unbalance conditions are monitored by create plant transients or abnormal the new protection scheme, PCS operating conditions. Also, the voltage unbalance points, and PT remaining power source(s) can be blown fuse alarms.

connected to the ESF buses within the The implementing design changes time assumed in the accident analysis.

document and implement the protection schemes at the 4kV Emergency Buses for voltage unbalance events utilizing Basler BE1-4 7N relays. Automatic emergency bus functions are implemented to protect against voltage unbalance events.

Analyses documents that not all voltage unbalance events can be detected by the Basler BE1-47N relays. Design changes are being implemented to provide a voltage unbalance detection and protection scheme at switchyard TX-1-1 and TX-2 using the Alstom OPD System on each transformer. For voltage unbalances detected on the high side of transformers TX-1 and TX-2, the transformer will be isolated. Existing protection will isolate the emergency buses and start/load the respective emergency diesel generator.

NEI Op~11 Phase lnitiad~e

, NRC,eranch te<::hnicalPositiqn 8-9

• C'

• ~.

C Detection circuits for the open phase condition, which prevents the functioning of important-to-safety structures, systems, and components, must be sensitive enough to identify an open phase condition for credited loading conditions (i.e., high and low loading).

Some transformers have very low or no loading when in standby mode.

Automatic detection may not be possible in this condition; however, automatic detection must happen as soon as loads are transferred to this standby source.

If automatic detection is not possible, shiftly surveillance requirements must be established to look for evidence of an open phase.

If open phase condition actuation circuits are required, the design should minimize misoperation or spurious The detection circuits should be sensitive enough to identify open phase conditions under all operating electrical system configurations and plant loading conditions for which the off-site power supplies are required to be operable in accordance with plant technical specifications {TSs) for safe shutdown.

The detection circuit should minimize spurious indications for an operable power source in the range of voltage Page 37 of 43 Modeling and analysis calculations determined and validated that the relay schemes, settings, and time delays are of sufficient sensitivity to only identify actual voltage unbalance events.

Automatic protection is available 100%

of the time at the emergency buses, regardless of the power source for the Emergency Buses.

Technical Specification 3.5.5 is being revised. In the event the BE1-47N negative sequence relays or the ABB-60 relay is disabled or unavailable, the applicable LCO will be entered and the protection scheme will be restored in the time allowed.

Three relays per emergency bus are configured in a 2-out-of-3 logic scheme to minimize misoperation or spurious Page 38 of 43

~,t

':~t t.&_

-"=--

0

~,,

-~-*

's-"

'"'/'7,iJX

"\\>,

.::,4C;7_:

-,c,

• ~~c:afaWc11t~*c.~,r.ic~(e*o$iti;~~ g{g

• "* ;' foe~ign D.i~Po$itio~t*:

action that could cause separation from an operable offsite GDC-17 source.

The protective scheme should not separate the operable GDC-17 source in the range of voltage unbalance normally expected in the transmission system.

It must be demonstrated that the additional actuation circuit design does not result in lower overall plant operation reliability.

perturbations such as switching surges, transformer inrush currents, load or generation variations, lightning strikes, etc., normally expected in the transmission system.

Protection scheme design should minimize misoperation, ma/operation, and spurious actuation of an operable off-site power source. Additionally, the protective scheme should not separate the operable off-site power source in the range of voltage perturbations such as switching surges, load or generation variations, etc., normally expected in the transmission system.

action of separation from operable off-site GDC-17 sources. Failure of a single relay makes the system operate in 2-out-of-2 logic for protection.

Modeling and analysis were used to determine and validate that relay setpoints are not within the range of normal voltage unbalances expected in the transmission system.

Plant operation reliability is maintained with safety-related equipment installed in a manner consistent with existing safety-related voltage protection schemes (i.e., the new protection scheme is being installed in parallel to the existing undervoltage and degraded voltage relays) which does not result in a lower plant operation reliability. Non-voltage unbalance event cases, such as unbalanced faults on the auxilia s stem and lar e Page 39 of 43 TABL~.1{:-DESIGN*:coMPLIAN~~ WITH THE:.NEI OPEN '.~H.ASE INITIA"FIVE ANP*.~RC BTP 8-~}3U1DANCE'.::,...

f

.*);*

NEH:~p~n phaseJ"r~tative

,:;; '. _NRC Br~n~h TechniC,~.1 ~:Qsition _8~:!t

.. ~pesign [)~~,~.~ition Devices must be coordinated with other protective devices in both the transmission system and the plant's electrical system (e.g., fault protection, overcurrent, etc.).

Detection and actuation circuits may be non-Class-1 E. While it is recognized that a Class-1 E solution is preferable, a non-Class-1 E solution may be more effective. A non-Class-1 E solution will enable timely implementation and will provide Protection scheme should comply with applicable requirements including single failure criteria for ESF systems as specified in 10 CFR Part 50, Appendix A, GDC17, and 10 CFR

50. 55a(h)(2) or 10 CFR 50. 55a(h)(3),

which require compliance with IEEE motor starts under various loading conditions, were used with various transmission system unbalances to demonstrate the protection algorithm's security.

Additionally, the new protection scheme will be installed during an 18-month monitoring period where the relays will be connected to the station's PTs and control power; however, the trip signal will be blocked. This will ensure the protection scheme does not inadvertently actuate during normal plant evolutions.

Modeling and analysis were used to coordinate the relay setpoints with existing station protective relaying.

The solution implemented by this Design Change is Safety-Related and complies with applicable requirements for single failure criteria for ESF systems, and does not replace any existing Class 1 E circuits.

Page 40 of 43

• J~E{L1z;li~oe~£f~.:cd~iltA.N~j~1Tµ;f~E N~L~~~r~)~,~s

, 1A r1~:~l~NP}&~c ~::;

{g G.f nJANJit~,

. *Y:~li~ijtC>[f~:Pt,~j:**,n,tia"ti+~i

,\\fNRg\\[i~n~h*:f~~hhi,~~);6si~I,8~:;~Cg:.

c:j[)e~ig6:"l)ls~~~,,~~.,*

reasonable levels of reliable functionality given the low likelihood of adverse impacts from open phase events. Additionally, there is regulatory precedent in using non-Class-1 E circuits in newly identified nuclear plant vulnerabilities (e.g.,

anticipated transient without scram (A TWS) circuits). New non-Class-1 E circuits will not be allowed to replace existing Class-1 E circuits.

The Updated Final Safety Analysis Report (UFSAR) must be updated to discuss design features and analyses related to the effects of, and protection for, any open phase condition design vulnerability. This update would typically be to chapter 8.

Std 279-1971 "Criteria for Protection Systems for Nuclear Power Generating Stations" or IEEE Std 603-1991, "Standard Criteria for Safety Systems for Nuclear Power Generating Stations." RG 1. 153, "Criteria for Power, Instrumentation, and Control Portions of Safety Systems," provides additional guidance on this topic.

If protective features are provided in a non-Class 1 E system only, a failure of the non-Class 1 E scheme should not preclude the onsite electrical power system from performing its safety function given a single failure in the onsite power system.

A UFSAR change request has been initiated to revise the UFSAR to describe the voltage unbalance analysis and detection/protection scheme implemented by this modification..

With no accident condition signal present, the open phase condition must not adversely affect the function of important to safety structures, systems, and components.

With an accident condition signal present, automatic detection and actuation will transfer loads required to mitigate postulated accidents to an alternate source and ensure that safety functions are preserved, as required by the current licensing The design of the protection features for OPCs should address power quality issues caused by open phase conditions such as unbalanced voltages and currents, sequence voltages and currents, phase angle shifts, and harmonic distortion that could affect redundant ESF buses.

The ESF loads should not be subjected to power quality conditions specified in industry standards such as Institute of Electrical and Electronic Engineers (IEEE) Standard (Std) 308-2001, "Criteria for Class 1 E Power Systems for Nuclear Power Generating Stations," Section 4.5, "Power Quality,"

with respect to the design and operation of electrical systems as indicated in Regulatory Guide (RG)

1. 32 "Criteria for Power Systems for Nuclear Plants."

Page 41 of 43 The voltage unbalance detection/protection scheme being implemented ensures functionality of Safety-Related equipment for initiating consequential voltage unbalance events on the transmission lines from the switchyard to the RSST and GSU transformers and interconnecting onsite auxiliary power circuits.

Modeling and analysis for negative sequence relay setting coordination ensures important to safety SSCs are not adversely affected.

An ABB-60 voltage balance relay is installed in the new voltage unbalance protection in order to ensure the BE1-4 7N relays do not cause the Emergency Bus to be isolated from its preferred source in the event of a false signal.

Voltage unbalance events in steady state and concurrent with a Loss of Coolant Accident (LOCA) were evaluated to develop analytical limits for the protection negative sequence relays. Impact on safety related motors, of block start of emer enc

Actuation times needed to maintain equipment safety functions should be short enough to provide reasonable assurance that accident mitigation functions are maintained.

If off-site power circuit(s) is (are) functionally degraded due to open phase conditions, and safe shutdown capability is not assured, then the ESF buses should be designed to be transferred automatically to the alternate reliable off-site power source or onsite standby power system within the time assumed in the accident analysis and without actuating any protective devices, given a concurrent design basis event.

Page 42 of 43 loads, and of isolating emergency loads from the affected transformer during a LOCA starting sequence and then restarting the emergency loads on the emergency sources were considered.

Time delays have been established by modeling and analysis utilizing coordination with existing protective relaying as well as accident mitigation considerations to ensure accident mitigation functions and capabilities are maintained.

For a voltage unbalance condition detected at the ESF buses, the new voltage unbalance protection logic energizes an existing undervoltage protection auxiliary relay for the associated bus which isolates the Emergency Bus, starts the EOG, and transfers power following the same process as the existing Undervoltage /

Degraded Voltage protection scheme.

/NEI Op~,n*Phase lnitiatiye

> -,,Jj° "> >'

-~1-Periodic tests, calibrations, setpoint verifications or inspections (as applicable) must be established for any new protective features. The surveillance requirements must be added to the plant Technical Specifications if necessary to meet the provisions of 1 OCFR50. 36.

The unbalanced voltage/current conditions for ESF components expected during various operating and loading conditions should not exceed motor manufacturer's recommendations. The International Electrotechnical Commission (/EC)

Standard /EC 60034-26, National Electrical Manufacturers Association (NEMA) Standard (MG 1) Parts 14.36 and 20.24, and IEEE Std C37.96-2012 (Guide for AC Motor Protection),

Section 5. 7.2.6, "Unbalanced Protection and Phase Failures," may be used for general guidance.

Technical Specification Surveillance Requirements and Limiting Conditions of Operation for equipment used for mitigation of open phase conditions should be identified and implemented consistent with the operability requirements specified in the plant TSs and in accordance with 10 CFR 50.36(c)(2) and 10 CFR 50.36(c)(3).

RG 1. 93 Availability of Electric Power Sources," provides additional guidance on this topic.

Page 43 of 43

..,Design Dispo~1t.ion NEMA Standard MG 1 was used as guidance for the calculations performed in support of the voltage unbalance detection and protection design change.

Technical Specification 3.3.5 is revised to add voltage unbalance relays as part of the loss of power Emergency Diesel start. The basis for Technical Specification 3.3.5 is being revised to document the BE1-47N negative sequence relay setpoint. TRM tables 4.5-1 and 4.9-1 are also being revised to document the BE1-47N relay setpoint.

Serial No.18-072 Docket Nos. 50-338/339 MARKED-UP TECHNICAL SPECIFICATIONS PAGES Virginia Electric and Power Company (Dominion Energy Virginia)

North Anna Units 1 and 2

LOP EOG Start Instrumentation 3.3.5 3.3 INSTRUMENTATION 3.3.5 Loss of Power (LOP) Emergency Diesel Generator (EOG) Start Instrumentation Three channels per bus of the loss of voltage Function and~~

three channels per bus of the degraded voltage Function\\'"'ft>~

the following 4160 VAC buses shall be 10PERABLE:

The Train Hand Train J buses; and

b. One bus on the other unit for each required shared component.

APPLICABILITY:

MODES 1, 2, 3, and 4,.

\\olhen associated EOG is required to be OPERABLE by LCO 3.8.2, "AC Sources-Shutdown."

ACTIONS

- - - - - - - - - - - - - - -. NOTE - - - - - - - - - - - - - - - -

Separate Condition entry is allo\\'1ed for each Function.

CONDITION REQUIRED ACTION COMPLETION TIME A.

One or more Functions A. l

---

NOTE---------

with one channel per The inoperable channel bus inoperable.

may be bypassed for up to 12 hour*s for surveillance testing of other channels.

Place channel in trip.

72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />

• • :)el. t.\\,"t-a.....~,.~3 *~ r p$<>71.3 /11 :'.H'"/GC/f)

B.

One or more Functions B.l Restore all but one 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> with b10 or more channel to OPERABLE channels per bus status.

i n*operab le.

North Anna Units 1 and 2 3.3.5-1

---Am@ndmen:ts-***2-31-/2 B.1

---

N OT E ------------------------------------------------------------------

If the negative sequence voltage protection function cannot be performed (e.g. the 4160V to 480V Balance Relay is tripped), the negative sequence voltage protection does not have to be declared inoperable provided verification is performed at least once per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> that an open phase condition does not exist on the primary side of transformer TX-3 and the Reserve Station Service Transformers, as well as the Unit 1/Unit 2 Main Step-up Transformers when power is supplied by the dependable alternate source. The negative sequence voltage protection function shall be restored within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

LOP EOG Start Instrumentation

3. 3. 5 ACTIONS CONDITION REQUIRED ACTION COMPLETION TI ME C.

Required Action and C.l Enter applicable Immediately associated Completion Condition(s) and Time not met.

Required Action(s) for the associated EOG made inoperable by LOP EDG start instrumentation.

SURVEILLANCE REQUIREMENTS SR 3.3.5.1 uv/ov _

S(t s.3.5,;L SR 3.3.5.~3 SURVEILLANCE

---

NOTE-------------

Verification of setpoint is not required.

Perform TADOT for LCO 3.3;5.a and LCO 3.3.5.b:i'Functions.

• • .s,ae,

(!\\ e.,l(+

ea.,1 e_ f., r V\\ c,-\\.1&., V\\A.<IA" l,,.. Uf Perform CHANNEL CA[IBRATION with Allowable Values as follows:

a. Loss of voltage Allowable Values

~ 2935 V and~ 3225 V with a time delay of 2 +/-1 seconds for LCO 3.3.5.a and LCO 3.3.5.b Functions.

b. Degraded voltage Allowable Values

~ 3720 V and~ 3772 V with:

1. A time delay of 7.5 +/-1.5 seconds with a Safety Injection (SI) signal for LCO 3.3.5.a Function; and

2. A time delay of 56 +/-7 seconds without an SI signal for LCO 3.3.5.a and LCO 3.3.5.b Functions.

l..

+i tie,

(_

e... rJ FREQUENCY In accordance with t the Surveillance Frequency Control Program In accordance with l the Surveillance Frequency Control Program

z. J.. iq i,il* O.IAJ. !:_ S.f ob'lt t,,

(.Lo 3,3, 5' a.. o.1/1. A LCO 3,3,S'b t="u~c:~MS North Anna Units 1 and 2 3.3.5-2 Amendments 262/243

LOP EOG Start Instrumentation 3.3.5 SURVEILLANCE REQUIREMENTS SR 3.3.5./

If SURVEILLANCE Verify ESF RESPONSE TIMES are within limit for LCO 3.3.5.a and LCO 3.3.5,b Functions.

Yc:.r-',...._ t,.A.i:)o-r ~r LLD 3.3.?"""ct

()..v\\J.. Ll. o 3. 5. S-b /J e;Jr:;,..tw.e S ei~c.i!..

i)..elo,.y Fw,-.,J; c ~

FREQUENCY In accordance with J the Surveillance Frequency Control Program

-::Z:-V\\.

~C..(J:i r~vtC. e. ~ lf*ln

~

Sc,\\. ll"v e't \\\\01..vac (.

Fr~IM-r'<<./

(..e.,.,._ 4.-o I froi:;ru,.v-

---

JV6Tl::A*:-* --------

Ne.j,,dir1 e,..Se jlM>>\\"e.. II~ l~ e.., 1 s c.C(.lt""- (~ /~

~.s o...

~.a..-c_,e.v~.:\\.~ e o + 11\\.oV'"J-l vtA.. / * \\lo 1-\\-0d e.

North Anna Units 1 and 2 3.3.5-3 Amendments 262/243 Serial No.18-072 Docket Nos. 50-338/339 PROPOSED TECHNICAL SPECIFICATIONS PAGES Virginia Electric and Power Company (Dominion Energy Virginia)

North Anna Units 1 and 2

LOP EOG Start Instrumentation 3.3.5 3.3 INSTRUMENTATION 3.3.5 Loss of Power (LOP) Emergency Diesel Generator (EOG} Start Instrumentation LCO

3. 3'. 5 Three channels per bus of the loss of voltage Function and three channels per bus of the degraded voltage Function, and three channels per bus of the negative sequence Function for the following 4160 VAC buses shall be OPERABLE:

a. The Train Hand Train J buses; and

b. One bus on the other unit for each required shared component.

APPLICABILITY:

MODES 1, 2, 3, and 4, When associated EOG is required to be OPERABLE by LCO 3.8.2, "AC Sources-Shutdown."

ACTIONS

- - - - - - - - - - - - - - - - NOTE - - - - - - - - - - - -

Separate Condition entry is allowed for each Function.

CONDITION A.

One or more A.1 Functions with one channel per bus inoperable.

North Anna Units 1 and 2 REQUIRED ACTION

---

NOTE---------

The inoperable channel may be bypassed for up to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for surveillance testing of other channels.

Place channel in trip.

3.3.5-1 COMPLETION TIME 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Amendments

ACTIONS CONDITION B.

One or more B.1 Functions with two or more channels per bus inoperable.

C.

Required Action and C.1 associated Completion Time not met.

North Anna Units 1 and 2 LOP EOG Start Instrumentation 3.3.5 REQUIRED ACTION COMPLETION TIME

---

NOTE-----------

1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> If the negative sequence voltage protection function cannot be performed (e.g.,

the 4160V to 480V Balance Relay is tripped), the negative sequence voltage protection does not have to be declared inoperable provided verification is performed at least once per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> that an open phase condition does not exist on the primary side of transformer TX-3 and the Reserve Station Service Transformers, as well as the Unit I/Unit 2 Main Step-up Transformers when power is supplied by the dependable alternate source. The negative sequence voltage protection function shall be restored within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

Restore all but one channel to OPERABLE status.

Enter applicable Immediately Condition(s) and Required Action(s) for the associated EOG made inoperable by LOP EOG start instrumentation.

3.3.5-2 Amendments

LOP EDG Start Instrumentation 3.3.5 SURVEILLANCE REQUIREMENTS SR 3.3.5.1 SR 3.3.5.2 SR 3.3.5.3 SURVEILLANCE

---

NOTE----------------

Verification of setpoint is not required.

Perform TADOT for LCO 3.3.5.a and LCO 3.3.5.b UV/DV Functions.

---

NOTE----------------

Verification of setpoint is not required.

Perform TADOT for LCD 3.3.5.a and LCO 3.3.5.b Negative Sequence Relay Functions.

---

NOTE----------------

Negative Sequence Voltage is calculated as a percentage of nominal voltage.

. Perform CHANNEL CALIBRATION with Allowable Values as follows:

a. Loss of voltage Allowable Values

~ 2935 V and~ 3225 V with a time delay of 2 +/-1 seconds for LCO 3.3.5.a and LCO 3.3.5.b Functions.

b. Degraded voltage Allowable Values

~ 3720 V ands 3772 V with:

1. A time delay of 7.5 +/-1.5 seconds with a Safety Injection (SI) signal for LCD 3.3.5.a Function; and

2. A time delay of 56 +/-7 seconds without an SI signal for LCO 3.3.5.a and LCO 3.3.5.b Functions.

c. Negative Sequence Voltage~ 2.894%

ands 5.106% for LCO 3.3.5.a and LCO 3.3.5.b Functions.

North Anna Units 1 and 2 3.3.5-3 FREQUENCY In accordance with the Surveillance Frequency Control Program In accordance with the Surveillance Frequency Control Program In accordance with the Surveillance Frequency Control Program Amendments

LOP EOG Start Instrumentation 3.3.5 SURVEILLANCE REQUIREMENTS SR 3.3.5.4 SURVEILLANCE Verify ESF RESPONSE TIMES are within limit for LCO 3.3.5.a and LCO 3.3.5.b Functions.

North Anna Units 1 and 2 3.3.5-4 FREQUENCY In accordance with the Surveillance Frequency Control Program Amendments Serial No.18-072 Docket Nos. 50-338/339 MARKED-UP TECHNICAL SPECIFICATIONS BASES PAGES (FOR INFORMATION ONLY}

Virginia Electric and Power Company (Dominion Energy Virginia}

North Anna Units 1 and 2

LOP EOG Start Instrumentation B 3.3.5 B 3~3 INSTRUMENTATION B 3.3.5 Loss of Power (LOP) Emergency Diesel Generator (EOG) Start Instrumentation

.BASES N e ""'.\\,'l11 e s *q, I.MJ,V\\t. e '(' e. \\lit~ s ti

-.~

i,,.

Cl re..

'?rov' l ol..!!..dl O II ett,c.

111 &o I} C/EJSS 1.lf bw.s i

,.,.;, J.. e, "--:?: 1-<v e The EDGs provide a source of emergency power when offsite power is either unavailable or is insufficiently stable to allow safe unit operation. Undervoltage protection will generate an LOP start if a loss of voltage or degraded voltage condition occurs on the emergency buses.~There are \\

..two:°r~gui red LOP start signals for each 4.16 kV emergency l

bus':' -three Undervoltage relays are provided on each 4160 V Class lE bus for detecting a loss of bus voltage or a sustained degraded voltage condition. The relays are combined in a two-out-of-three logic to generate a LOP signal. A loss of voltage start of the EDG is initiated when the voltage is less than 74% of rated voltage and lasts for approximately 2 seconds. A degraded voltage start of the EOG is produced when the voltage is less than 90% of rated voltage sustained for approximately 56 seconds. The time delay for the degraded voltage start signal is reduced to approximately

.5 seconds with the presence of a Safety Injection signal or the Hand J bus on this unit.

sei~rl,e. vol 9 e.. +*

?rol-ec..+i.ov') t \\A ll\\-e.j~ \\Ve.

.e IM,,lf)Ge v"l~,e. :s+~r+

ne 4160 VAC bus from the other unit is needed to support S-+ Z ~ EV bi i. s ~..... ~-\\;"'.JeJ. perat ion of each required Service Water (SW) pump, Main o

• ~

Control Room/Emergency Switchgear Room (MCR/ESGR) Emergency wV\\e.V"l+\\.-..e. ll'\\~i"1:4we_

Ventilation System (EVS) fan, Auxiliary Building central Seq,~,e 11ot"t"l'-j c.. 1

'=-'

exhaust fan, and Component Cooling Water (CC) pump. SW,

-e_;:,..-k-r ~Ol,V"\\

o< e..i/AA,{

MCR/ESGR EVS, Auxiliary Building central exhaust system, and u*f, r

'vital CC are shared systems.

~t

• o""I" VI0~ 1 110 /+o..4e.. "'11,-\\<.-

11e.Jfif..J..,ve.

The Allowable Value in conjunction with the trip setpoint tJ,t vo/i.J.-~,H.

and LCO establishes the threshold for Engineered Safety Se..itM-iW

~ d, IA.~re Features Actuation System (ESFAS) action to prevent

xo

• ec.A'L~v> v>' l' et \\

xceedi ng acceptable 1 imi ts such that the consequences of

~-\\.,..,

A-~oJ;~-t\\\\.re.e...

(4l-CI.\\J> esign Basis Accidents (DBAs) will be acceptable. The o-ev,; ~

Lot' si_y"'d. llowable Value is considered a limiting value such that a te> c5 t.V\\ V"

,e

(;>.

channel is OPERABLE if the set point is found not to exceed the Allowable Value during the CHANNEL CALIBRATION. Note that, although a channel is OPERABLE under these circumstances, the setpoint must be left adjusted to within the established calibration.tolerance band of the setpoint (continued)

North Anna Units 1 and 2 B 3.3.5-1

BASES BACKGROUND (continued)

LOP EOG Start Instrumentation B 3.3.5 in accordance with uncertainty assumptions stated in the referenced setpoint methodology, (as-left-criteria) and

.confirmed to be operating with the statistical allowances of the uncertainty terms assigned.

Allowable Values and LOP EOG Start Instrumentation Setpoints The trip setpoints are summarized in Reference 3. The selection of the Allowable Values is such that adequate protection is provided when all sensor and processing time delays are taken into account.

Setpoints adjusted consistent with the requirement of the Allowable Value ensure that the consequences of accidents will be acceptable, providing the unit is operated from within the LCOs at the onset of the accident and that the equipment functions as designed.

Allowable Values are specified for each Function in SR 3.3.5.2. Nominal trip setpoints are also specified in the unit specific setpoint calculations and listed in the Technical Requirements Manual (TRM) (Ref. 2). The trip setpoints are selected to ensure that the setpoint measured by the surveillance procedure does not exceed the Allowable Value if the relay is performing as required. If the measured setpoint does not exceed the Allowable Value, the relay is considered OPERABLE. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within the Allowable Value, is acceptable provided that operation and

.testing is consistent with the assumptions of the unit specific setpoint calculation (Ref. 3).

APPLICABLE The LOP EOG start instrumentation is required for the SAFETY ANALYSES Engineered Safety Features (ESF) Systems to function in any accident with a loss of offsite power. Its design basis is that of the ESFAS.

Accident analyses credit the loading of the EOG based on the loss of offsite power during a loss of coolant accident (LOCA). The actual EOG start has historically been associated with the ESFAS actuation. The EOG loading has been included in the delay time associ.ated with each safety system component requiring EOG supplied power following a loss of offsite power. The analyses assume a non-mechanistic (continued)

North Anna Units 1 and 2 B 3.3.5-2

BASES APPLICABLE° SAFETY ANALYSES (continued)

LCO Q1,e~ 1'\\cy1Alv e se1L~.;:1Lc

\\j O \\ -\\-o,_ c;y--

LOP EOG Start Instrumentation B 3.3.5 EOG loading, which does not explicitly account *for each individual component of loss of power detection and subsequent actions.

The required channels of LOP EOG start instrumentation, in conjunction with the ESF systems powered from the EOGs, provide unit protection in the event of any of the analyzed accidents discussed in Reference 5, in which a loss of offsite power is assumed.

The delay times assumed in the safety analysis for the ESF equipment include the 10 second EDG start delay, and the appropriate sequencing delay, if applicable. The response times for ESFAS actuated equipment in LCO 3.3.2, "Engineered Safety Feature Actuation System (ESFAS) Instrumentation, 11 include the appropriate EOG loading and sequencing delay if applicable.

The LOP EOG start instrumentation channels satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

The LCO for LOP EOG start instrumentatiori requires that three channels per bus of J;etti the 1 oss of vo.l tage).--a-rtd-degraded voltageJ'Functions shall be OPERABLE in MODES 1, 2, 3, and 4 when the LOP EOG start instrumentation supports safety systems associated with the ESFAS; This is associated with the requirement of LCO 3.3.5.a for this unit's Hand J buses. LCO 3.3.5.b specifies that for~ required Hand/or J bus on the other unit that is needed to support a required shared component for this unit, the LOP EOG start instrumentation for the required bus must be OPERABLE. The other unit's required Hand/or J bus are required to be OPERABLE to support the SW, MCR/ESGR EVS, Auxiliary Building*

central exhaust, and CC functions needed for this unit.

These Functions share components, pumps, or fans, which are electrically powered from both units. A channel is OPERABLE with a trip setpoint value outside its calibration tolerance band provided the trip setpoint "as-found" value does not exceed its associated Allowable Value and provided the trip setpoint 11as-left" value is adjusted to a value within the 11as-left 11 calibration tolerance band of the trip setpoint. A trip setpoint may be set more conservative than the trip setpoint specified in the TRM (Ref. 2) as necessary in response to unit conditions. In MODES 5 or 6, the three channels must be OPERABLE whenever the associated EOG is required to be OPERABLE to ensure that the automatic start of (continued)

North Anna Units 1 and 2 B 3.3.5-3

BASES LCO (continued)

APPLICABILITY ACTIONS LOP EDG Start Instrumentation B 3.3. 5 the EOG is available when needed. Loss of the LOP EOG Start Instrumentation Function could result in the delay of safety systems initiation when required. This could lead to unacceptable consequences during accidents. During the loss of offsite power the EDG powers the motor driven auxiliary feedwater pumps. Failure of these pumps to start would leave only one turbine driven pump, as*well as an increased potential for a loss of decay heat removal through the secondary system.

The LOP EOG Start Instrumentation Functions are required in MODES l, 2, 3, and 4 because ESF Functions are designed to provide protection in these MODES. Actuation in MODE 5 or 6 is required whenever the required EOG must be OPERABLE so that it can perform its function on a LOP or degraded power to the emergency bus.

In the event a channel I s trip setpoint is found nonconservative with respect to the Allowable Value, or the channel is found inoperable, then the function that channel provides must be declared inoperable and the LCO Condition entered for the particular protection function affected.

Because the required channels are specified on a per bus basis, the Condition may be entered separately for each bus as appropriate.

A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed in the LCO and for each emergency bus. The Completion Time(s) of the inoperable channel (s) of a Function will. be tracked separately for each Function starting from the time the Condition was entered for that Function for the associated emergency bus.

Condition A applies to the LOP EDG start Function with 1 ass of voltage,~ degraded vol tagef eh-anrre-l-per bus inoperable.

If one channel is inopefable, Required Action A.1 requires that channel to be placed in trip within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. A plant-specific risk assessment, consistent with Reference 4, (continued)

North Anna Units 1 and 2 B 3.3.5-4

BASES ACTIONS A.1 (continued)

LOP EDG Start Instrumentation B 3.3.5 was performed to justify the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time. With a.

channel in trip, the LOP EOG start instrumentation channels are configured to provide a one-out-of-two logic to initiate a trip of the incoming offsite power.

A Note is added to *allow bypassing an inoperable channel for up to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for surveillance testing of other channels. A plant-specifi~ risk assessment, consistent wJth Reference 4, was performed to justify the 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> time limit. This allowance is made where bypassing the channel does not cause an actuation and where normally, excluding required testing, two other channels are monitoring that parameter.

The specified Completion Time and time allowed for bypassing one channel are reasonable considering the Function remains fully OPERABLE on every bus and the low probability of an event occurring during these intervals.

8.1 Condition B applies when more than one loss of voltage, 'b-y,.

\\

more than one degraded voltag~Vchannel on an emergency bus is inoperable.

Required Action 8.1 requires restoring all but one channel to OPERABLE status. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time should allow ample time to repair most failures and takes into account the low probability of an event requiring an LOP start occurring during this interval.

C.1 Condition C applies to each of the LOP EOG start Functions when the Required Action and associated Completion Time for Condition A or Bare not met.

In these circumstances the Conditions specified in LCO 3.8.1, 11 AC Sources-Operating, 11 or LCO 3.8.2, 11 AC Sources-Shutdown, 11 for the EDG made inoperable by failure of the LOP EOG start instrumentation are required to be entered immediately. The actions of those LCOs provide for adequate compensatory actions to assure unit safety.

North Anna Units 1 and 2 B 3.3.5-5

BASES SURVEILLANCE REQUIREMENTS tol' uv/Dv

+v..l'\\C..~ ~ 0 rt'$,

SR 3.3.5.1 LOP EDG Start Instrumentation B 3.3.5 SR 3.3.5.1 is the performance of a TADOT for channels required by LCO 3.3.5.a and LCO 3.3.5.b.&A successful test of the required contact(s} of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable TADOT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at-an 18 month frequency with applicable extensions. The test checks trip devices that f

provide actuation signals directly, bypassing the analog process control equipment.

The SR is modified by a Note that excludes verification _of setpoints from the TADOT. Since this SR applies to the loss of voltage and degraded voltage relays for the 4160 VAC emergency buses, setpoint verification requires elaborate bench calibration and is accomplished during the CHANNEL CALIBRATION. Each train or logic channel shall be functionally tested up to and including input coil SR 3,3,S'. d.

Frequency is based on operating experience, equipment continuity testing of the ESF slave relay. The Surveillance j reliability, and plant risk and is controlled under the

~

1t S.:: c.

~...\\..\\.a.<.J.,..cJ. _____

S 7

urvei 11 ance Frequency Control Program.

\\

~

i""-c:..r\\'-uf c,. \\At

a.

V\\ "'.j "-.\\-~ v e SC1,(}..c..l'\\C.e. VO \\\\a.~~

SR 3.3.5./~

SR 3.3.5.1 is the performance of a CHANNEL CALIBRATION for channels required by LCO 3.3.5.a and LCO 3.3.5.b.

The setRoints. as well 1_as the response to a loss of voltage,

...a-no* a degraded voltagi;vtest,, shall include a single point verification that the trip occurs within the required time delay, as shown in Reference 1.

CHANNEL CALIBRATION is a complete check of the instrument J

loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary. range and accuracy. The verification of degraded voltage with a SI signal is not required by LCO 3.3.5.b.

(continued)

North Anna Units 1 and 2 B 3.3.5-6

• SR 3.3.5.2 SR 3.3.5.2 is the performance of a TADOT for channels required by LCO 3.3.5.a and LCO 3.3.5.b.

for Negative Sequence Relay Functions. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This. clarifies what is an acceptable TADOT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at an 18 month frequency with applicable extensions. The test checks trip devices that provide actuation signals directly, bypassing the analog process control equipment.

The SR is modified by a Note that excludes verification of setpoints from the TADOT. Since this SR applies to the negative sequence voltage relays for the 4160 VAC emergency buses, setpoint verification requires elaborate bench calibration and is accomplished during the CHANNEL CALIBRATION. Each train or logic channel shall be functionally tested up to and including input coil continuity testing of the ESF slave rela*y. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

BASES SURVEILLANCE REQUIREMENTS 3

SR 3.3.5vt (continued)

LOP EOG Start Instrumentation B 3.3.5 equipment reliability, and plant risk and is controlled

~

The Survei 11 a nee Frequency is based on operating experience, 1*

under the Surveillance Frequency Control Program.

l/

SR 3.3.5:J

\\

This SR ensures the individual channel ESF RESPONSE TIMES are less than or equal to the maximum values assumed in the accident analysis for channels required by LCO 3.3.5.a and LCO 3.3.5.b. Response Time testing acceptance criteria are included in the TRM (Ref. 2).

Individual component respon$e times are not modeled in the analyses. The analyses model the overall or total elapsed time, from the point at which the parameter exceeds the trip setpoint value at the sensor, to the point at which the equipment in both trains reaches the required functional state (e.g., pumps at rated discharge pressure, valves in full open or closed position).

• For channels that include dynamic transfer functions (e.g.,

lag, lead/lag, rate/lag, etc.), the response time test may be performed with the transfer functions set to one with the resulting measured response time compared to the appropriate TRM response time. Alternately, the response time test can be performed with the time constants set to their nominal value provided the required response time is analytically calculated assuming the time constants are set at their nominal values. The response time may be measured by a series of overlapping tests such that the entire response time is measured.

Response time may be verified by actual response time test in any series of sequential, overlapping or total channel.

measurements, or by the summation of allocated sensor, signal processing and actuation logic resp6nse times ~ith actual response* time tests on the remainder of the channel.

Testing of the final actuation devices, which make up the

~

bulk of the response ti~e. is included in the testing of each' channel.

1*

The Surveillance Frequency is based on operating experience,

~

equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

11 North Anna Units 1 and 2 B 3.3.5-7

BASES REFERENCES 1.. UFSAR, Section 8.3.

LOP EDG Start Instrumentation B 3.3. 5

2. Technical Requirements Manual.

3. RTS/ESFAS Setpoint Methodology Study (Technical Report EE-0116).

4. WCAP 14333-P-A, Rev. l, October 1998.

5. UFSAR, Chapter 15.

LP. rv r

.... l. r,; <d 1 (.~..-\\. ~ I" J-o I J - o \\

North Anna Units 1 and 2

• B 3.3.5-8

f-l BASES BACKGROUND (continued)

AC Sources-Operating B 3.8.1 The 230/500 kV switchyard, which is an integral part of the transmission network, is the source of offsite (preferred) power to the station Class lE electrical system. From the 230/500 kV switchyard, five electrically and physically separated circuit~ are available to provide AC power, through either the system reserve transformers (SRTs) and RSSTs or.the station service transformers (SSTs), to the 4.16 kV ESF buses. A detailed description of the offsite power network and the circuits to the Class lE ESF buses is found in the UFSAR, Chapter 8 (Ref. 2).

An offsite circuit consists of all breakers, transformers, switches, interrupting devices, cabling, and controls required to transmit power from the offsite transmission

~etworfk to 1the onsit 1e Class lE ESF bus(es). Each one is 1*:.'

quali ied' via ana ysis to show that they meet the requirements of GDc 17.

Certain required unit loads are energized in a predetermined sequence in order to prevent overloading the transformers t

supplying offsite power to the onsite Class lE Distribution System. After the initiating signal is received, permanently connected loads and all automatically connected loads, via the load sequencing timing relays, needed to recover the unit or maintain it in a safe condition are energized.

The ons ite standby power source for each 4.16 kV ESF bus is a dedicated EDG.* EDGs Hand J are dedicated to ESF b~ses H and J, respectively. An EDG starts automatically on a safety.

injection (SI) signal (i.e., low pressurizer pressure or high containment pressure signals) or on an ESF bus degraded voltagE;J, cm undervoltage,Vsignal (refer to LCO 3.3.5, "Loss of Power tLOP) Emergency Diesel Generator (EOG) Start Instrumentation"). After the EOG has started, it will automatically tie to its respective bus after offsite power is isolated as a consequence of ESF bus undervoltage or f

degraded voltage, independent of or coincident with an SI*

signal. The EOGs will also start and operate in the standby mode without tying to the ESF bus on an SI signal or a momentary undervoltage condition. Following the loss of 1

offsite power, an undervoltage signal strips nonpermanent loads from the ESF bus. When the EDG is tied to the ESF bus,

.. loads are then sequentially connected to their respective ESF bus by the sequencing timing relays. The specific ESF equipment's sequencing timer controls the permissive and starting signals to motor breakers to prevent overloading the EOG by automatic load application.

(continued)

North Anna Units 1 and 2 B 3.8.1-2

BASES BACKGROUND (continued)

APPLICABLE SAFETY ANALYSES LCO AC Sources-Operating B 3.8.1 I~ the event of a loss of preferred (offsite) power, the ESF g electrical loads are automatically connected to the EDGs in t

sufficient time to provide for safe reactor shutdown and to mitigate the consequences of a Design Basis Accident (OBA) such as a loss of coolant accident (LOCA) without overloading the EDGs.

Ratings for Train Hand Train J EDGs satisfy the requirements of Safety Guide 9 (Ref. 3). The continuous service rating of each EOG is 2750 kW with 3000 kW allowable for up to 2000 hours0.0231 days <br />0.556 hours <br />0.00331 weeks <br />7.61e-4 months <br /> per year. The ESF loads that are powered from the 4.16 kV ESF buses are listed in Reference 2.

The initial conditions of OBA and transient analyses in the UFSAR, Chapter 6 (Ref. 4) and Chapter 15 (Ref. 5), assume ESF systems are OPERABLE. The AC electrical power sources are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System (RCS), and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.4, Reactor Coolant System (RCS); and Section 3.6, Containment Systems.

The OPERABILITY of the AC electrical power sources is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit. This result~ in maintaining at least one train of the onsite or offsite AC sources OPERABLE during accident conditions in the event of:

a.* An assumed loss of all off site power or all onsite AC power; and

b. A worst case single failure.

The AC sources satisfy Criterion 3 of 10 CFR 50.36(c) (2) (ii).

A minimum of two qualified offsite circuits between the l~

230/500 kV switchyard and the onsite Class lE Electrical Power System and two separate and independent EDGs for supplying.the redundant trains for each unit ensure (continued)

North Anna, Uni ts 1 and 2 B 3.8.1-3

-itevt"S"i-oo-H3

BASES LCD (con ti n*ued)

AC Sources-Operating B 3.8. 1 availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an anticipated operational occurrence (AOO) or a postulated OBA.

Qualified offsite circuits include the two 500-34.5 kV transformers and one 230-34.5 kV transformers (collectively referred to as the SRTs) that feed three independent 34.5 kV buses which supply the RSSTs. In addition, there are two 500 kV lines from the switchyard to the Unit 1 and Unit 2 generator step-up transformers and SSTs. These circuits are described ih the UFSAR and are part of the licensing basis for the unit.

In addition, the required automatic load sequencing timing relays must be OPERABLE. A 11 requiredl1 load sequencing timing relay is one whose host component is capable of automatically loading onto an emergency bus.

Each independent qua 1 ifi ed offs i te source must be capab 1 e ot'v maintaining rated frequency and voltage, and accepting required loads during an accident, while connected to the ESF buses.

Normally, the qualified offsite sources for the Unit 1. and 2 ESF buses are from the 34.5 kV buses 3, 4, and 5 which supply the RSSTs which feed the transfer buses. RSSTs A and B may be fed from the same 34.5 kV bus, but RSST C must be fed from a different 34.5 kV bus than RSST A and RSST B. The 0, E, and F transfer buses supply the onsite electrical power to the four ESF buses for the two unit~. In addition to the normal alignment, the D and E transfer buses can be tied together via the 4160 V bus OL installed as part of the AAC modifications.

ESF bus lH is normally fed through the F transfer bus from RSST C. Station service bus 18 can provide an alternate preferred feed for the bus ESF lH.

ESF bus lJ is normally fed through the D transfer bus from RSST A. Bus lJ has an alternate preferred feed from station service bus 2B. In addition, ESF bus lJ can be fed through D transfer bus from RSST s*with breakers 05Ll and 05L3 on AAC bus OL closed (backup alternate feed).

ESF bus 2H is normally fed through the E transfer bus from

).

)

RSST B. Station service bus 2C can provide an alternate 7

preferred feed for bus 2H. In addition, ESF bus 2H can be fed through E transfer bus from RSST A with breakers 05Ll and 05L3 on AAC bus OL closed (backup alternate feed)..

ESF bus 2J is normally fed through the F transfer bus from RSST C. Station service bus lA can provide an alternate preferred feed for Bus 2J.

(continued)

North Anna Units 1 and 2 B 3.8.1-4

BASES LCO (continued)

AC Sources-Operating B 3.8.1 The two 500 kV lines connecting each unit's main step-up and SSTs with the switchyard are the remaining qualified sources of offsite (preferred) power that are available to power ESF buses. For Unit 1, this soufce is normally available following a unit trip since there is an installed main generator breaker. Therefore, station service bus lA and lB,,.

which provide the preferred alternate feeds to the 2J and lH ESF buses, respectively, normally will not be affected. For Unit 2, where there is no installed main generator breaker, station ser.vice bus 28 and 2C, which provide the preferred L~

alternate feeds to ESF buses lJ and 2H, respectively~ will automatically transfer to RSST B and RSST C following a unit *~

trip.

'~

Each EOG must be capable of starting, accelerating to rated speed and voltage, and connecting to its respective ESF bus

\\'

on detection ot*bus undervoltage_ib~ degraded voltag~~ This will be accomplished within 10 seconds. Each EDG must also be capable of accepting required loads within the assumed loading sequence intervals, and continue to operate until offsite power can be restored to the ESF buses. These capabilities ~re required to be met from a variety of initial conditions such as EDG in standby with the engine hot and EDG in standby with the engine at ambient conditions. Additional EOG capabilities must be demonstrated to meet required Surveillances.

Proper sequencing of loads is a required function for EOG OPERABILITY.

In the event of a loss of offsite (preferred) power supply to the emergency bus, the EOG will auto start and re-energize its associated bus. In this configuration the EDG will become inoperable due to the defeat of load seguencing timers. Upon completion.of guidance in abnormal procedures for reconfigur*ation of the affected electrical bus to tontrol loads, TS 3.8.l Condition K may be exited as sequencing timing relays are no longer required as long as the associated emergency bus is not subsequently paralleled to another bus. The diesel can be considered operable which would allow exiting TS 3.8.1 Conditions Band Hand remaining in TS 3.8.1 Condition A.

The other unit 1s offsite circuit(s) and EDG(s) are required to be OPERABLE to support the S\\~, MCR/ESGR EVS, Auxiliary Building central exhaust, and CC functions needed for this unit. These functions share components, pump or fans, which are electrically powered from both units.

(continued)

North Anna Units 1 and 2 B 3.8.1-5 Revision 58

I,,

BASES AC Sources-Operat i ng B 3.8.1 SURVEILLANCE SR 3.8.1.1 RE~~~~{~~~JJ)

-+:1,~s &R ens1:1res pro~er GirGuit contiirnity fop.t,r,e offsite At:

~ -e-:1 ectri-e-a~ 15ower s1:1-p13~:Y to the or:.isU~ dis-t-1::.HH.i.:t;.:i-efl~

..ar:i~ avan abil it:;' of. e#site l\\C e.l-ectri cal 13e\\'ler. The 13reak-er

{l.\\l.) s~ e\\l\\Sv..r-es

...alignrne+it 11e-Fifies that each breaker is in i~s eerreet C.o r re(....\\, lo r ee...~i--

~sit i oo to en1s.ure th.a.t-di stri but-i-e-R-131:1s es and leads a-r-e

\\ *s

,:.,A,.\\..(;. (" e.at.c..'...

~eonn~ praferred or-alte-r-na-te pmter sot1~ces ~er Ol ~ ".'"WI J.

.{:+'sr~ c..' f

• ~ -1:ffii t r o-r Un~ t 2, and tl:iat appropriate i r:1Ele13endence e-f

('~v.A~e o

~I. ~;\\,. -effl-i-i:e ci io~d. The Survei 11 ance Frequency

~erAS(A,'l'"'(.4,\\il.a.4-d,:STf\\ ~"viis based on operating experience, equipment reliability, and i l d,s t.).f(!..

plant risk and is controlled under the Surveillance lllV.':ie~ ai.1M~ ~a.

Frequency Control Program.

C. 0 VI.LI\\,er..,~ -e J.

'\\-'ei

~e \\ i

? re.I; e.rr t?J..

0.:- ~\\\\c.r11Ww+e. SR 3. 8.1. 2 and SR 3. 8.1. 7

'rov.,er ~ou.rc.es a.v.J...

These SRs help to ensure the availability of the standby

+ :-\\-

f'\\°".\\:e.

electrical power supply to mitigate DBAs and transients and

~~

CA.~c=iro

. *\\ to maintain the unit in a safe shutdown condition.

\\v,.~e((,V"\\?'ew.e o.i; {:)~ e

• +;,,s lf'J\\O:\\~m~tl\\e.},

To m, mm, ze the wear on moving parts that do not get C\\rt~,

lubricated when the engine is not running, these SRs are 1'"','i.') S(l.- o...\\:.C> vef1~\\eS modified by a Note (Note 1 for SR 3.8.1.2) to indicate that ti

• l '-T*-i a 11 EDG starts for these Surveillances may be preceded by an

'"t~e. *1.'v'\\J.1..c..o..\\-e.a.. a."d-1 Gl.'ll* ~ 1 engine prel ube period and followed by a warmup period prior

". 11-

\\.\\v.,s; e. vC\\ (..

to 1 oadi ng.

O'\\"",\\f\\.(,e.e.~?

e\\-tdC\\t"'-\\ '?ov..:1e (' ~\\o-

~

~Vl,ir~J. o~~~i\\e c.i.tc.u.'i. ~ -\\,o J&.(. o~":>~~e Ai:c;J c~ !ovv<\\-i UV' "<to~ °'"'0 r ~

• For the purposes of SR 3.8.1.2 and SR 3.8.1.7 testing, the EDGs are started from standby conditions. Standby conditions for an EOG mean that the diesel engine coolant and oil are being continuously circulated, as required, and temperature is being maintained consistent with manufacturer recommendations.

In order to reduce stress and wear on diesel engines, the manufacturer recommends a modified start in which the starting speed of EDGs is limited, warmup is limited to this lower speed, and the EDGs are gradually accelerated to synchronous speed prior to loading. These start procedures are the intent of Note 2.

SR 3.8.1.7 requires that the EOG starts from standby conditions and achieves required voltage and frequency within 10 seconds. The 10 second start requirement supports the assumptions of the design basis LOCA analysis in the UFSAR, Chapter 15 (Ref. 5).

(continued)

North Anna Units 1 and 2 B 3.8.1~22

I BASES APPLICABLE SAFETY ANALYSES (continued)

LCO AC Sources-Shutdown B 3.8.2 minimal consequences. These deviations from DBA analysis assumptions and design requirements during shutdown conditions are ~llowed by the LCO for required systems.

During MODES l, 2, 3, and 4, various deviations from the analysis assumptions and design requirements are allowed within the Required Actions. This allowance is in recognition that certain testing and maintenance activities must be conducted provjded an acceptable level of risk is not exceeded. During MODES 5 and 6, performance of a significant number of required testing and maintenance activities is also required. In-MODES 5 and 6, the activities are generally planned and administratively controlled.

Relaxations from MODE 1, 2, 3, and 4'LCO requirements are acceptable during shutdown modes based on:

a. The fact that time in an outage is limited. This is a risk prudent.goal as well as a utility economic consideration.

b. Requiring appropriate compensatory measures for certain conditions. These may include administrative controls, reliance on systems that do not necessarily meet typical design requirements applied to systems credited in operating MODE analyses, O( both.

c. Prudent utility consideration of the risk associated with multiple activities that could affect multipl~ systems.

d. Maintaining, to the extent practical, the ability to perform required functions (even if not meeting MODE 1, 2, 3, and 4 OPERABILITY requirements) with systems assumed to function during an event.

In the event of an accident during shutdown, this LCO ensures the capability to support systems necessary to avoid immediate difficulty, assuming either a loss of all offsite power or a loss of all onsite emergency diesel generator (EOG) power.

The AC sources satisfy Criterion 3 of 10 CFR 50.36(c) (2) (ii).

. One offsite circuit capable of supplying the onsite Class lE power distribution subsystem(s) of LCO 3.8.10, 11 Distribution Systems-Sh0tdown," ensures that all required loads are (continued)

North Anna Units 1 and 2 B 3.8.2-2 Revision 0

BASES LCO (continued) 0, h\\J\\, ~'\\.e5tt+ive.

Sc.iU~VJ.L v',J*\\*u.~ O<

AC Sour~es-Shutdown B 3.8.2 powered from offsite power. An OPERABLE EOG, associated with the distribution system trains required to be OPERABLE by LCO 3.8.10, ensures a diverse power source is available to provide electrical power support, assuming a loss of the offsite circuit. Together, OPERABILITY of the required offsite circuit and EDG ensures the availability of sufficient AC sources to operate the unit in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents involving handling recently irradiated fuel).*

The qualified offsite circuit must be capable of'l1maintaining \\

rated frequency and voltage, and accepting required 1 oads during an accident, while connected to the Engineered Safety Feature (ESF) bus(es). Qualified offsite circuits are those that are described in the UFSAR and are part of the licensing basis for the unit.

Offsite circuits consist of 34.5 kV buses 3, 4, and 5 supplying the Reserve Station Service Transformer(s) (RSST) which feed the transfer buses. The 0, E, and F transfer buses supply the onsite electrical power to the four.emergency buses for the two units. Unit 1 emergency bus His fed through the F transfer bus from the C RSST. Unit 1 emergency bus J is fed through the D transfer bus from the A RSST.

Unit 1 station service bus lB can be an alternate feed for Unit 1 H emergency bus, while Unit 1 J bus may be fed from Unit 2 station service bus 2B. Unit 2 emergency bus H is fed through the E transfer bus from the B RSST. Unit 2 emergency bus J is fed through the F transfer bus from the C RSST.

Unit 2 station service bus 2C can be an alternate feed for t~'*

Unit 2 H emergency bus, while Unit 2 J bus may be fed from Unit 1 station service bus lA. In addition, E transfer bus can be a backup alternate feed to Unit 2 H bus (fed from RSST A through the O transfer bus and OL bus). The RSSTs can be fed by any 34.5 kV bus (3, 4, or 5) provided RSSTs A and B are fed from a different 34.5 kV bus than RSST C.

The EOG must be capable of starting, accelerating to rated

_____s_~.d_an.d_ypJ_tsuJ.e_, and connecting to its_r..e$pective ESF bus on detection of. bus undervoltage1 ~ degraded voltage0'The EOG must be capable of accepting required loads within the assumed loading sequence intervals, and continue to operate until offsite power can be restored to the ESF b~s. These capabilities are*required to be met from a variety of initial conditions such as EDG in standby with the engine hot and the EDG in *standby at ambient conditions.

Proper sequencing of loads is a req~ired function for EOG OPERABILITY.

(continued)

North Anna Units 1 and 2 B 3.8.2-3 Revision 58