ML18138A136

U1 and U2 - NRC Inspection of Ti 2515/194, Inspection of the Licensees Implementation of Industry Initiative Associated with the OPC Design Vulnerabilities in Electric Power Systems (NRC Bulletin 2012-11) - IR 05000454(455)/2018011

ML18138A136
Person / Time
Site:	Byron
Issue date:	05/17/2018
From:	Robert Daley Engineering Branch 3
To:	Bryan Hanson Exelon Generation Co, Exelon Nuclear
References
BL-12-001 IR 2018011
Download: ML18138A136 (32)

Text

May 17, 2018 Mr. Bryan C. Hanson Senior VP, Exelon Generation Company, LLC President and CNO, Exelon Nuclear 4300 Winfield Road Warrenville, IL 60555

SUBJECT:

BYRON STATION, UNITS 1 AND 2NRC INSPECTION OF TEMPORARY INSTRUCTION 2515/194, INSPECTION OF THE LICENSEES IMPLEMENTATION OF INDUSTRY INITIATIVE ASSOCIATED WITH THE OPEN PHASE CONDITION DESIGN VULNERABILITIES IN ELECTRIC POWER SYSTEMS (NRC BULLETIN 2012-01)INSPECTION REPORT 05000454/2018011; 05000455/2018011

Dear Mr. Hanson:

On April 5, 2018, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Byron Station, Units 1 and 2. On April 5, 2018, the inspectors discussed the results of this inspection Mr. T. Chalmers and other members of your staff. The results of this inspection are documented in the enclosed report.

The NRC inspectors did not identify any findings or violations of more-than-minor significance.

This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with Title 10 of the Code of Federal Regulations, Part 2.390, Public Inspections, Exemptions, Requests for Withholding.

Sincerely,

/RA/

Robert C. Daley, Chief Engineering Branch 3 Division of Reactor Safety Docket Nos. 50-454; 50-455 License Nos. NPF-37; NPF-66

Enclosure:

IR 05000454/2018011; 05000455/2018011

Letter to Bryan C. Hanson from Robert C. Daley dated May 17, 2018

SUBJECT:

BYRON STATION, UNITS 1 AND 2NRC INSPECTION OF TEMPORARY INSTRUCTION 2515/194, INSPECTION OF THE LICENSEES IMPLEMENTATION OF INDUSTRY INITIATIVE ASSOCIATED WITH THE OPEN PHASE CONDITION DESIGN VULNERABILITIES IN ELECTRIC POWER SYSTEMS (NRC BULLETIN 2012-01)INSPECTION REPORT 05000454/2018011; 05000455/2018011 DISTRIBUTION:

Jeremy Bowen RidsNrrDorlLpl3 RidsNrrPMByron Resource RidsNrrDirsIrib Resource Steven West Darrell Roberts Richard Skokowski Allan Barker DRPIII DRSIII ROPreports.Resource@nrc.gov OPCTI2515-194-08@nrc.gov ADAMS Accession Number ML: 18138A136 OFFICE RIII RIII RIII RIII NAME ADahbur:cl RDaley DATE 05/17/18 05/17/18 OFFICIAL RECORD COPY

Enclosure U.S. NUCLEAR REGULATORY COMMISSION REGION III Docket Numbers:

50-454; 50-455 License Numbers:

NPF-37; NPF-66 Report Numbers:

05000454/2018011; 05000455/2018011 Enterprise Identifier: I-2018-011-0015 Licensee:

Exelon Generation Company, LLC Facility:

Byron Station, Units 1 and 2 Location:

Byron, IL Dates:

April 2, 2018, through April 5, 2018 Inspectors:

A. Dahbur, Senior Reactor Inspector (Lead)

I. Hafeez, Reactor Inspector Accompanying J. Quichocho, Chief, NRR/DE/EEOB Personnel:

H. Kodali, Electrical Engineer, NRR/DE/EEOB S. Elkhiamy, Reactor Inspector, (Region I, Observer)

Approved by:

R. Daley, Chief Branch 3 Division of Reactor Safety

2

SUMMARY

The U.S. Nuclear Regulatory Commission (NRC) continued monitoring licensees performance by conducting Temporary Instruction 2515/194, Inspection of the Licensees Implementation of Industry Initiative Associated with the Open Phase Condition Design Vulnerabilities in Electric Power Systems (NRC Bulletin 2012-01), at Byron Station, Units 1 and 2, in accordance with the Reactor Oversight Process. The Reactor Oversight Process is the NRCs program for overseeing the safe operation of commercial nuclear power reactors. Refer to https://www.nrc.gov/reactors/operating/oversight.html for more information.

List of Findings and Violations None Additional Tracking Items None

3 INSPECTION SCOPE Inspections were conducted using the appropriate portions of the temporary instruction (TI) in effect at the beginning of the inspection unless otherwise noted. Currently approved TIs with their attached revision histories are located on the public website at https://www.nrc.gov/reading-rm/doc-collections/insp-manual/temp-instructions/. Samples were declared complete when the TI requirements most appropriate to the inspection activity were met consistent with Inspection Manual Chapter 2515, Light-Water Reactor Inspection Program Operations Phase. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel to assess licensee performance and compliance with Commission rules and regulations, license conditions, site procedures, and standards.

OTHER ACTIVITIESTEMPORARY INSTRUCTIONS, INFREQUENT AND ABNORMAL Temporary Instruction 2515/194Inspection of the Licensees Implementation of Industry Initiative Associated With the Open Phase Condition Design Vulnerabilities in Electric Power Systems (NRC BULLETIN 2012-01)

The inspectors conducted interviews and discussions with the licensee, reviewed available design, testing, grid data trending results documentation, and conducted walkdowns of installed equipment. The team verified that the licensee had completed the installation and testing of equipment (including the tripping functions), installed and tested alarming circuits both local and in the control room, and analyzed potential impacts associated with the design implementation on the current licensing basis.

The inspectors performed Section 03.01 of the Temporary Instruction in order to determination whether the licensee appropriately implemented the voluntary industry initiative, dated March 16, 2015 (ADAMS Accession No. ML15075A454).

The team performed Section 03.02 of the Temporary Instruction to gather information to determine whether the modifications implemented by the licensee of each unique open phase condition system design adequately address potential open phase conditions. The information gathered for this section is tabulated in attachment Table 1Information Gathered for TI 2515/194, to this report.

INSPECTION RESULTS Observation TI 2515/194 Byron Station selected Schweitzer Engineering Laboratories (SEL) 451-5 microprocessor based relays for the open phase detection system. The relay schemes monitor and compare the positive, negative and zero sequence current input from existing Current Transformers on the high side of System Auxiliary Transformers (SATs) 142-1, 142-2, 242-1 and 242-2 to detect loss of phase or low load conditions. The relay algorithm/scheme and associated setpoint calculations were developed by the licensee to detect the loss of phase on the preferred offsite source for the engineered safety feature buses and initiate actions to separate that source from the onsite distribution system. The relay schemes also used a time delay to ride out a short duration transient but allow sufficient time to detect a valid phase failure condition. The licensee completed the monitoring mode of operation of open phase system and enabled the tripping function for full implementation in November 2014.

4 Based on interviews and discussions with the licensee, review of available design, testing, grid data trending results documentation, and walkdowns of installed equipment, the team had reasonable assurance the licensee appropriately implemented the voluntary industry initiative.

No findings were identified.

Temporary Instruction 2515/194-03.01Voluntary Industry Initiative (Part 1)

a. Detection, Alarms and General Criteria (1) The inspectors determined by walkdowns and observation that open phase conditions will be detected and alarmed in the control room for each unit.

(2) Based on review of the licensee calculation for the relay setting limits used in the Open Phase Condition algorithms, the inspectors determined that detection circuits were sensitive enough to identify an open phase condition for all credited loading conditions.

(3) Licensee analysis showed that the short time delay used in the open phase condition design/protective scheme will minimize misoperation or spurious trip in the range of voltage unbalance normally expected in the transmission system. The analysis also showed that time delay coordinated with switchyard faults. In addition, since 2014 in when the open phase condition scheme was activated/in-service, the system did not cause any trip.

(4) No Class-1E circuits were replaced with non-Class 1E circuits in the design.

(5) The licensee revised Byron Updated Final Safety Analysis Report, Section 8.3.1.1.2.1 Offsite Power Sources (SATs), and added the loss of phase protection. The change was incorporated into Updated Final Safety Analysis Report, Revision 16. The revision did not discuss the design features and analysis in detail. However, the licensee concluded that the level of detail provided for the open phase condition protection was consistent with the level of detail provided for the other conditions that could trip the SAT feed breakers to the engineered safety feature buses.

b. Protective Actions Criteria (1) The licensee determined they were susceptible to an open phase condition, and implemented design changes to mitigate the effects.

(2) The inspectors determined that with an open phase condition present and no accident condition signal, the SEL 451-5 protection relay system would not adversely affect the function of important-to-safety systems, structures and components. The licensees open phase condition design solution added a set of additional tripping inputs in parallel to the existing transformer isolation controls.

This addition added a new tripping condition (open phase) to the electrical faults which result in tripping the SAT lockout relays after short time delay. The credited plant response would be the same regardless of the conditions that generated the isolation of the transformer. In addition, the licensees analysis verified that the

5 open phase condition Relays can detect and isolate an open phase condition prior to any motor damage or loss of Technical Specifications function for important-to-safety equipment.

(3) The inspectors determined that with an open phase condition present and an accident condition signal present, the SEL 451-5 protection relay system would result in tripping the SAT lockout relays after a short time delay. The SAT lockout relays will then trip the SAT primary and secondary side breakers. This will result in the bus loss of voltage relays dropping out and transferring the safety-related busses to their respective emergency diesel generators.

(4) The inspectors verified that periodic test, calibrations, setpoint verifications were established for the newly added SEL 451-5 protection relays system. No surveillance requirements for the SEL 451-5 were added to the plant Technical Specifications.

EXIT MEETINGS AND DEBRIEFS On April 5, 2018, the inspectors presented the Temporary Instruction 2515/194 inspection results to Mr. T. Chalmers, Plant Manager, and other members of the licensee staff.

The inspectors verified no proprietary information was retained, however some material used by the team to document compliance was characterized as proprietary by the vendor.

DOCUMENTS REVIEWED Inspection Procedure Temporary Instruction 2515/194 Drawings:

- 6E-0-4000B; One Line Current Relay & Instrument Diagram Of 345KV Bus-4,5,6 &7; Revision P

- 6E-0-4106B; Schematic Diagram Current & Potential Circuits For Sys. Aux. TR. 242 & 345KV Bus 13 (Units 1 &2); Revision F

- 6E-0-4106C; Schematic Diagram System 1 &2 Protective Relays D.C. Circuits Sys. Aux.

TR 242 345KV Bus 13; Revision D

- 6E-0-4106D; 3-Line Current & Potential Schematic Diagram 345KV Bus 13 SAT-242 Revenue Metering; Revision C

- 6E-1-4002B; Single Line Diagram System Auxiliary Transformer and 6.9KV Switchgear; Revision M

- 6E-1-4016C; Relaying & Metering Diagram System Auxiliary Transformers 142-1 & 142-2; Revision N

- 6E-2-4016C; Relaying & Metering Diagram System Auxiliary Transformers 242-1 & 242-2; Revision N

- 6E-1-4030AN002; Schematic Diagram Annunciator Window Engraving 1UL-AN023 &

24 AT 1PM01J; Revision Y

- 6E-1-4030AP01; Schematic Diagram System Auxiliary Transformer 142-1 Tripping Relays

- 6E-1-4030AP02; Schematic Diagram System Auxiliary Transformer 142-2 Tripping Relays

6 Procedures:

- 2BOSR 8.1.1-1; Normal and Reserve Offsite AC Power Availability Weekly Surveillance; Revision 11

- BAR 1-20-A4; SAT 142-2 Lockout Relay Trip Alarm; Revision 5

- BAR 1-20-E7; Sat 142-1 Low Load/Trouble Alarm; Revision 4

- BAR 2-20-E5; SAT 242-1 Loss of Phase Alarm; Revision 4

- 1BOL AP1; Unit 1 SAT Low Load or Trouble Condition Loss of Phase Monitoring; Revision 2

- BOP AP-52; Restoring Unit System Aux Transformer 142-1 and 142-2 During Power Operation; Revision 23 Calculation:

- BYR13-177; Unit 1 and Unit 2 Loss of Phase Detection Relay Settings; Revision 01

- BYR13-221; Open Phase Detection LOCA Analysis; Revision 00

- BYR13-176; Loss of Phase Detection EMTP Analysis; Revision 01

- EC 389896; SAT Loss of Phase Relay Installation; Revision 04

- 6G-12-008; 50.59 Evaluation for Loss of Phase Detection Scheme Phase Unbalance Relay Installation; Revision 2

- EC 623307; Open Phase Evaluations on Secondary Side of Auxiliary Transformer Condition Reports Issued during Inspection:

- AR 04122056; SAT Loss of Phase Relay Minimum Load Requirement; 04/02/2018

- AR 04122523; Identified Error in 50.59; 04/03/2018

- AR 04122945; Schematic Drawing Errors; 04/04/2018 Work Orders:

- 01564945; Install Modification per EC 389896 - SAT 142-1

- 01565039; Install Modification per EC 389896 - SAT 142-2

- 01565043; Install Modification per EC 389896 - SAT 242-1

- 01565047; Install Modification per EC 389896 - SAT 242-2

TABLE 1INFORMATION GATHERED FOR TEMPORARY INSTRUCTION 2515/194 Attachment A

Open Phase Condition Detection and Alarm Scheme Describe Observations/Comments 1 Are all credited offsite power sources specified in Updated Final Safety Analysis Report (UFSAR), Chapters 8.1, 8.2, and 8.3, and plant Technical Specifications (TSs) considered in the design of Open Phase Condition (OPC) detection and protection schemes?

Yes No The two credited offsite power sources are the power feeds from the switchyard to the Unit 1 System Auxiliary Transformers (SATs) 142-1 and 142-2 and to the Unit 2 SATs 242-1 and 242-2.

For each unit there is a common feed from the switchyard and then there is a T connection near the SATs, where the common feed splits into two sections to connect to the two SATs. Byron Station does not use a backfeed configuration.

Engineering Change (EC) 389896 installed OPC relays to protect the Unit 1 SATs, and EC 389897 installed OPC relays to connect the Unit 2 SATs.

The Schweitzer Engineering Laboratories (SEL) 451 relay was selected to be used as OPC relay.

2 Are OPC detection scheme(s) installed to monitor the qualified offsite power paths to the engineered safety feature (ESF) buses during all modes of operation?

Yes No The ESF buses are normally aligned to the SATs from their respective unit (e.g., 4.16 kV ESF Bus 141 is fed by SAT 142-1 and 4.16 kV ESF Bus 142 is fed by SAT 142-2). The ESF buses also can be aligned to the reserve feed from the opposite units SATs via the crosstie breakers.

OPC protection is provided for both the Unit 1 and Unit 2 SATs per ECs 389896 and 389897.

The EC 623307 evaluated the potential need for OPC detection on the secondary sides of the SATs that connect the SATs to the 4.16 kV and 6.9 kV buses. The EC concluded that due to the connections being non-segregated phase buses, an open phase circuit failure is not credible.

Therefore OPC detection is not required for the secondary side connections of the SATs to the 4.16 kV ESF buses.

3 a. What is the scope of OPCs considered by the licensee?

a. The scope of the OPCs considered include:

The two credited offsite power sources are the power feeds from the switchyard to the Unit 1 SATs 142-1 and 142-2 and to the Unit 2 SATs 242-1 and 242-2. For each unit there is a common feed from the switchyard and then there is a T connection near the SATs, where the common feed splits into two sections to connect to the two SATs.

TABLE 1INFORMATION GATHERED FOR TEMPORARY INSTRUCTION 2515/194 2

b. Did the licensee exclude certain OPCs (e.g., high voltage or low voltage side of power transformers),

operating and loading configurations in their analyses? If so, identify the technical justifications for any exclusion.

Yes No

b. Consistent with the industry initiative and as discussed in Calculations BYR13-176 and BYR13-177, the Byron Station OPC analysis included consideration of the following types of OPCs on the two credited offsite power sources:

• Single or Double Open Phase and Ground on SAT Primary

• Single Ungrounded or Double Grounded/Ungrounded on SAT Primary

• Double Ungrounded Open Phase on SAT Primary These OPCs were evaluated for all expected operating and loading configurations.

The only exception is when the SAT is initially energized. A minimum load of 2.27 A primary current (about 1400 kVA) needs to be applied to satisfy minimum loading requirements. A low load/trouble alarm window is provided to alert the operators to this condition. After the SATs are energized and loaded, this minimum loading requirement is met during all normal and accident loading conditions.

The EC 623307 evaluated the potential need for OPC detection on the secondary sides of the SATs that connect the SATs to the 4.16 kV and 6.9 kV buses. The EC concluded that due to the connections being non-segregated phase buses, an open phase circuit failure is not credible. Therefore OPC detection is not required for the secondary side connections of the SATs to the 4.16 kV ESF buses.

The 4.16 kV ESF switchgear buses include switchgear breakers and cable feeds to 4.16 kV loads and 480V ESF switchgear buses.

Each 480V ESF switchgear houses a stepdown transformer (4.16 kV to 480V) and a 480V bus including load center breakers that have cable feeds to 480V load center loads and 480V motor control centers (MCCs). The 480V MCCs includes compartments with molded case circuit breakers and cable feeds to small 480V MCC loads. The cables are routed within plant trays or conduits.

TABLE 1INFORMATION GATHERED FOR TEMPORARY INSTRUCTION 2515/194 3

A separate OPC detection system that monitors the circuits at the ESF 4.16 kV, 480V switchgear, and 480V MCCs is not required, since an OPC on an ESF circuit would be considered a single failure, and the redundant train would be available to provide the required safe shutdown functions. Additionally, detecting OPCs on the low voltage side is not part of the industry initiative.

4 Are the detection schemes capable to identify OPCs under all operating electrical system configurations and plant loading conditions?

Yes No The OPC relays are capable of detecting OPCs under all operating electrical system configurations and plant loading conditions.

The only exception is when the SAT is initially energized. A minimum load of 2.27 A primary current (about 1400 kVA) needs to be applied to satisfy minimum loading requirements. A low load/trouble alarm window is provided to alert the operators to this condition. After the SATs are energized and loaded, this minimum loading requirement is met during all normal and accident loading conditions.

5 a. If the licensee determined that OPC detection and alarm scheme was not needed, did the licensee provide adequate calculational bases or test data?

b. Are all OPCs detected and alarmed in the Main Control Room (MCR) with the existing relays?

Yes No Yes No

a. The licensee determined that OPC detection is needed at the Byron Station and that alarm, and protection is required. The OPC relays were installed per ECs 389896 and 389897.

b. the OPC relays installed by these ECs will detect OPCs and alarm in the MCR.

6 a. Are the detection and alarm circuits independent of actuation (protection) circuits?

b. If the detection, alarm and actuation circuits are non-Class 1E, was there any interface with Class 1E systems?

Yes No Yes No

a. For each SAT, an OPC relay is used to detect OPCs and to generate alarm and actuation signals. The relay does have independent output circuits for alarms and for actuation.

b. There are no interfaces with Class 1E systems.

The current sensing inputs for the Byron OPC relays are connected to the SAT 345 kV bushing current transformers (CTs), which are nonsafety-related (NSR). In the same manner as other SAT protective relays, the trip outputs from the Byron OPC relays are connected to the SAT lockout relays, which are NSR. The OPC relay, or any other SAT protective relay, would trip the SAT lockout relay, which would then trip SAT high side (345 kV) and low side

TABLE 1INFORMATION GATHERED FOR TEMPORARY INSTRUCTION 2515/194 4

(4.16 kV and 6.9 kV) breakers to isolate the SATs. The alarm outputs from the Byron OPC relays are connected to NSR alarm windows in the MCR.

7 a. Did the manufacturer provide any information/data for the capability of installed relays to detect conditions, such as unbalanced voltage and current, negative sequence current, subharmonic current or other parameters used to detect OPC in the offsite power system?

b. What are the analyses and criteria used by the licensee to identify the power system unbalance due to OPCs; and loading and operating configurations considered for all loading conditions which involve plant trip followed by bus transfer condition?

Yes No Yes No

a. Per Calculation BYR13-176, the Byron OPC relays use phase and sequence currents on the high side (345 kV) of the SATs to detect OPCs. The SEL-451-5 relays are used for the OPC relays. According to the vendor, this relay has a minimum relay input current hardware detection limit of 0.02 A secondary current (Reference Section 2.1 of Calculation BYR13-177) and is able to detect a minimum change in current of 0.01 A secondary current (Reference Section 2.5 of Calculation BYR13-177). The OPC relay does not use unbalanced voltages or subharmonic currents as inputs to detect an OPC. Also, the relay uses filtered inputs for the current input signals, so subharmonics would not affect the OPC relays (

Reference:

BYR 13-176, Section 1.0).

b. The Electric Magnetic Transit Program (EMTP) was used to model the Byron electrical system and to simulate various types of OPCs (single and double open phases, with and without a ground) under different loading conditions.

For single or double open phase and ground, zero sequence current is used to detect an OPC.

For single ungrounded or double grounded/ungrounded open phase, phase currents are used to detect an OPC, and zero and negative currents are used as security elements to differentiate a true OPC from a fault.

For double ungrounded open phases, phase currents are used to detect an OPC, and zero sequence current is used as a security element to differentiate a true OPC from a fault.

TABLE 1INFORMATION GATHERED FOR TEMPORARY INSTRUCTION 2515/194 5

c. If certain conditions cannot be detected, did the licensee document the technical basis for its acceptability?

d. Did the licensee perform functional testing to validate limitations specified by the manufacturer of the relays?

c. The analysis accounted for minimum relay sensitivity. The analysis identified that there is a minimum current, equivalent to about 1400 kVA or 2.27 A, that is required for the OPC relay to detect an ungrounded OPC.

This minimum loading requirement is met during all normal and accident loading conditions (

Reference:

BYR 13-177, Section 8.8).

d. Functional testing of the OPC relays was performed per Work Orders #01564945, 01565039, 01565043, and 01565047 for SATs 142-1, 142-2, 242-1, and 242-2, respectively.

8 a. Do OPC detection circuit design features minimize spurious detections due to voltage perturbations observed during events which are normally expected in the transmission system?

b. Identify whether the licensee considered alarm/trip settings coordination with other electric power system relays including transmission system protection features setup to avoid false indications or unnecessary alarms.

Yes No

a. As discussed in Section 6 of Calculation BYR13-176, security elements (zero and negative sequence current limits) were added to allow the relay to distinguish between a true OPC and a fault downstream of the SATs. This ensures that for a fault on a bus or a load fed by the SAT, the OPC relays will not actuate and trip the SATs. Instead, the protective devices closest to the fault will isolate the faulted load or bus, and the SAT will remain available to supply power to the remaining loads.

b. In addition, as discussed in Section 7.4 of Calculation BYR13-176, a 30 cycle (0.5 second) time delay is provided to allow the OPC relay to coordinate with switchyard transmission relays for Zone 2 protection, so that the OPC relay will not spuriously actuate for a switchyard fault.

9 Identify how the alarm features provided in the MCR including setpoints are maintained, calibrated, and controlled.

Transmittal of Design Information #BYR-16-005 identified the maintenance testing requirements for the OPC relays per North American Reliability Corporation (NERC) Standard PRC-005-2. Note that PRC-005-6 has superseded PRC-005-2; however, the requirements applicable to the OPC relays are the same in both revisions of PRC-005.

The Preventative Maintenance Identity Documents 00190772-03, 00190773-03, 00190774-03, and 00190775-03 are in place to track the periodic testing of the OPC relays.

The Preventive maintenance are scheduled to be performed on a 9 year frequency with a

TABLE 1INFORMATION GATHERED FOR TEMPORARY INSTRUCTION 2515/194 6

25 percent grace period, which is bounded by the 12 year frequency specified in PRC-005-6 and is acceptable. The setpoints are maintained by SEL 451 relay software control program.

10 Does the OPC detection scheme consider subharmonics in the supply power or offsite power system?

Yes No The relay uses filtered inputs for the current input signals, so subharmonics would not affect the OPC relays. Thus, subharmonics were not considered during the design of the OPC relays.

No issues with subharmonics were identified during the testing and monitoring of the OPC relays. A 125 volts direct current (VDC) bus is used to provide control power for each OPC, so the power source would not be susceptible to subharmonics. After the OPC relays were installed, the relays were monitored for a period of time in the alarm-only configuration, and proper operation of the relays was verified. Therefore, spurious operation due to subharmonics is not a concern.

11 Are OPC detection and alarm circuit components scoped into the licensees maintenance rule program?

Yes No Action Tracking Item (ATI) #01570501-53 documents the Maintenance Rule scoping review performed by Engineering for the OPC relays.

According to this ATI, the functions that the OPC relays are protecting are already scoped into the Maintenance Rule. A spurious relay actuation would result in a spurious SAT trip, which would be a functional failure of the SAT per Maintenance Rule Function MP-08, Transform Switchyard Voltage to 4 KV and 6.9 KV for Plant Use. This would ensure that an OPC relay failure that causes a spurious SAT trip is resolved in a timely manner. Consistent with other SAT protective relays, the OPC relays are not individually listed in the Maintenance Rule Program.

An OPC relay trouble condition (loss of power, software issues (S-alarm), hardware trouble (H-alarm) and Minload )that results in the relay not being functional would be identified as an Unresolved Maintenance Issue, per Requirement R5 of NERC Standard PRC-005-6.

This would ensure that a failed OPC relay is either repaired or replaced in a timely manner.

This is consistent with other SAT protective relays.

TABLE 1INFORMATION GATHERED FOR TEMPORARY INSTRUCTION 2515/194 7

B Open Phase Condition Protection scheme Describe Observations/Comments 1 Record location of the sensing of the protection scheme (e.g., high voltage or low voltage side of the transformer, ESF bus, etc.).

The Byron OPC relays monitor current on the high side (345 kV) of the SATs. The Byron OPC relay current sensing inputs are connected to the current transformers (CTs) that are part of the 345 kV bushings on the SATs.

2 a. Record the classification of the protection scheme, safety or non-safety.

b. Did the licensee consider the interface requirements for non-safety with safety-related circuits?

Yes No

a. Classification: Safety / Non-Safety (circle one)

b. Yes. The OPC protection scheme is classified as NSR and the OPC relay configuration and circuitry does not interface with safety-related (SR) circuits.

As stated in Section 4.1.4.2 of the Design Considerations Summary (DCS) for ECs 389896 and 389397, The new Loss of Phase Detection Cabinet 1(2)PA55J and all of the components being installed within this cabinet are considered NSR. In Section 4.1.4.2 of the DCS, it states that the design change is classified as SR since the cabinet attachment to the wall is SR since the wall is SR. The anchors must be procured safety related. The floor anchor installation for the panel support frame is a SR activity and must be performed according to all SR procedures, practices and quality control hold points.

The current sensing inputs for the Byron OPC relays are connected to the SAT 345 kV bushing CTs, which are NSR. In the same manner as other SAT protective relays, the trip outputs from the Byron OPC relays are connected to the SAT lockout relays, which are NSR. The OPC relay, or any other SAT protective relay, would trip the SAT lockout relay, which would then trip SAT high side (345 kV) and low side (4.16 kV and 6.9 kV) breakers to isolate the SATs. The alarm outputs from the Byron OPC relays are connected to NSR alarm windows in the MCR.

Based on the above discussion, the licensee considered interface requirements for non-safety with SR circuits.

TABLE 1INFORMATION GATHERED FOR TEMPORARY INSTRUCTION 2515/194 8

3 a. Record the type of the protection scheme, digital or non-digital.

b. Are cyber security requirements specified for digital detection scheme?

Yes No N/A

a. Type: Digital / Non-Digital (circle one)

b. The OPC (SEL-451) relays installed per EC 389896 (U1) and EC 389897 (U2) were screened and determined to be Critical Digital Assets (CDAs) in scope of 10 CFR 73.54.

During the design process, protection from accidental and malicious attempts to manipulate relay programming were established A Disaster Recovery Plan has been developed and is stored in the Records Management System to ensure timely restoration of the SEL-451 relays in the event of failure.

4 Did the licensee consider any design features to prevent protective functional failures for OPC protection system?

Yes No The SEL-451 is highly reliable relay. The relay is continuously running self-diagnostic routines. In the unlikely event that an internal relay failure is detected, a trouble alarm is annunciated in the MCR and the relay tripping function is blocked to prevent the possibility of a spurious relay trip.

See references below and also Section 4.1.5 of (DCS for ECs 389896 and 389897. Additionally, Operating Experience (OPEX) reviews that were performed for ECs 389896 and 389897 only identified one OPEX (OE24398 at Comanche Peak U1) where two SEL-551 relay failures occurred approximately 1 month apart due to a manufacturing defect in the voltage regulator integrated circuit. The SEL has since upgraded the power supply voltage regulators, which are not susceptible to the same failure mechanism.

This issue was resolved prior to the SEL-451-5 relays for Byron Station being manufactured. The remaining 10 OPEX items that were identified were due to incorrect relay settings or programming and not due to internal relay failures, or the OPEXs identified cases where an OPC occurred and OPC protection had not been provided. (Reference Section 4.1.16 of the DCS for ECs 389896 and 389897) 5 Identify the number of channels provided per offsite power source and if there is independence between channels and sensors.

The credited offsite power sources are the Units 1 and 2 SATs. Each Byron Unit has two SATs.

One OPC relay is provided for each SAT. The Units 1 OPC relays are completely independent from the Unit 2 OPC relays and do not share any sensor (i.e., CT) inputs.

TABLE 1INFORMATION GATHERED FOR TEMPORARY INSTRUCTION 2515/194 9

For each unit, the two SATs (i.e., Unit 1 SATs 142-1 and 142-2) share a common connection to the switchyard. There is a T connection near the SATs that connects each SAT to the common feed to the switchyard. It is possible that an open phase upstream of the T connection could cause circulating currents in the two SATs if the SAT loading is uneven between the two SATs. Therefore, it is necessary for each OPC relay to be connected to the CTs from both SATs to be able to detect OPCs on the common feed to the switchyard with uneven SAT loading conditions. Reference the following discussion from Section 6.1.2.1 of Calculation BYR13-176:

At Byron, each unit has two identical SATs operated off a common feed from the switchyard. An open phase can -

and did (at Byron) - occur on the common point prior to the T connection. Uneven transformer loading will cause a circulating current to exist in both SAT H windings even if an open phase exists upstream of the T connection. The circulating current exists in the SAT neutrals and the opened phase, which means that an Ia<MINDETC condition at the individual transformers does not exist. For this reason, it is necessary to not only monitor the six SAT phase currents (three for each SAT), but also the phase currents flowing into the T connection from the switchyard. Following Kirchhoffs current law, this current can be calculated by simply taking the vectoral sum (IVsum in the diagram below) of SAT phase currents, so additional CTs are not required.

The logic string will be altered so that it checks for current unbalance in the common feed as well as current unbalance in the individual SAT feed. This logic will be able to detect an open phase at the common SAT feed.

TABLE 1INFORMATION GATHERED FOR TEMPORARY INSTRUCTION 2515/194 10 6 a. What is the safety classification of power supply for the protection scheme?

b. Was a loss of power to the protection scheme considered?

Yes No

a. Non-safety related. The Byron OPC relays are provided control power from the 125 VDC NSR distribution panel that is of the same electrical division as the division used to provide control power for the other SAT protective relays and lockout relays:

SAT 142-1 OPC Relay 851PST11 NSR Div 11 Panel 1DC05EB SAT 142-2 OPC Relay 851PST12 NSR Div 12 Panel 1DC06EB SAT 242-1 OPC Relay 851PST21 NSR Div 21 Panel 2DC05EB SAT 242-2 OPC Relay 851PST22 NSR Div 22 Panel 2DC06EB The 125 VDC ESF battery of the same electrical division provides power for the associated NSR panel via two 1E/Non-1E isolation fuses. For example, 125 VDC ESF Battery 111 provides power to NSR Div. 11 Panel 1DC05EB. The SR stationary battery calculations were updated due to the addition of NSR panels.

b. Loss of direct current control power to the OPC relay will not cause a spurious trip of the relay.

Loss of direct current control power will result in a relay low load/trouble alarm window being actuated in the MCR, and the OPC relay will not be functional and will not be able to trip on an action OPC. (

Reference:

Section 4.1.5 of the DCS for ECs 389896 and 389897) 7 Identify if the licensee considered the consequences of a failure or malfunction of a channel.

No OPC and Relay Failure:

The OPC relays are continually running self-diagnostics. The inputs to the relay trouble alarm are loss of power, software trouble (S-alarm), hardware trouble (H-alarm) and Minload. If a relay trouble condition were to be detected, the relay tripping capability would be automatically blocked, and a relay low load/trouble alarm window would be annunciated in the MCR.

One OPC relay is provided per SAT. For each unit, the two SATs share a common connection to the switchyard. While the two OPC relays per unit are not redundant, there is some overlap in protection for an OPC. Both OPC relays would

TABLE 1INFORMATION GATHERED FOR TEMPORARY INSTRUCTION 2515/194 11 detect an OPC on the common line between the Switchyard bus and upstream of the T connection, where the line splits into two sections to connect to each SAT. For an OPC on the line section downstream of the T connection, only the OPC relay for the affect SAT would detect the OPC. The other OPC relay would not be able to detect the OPC.

OPC and Relay Failure:

Therefore, if an OPC relay had a trouble condition and an OPC were to then occur, either the other OPC relay would detect the OPC and trip the SATs for an OPC on the common line or the operators would respond per station procedures to manually trip the SATs for the line section downstream of the T connection. (Reference the DCS for ECs 389896 and 389897 and Procedures BARs 1-20-E7, 1-20-E8, 2-20-E11, and 2-20-E12.)

A spurious actuation of an OPC relay would result in the SATs de-energizing and causing a loss of offsite power (LOOP). The diesel generators (DGs) would re-energize the 4.16 kV ESF buses and the remaining Non-ESF buses would autobus transfer to the Unite Auxiliary Transformers (UATs). The unit is expected to keep operating under these conditions. Spurious actuation of an OPC relay would not cause a turbine/generator or reactor trip.

8 Did the design consider the single failure criteria as outlined in the General Design Criterias (GDCs) or the principle design criteria specified in the updated final safety analysis report?

Yes No As described in GDC 17, Electric Power Systems, the single failure criteria as it applies to the offsite power supplies is at the system level.

Specifically, that a single failure will only affect one supply, and will not propagate to the alternate supply. This is based on the physical configuration of the transmission lines, right of ways, and the transmission circuit supplying the SATs, and means to rapidly locate and isolate system faults.

TABLE 1INFORMATION GATHERED FOR TEMPORARY INSTRUCTION 2515/194 12 The NSR OPC relays are only connected to the NSR SAT lockout relays. There are no interfaces with the ESF buses or the ESF DGs. Therefore, if an OPC were to occur with a single failure of a 4.16 kV ESF bus, the OPC relays would trip the SAT lockout relays. The SAT lockout relays would trip the SAT high and low side breakers (including the SAT feed breakers to the 4.16 kV ESF buses).

Both DGs would auto start on bus undervoltage.

The DG for the non-faulted bus would re-energize its bus and sequence on the required loads. The DG for the faulted bus would run unloaded and not attempt to re-energize its bus due to the bus being locked out. This is consistent with the single failure criteria for the SR portion of the Auxiliary Power System.

Therefore, Byron Station's installation and activation of an automatic loss of phase detection and actuation system addresses the identified gap in the inclusion of adequate provisions to ensure a failure of the offsite circuit as a result of an open phase condition will not preclude the onsite electrical power system from being able to perform its specified safety functions. Specifically, in accordance with GDC 17, the onsite power systems will retain sufficient capacity and capability to assure that (1) specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded as a result of anticipated operational occurrences and (2) the core is cooled and containment integrity and other vital functions will be maintained in the event of postulated accidents given an OPC on the offsite electric power system and a single failure in the onsite power system.

9 a. Did the licensee identify the industry standards and criteria to verify power quality issues caused by OPCs that affect redundant ESF buses?

Yes No

a. Calculation BYR13-176 Sections 3.11, 6.5 and 7.1 and Attachment A evaluated the Byron area transmission system and accounted for normal unbalanced voltages and currents in the grid. The bounding transmission system sequence voltages are summarized in Section 7.1.1 of Calculation BYR13-176 and were used as inputs for the EMTP analysis for OPCs.

TABLE 1INFORMATION GATHERED FOR TEMPORARY INSTRUCTION 2515/194 13

b. What industry standards were used to develop the acceptance criteria for OPC trip setpoint or analytical limit?

As discussed in Calculation BYR13-176, the OPC relays measure phase currents on the high side (345 kV) of the SATs. The OPC relays use the phase current inputs to calculate sequence currents, and then the phase and sequence currents are used to detect an OPC. Sequence voltages are not used by the OPC relays.

In the event of an OPC, the OPC relays will rapidly detect the OPC condition and trip the SATs after a 30 cycle (0.5 second) time delay.

(Reference Section 7.4 of Calculation BYR13-176.) The associated 4.16kV ESF bus will experience an undervoltage condition.

This will start the emergency DG, load shed the bus, and then load the bus with the required ESF loads. The feed to the associated 6.9kV bus will be automatically transferred from the SAT to the UAT, if it is available. That is, the actuation of the OPC relays will produce the same results as the actuation of other SAT protection devices.

Calculation BYR13-221 evaluated the effects of negative sequence current on motor heating during an OPC and determined that the motors would not be damaged during the time that it would take the OPC relays to isolate the buses from the SATs. Due to the short duration of an OPC condition, additional evaluation of power quality issues caused by an OPC is not required.

b. Industry standards were listed in Section 4, References of Calculation BYR13-176, Loss of Phase Detection EMTP Analysis and in Calculation BYR13-221, Open Phase Detection Loss of Coolant Accident (LOCA) Analysis.

10 What are the analytical limits or criteria used for setpoints of the actuation/protection scheme to provide adequate protection for motors and sensitive equipment?

The logic strings and bounding values for the OPC relays are summarized in Section 8 of Calculation BYR13-176. There are three logic strings used to detect OPCs as discussed in Section 8.1 of Calculation BYR13-176:

Logic String 1 (Single or Double Grounded Open Phase Detection)

Logic String 2 (Single Ungrounded or Double Grounded/Ungrounded Open Phase Detection)

TABLE 1INFORMATION GATHERED FOR TEMPORARY INSTRUCTION 2515/194 14 Logic String 3 (Double Ungrounded Open Phase Detection)

The bounding values for the settings used in the logic strings are summarized in Section 8.2 of Calculation BYR13-176. These bounding values were selected based on the results of the EMTP analysis to provide a range of values that will be able to promptly detect an OPC and trip the SATs after a 30 cycle (0.5 second) time delay, while also not tripping for other fault conditions.

Calculation BYR13-177 used the bounding values from Calculation BYR13-176 as inputs and applied CT and relay accuracy to determine the actual setpoints used for the settings in the OPC logic.

Calculation BYR13-221 performed an analysis to verify that the ESF loads would not be damaged during the time delay between when an OPC occurs and when the SAT is tripped. As discussed in Section 1.3 of Calculation BYR13-221, this analysis evaluated the following four items for the ESF buses:

The impact of the single phase block start of ESF loads on the bus protection scheme (overcurrent and undervoltage).

The impact of the single phase block start of ESF loads on the motor protection scheme (overcurrent).

The heating (i22t) impact of single phase block start of ESF loads on the running and starting motors and motor operated valves (MOVs).

The impact of isolating ESF loads from the SATs during the starting sequence and then restarting the ESF loads on the emergency source.

As discussed in Section 6.2.3 of Calculation BYR13-221 for motor heating, the induction motors i22t capability is >= 40 pu. However, a thermal limit of 20 pu was used during the OPC to account for a second start (hot start) of the motor after the emergency DG restores normal voltage to the bus.

TABLE 1INFORMATION GATHERED FOR TEMPORARY INSTRUCTION 2515/194 15 As discussed in Section 8 of Calculation BYR13-221, the analysis determined that no bus or motor protective devices would trip during the OPC, and the analysis also determined that the motor thermal duties would be less than the thermal limit of 20 pu for i22t heating. Therefore, this ensures that all loads are protected from the effects of an OPC.

11 What are the design features provided to preclude spurious trips of the offsite power source (e.g. coincidence logic)?

As discussed in Section 6 of Calculation BYR13-176, security elements (zero and negative sequence current limits) were added to allow the relay to distinguish between a true OPC and a downstream fault. This ensures that for a fault on a bus or a load fed by the SAT, the OPC relays will not actuate and trip the SATs. Instead, the protective devices closest to the fault will isolate the faulted load or bus, and the SAT will remain available to supply power to the remaining loads.

In addition, as discussed in Section 7.4 of Calculation BYR13-176, a 30 cycle (0.5 second) time delay is provided to allow the OPC relay to coordinate with switchyard transmission relays for Zone 2 protection, so that the OPC relay will not spuriously actuate for a switchyard fault.

12 a. What analyses have been performed by the licensee which demonstrates that the OPCs do not adversely affect the function(s) of important-to-safety equipment required for safe shutdown during anticipated operational occurrences, design basis events, and accidents?

If an analyses was not performed, what justification was provided?

b. Are bus transfer schemes and associated time delays considered?

Yes No

a. Calculation BYR13-221 performed an open phase detection LOCA analysis. This calculation determined that the effects of negative sequence current during the OPC time delay are acceptable and will not prevent the ESF loads from functioning as required.

Section 8.1.3 of Calculation BYR13-221 states, Based on the results all motors and MOVs have the thermal capability to withstand the postulated event.

(Note that as stated in Section 2.5.1 of Calculation BYR13-221, the Calculation used an OPC time delay of 0.6023 seconds, which included the 0.5 second time delay for the OPC relay and additional times for operation of the SAT lockout relay and the 345 kV circuit breakers.)

b. Bus transfer schemes do not apply. The ESF buses are always connected to the SATs.

TABLE 1INFORMATION GATHERED FOR TEMPORARY INSTRUCTION 2515/194 16 13 Are OPC protection/actuation circuit components scoped, as appropriate, into the licensees Maintenance Rule Program?

Yes No The ATI #01570501-53 documents the Maintenance Rule scoping review performed by Engineering for the OPC relays. According to this ATI, the functions that the OPC relays are protecting are already scoped into the Maintenance Rule. A spurious relay actuation would result in a spurious SAT trip, which would be a functional failure of the SAT per Maintenance Rule Function MP-08, Transform Switchyard Voltage to 4 KV and 6.9 KV for Plant Use. This would ensure that an OPC relay failure that causes a spurious SAT trip is resolved in a timely manner. Consistent with other SAT protective relays, the OPC relays are not individually listed in the Maintenance Rule Program.

An OPC relay trouble condition that results in the relay not being functional would be identified as an Unresolved Maintenance Issue per Requirement R5 of NERC Standard PRC-005-6.

This would ensure that a failed OPC relay is either repaired or replaced in a timely manner.

This is consistent with other SAT protective relays.

TABLE 1INFORMATION GATHERED FOR TEMPORARY INSTRUCTION 2515/194 17 C

Describe Observations/Comments UFSAR Updates to Reflect the Need to Protect Against OPCs:

Using items 1 to 6 below as examples, identify whether the licensee has updated the UFSAR (and supporting documents such as calculations of record, design change modifications, etc.) to ensure plant-specific licensing basis/requirements include discussions of the design features and analyses related to the effects of, and protection for, any OPC design vulnerability:

Yes No Byron Station has revised the UFSAR to add the OPC relays to UFSAR Section 8.3.1.1.2.1 per Document Revision Package 14-094 for Unit 1 EC 389896 and per Document Revision Package 14-090 for EC 389897. The level of detail provided in the UFSAR for the OPC relays is consistent with the level of detail provided in the UFSAR for the other SAT protective relays.

1 The plant-specific analysis and documentation that established the resolution of the OPC design vulnerability, including the failure mode analysis performed.

The plant-specific analysis is documented in Calculations BYR13-176, BYR13-177, and BYR13-221. The failure mode analysis is documented in ECs 389896 and 389897.

The plant-specific analysis is documented in Calculations BYR13-176, Loss of Phase Detection EMTP Analysis BYR13-177, Unit 1 and 2 Loss of Phase Detection Relay Settings,

and BYR13-221, Open Phase Detection LOCA Analysis.

The failure modes and effects analysis is documented in ECs 389896 and 389897. The components evaluated areSEL-451 relays, CTs on the high side of the SATs, new test switches, existing watt-hour meters and overcurrent relays. The classification used; No, low, medium and high impact is based on the impact of a single system or component failure.

A no impact event will allow the new relay system to sustain failure without materially impacting the relay system reliability. In a low impact event, the system will still function to isolate the 4.16 kV and 6.9 kV buses on a phase balance, and will not induce a spurious LOOP. A medium impact event is where protection to the electrical system is lost from a phase imbalance event. In a high impact event a unit LOOP is created.

TABLE 1INFORMATION GATHERED FOR TEMPORARY INSTRUCTION 2515/194 18 Summary:

The SEL-451 Relays will have high impact on spurious actuation of the relay, and failure of current inputs, CTs for high side of SATs will have high impact CT short to ground, open circuit in the CT windings, high impact on failure of the CTs, high impact on failure of overcurrent relay.

The Calculation BYR 13-176 is to provide the logic and setting limits for an algorithm that will be able to detect a single or double open phase in the high voltage (345 kV) connection between SATs and the interconnection with the ring bus.

This calculation examines the OPC event scenario during which the 345 kV line does not to ground on the transmission side, so there may not be enough fault current to be detected and cleared by the switchyard protection scheme; and the energized 345 kV line does not short to ground on the transmission side, so there may be no fault current to be detected and cleared by the switchyard protection scheme.

Calculation BYR13-177 implements the results of Calculation BYR13-176 for the above OPC phase event scenarios.

Calculation BYR13-221 evaluate the impact an open phase event concurrent with a LOCA for Byron and Braidwood stations has on essential (ESF) buses, motors, and MOVs.

2 Description of OPC automatic detection scheme, including how offsite power system OPCs are detected from sensing to alarm devices (loss of one or two phases of the three phases of the offsite power circuit both with and without a high-impedance ground fault condition on the high-voltage side of all credited qualified offsite power sources under all loading and operating configurations; and loss of one or two phases of three phases of switchyard breakers that feed offsite power circuits to transformers without ground.)

The description of the OPC automatic detection scheme is documented in Calculations BYR13-176 and BYR13-177.

The OPC relays will detect an OPC on the 345kV side of the SATs to isolate the SATs and to alarm the condition so that the appropriate operator action can be taken. The OPC relays will detect both one or two open phases with or without a ground. The OPC relays are connected to existing CTs on the high side (345kV) of the SATs. The OPC relays measure phase currents and calculate positive, negative, and zero sequence currents to detect an OPC.

One OPC relay is installed for each SAT.

However, there are two SATs per unit connected to a common switchyard bus. Therefore, a trip of

TABLE 1INFORMATION GATHERED FOR TEMPORARY INSTRUCTION 2515/194 19 one OPC relay will result in both SATs for the unit being isolated. Alarms are provided in the MCR for loss of phase trip and OPC relay low load/trouble conditions.

3 Detection circuit design features to minimize spurious indications for an operable offsite power source in the range of voltage perturbations, such as switching surges, transformer inrush currents, load or generation variations, and lightning strikes, normally expected in the transmission system.

Detection circuit design features to minimize spurious indications for an operable offsite power source are documented in Calculations BYR13-176 and BYR13-177 and in ECs 389896 and 389897.

The potential effects of normally expected transmission system conditions on the OPC relays are summarized as follows:

Range of voltage perturbations, such as switching surges:

The OPC relays use phase and sequence currents as inputs to detect an OPC. The OPC relays do not use voltage as an input to detect an OPC. Therefore, voltage perturbations will not cause a spurious actuation of an OPC relay.

Transformer inrush currents:

The OPC relay trip outputs are manually blocked by opening test switches to prevent spurious OPC relay trips during energization of the SATs. After a minimum load of 2.27 Amps primary current (about 1400 kVA) has been applied to the SATs and min load alarm has reset, the test switches are closed to enable the tripping capability for the OPC relays.

Inrush currents for the Main Power Transformers (MPTs) are not a concern since the Main Generator energizes the MPTs prior to closing the MPT switchyard breakers. Also, Byron does not backfeed the MPTs from the Switchyard.

Load or generation variations:

As discussed in Section 6.6.4 of Calculation BYR13-176, the EMTP analysis evaluated SAT loading conditions from no load to maximum load. Also, as discussed in Section 2.3.2 and in Attachment B (Page B227) of Calculation BYR13-176, the EMTP analysis evaluated generation voltage variation from 0.95 pu to

TABLE 1INFORMATION GATHERED FOR TEMPORARY INSTRUCTION 2515/194 20 1.05 pu. Additionally, according to Section 7.5 of Calculation BYR13-176, the EMTP analysis evaluated the impact of whether or not the Byron Main Generators were operating on the minimum load requirement for the OPC Logic Strings 2 and 3 to function correctly.

Lightning strikes:

The OPC relays have a 0.5 second time delay which would bound the expected transient from a lightning strike and prevent spurious trip of an OPC relay.

4 Alarm features provided in the MCR. Discuss the ESF bus alignment during normal plant operation and the operating procedures in place to address OPCs. If the plant auxiliaries are supplied from the main generator and the offsite power circuit to the ESF bus is configured as a standby power source, then OPCs should be alarmed in the MCR for operators to take corrective action within a reasonable time.

The normal ESF bus alignment is discussed in UFSAR Section 8.3. The credited offsite power circuits are always loaded during normal operation. The alarm features provided in the MCR for OPCs are documented in ECs 389896 and 389897.

5 Describe the automatic protection scheme provided for OPCs including applicable industry standards used for designing the scheme. Design features to minimize spurious actuations for an operable offsite power source in the range of voltage perturbations, such as switching surges, transformer inrush currents, load or generation variations, and lightning strikes, normally expected in the transmission system should be described.

The automatic protection scheme for OPCs is documented in Calculations BYR13-176 and BYR13-177 and in ECs 389896 and 389897.

The standards are listed in Section 4 of Calculation BYR13-176.

Protection Scheme:

Upon detection of an OPC, the OPC relays will actuate the SAT lockout relays, similar to other SAT protective relays. The SAT lockout relays will isolate the SAT by tripping the 345kV feed breakers to the SAT and the SAT secondary side 4.16kV and 6.9kV feed breakers. The associated 4.16kV ESF bus will experience an undervoltage condition. This will start the EDG, load shed the bus, and then load the bus with the required ESF loads. The feed to the associated 6.9kV bus will be automatically transferred from the SAT to the UAT, if it is available. That is, the actuation of the

TABLE 1INFORMATION GATHERED FOR TEMPORARY INSTRUCTION 2515/194 21 OPC relays will produce the same results as the actuation of other SAT protection devices.

The OPC relay logic strings for detecting an OPC without a ground require a minimum load to operate correctly. A MINLOAD interlock is provided in the relay logic. If the SAT load is below the MINLOAD value, the relay trip logic is blocked and a low load alarm will annunciate in the Main Control Room. In addition, the relay will alarm in the Main Control Room in the event of an internal relay failure, and the tripping capability of the relay will be automatically blocked.

A spurious trip of the OPC relay could result in a LOOP. The potential effects of normally expected transmission system conditions on the OPC relays are summarized as follows:

Range of voltage perturbations, such as switching surges:

The OPC relays use phase and sequence currents as inputs to detect an OPC. The OPC relays do not use voltage as an input to detect an OPC. Therefore, voltage perturbations will not cause a spurious actuation of an OPC relay.

Transformer inrush currents:

The OPC relay trip outputs are manually blocked by opening test switches to prevent spurious OPC relay trips during energization of the SATs. After a minimum load of 2.27 Amps primary current (about 1400 kVA) has been applied to the SATs and min load alarm has reset, the test switches are closed to enable the tripping capability for the OPC relays.

Inrush currents for the MPTs are not a concern since the Main Generator energizes the MPTs prior to closing the MPT switchyard breakers.

Also, Byron does not backfeed the MPTs from the Switchyard.

TABLE 1INFORMATION GATHERED FOR TEMPORARY INSTRUCTION 2515/194 22 Load or generation variations:

As discussed in Section 6.6.4 of Calculation BYR13-176, the EMTP analysis evaluated SAT loading conditions from no load to maximum load. Also, as discussed in Section 2.3.2 and in Attachment B (Page B227) of Calculation BYR13-176, the EMTP analysis evaluated generation voltage variation from 0.95 pu to 1.05 pu. Additionally, according to Section 7.5 of Calculation BYR13-176, the EMTP analysis evaluated the impact of whether or not the Byron Main Generators were operating on the minimum load requirement for the OPC Logic Strings 2 and 3 to function correctly.

Lightning strikes:

The OPC relays have a 0.5 second time delay which would bound the expected transient from a lightning strike and prevent spurious trip of an OPC relay.

6 Brief discussion of the licensees analyses performed for accident condition concurrent OPCs which demonstrate that the actuation scheme will transfer ESF loads required to mitigate postulated accidents to an alternate source consistent with accident analyses assumptions to ensure that safety functions are preserved, as required by the licensing bases.

The analysis for an accident condition with a concurrent OPC is documented in Calculation BYR13-221. The analysis assumes a design basis LOCA concurrent with the OPC. A design basis LOCA bounds other design basis accidents and a reactor trip without an accident with respect to electrical loading.

The analysis verified that the ESF loads would not trip their overcurrent protective devices and that the ESF buses would not trip any undervoltage or overcurrent protective devices during the OPC time delay of 0.5 seconds. The analysis also verified that the ESF loads would not be damaged from excessive heating due to negative sequence currents. This assures that the required ESF loads would be capable of starting and running as required when the DGs restore normal voltage to the ESF buses.

TABLE 1INFORMATION GATHERED FOR TEMPORARY INSTRUCTION 2515/194 23 D

Describe Observations/Comments 1 a. The TS Surveillance Requirements and Limiting Condition of Operation for Equipment Used for OPCs Mitigation: Are TSs Surveillance Requirements and Limiting Condition of Operation for equipment used for the mitigation of OPC identified and implemented consistent with the operability requirements specified in the plant TSs?

b. If the licensee determined that TSs are unaffected because OPC is being addressed by licensee-controlled programs, is the technical justification adequate?

Yes No Yes No

a. Byron Station is using NSR protective relays connected to the SAT high side (345 kV) bushing to detect and protect against OPCs.

Upon detection of an OPC, the OPC relays trip the NSR SAT lockout relays. Each OPC relay is another offsite source protective relay. The OPC relays do not have any safety-related inputs from ESF bus voltage or current, and the OPC relay outputs do not trip any ESF bus breakers or start any safety-related DGs.

Therefore, the OPC relays are being treated in the same manner as other offsite power source protective relays, and the OPC relays do not require addition to the TSs.

b. Steps have been added to the Normal and Reserve Offsite Power Availability Weekly Surveillances 1BOSR 8.1.1-1 and 2BOSR 8.1.1-1 to verify that the SAT OPC relays are functioning normally. If an OPC relay is identified not to be functioning normally, then the procedures direct the operator to take the appropriate compensatory actions to monitor ESF bus voltage and to open the affected SAT feed breaker if necessary.

E Describe Observations/Comments Provide a brief summary of the Open Phase Condition plant modification performed under Title 10 of the Code of Federal Regulations, Part 50.59 The 50.59 evaluation concludes that no U.S. Nuclear Regulatory Commission review is required.

The OPC relays will detect an OPC on the 345kV side of the SATs to isolate the SATs and to alarm the condition so that the appropriate operator action can be taken. The OPC relays will detect both one or two open phases with or without a ground. The OPC relays are connected to existing CTs on the high side (345kV) of the SATs. The OPC relays measure phase currents and calculate positive, negative, and zero sequence currents to detect an OPC.

TABLE 1INFORMATION GATHERED FOR TEMPORARY INSTRUCTION 2515/194 24 One OPC relay is installed for each SAT.

However, there are two SATs per unit connected to a common switchyard bus. Therefore, a trip of one OPC relay will result in both SATs for the unit being isolated. Alarms are provided in the MCR for loss of phase trip and OPC relay low load/trouble conditions.

Upon detection of an OPC, the OPC relays will actuate the SAT lockout relays, similar to other SAT protective relays. The SAT lockout relays will isolate the SAT by tripping the 345kV feed breakers to the SAT and the SAT secondary side 4.16kV and 6.9kV feed breakers. The associated 4.16kV ESF bus will experience an undervoltage condition. This will start the EDG, load shed the bus, and then load the bus with the required ESF loads. The feed to the associated 6.9kV bus will be automatically transferred from the SAT to the UAT, if it is available. That is, the actuation of the OPC relays will produce the same results as the actuation of other SAT protection devices.

The OPC relay logic strings for detecting an OPC without a ground require a minimum load to operate correctly. A MINLOAD interlock is provided in the relay logic. If the SAT load is below the MINLOAD value, the relay trip logic is blocked and a low load alarm will annunciate in the MCR. In addition, the relay will alarm in the MCR in the event of an internal relay failure, and the tripping capability of the relay will be automatically blocked.

A spurious trip of the OPC relay could result in a LOOP. However, the SEL-451-5 microprocessor-based relays are very reliable and are widely used in the industry. A review in industry operating experience identified instances of improper settings or testing of similar relay models, but no failures of these devices.

The 50.59 Evaluation determined that due to the balancing of the positive effects (isolating a degraded power source) and the potential negative effects (inappropriate isolation of a functioning power source), the proposed activity does not result in a more than a minimal increase in the frequency of occurrence of an accident previously evaluated in the UFSAR or result in a more than minimal increase in the frequency of a malfunction of an structures, systems, and components.