ML18197A219

From kanterella
Jump to navigation Jump to search
APR1400 Chapter 8, Electric Power, Final Safety Evaluation Report
ML18197A219
Person / Time
Site: 05200046
Issue date: 09/28/2018
From: George Wunder
NRC/NRO/DLSE/LB2
To:
Wunder G / NRO/ 415-1794
Shared Package
ML18087A364 List:
References
Chapter 8
Download: ML18197A219 (111)
v • d • e


Text

8 ELECTRIC POWER Chapter 8, Electric Power, of this safety evaluation (SE) describes the Nuclear Regulatory Commission (NRC) staffs review of Chapter 8, Electric Power, of the Advanced Power Reactor 1400 (APR1400) Design Control Document (DCD), Revision 3, submitted by Korea Electric Power Corporation (KEPCO) and Korea Hydro & Nuclear Power Co., Ltd (KHNP),

hereinafter referred to as the applicant, for the design certification (DC) of the APR1400 and the NRC staffs, hereinafter referred to as the staff, conclusions on the basis of that review.

8.1 Introduction 8.1.1 Introduction The APR1400 electric power system is the source of power for station auxiliaries during normal operation, and for the reactor protection system (RPS) and engineered safety features (ESF) during abnormal and accident conditions. The objective of the review is to determine the adequacy of the applicants description of the offsite power system, onsite power system, station blackout capabilities, and the acceptance criteria to be implemented in the design.

Furthermore, the staff reviews of the design ensures that these systems are designed to have adequate capability, redundancy, independence, and testability in compliance with the regulations and conformance to the guidance established by the NRC.

8.1.2 Summary of Application Section 8.1, Introduction, of the APR1400 DCD describes the electric power system. It includes three alternating current (ac) power sources: the power supplied by the unit main generator (MG), the offsite power supplied by the transmission grid system, and the onsite emergency Class 1E (safety-related) power supplied by standby emergency diesel generators (EDGs). The plant electric power system also includes an additional non-Class 1E (non-safety-related) gas turbine generator (GTG) to supply the required loads in the event of a loss of all ac emergency onsite power sources as well as offsite power sources (i.e. station blackout (SBO)).

In addition to the ac power sources, the plant is equipped with an onsite, Class 1E and non-Class 1E direct current (dc) systems that provide the required dc power to dc-operated components and to essential plant instrumentation and controls (I&Cs). The Class 1E and non-Class 1E dc systems also provide power to Class 1E and non-Class 1E 120 Volt ac (Vac) I&Cs loads through inverters.

8.1.3 Regulatory Basis The relevant requirements of the Commissions regulations for the electric power system and the associated acceptance criteria are given in Section 8.1 of NUREG-0800, the Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition, and are summarized below. NUREG-0800 identifies the acceptance criteria and guidelines and their applicability to various sections of SRP Chapter 8. The acceptance criteria defines the Commissions requirements for power systems important to safety. The guidelines amplify these requirements and provide a basis upon which to evaluate the conformance of the power systems to the requirements. SRP Section 8.2, Offsite Power System, Section 8.3.1, AC Power systems, Section 8.3.2, DC Power Systems, and Section 8.4, Station Blackout, contain the specific review interfaces for each SRP section.

8-1

Other regulatory criteria guiding the staffs review are

1. Section 52.47(b)(1) of 10 CFR, which requires that a DC application contain the proposed inspections, tests, analyses and acceptance criteria (ITAAC) that are necessary and sufficient to provide reasonable assurance that, if the inspections, tests, and analyses are performed and the acceptance criteria met, a facility that incorporates the DC is built and will operate in conformity with the DC, the provisions of the Atomic Energy Act of 1954 (AEA), as amended, and the NRC rules and regulations.
2. Section 52.80(a) of 10 CFR, which requires that a COL application contain the proposed inspections, tests, and analyses, including those applicable to emergency planning, that the licensee shall perform, and the acceptance criteria that are necessary and sufficient to provide reasonable assurance that, if the inspections, tests, and analyses are performed and the acceptance criteria met, the facility has been constructed and will operate in conformity with the COL, the provisions of the AEA, and the NRC's rules and regulations.

8.1.4 Technical Evaluation The staff reviewed the APR1400 DCD Tier 1 and Tier 2 to assure that the applicant provided a discussion about the compliance to the regulations and conformance to the regulatory guidance as shown in DCD Tier 2 Table 8.1-2, Criteria and Guidelines for Electric Power Systems, and Table 1.9-2, APR1400 Conformance with the Standard Review Plan. The details of the staffs review in regards to compliance to the regulations and conformance to the regulatory guidance appear in subsequent sections of this chapter.

8.1.4.1 Compliance with 10 CFR 52.47(b)(1) and 10 CFR 52.80(a) 10 CFR 52.47(b)(1), Contents of Applications; Technical Information, and 10 CFR 52.80(a),

Contents of Applications; Additional Technical Information, are applicable to the APR1400 design, as described in DCD Tier 2 Table 8.1-2, Criteria and Guidelines for Electric Power Systems. However, the DCD did not discuss how the design meets these requirements.

Therefore, In RAI 177-8166, Question 08.01-4 (ML15243A475), the staff requested that the applicant discuss how the APR1400 design complies with the requirements listed in Section 8.1.3 of this report.

In its response to RAI 177-8166, Question 08.01-4 (ML15345A339), the applicant stated that the electric power system of APR1400 design complies with the requirements of 10 CFR 52.47(b)(1) and 10 CFR 52.80(a). As it pertains to 10 CFR 52.47(b)(1) and 10 CFR 52.80(a), in the RAI response, the applicant stated that the ITAAC provides reasonable assurance that a facility using the APR1400 DC will be constructed in accordance with the DC, and that any future facility will be constructed and operated in conformity with the combined license. The applicant also stated that ITAAC proposed for the electrical systems of APR1400 are described in DCD Tier 2, Section 14.3.2.6, ITAAC for Electrical Systems, and Tier 1, Section 2.6, Electric Power. However, the applicant did not provide a statement or discussion in the DCD to indicate applicability of 10 CFR 52.47(b)(1) and 10 CFR 52.80(a).

Since the applicant did not provide a statement or discussion in the DCD to indicate applicability of 10 CFR 52.47(b)(1) and 10 CFR 52.80(a), the staff requested additional information in RAI 437-8540, Question 08.01-17 (ML16068A196). In its response to RAI 437-8540, Question 08.01-17, (ML16097A523), the applicant added DCD Tier 2 Section 8.2.2.4, Conformance with 8-2

10 CFR 52.47(b)(1) and 10 CFR 52.80(a), Section 8.3.1.2.6, Conformance with 10 CFR 52.47(b)(1) and 10 CFR 52.80(a), Section 8.3.2.2.5, Conformance with 10 CFR 52.47(b)(1) and 10 CFR 52.80(a),and Section 8.4.2.3, Conformance with 10 CFR 52.47(b)(1) and 10 CFR 52.80(a), and revised Section 8.3.1.2, Analysis, and Section 8.3.2.2, Analysis. The response addressed applicability of 10 CFR 52.47(b)(1) and 10 CFR 52.80(a) in the sections mentioned above. The applicant in the DCD Tier 2 sections mentioned above stated that the ITAAC are provided in DCD Tier 1 Section 14.3.2.6 and the electrical design conforms to 10 CFR 52.47(b)(1) and 10 CFR 52.80(a).

The staff determined that the response was acceptable because in DCD Tier 2, the applicant explained that the APR1400 DC contains the necessary ITAAC to provide assurance that if the inspections, tests, and analyses are performed and the acceptance criteria met, then a plant that incorporates the APR1400 DC has been constructed and will be operated in accordance with the DC. Furthermore, a COL applicant utilizing the APR1400 DC will include the necessary ITAAC to provide reasonable assurance that the facility has been constructed and will be operated in conformity with the combined license. Thus, the staff finds that since the ITAAC are provided in DCD Tier 2 Section 14.3.2.6 for electrical systems, the applicant conforms to 10 CFR 52.47(b)(1) and 10 CFR 52.80(a). The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response and finds that RAI 437-8540, Question 08.01-17, is resolved and closed.

8.1.4.2 Criteria and Guidelines for Electric Power Systems 8.1.4.2.1 General design criterion 5, sharing of structures, systems, and components Part 50 of 10 CFR, Appendix A, General Design Criteria (GDC) 5, Sharing of Structures, Systems, and Components, states that SSCs important to safety shall not be shared among nuclear power units unless it can be shown that such sharing will not significantly impair their ability to perform their safety functions, including, in the event of an accident in one unit, an orderly shutdown and cooldown of the remaining units.

DCD Tier 2 Section 8.2.1, System Description, indicates that the APR1400 is designed to meet GDC 5. However, DCD Tier 2 Table 8.1-2, Criteria and Guidelines for Electric Power Systems, indicated that GDC 5 is not applicable to the APR1400 design. Therefore, in RAI 177-8166, Question 08.01-2, (ML15243A475), the staff asked the applicant to clarify the inconsistency between DCD Tier 2 Section 8.2.1 and Table 8.1-2.

In its response to RAI 177-8166, Question 08.01-2, (ML15321A290), the applicant stated, in part, that the requirements of GDC 5 pertain to the sharing of SSCs between units and since the APR1400 design is considered as a single unit with no shared SSCs, then the design is considered to meet the GDC 5 requirements. The applicant also revised DCD Tier 2, Table 8.1-2 to indicate the applicability of GDC 5 to DCD Tier 2, Sections 8.2,Offsite Power System, 8.3.1, AC Power Systems, and 8.3.2 DC Power Systems. The staff reviewed the applicants response and noted that the addition of GDC 5 to DCD Tier 2 Table 8.1-2 is not consistent with the response which indicated that the APR1400 design is a single unit plant and that GDC 5 applies to the sharing of SSCs between units. Therefore, in follow-up RAI 437-8540, Question 08.01-15 (ML16068A196), the staff requested the applicant to remove the GDC 5 reference in DCD Tier 2 Sections 8.2.1, 8.1.3.3, General Design Criteria, NRC Regulatory Guides, Branch Technical Positions, Generic Letters, and Industry Standards, and DCD Tier 2, Table 8.1-2 to be consistent with the response and the applicability of GDC 5 to the APR1400 design.

8-3

In its response to RAI 437-8540, Question 08.01-15 (ML16093A043), the applicant revised DCD Tier 2, Section 8.1.3.3, General Design Criteria, NRC Regulatory Guides, Branch Technical Positions, Generic Letters, and Industry Standards; Section 8.2.1, System Description; Section 8.2.2.1, Conformance with 10 CFR Part 50; Section 8.3.1.2, Analysis; Section 8.3.2.2, Analysis; and Table 8.1-2, Criteria and Guidelines for Electric Power Systems, by deleting the references to GDC 5 and RG 1.81,Shared Emergency and Shutdown Electric Systems for Multi-Unit Nuclear Power Plants indicating that GDC 5 is not applicable to the APR1400 design. The staff reviewed the response and verified the proposed DCD changes and determined that the response was acceptable because the applicant clarified that GDC 5 is not applicable to the APR1400 design and made the appropriate DCD changes. However, the staff notes that if the APR1400 design is applied to a multi-unit plant site related to a COL application, then GDC 5 would apply. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response and finds that RAI 437-8540, Question 08.01-15, is resolved and closed.

8.1.4.2.2 Conformance to SECY-90-016 The staff in SECY-90-016 identified station blackout (SBO) in electrical power systems as a significant issue to reactor safety for evolutionary ALWR designs. The applicant in APR1400 DCD Table 8.1-2, Criteria and Guidelines for Electric Power Systems listed the Commission Paper SECY-90-016, Evolutionary Light Water Reactor (LWR) Certification Issues and Their Relationships To Current Regulatory Requirements, but did not discuss the applicability to the design in DCD Chapter 8 or any other DCD sections. Therefore, in RAI 177-8166, Question 08.01-6 (ML15243A475), the staff requested that the applicant provide a discussion on how the APR1400 design meets the guidance in SECY-90-016 with respect to SBO.

In its response to RAI 177-8166, Question 08.01-6 (ML15352A274), the applicant stated in part that SBO rule (10 CFR 50.63, Loss of all Alternating Current Power) and SECY-90-016 are applicable to the APR1400 electric power system design. In addition, the APR1400 design meets the recommendation in SECY-90-016 but the applicant did not include any statements in the DCD on conformance to SECY-90-016. Therefore, in follow-up RAI 437-8540, Question 08.01-18, (ML16068A196) the staff requested that the applicant provide an explanation or statement in the DCD as to how the APR1400 design meets SECY-90-016.

In its response to RAI 437-8540, Question 08.01-18 (ML16123A388), the applicant revised DCD Tier 2, Section 8.4.1.1, Description, with a reference to SECY-90-016, explaining that the design features satisfy SECY-90-016. The staffs review of conformance to SECY-90-016 is discussed in Section 8.4, Station Blackout, of this report.

The staff finds that the response to RAI 437-8540, Question 08.01-18, is acceptable because the applicant provided discussions in the DCD, which explains how SECY-90-016 applies to the APR1400 design. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response and finds that RAI 437-8540, Question 08.01-18, is resolved and closed.

8.1.4.2.3 Conformance to SECY-91-078 GDC 17 requires that onsite and offsite electrical power be provided to facilitate the functioning of SSCs important to safety. RG 1.206, Combined License Applications for Nuclear Power Plants states that GDC 17 requirements for the interface between the onsite ac and offsite power system in evolutionary light water reactor (LWR) design applications are documented in 8-4

SECY-91-078, EPRIs Requirements Document and Additional Evolutionary LWR Certification Issues, (NRC,1991, ML072150592) Design Requirements. SRP Section 8.3, Onsite Power Systems, states in part that the electrical power system design should be based on SECY 078, to include at least one offsite circuit to each redundant safety division directly with no intervening non-safety buses and an alternate offsite power source to non-safety loads. Thus, in order to comply with GDC 17, the applicant should conform to SECY-91-078 or provide other acceptable justification.

In RAI 16-7915, Question 08.01-1 (ML15142A611), the staff explained that each unit auxiliary transformer (UAT) and standby auxiliary transformer (SAT) has two secondary voltage windings, rated 13.8 kilo Volts (kV) and 4.16 kV. From DCD Tier 2 Figure 8.1-1, Electric Power System Single-Line Diagram, it is noted that the 13.8 kV winding of each unit auxiliary transformer (UAT) and standby auxiliary transformer (SAT) is connected to non-Class 1E buses. The 4.16 kV winding is connected to 4.16 kV safety-related buses, as well as non-safety-related permanent non-safety (PNS) buses. The staff also explained that in accordance with SECY-91-078, EPRIs Requirements Document and Additional Evolutionary LWR Certification Issues, (ML072150592), the offsite power shall be directly supplied to the emergency Class 1E buses without any intervening non-Class 1E buses. The staff noted that both Class 1E and non-Class 1E buses are connected to the same UAT, and similarly for the SAT, rendering the emergency Class 1E buses/switchgear vulnerable to potential failure as a result of a failure of the non-Class 1E bus/switchgear. In addition, the safety loads could be subjected to transients caused by the non-safety loads, and result in additional failure points between the offsite power sources and the safety loads. Therefore, the staff determined that the proposed design does not meet the SECY-91-078 requirements.

Furthermore, GDC 17 requires, in part, that the onsite electrical distribution system has sufficient independence, redundancy, and testability to perform its safety functions assuming a single failure. In addition, SRP Section 8.2, Acceptance Criterion 4; and Section 8.3, AC Power Systems (Onsite), Acceptance Criteria 4J, discuss this requirement. The proposed design does not provide capability to minimize the probability of losing electric power at the safety bus, since there is potential that the Class 1E buses are vulnerable to failures as a result of failures of the non-Class 1E buses. Therefore, the staff determined that the proposed design does not meet the GDC 17 requirement.

Therefore, in RAI 16-7915, Question 08.01-1, the staff requested that the applicant provide the following:

a) A power distribution configuration that meets the requirements of SECY-91-078 and GDC 17, such that the failure of the non-safety bus/switchgear does not adversely impact the Class 1E Emergency Power Bus/Switchgear.

b) Revised single line diagrams and descriptions in DCD chapters that reflect any changes in the power distribution systems.

In its response to RAI 16-7915, Question 08.01-1 (ML15173A092), the applicant stated in part, the following:

The APR1400 offsite power system is designed in accordance with IEEE Std. 765 IEEE Standard for Preferred Power Supply (PPS) for Nuclear Power Generating Stations (NPGS), which provides detail design guidance and design criteria to properly meet 8-5

GDC 17. In particular, the APR1400 adopts the enhanced preferred power supply (PPS) design mentioned in Section 4.5.c of IEEE Std. 765.

Since each preferred power supply (PPS) circuit connects directly to redundant 4.16 kV Class 1E buses, failure of a non-Class 1E bus does not prevent the PPS circuit from supplying the offsite power to the Class 1E buses, provided the failure is properly isolated by the protective devices.

The Class 1E buses are not subject to potential failure due to a failure of the non-Class 1E buses since the non-Class 1E electrical equipment is designed to preclude adverse effects on Class 1E electrical equipment due to its failure during normal, accident, or post-accident modes of plant operation and each Class 1E and non-Class 1E buses are protected by properly coordinated Class 1E and non-Class 1E protection devices as described in DCD Tier 2 Chapter 8, Section 8.1.3.2.j and Section 8.3.1.3.4.

KHNP recognizes that in case of a specific failure, e.g. fail-to-open of the bus incoming breaker upon the fault at a non-Class 1E MV bus, the fault effect could propagate to the Class 1E buses which are fed from the same SAT or UAT as the faulted non-Class 1E bus.

KHNP plans to implement design enhancement to the incoming breakers at the non-Class 1E MV buses to address potential risk associated with fault at non-Class 1E MV bus affecting Class 1E MV bus.

The applicant proposed to enhance the design by providing two independent circuit breakers, connected in series, and used as incoming breakers for all non-Class 1E 13.8 kV and 4.16 kV switchgears, and provided the proposed design in DCD, Tier 1 Figure 2.6.1-1, AC Electrical Power Distribution System; DCD Tier 2, Figure 8.1-1; and Table 8.1-2, Criteria and Guidelines for Electric Power Systems. The applicant explained that the design enhancement would significantly reduce the probability of failure of the non-Class 1E incoming breakers in case of a bus fault. The applicant also explained that only one of the two independent circuit breakers will be used for switching operation and protection, while the other breaker will be used only for protection. The applicant also explained that to avoid a common cause failure of the two circuit breakers, each circuit breaker will be independent from the other, both physically and functionally, and will have its own protective relaying provisions.

The staff reviewed the response to RAI 16-7915, Question 08.01-1 and found that the response was not acceptable because of the following: (1) a potential for failure of the Class 1E system due to the failure of the non-class 1E system, (2) the safety loads could be subjected to transients caused by the non-safety loads, (3) the lack of separation between the non-safety and safety system compromises the safety system reliability, and 4) the proposed design did not meet the intent of SECY-91-078 for compliance with GDC 17. In order to conform to the guidance in SECY-91-078 to satisfy GDC 17, the staffs position, as discussed in SECY-91-078, requires: (1) that an alternate power source to non-safety loads, unless it can be demonstrated that the design will ensure that transients for loss of non-safety power events that are less severe than those associated with the turbine-trip-only, and (2) that at least one offsite circuit to each redundant Class 1E (safety) division should be supplied directly from one of the offsite power sources with no intervening non-Class 1E (non-safety related) buses in such a manner that the offsite source can power the safety buses if any non-safety bus should fail.

8-6

In its response to RAI 16-7915, Question 08.01-1, (ML15173A092), the applicant also did not provide analysis to show how the proposed additional circuit breaker would work in the two breaker scheme to protect the Class 1E buses due to a failure by the non-Class 1E breakers.

The staff also noted that IEEE Std. 765, Standard for Preferred Power Supply (PPS) for Nuclear Power Generating Stations (NPGS) has not been endorsed in applicable RGs (RG 1.32, Criteria for Safety-Related Electric Power Systems for Nuclear Power Plants, and RG 1.75, Physical Independence of Electric Systems). IEEE Std. 308-2001, IEEE Standard Criteria for Class 1E Power Systems for Nuclear Power Generating Stations as endorsed by RG 1.32, states that the non-Class 1E circuits shall meet the independence and isolation requirements as established in IEEE Std. 384-1992, IEEE Standard Criteria for Independence of Class 1E Equipment and Circuits. IEEE Std. 384-1992 as endorsed by RG 1.75 states that the applicant should follow the guidance in IEEE Std. 384 to address independence and isolation of Class 1E and non-Class 1E circuits.

Therefore, in follow-up RAI 338-8426, Question 08.01-14, (ML15351A297), the staff requested that the applicant provide an explanation as to how the proposed design meets GDC 17 requirements, and guidance in SRP 8.3, SECY-91-078, RG 1.32, RG 1.75, and applicable industry standards. Specifically, the staff requested the applicant to explain how the APR1400 design satisfies the SECY-91-078 guidance with an alternate power source to non-safety loads and at least one offsite circuit to each redundant Class 1E (safety) division should be supplied directly from one of the offsite power sources with no intervening non-Class 1E (non-safety related) buses. For the direct connection from offsite to the Class 1E buses, the staff requested the applicant to explain how the sharing of the common 4.16kV secondary UAT and SAT winding would impact the Class 1E buses if there was a transient or failure on the non-Class 1E buses and equipment.

In its response to RAI 338-8426, Question 08.01-14 (ML15004A025), regarding an alternate power source to the non-safety loads, the applicant explained that the alternate power source to the non-safety loads is through the SATs. The design includes two physically separate offsite power sources, referred to as the normal and alternate preferred power supplies, and are provided for all non-safety loads as well as safety loads. The normal preferred power supply is provided through the UATs and the alternate preferred power supply is provided through the SATs. The staff finds that the alternate power source to the non-safety loads as required by SECY-91-078 and fed through the SATs is acceptable because it provides an alternate source to feed the non-safety loads.

In regards to the direct connection from offsite to the Class 1E buses, where the APR1400 design includes sharing of a common transformer winding to feed both safety and non-safety buses, the staff had the following concerns: (1) maintaining voltage regulation at the safety buses, (2) transients from the non-safety loads or system impacting the safety loads or system, and (3) the creation of a failure point between the offsite power and the safety buses.

In its response to RAI 338-8426, Question 08.01-14 (ML17004A025), regarding the APR1400 design where the non-safety and safety buses are being fed from a common transformer winding, the applicant addressed the staffs three concerns as discussed below.

The applicant addressed the staffs first concern of voltage regulation at the safety buses by explaining that the on-load tap changers (OLTCs) at the primary side of the UATs and SATs ensure that the voltage regulation at the medium voltage (MV) safety buses is maintained in an acceptable range, and a voltage regulation study was performed which confirmed the voltage 8-7

range. Technical report Onsite AC Power System Analysis (APR1400-E-E-NR-14001-P) includes a description of the voltage regulation study that was performed. Staff reviewed this report, and further details of the staffs review is in Section 8.3 of this report. Regarding adequate voltage at the safety buses, the staff finds that the OLTCs ensure and the voltage regulation study show that the voltage at the medium voltage safety buses is maintained in an acceptable range. Therefore, the staff finds that the response is acceptable in regard to the first concern of voltage regulation at the safety buses.

The applicant addressed the staffs second concern related to potential for transients at the safety buses caused by accident or operating occurrences on the non-safety buses by discussing: (a) large motor starting, (b) motor reacceleration during a bus transfer condition, or (c) short circuit. The applicant in its RAI response provided the following explanations:

a. A large motor starting study, discussed in technical report APR1400-E-E-NR-14001-P, has been performed and the results of the study demonstrate that voltage variation at the safety buses is maintained within acceptable limits during the non-safety large motor starting condition.
b. The transient effect of re-acceleration of non-safety motors during a bus transfer is assessed by the fast bus transfer study, as discussed in the technical report, and the result of the study concludes that the re-acceleration of non-safety motors do not hinder the re-acceleration of the safety motors.
c. During a short circuit on the non-safety bus, the design allows the safety bus to remain connected, or to be transferred to the alternate power supply based on a failure mode effects analysis (FMEA).

The staff reviewed the technical report and the RAI response. As a result, the staff finds that the applicants response to the staffs second concern is acceptable because of the following:

  • The applicant performed a large motor starting study, which demonstrated that voltages at the safety buses would be maintained within acceptable limits during large non-safety motor starting. Therefore, when large motors are starting, the safety buses and equipment would be able to perform their intended function.
  • The applicant performed the fast bus transfer study which demonstrated that the re-acceleration of non-safety motors do not hinder the re-acceleration of the safety motors.
  • The applicant provided a FMEA which showed that during a short circuit on the non-safety bus, the design allows the safety bus to remain connected, or to be transferred to the alternate power supply.

The applicant demonstrated through the large motor starting study and the FMEA that the Class 1E equipment will be able to perform their intended function under various scenarios and transients discussed above. The staff reviewed the technical report and verified the assumptions and methodology of the studies. Further details of the staffs review is in Section 8.3 of this report. Since the applicant demonstrated that the Class 1E systems can perform their intended function, the staff finds transients from the non-safety loads will not affect the Class 1E equipment from performing its intended function. Therefore, the staffs second 8-8

concern regarding transients from the non-safety loads or system impacting the safety loads or system is addressed and resolved.

The applicant addressed the staffs third concern by explaining that the UAT (or SAT) relays are able to detect an electric fault at a connection point between safety or non-safety buses. Power is then transferred to the alternate PPS or to the EDG power source, to eliminate the failure point between the offsite power source and the safety buses. The staff finds that the applicants response to the staffs third concern is acceptable because the relays at the UATs and SATs have the ability to detect a fault at the transformer safety and non-safety connection point. In addition, the applicant provided a FMEA which demonstrated that the APR1400 offsite power system retains its ability to feed the safety loads of both divisions through both (normal and alternate) PPS upon a single failure on the non-safety bus.

The staff found that the response to RAI 338-8426, Question 08.01-14 was acceptable as evaluated above; however, the applicant did not include DCD changes for the proposed design or an ITAAC to verify that transients on the non-safety system would not impact the safety systems. Therefore, in RAI 539-8730, Question 08.01-21 (ML17052A018) the staff requested the applicant to incorporate in the DCD, its justification to support that the APR1400 design is in compliance with GDC 17, and in conformance to SECY-91-078, as discussed in the response to RAI 338-8426, Question 08.01-14 (ML17004A023). In addition, the staff requested that the applicant explain how (e.g. COL Item, ITAAC) they will verify that transients on the non-safety buses will not impact the safety buses as described in the APR1400 design.

In its initial response to RAI 539-8730, Question 08.01-21, (ML17153A256), the applicant added DCD Tier 2, Section 8.3.1.3.9, Bus Transfer Study, to describe the bus transfer study discussed in the response to RAI 338-8426, Question 08.01-14. In addition, the applicant added language in DCD Tier 2, Section 14.3.2.6 related to the DCD Tier 1, Section 2.6.1.1, Design Description, and DCD Tier 2, Section 8.3.1.1.2.3, System Independence changes explaining that transients or failures occurring in the non-Class 1E buses will not cause failure of the Class 1E loads. However, in its response to RAI 539-8730, Question 08.01-21, the applicant used the incorrect reference number for SECY-91-078 in Section 8.3. In the revised response to RAI 539-8730, Question 08.01-21, (ML18129A385), the applicant corrected this error. Based on the review of DCD Revision 3, the staff has confirmed incorporation of the changes described above; therefore, RAI 539-8730, Question 08.01-21, is resolved and closed.

The applicant added DCD Tier 1, Table 2.6.1-3, AC Electric Power Distribution System ITAAC, ITAAC Item 26 for the COL applicant to verify that the Class 1E loads will not fail due to transients on non-Class 1E electrical equipment during non-Class 1E large motor starting or re-acceleration. The COL applicant will be required to perform analyses as stated in DCD Tier 1, Table 2.6.1-3, ITAAC Item 26.a and Item 26.b to assure that Class 1E loads will not fail due to transients on non-Class 1E electrical equipment during non-Class 1E large motor starting or re-acceleration. The staff finds that the proposed ITAAC is acceptable because it provides verification by performing transient analyses (i.e., motor starting, bus transfer analysis), to demonstrate that the Class 1E buses and motors will not be adversely impacted by transients on the non-Class 1E electrical equipment.

The applicant explained that the existing DCD Tier 1, Table 2.6.1-3, ITAAC Item 20 verifies that the Class 1E buses remain unaffected by a short-circuit fault on the non-Class 1E buses or circuits by proper coordination of overcurrent protection for the Class 1E power system. The staff finds that ITAAC Item 20 is acceptable because it provides verification of the overcurrent 8-9

protection and coordination scheme, which assures that short-circuit fault on the non-Class 1E buses or circuits will not impact the Class 1E buses.

In addition, the applicant explained that the existing ITAAC Item 8 of Table 2.6.1-3 in DCD Tier 1 verifies that the medium voltage Class 1E buses can be automatically transferred satisfactorily to the alternate preferred offsite power supply should the normal preferred offsite power supply not be available. The staff finds that the use of ITAAC Item 8 is acceptable because it provides verification that the Class 1E MV bus transfer to the alternate preferred supply will occur if the normal preferred offsite source is not available.

The staff finds that the response to RAI 539-8730, Question 08.01-21 (ML17153A256), is acceptable because the applicant included in DCD Tier 1 and Tier 2 the changes discussed above to address how the APR1400 design is in compliance with GDC 17 and in conformance to the guidance in SECY-91-078. Specifically, (1) the applicant will assure that short-circuit faults on the non-Class 1E buses will not affect the Class 1E buses with existing ITAAC 20, (2) existing ITAAC 8 will assure that medium voltage Class 1E buses can be automatically transferred satisfactorily to the alternate preferred offsite power supply should the normal preferred offsite power supply not be available, and (3) the new ITAAC 26 will verify by analysis that large motor starting, and the bus transfer during motor re-acceleration can be accomplished such that the Class 1E equipment will be able to perform its intended function. Based on the review of DCD Revision 3, the staff has confirmed incorporation of the changes described above; therefore, RAI 539-8730, Question 08.01-21, is resolved and closed.

Considering both Class 1E and non-Class 1E buses are connected to the same UAT, and similarly, for the SAT, the staff finds that the applicant demonstrated through the large motor starting study and the FMEA, that the Class 1E equipment will be able to perform their intended function under various scenarios and transients. Furthermore, the staff finds that ITAAC are provided to verify that transients or failures occurring in the non-Class 1E buses will not cause failure of the Class 1E loads. Thus, the staff finds that the APR1400 electrical design conforms to SECY-91-078 since; (1) there is an alternate source to feed the non-safety loads and (2) the safety buses and equipment will be able to perform their intended function.

8.1.5 Combined License Information Items There are no COL information items for DCD Tier 2 Section 8.1.

8.1.6 Conclusion As set forth above, the staff has reviewed all of the relevant information that is applicable to the APR1400 onsite ac power system design and evaluated its compliance with 10 CFR 52.47(b)(1) and 10 CFR 52.80(a). The staff concludes that the applicant has provided sufficient information in the DCD and identified necessary analyses to support the bases for their conclusions for the COL applicant.

8.2 Offsite Power System The APR1400 standard plant is designed to be connected to the offsite electric power grid via the switchyard interconnections. The offsite power system is intended to provide at least two physically independent sources of power for safe shutdown of the reactor.

8-10

8.2.1 Introduction The offsite power system is the preferred source of power for the RPS and ESF during normal, abnormal, and accident conditions. It encompasses the transmission network, overhead or underground transmission lines, transmission line towers, switchyard components and control systems, switchyard battery systems, transmission tie lines, MG, generator circuit breaker (GCB), main transformer (MT), UATs, SATs, isolated phase bus (IPB), and the electrical components associated with them. The function of the offsite power system is to supply power to both Class 1E and non-Class 1E plant loads. The offsite power system is also connected to the MG via its output transformer, the MT. Electric power from the transmission network to the onsite electrical distribution system is supplied by two physically independent circuits. The intended function of the offsite power system is to provide sufficient capacity and capability to ensure that the SSCs important to safety perform as intended. The objective of the staff review is to verify that the offsite power system satisfies the requirements of 10 CFR Part 50, Appendix A, GDCs 5, 17, and 18, and will perform its design function during all plant operating and accident conditions.

8.2.2 Summary of Application DCD Tier 1: The Tier 1 information associated with this section is found in DCD Tier 1, Section 2.6.1, AC Electric Power Distribution System, and Table 2.6.1-3, AC Electric Power Distribution System Inspections, Tests, Analyses, and Acceptance Criteria. Section 2.6.1 in DCD Tier 1 provides a general design description of the APR1400 standard ac electric power distribution system. Table 2.6.1-3 provides the detailed ITAAC for the ac electric power distribution systems.

DCD Tier 2: The applicant has provided a Tier 2 system description in DCD Tier 2, Section 8.2, Offsite Power System, summarized here in part, as follows:

The offsite power system is the preferred source of power for the RPS and ESF during normal, abnormal, and accident conditions. It encompasses the transmission network, overhead or underground transmission lines, transmission line towers, switchyard components and control systems, switchyard battery systems, transmission tie lines, MG, GCB, MT, UATs, SATs, IPB, and the electrical components associated with them.

The boundaries between the offsite power system and the onsite power system are the incoming circuit breakers of the switchgears, which are included in the onsite power system.

The switchyard is connected to the transmission lines to transmit the electricity produced by the APR1400 to the transmission network and to the transmission tie lines to provide offsite power to the auxiliary and service loads of the APR1400.

Electric power from the transmission network to the onsite electrical distribution system is supplied by two physically independent circuits. The COL applicant is to identify those independent circuits (COL Item 8.2(1)). The APR1400 is designed to meet the requirements in 10 CFR Part 50, Appendix A, and GDC 2, 4, 5, 17, and 18 (DCD Tier 2, Section 8.2.4, References 1 through 5, respectively).

ITAAC: The ITAAC associated with Tier 2, Section 8.2, Offsite Power System, are described in DCD Tier 1, Section 2.6, AC Electric Power Distribution System and the detailed ITAAC are 8-11

given in Table 2.6.1-3, AC Electric Power Distribution Systems Inspections, Tests, Analyses, and Acceptance Criteria.

Technical Specifications (TS): The TS associated with DCD Tier 2, Section 8.2, are given in DCD Tier 2, Chapter 16, Technical Specifications, Sections 3.8.1, AC Sources - Operating, and 3.8.2, AC Sources - Shutdown.

APR1400 Plant Interfaces: Chapter 1 of DCD Tier 2, Table 1.8-1, Index of System, Structure, or Component Interface Requirements for APR1400, contains information related to the following plant interfaces that will be addressed in the COL designs:

  • Systems - Offsite power system, including switchyard 8.2.3 Regulatory Basis The relevant requirements of the Commissions regulations for the offsite power system and the associated acceptance criteria are given in Section 8.2 of NUREG-0800, the Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition, and are summarized below. Review interfaces with other SRP sections can be found in Section 8.2 of NUREG-0800.
1. Section 52.47(b)(1) of 10 CFR, which requires that a DC application contain the proposed ITAAC that are necessary and sufficient to provide reasonable assurance that, if the inspections, tests, and analyses are performed and the acceptance criteria met, a facility that incorporates the DC is built and will operate in conformity with the DC, the provisions of the Atomic Energy Act of 1954, as amended, and the NRC rules and regulations.
2. Appendix A, General Design Criteria, of 10 CFR Part 50, GDC 2, Design basis for protection against natural phenomena, as it relates to SSCs of the ac power system being capable of withstanding the effects of natural phenomena without the loss of the capability to perform their safety functions.
3. GDC 4, Environmental and dynamic effects design bases, as it relates to SSCs of the ac power system being capable of withstanding the effects of missiles and environmental conditions associated with normal operation, maintenance, testing, and postulated accidents.
4. GDC 5, Sharing of structures, systems, and components, as it relates to sharing of SSCs of the preferred power systems among nuclear power units. The APR1400 plant is designed to be a single-unit plant.
5. GDC 17, Electric power systems, as it relates to the preferred power systems:

(i) capacity and capability to permit functioning of SSCs important to safety; (ii) provisions to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit, the loss of power from the transmission network, or the loss of power from the onsite electric power supplies; (iii) physical independence; (iv) availability; and (v) 8-12

simultaneous failure under operating and postulated accident and environmental conditions.

6. GDC 18, Inspection and testing of electric power systems, as it relates to inspection and testing of the offsite electric power systems.
7. Section 50.63 of 10 CFR, Loss of all alternating current power, as it relates to an AAC power source (as defined in 10 CFR 50.2) provided for safe shutdown in the event of and the capability to withstand and recover from an SBO.
8. Section 50.65 of 10 CFR, Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, Section (a)(4), as it relates to the requirements to assess and manage the increase in risk that may result from proposed maintenance activities before performing the maintenance activities for the offsite power system.

Acceptance criteria adequate to meet the above regulatory requirements include:

1. RG 1.32, Criteria for Power Systems for Nuclear Power Plants, which endorses IEEE Std. 308-2001, IEEE Standard Criteria for Class 1E Power Systems for Nuclear Power Generating Stations, as related to the availability and number of immediate access circuits from the transmission network.
2. RG 1.155, Station Blackout, as related to the adequacy of the AAC source and the independence of the AAC power source from the offsite and onsite power systems and sources. New applications must provide an adequate AAC source of diverse design (with respect to ac onsite emergency sources) that is consistent with the guidance in RG 1.155 and capable of powering at least one complete set of normal safe shutdown loads.
3. RG 1.204, Guidelines for Lightning Protection of Nuclear Power Plants, which endorses IEEE Std. 665-1995 (reaffirmed in 2001), IEEE Guide for Generating Station Grounding, IEEE Std. 666-1991 (reaffirmed 1996), IEEE Design Guide for Electric Power Service Systems for Generating Stations, IEEE Std. 1050-1996, IEEE Guide for Instrumentation and Control Equipment Grounding in Generating Stations, and IEEE Std. C62.23-1995 (reaffirmed in 2001), and IEEE Application Guide for Surge Protection of Electric Generating Plants, as they relate to the design, installation, and performance of station grounding systems and surge and lightning protection systems.
4. RG 1.160, Revision 3, Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, as it relates to the effectiveness of maintenance activities for onsite emergency ac power sources including grid-risk-sensitive maintenance activities (i.e., activities that tend to increase the likelihood of a plant trip, increase the loss-of-offsite power (LOOP) frequency, or reduce the capability to cope with a LOOP or SBO).
5. RG 1.206, Combined License Applications for Nuclear Power Plants (LWR Edition), as it relates to power system analytical studies and stability studies to verify the capability of the offsite power systems and their interfaces with the onsite power system.
6. SECY 91-078, Chapter 11 of the Electric Power Research Institute's (EPRI's) Requirements Document and Additional Evolutionary Light Water Reactor 8-13

(LWR) Certification Issues, as it relates to the interface between the onsite ac power system and the offsite power system.

7. NUREG-0800, Standard Review Plan, BTP 8-9, Open Phase Conditions in Electric Power System, Rev. 0, U.S. Nuclear Regulatory Commission, July 2015.

8.2.4 Technical Evaluation The staff reviewed the offsite power system described in Section 8.2 of the APR1400 DCD, Tier 2, to determine whether the system: (1) provides the required minimum of two separate circuits from the transmission network to the onsite distribution system; (2) has adequate capacity and capability to supply power to all safety loads; (3) has both physical and electrical separation between the two (or more) circuits to minimize the chance of simultaneous failure; and (4) includes an interface of the preferred power source with an AAC power source for safe shutdown in the event of an SBO.

Table 8-1 of the SRP lists GDC, RGs, standards, and BTPs that are applicable to the electrical power systems. The staff has reviewed the applicable DCD information for compliance and conformance to the offsite power system requirements and guidance as described below.

In general, the offsite power system is acceptable when it can be concluded that two separate circuits from the transmission network to the onsite, Class 1E power distribution system are provided, adequate physical and electrical separation exists, and the system has the capacity and capability to supply power to all safety loads and other required equipment.

The interconnection of the preferred (offsite) power supply with an AAC power source for safe shutdown in the event of an SBO is also reviewed with respect to its adequacy and its independence from the offsite and onsite power systems. The applicant provided the interface requirements for those parts of the design in Tier 1 Section 3.1. The interface requirements are adequate since they provide sufficient requirements to address completion of the COL FSAR, in that capacity, capability, independence, sizing, protocols and other items are outlined in the interface requirements. The staff reviewed these interface requirements and found them adequate; therefore, the provisions of 10 CFR 52.47(a)(25) have been met. Compliance with 10 CFR 52.47(a)(26) is addressed in Section 14.3 of this report.

Note that subsequent to the issuance of SRP Section 8.2, Revision 4, the staff determined that GDC 2, Design bases for protection against natural phenomena, and GDC 4, Environmental and dynamic effects design bases, are not applicable to the offsite power system, as stated in correspondence dated January 23, 2009 (ML090260039).

8.2.4.1 GDC 2, Design bases for protection against natural phenomena, and GDC 4, Dynamic and environmental effects design bases GDC 2 states that SSCs important to safety shall be designed to withstand the effects of natural phenomena such as earthquakes, tornadoes, hurricanes, floods, tsunami, and seiches without loss of capability to perform their safety functions. Thus, GDC 2 requires that capability for the offsite power system to perform its functions be retained during the most severe natural phenomena that have been historically reported for the site and surrounding area.

8-14

GDC 4 states that SSCs associated with the offsite power system be capable of withstanding the effects of missiles and environmental conditions associated with normal operation, maintenance, testing, and postulated accidents.

DCD Tier 2 Section 8.2.2.1, Compliance with 10 CFR Part 50, discusses compliance with GDC 2 and GDC 4. For GDC 2, DCD Tier 2 Section 8.2.2.1 states that the offsite power system is designed to withstand the effects of natural phenomena such as high and low atmospheric temperatures, high wind, rain, lightning discharges, ice and snow conditions, and weather events. In regards to GDC 4, the applicant stated that the offsite power system is designed to provide power to systems important to safety during normal, abnormal, accident, and post-accident conditions. The offsite power system supplies electric power required for the operation of systems important to safety even if or when they are subject to adverse dynamic effects.

In RAI 177-8166, Question 08.01-5 (ML15243A475), the staff requested that the applicant clarify whether the offsite power system was important to safety and whether it is in compliance with GDC 2. In its response to RAI 177-8166, Question 08.01-5 (ML16026A463), the applicant stated that the SATs are important to safety and are designed to withstand the effects of natural phenomena such as high and low atmospheric temperatures, high wind, rain, ice and snow conditions, and weather events as specified in DCD Tier 2, Table 2.0-1, Site Parameters.

Section 8.2.2.1 of the DCD Tier 2 will be revised to state that components of the offsite power system, determined to be risk-significant non-safety related SSCs by the design reliability assurance program, are designed to withstand the effects of natural phenomena. Since the important to safety components of the offsite power system are designed to withstand the effects of natural phenomena and adverse dynamic effects as well as have two physical independent circuits with provisions to minimize the probability of simultaneous failure, the APR1400 design is in compliance of GDC 2 and this issue is resolved. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response and finds that RAI 177-8166, Question 08.01-5, is resolved and closed.

In summary, the staff finds that the important to safety components of the offsite power system are designed to withstand the effects of natural phenomena and adverse dynamic effects as well as have two physical independent circuits with provisions to minimize the probability of simultaneous failure and that the APR1400 design is in compliance with GDC 2 and GDC 4.

8.2.4.2 GDC 5, Sharing of structures, systems, and components GDC 5 states that SSCs important to safety should not be shared among other units unless it can be demonstrated that the sharing will not significantly impair their ability to perform their safety functions. Since the APR1400 is designed to be a standalone unit, there are no offsite power SSCs important to safety that are shared between individual power units. This aspect of the design is in compliance with GDC 5. However, GDC 5 may be applicable to a COL applicant that references the APR1400 design if its application includes multiple units.

8.2.4.3 GDC 17, Electric power systems GDC 17 requires that the offsite power system provide at least two physically independent circuits (preferred and alternate) from the switchyard to the Class 1E loads. At least one of these two circuits must be immediately available. The system must be capable of supplying all safety loads independent of the onsite emergency power system.

8-15

The applicant stated in DCD Tier 2 Section 8.2.1.3, Offsite Power System Components and Circuits, that:

Each preferred power source has the capacity and capability to permit functioning of SSCs important to safety and all other auxiliary systems under normal, abnormal, and accident conditions. The normal preferred power circuit is connected to the high-voltage side of the MT. During power operation mode, the GCB is closed and the MG is connected to the transmission system through the MT and also supplies power to the UATs. The alternate preferred circuit is connected to the high-voltage side of the SATs.

In case the power supply is unavailable from the UATs, the power supply is maintained because the onsite non-safety-related and safety-related bus connections are transferred automatically from the UATs to the SATs.

The transmission network is a source of power for the onsite power system and includes at least two preferred power supplies, as stated in DCD Tier 2 Section 8.2.1.1, Transmission Network.

The switchyard connects the transmission network to the plant. Because both the transmission network and switchyard are not within the scope of the APR1400 design and are site-specific, the COL applicant will provide information in order to ensure the preferred power source has the capacity and capability to provide power to SSCs important to safety under normal, abnormal and accident conditions. Specifically, the COL applicant is to identify the circuits from the transmission network to the onsite electrical distribution system that are supplied by two physically independent circuits, as stated in COL Item 8.2(1). In addition, the COL applicant is to provide information on the location of rights-of-way, transmission towers, voltage level, and length of each transmission line from the site to the first major substation that connects the line to the transmission network (COL Item 8.2(2)). The COL applicant is to describe and provide layout drawings of the circuits connecting the onsite distribution system to the preferred power supply (COL Item 8.2(4)). Finally, as part of COL Item 8.2(5), the COL applicant is to describe site-specific information for the protective devices, ac power, and dc power that control the switchyard equipment. This information ensures the offsite power system can meet its intended function, and since it is site-specific design, these issues are left as COL information items.

In support of GDC 17, RG 1.206 states, in part, that an applicant should follow the guidance set forth by SRP Section 8.2 in Appendix A, Guidelines for Generator Circuit Breakers/Load Break Switches. SRP Section 8.2, Appendix A states that that only devices that have the capability of interrupting the system maximum available fault current, i.e., circuit breakers, will be approved as a means of isolating the unit generators from the offsite power system in order to provide immediate access in accordance with GDC 17. Furthermore, SRP Section 8.2, Appendix A states that generator circuit breakers should be designed to perform their intended function during steady-state operation, power system transients and major faults. SRP Section 8.2 states that the ratings and required capabilities of a generator circuit breaker are the designated limits of operating characteristics based on definite conditions as defined in IEEE Std C37.013, which describes design test procedures and methods that should be performed to demonstrate the ability of a generator circuit breaker to meet the assigned ratings when operating at rated maximum voltage and power frequency. The staffs concern is that the criteria on generator breakers are much more rigorous on those devices if they are used in an immediate-access source of power scheme as opposed to a delayed-access source of power scheme. Immediate-access devices must be qualified to isolate the MG under maximum postulated fault current conditions. Delayed-access devices do not need this capability as they would not be used to isolate the MG prior to the clearing of any fault current. In RAI 36-7936, Question 08.02-2 (ML15168A693), the staff requested that the applicant demonstrate that the design of the GCB 8-16

complies with the provisions of Appendix A and describe the synchronizing scheme, auxiliary support systems, and maintenance strategies. In its response to RAI 36-7936, Question 08.02-2 (ML15215A518), the applicant provided detailed information regarding the compliance of SRP 8.2, Appendix A, including: (1) the tests to demonstrate the ability of the generator circuit breaker to meet the required capabilities, (2) the synchronizing scheme, (3) auxiliary support systems, and (4) maintenance strategies. In DCD Tier 2 Sections 8.1.3.3, General Design Criteria, NRC Regulatory Guides, Branch Technical Positions, Generic Letters, and Industry Standards, 8.2.4, References, and 8.2.2.3, Conformance with NUREG-0800, the applicant included IEEE Std. C37.013, Standard for AC High-Voltage Generator Circuit Breakers Rated on a Symmetrical Current Basis, which is referenced in SRP 8.2. The staff determined that the information is acceptable since the design of the GCB conforms to IEEE Std. C37.013. The ratings and required capabilities of the GCB are the designated limits of operating characteristics based on definite conditions as defined in IEEE Std. C37.013. Since the applicant conforms to the tests and maintenance procedures in IEEE Std. C37.013 and added the standard to the DCD, the staff determined that the testing and maintenance strategies of the GCB are acceptable.

The response did not indicate whether an air-blast or SF6 breaker would be used, considering the continuous current rating of the main IPB. In RAI 408-8522, Question 08.02-10 (ML16048A201), the staff requested information regarding the specific type of GCB to be used.

In its response to RAI 408-8522, Question 08.02-10 (ML16077A276), the applicant responded that a specific type of GCB has not been chosen and for the reference plant, an air-blast circuit breaker was used that can meet the technical requirements for continuous current rating. The staff determined that the response is acceptable and the issue is resolved since: (1) the design of the GCB conforms to IEEE Std. C37.013, and (2) the design of the GCB conforms to the guidance in SRP 8.2, Appendix A. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response and finds that RAI 408-8522, Question 08.02-10, is resolved and closed.

The staff performed an audit to review the design approach on the methodology and assumptions for the isolated phase bus and GCB. The audit report (ML16300A205) discusses the staffs evaluation of the capability of the GCB capability of interrupting the maximum asymmetrical and symmetrical fault current available. The staff reviewed the summary results and determined that based on the audit, the GCB has the capability of interrupting the maximum asymmetrical and symmetrical fault current and that the design conforms to the methodology provided in SRP 8.2 and IEEE Std. C37.013-1997.

When the normal source is not available through the MT, offsite power is provided to the non-safety-related onsite electric power buses through the SAT as their alternate offsite source. In addition, safety-related EDGs supply power to the safety loads in the event of a LOOP.

Additional technical details on bus transfer are discussed in Section 8.3.1.4.17 of this report.

Section 8.2.1.3, Offsite Power System Components and Circuits, of the DCD Tier 2 states that the UATs and SATs are offsite power system components. IEEE Std.666-1991, reaffirmed in 1996, IEEE Design Guide for Electric Power Service Systems for Generating Systems, recommends, in addition to overcurrent and differential current protection, sudden pressure and ground fault protection in order to fully protect large power transformers. This standard is endorsed in RG 1.204 with regard to the protection provided by these protective schemes against lightning strikes. Section 8.2.1.3 of the DCD Tier 2 did not, however, include ground fault and sudden pressure protection for the UATs and SATs. In order to assure protection for 8-17

these transformers, in RAI 144-8093, Question 08.02-6 (ML15221A012), staff requested that the applicant discuss the protection schemes for the large power transformers (MT, UATs, and SATs). In its response to RAI 144-8093, Question 08.02-6 (ML15294A517), the applicant stated that the protection schemes including overcurrent, differential current, sudden pressure and ground fault protection for the large power transformers are provided in accordance with the recommendations in IEEE Std. 666-1991. The applicant also provided tables which list the MT, UATs, and SATs protective relays. The applicant revised DCD Tier 2 Section 8.2.1.3 to state that the protection schemes including overcurrent, differential current, sudden pressure, and ground fault protection for the MT, UATs, and SATs are provided in accordance with the recommendations in IEEE Std. 666. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response and finds that RAI 144-8093, Question 08.02-6, is resolved and closed.

Based on the response to RAI 144-8093, Question 08.02-6 (ML15294A517), the staff requested additional information in RAI 405-8497, Question 08.02-9, (ML16042A256), to ensure that the design would provide for all protective features recommended by IEEE Std. 666-1991 and would update the DCD to reflect this commitment. Specifically, the staff requested additional information on whether thermal overload protection is included for the MT, UATs, and SATs.

Furthermore, the staff noted that IEEE Std. 666-1991 and IEEE Std. 242-2001, IEEE Recommended Practice for Protection and Coordination of Industrial and Commercial Power Systems, discuss overall differential backup protection. The staff requested additional information regarding why the unit overall differential relay is not included for the UAT or provide alternate means of protection in response to RAI 405-8497, Question 08.02-9. In its response to RAI 405-8497, Question 08.02-9 (ML16098A283), the applicant stated that the thermal overload protection function will be included as part of the protection functions for the MT, UATs, and SATs. Furthermore, the applicant clarified that UAT has a differential protection relay as well as an overcurrent relay and the unit overall differential protection relay is not necessary. The applicant provided the overall differential scheme in the RAI response that shows overlapping protection such that the unit overall differential relay encompasses the high side of the UAT and the differential protection relay covers the secondary side of the UAT.

Therefore, both the MT and UAT are protected against faults. The applicant added DCD Tier 2, Table 8.2-2, Protective Relay List of the MT, UATs, and SATs to provide a list of protective relays for the MTs, UATs, and SATs, which complies with the recommendations in IEEE Std.

666-1991. The staff determined that this is acceptable since the protection schemes for the large power transformers conform to IEEE Std. 666-1991 and IEEE Std. 242-2001. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response and finds that RAI 405-8497, Question 08.02-9, is resolved and closed.

In RAI 39-7937, Question 08.02-3 (ML15174A379), the staff requested additional information regarding the conformance to GDC 17 to specifically show that no single event will simultaneously fail both offsite power circuits. In addition, the staff requested additional information regarding electrical schematics and discussion of the switchyard breaker control system, its power supply configuration and breaker arrangement to demonstrate that there would be no simultaneous failure of both offsite power circuits. In its response to RAI 39-7937, Question 08.02-3 (ML15210A446), the applicant stated that the switchyard design, including the switchyard breaker control system and breaker arrangement, are site specific along with requirements of the transmission system operator. Thus, the applicant revised COL Item 8.2(5) such that the COL applicant is to describe the design of the switchyard equipment, including breaker arrangement, electrical schematics of the breaker control system, protective devices and their settings, and auxiliary power supplies (ac and dc) for control and protection. The 8-18

applicant also revised COL Item 8.2(7) such that the COL applicant will provide a Failure Modes and Effects Analysis (FMEA) of the switchyard components to assess the possibility of simultaneous failure of both circuits as a result of single events. The staff determined that these changes are acceptable since the COL applicant will perform a failure mode and effects analysis and show conformance to GDC 17 to specifically show that no single event will simultaneously fail both offsite power circuits. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response and finds that RAI 39-7937, Question 08.02-3, is resolved and closed.

In addition, GDC 17 specifies the safety function of the electric power systems as providing sufficient capacity and capability to assure that: (1) specified acceptable fuel design limits and design conditions of the reactor coolant system (RCS) pressure boundary are not exceeded as a result of anticipated operational occurrences (AOOs) and (2) the core is cooled and containment integrity and other vital functions are maintained in the event of postulated accidents. The systems to which the offsite power system supplies power that accomplish these functions are governed by GDC 33, Reactor Coolant Makeup; GDC 34, Residual Heat Removal; GDC 35, Emergency Core Cooling; GDC 38, Containment Heat Removal; GDC 41, Containment Atmosphere Cleanup; and GDC 44 Cooling Water; for SSCs important to safety during normal and accident conditions, as necessary for the specific system condition.

Since the switchyard is connected to a minimum of two independent and redundant transmission lines, and the switchyard design includes circuit breakers to isolate a faulted offsite transmission line upon a loss of one circuit (assuming the onsite power is not available), a loss of one circuit does not affect the availability of the other offsite circuit. Therefore, power to the Class 1E buses will remain available to accomplish the safety functions identified in the above criteria. The staff determined that the applicants design satisfies the requirements of GDC 17 with respect to the offsite power system on: (1) capacity and capability to permit functioning of SSCs important to safety; (2) provisions to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit or loss of power from the onsite electric power supplies; (3) physical independence of circuits; and (4) availability of circuits to ensure that fuel design limits and design conditions of the reactor pressure boundary are not exceeded.

On July 27, 2012, the staff issued BL 2012-01, Design Vulnerability in Electric Power System, to all holders of operating and COLs requesting information about the facilities electric power system designs. The intended purpose of the bulletin was to affirm that all plants comply with the GDC 17 requirements, and to evaluate whether any further regulatory action is warranted to address this design vulnerability.

The staff issued RAI 178-8184, Question 08.02-7 (ML15243A586), in which the staff requested that the applicant provide information on how its electrical system design would detect, alarm, and respond to a single-phase open circuit condition, with/without a high impedance ground.

The staff requested that the applicant describe its plans for establishing its surveillance testing and protection scheme as they relate to the electrical system components that will provide detection, alarm, and response to an open circuit condition. In addition, the staff requested that the applicant discuss how an unintended separation from the off-site power source, due to a false indication of an open phase, can be prevented. Lastly, the staff requested that the applicant provide a summary of analysis performed for ground-fault, and an open phase condition based on the power system configuration of APR1400. In its response to RAI 178-8184, Question 08.02-7 (ML15357A301), the applicant stated that the necessary design 8-19

evaluation and analyses against open phase conditions along with the final solution for the APR1400 DC will be provided by the COL applicant as described in DCD Tier 2, Section 8.2.3, Combined License Information and specified in COL Item 8.2(8). The applicant provided a revised COL Item 8.2(8) in the RAI response.

The staff determined that this is unacceptable since the APR1400 design does not provide a method of responding to open phase conditions to protect the Class 1E equipment. The revised COL Item 8.2(8) defers the responsibility to the COL applicant for design features to detect, alarm and protect against open phase conditions. In order to verify the applicant has addressed the design vulnerability in accordance with the requirements specified in GDC 17 and the design criteria for protection systems under 10 CFR 50.55a(h), the staff requested additional information in RAI 540-8729, Question 08.02-12 (ML17052A019) specifically, regarding design features and how the protection features meet the criteria in Position B.2.c in Branch Technical Position (BTP) 8-9, Open Phase Conditions in Electric Power System. In its response to RAI 540-8729, Question 08.02-12 (ML17192A542), the applicant discussed the open phase detection and protection (OPDP) system, which could be Class 1E or non-Class 1E, and COL Item 8.2(8) states that the COL applicant is to determine the specific type of OPDP system. The applicant, in its response, discussed the protection features with both a non-Class 1E and Class 1E OPDP system. The applicant stated, in its response, that with the protection features the APR1400 electric power system will retain its capability to provide power for the required safety functions for any open phase condition (OPC) which would cause the offsite power circuit(s) to be functionally degraded, given a concurrent design basis event. Furthermore, the applicant provided COL item 8.2(8), in which the COL applicant will determine the specific type of OPDP system to address the requirements of B.1 and B.2 of BTP 8-9, Open Phase Conditions in Electric Power Systems, (ML15057A085). In addition, the applicant revised DCD Tier 1, Table 2.6.1-3, to provide ITAAC Item 23, which specifies that that the OPDP system is capable of detecting OPCs over the full range of transformer loading for loss of one phase with and without a high impedance ground or loss of two phases without a high impedance ground. Completion of ITAAC 23 will provide the staff reasonable assurance that the OPDP system can detect an open phase condition. The applicant also revised DCD Tier 1, Table 2.6.1-3, ITAAC Item 24 to specify that upon detection of an open phase condition, the OPDP system will send an alarm in the MCR. Completion of ITAAC 24 will provide the staff reasonable assurance that the OPDP system can provide an alarm in the MCR and RSR upon detection of an open phase condition.

The applicant also included ITAAC 25 in DCD Tier 1, Table 2.6.1-3 to ensure Class 1E medium voltage buses are automatically separated from the degraded offsite source, transferred to the alternate power source or onsite standby source. The staff finds the OPDP system acceptable since the ITAAC ensure the system can detect an open phase condition, provide an alarm in the MCR and RSR, and ensure that the safety buses are not affected. The OPDP system conforms to BTP 8-9 since it provides detection, alarm in the MCR and RSR, and protection features in that the Class 1E medium voltage buses will transfer to a power source without an open phase condition. Since the OPDP system meets the staff position in BTP 8-9, per COL item 8.2(8) and DCD Tier 1, Table 2.6.1-3 ITAAC Items 23, 24, and 25, the staff finds the response acceptable.

The staff confirmed that DCD Revision 2 contains the changes as committed to in the RAI response and finds that RAI 540-8729, Question 08.02-12, is resolved and closed.

8.2.4.4 GDC 18, Inspection and testing of electric power systems GDC 18, with respect to the offsite power system, requires that the SSCs associated with the offsite power system (i.e., the switchyard and incoming circuits) are capable of being tested periodically to assess the continuity of the system and the condition of the components, and 8-20

thereby assure proper functioning. DCD Tier 2 Section 8.2.2.1, Conformance with 10 CFR Part 50, discusses conformance with GDC 18 stating that the offsite power system of the APR1400 has the capability to perform integral testing on a periodic basis. In RAI 109-8079, Question 08.02-5 (ML15206A006), the staff requested additional information on the periodic testing of the offsite power system. In its response to RAI 109-8079, Question 08.02-5 (ML15252A099), the applicant stated that the offsite power system is accessed for required periodic inspection and testing, enabling verification of important system parameters, performance characteristics, and features and detection of degradation and/or impending failure under controlled conditions.

Furthermore, the applicant provided a summary of typical periodic equipment and system tests, including the operability and functional performance. COL Item 8.2(9) states that the COL applicant is to describe how testing is performed on the offsite power system components.

However, the applicant provided the tests for gas insulated substations in the RAI response.

Since gas insulated substations have specific inspection and testing, in RAI 257-8331, Question 08.02-8 (ML15293A571), the staff requested further information on how the conformance of applicable standards, FMEA, and additional description of the components in the gas insulated substation. In its response to RAI 257-8331, Question 08.02-8 (ML15350A375), the applicant stated that the switchyard design is site-specific and in its response to RAI 39-7937, Question 08.02-3 (ML15210A446), the applicant proposed a revision to COL Item 8.2(5) which states that the COL applicant is to describe the design of the switchyard equipment, applicable standards, and other information. Therefore, based on COL Item 8.2(9), the staff determined that the applicants design meets the testability requirements of GDC 18 with respect to the capability of inspection and testing of the offsite power system and equipment and is acceptable.

8.2.4.5 Compliance with 10 CFR 50.63 and Conformance to RG 1.155 Section 50.63 of 10 CFR Part 50 requires measures to ensure that the plant can withstand and recover from a loss of all ac power (SBO). Further evaluation of this issue is contained in Section 8.4, Station Blackout of this report. The staff reviewed the offsite power system to assure that the failure of the offsite system will not affect the ability of the SBO power sources (AAC GTG), to carry out their intended function.

DCD Tier 2 Section 8.4.1.3 Alternate AC Power Source explains that the SBO power source (AAC GTG) is not directly connected to the offsite power sources. Isolation between the Class 1E and the non-Class 1E system is maintained by two circuit breakers in series. The electrical connections are only remade manually in case of an SBO after loss of all ac power, including LOOP. The staff finds that this aspect of the design complies with 10 CFR 50.63 and conforms to the guidance in RG 1.155, Appendix B, which provides an acceptable means of meeting the requirements for isolation between AAC sources and the onsite and offsite power systems.

8.2.4.6 Compliance with 10 CFR 50.65 The requirements of 10 CFR 50.65(a)(4) (the Maintenance Rule) specify that COL applicants assess and manage the increase in risk that may result from proposed maintenance activities before performing maintenance activities in general, and this includes the offsite power transmission lines. For instance, grid stability and offsite power availability are examples of emergent conditions that may result in the need for assessment or that could change the conditions of a previously performed assessment. Accordingly, COL applicants should perform grid reliability evaluations as part of the maintenance risk assessment before performing grid-risk-sensitive maintenance activities (such as surveillances, post-maintenance testing, and preventive and corrective maintenance).

8-21

For qualitative risk assessments, the evaluation includes how the risk assessment and management programs will preserve plant-specific key safety functions. These programs are based on Nuclear Energy Institute Guideline NUMARC 93-01, Revision 4A, Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, April 1996, endorsed by RG 1.160, Monitoring the Effectiveness of Maintenance at Nuclear Power Plants.

The staff has reviewed the implementation of the Maintenance Rule program (10 CFR 50.65) described in DCD Tier 2, Section 17.6, Maintenance Rule. COL Item 17.6(1) states, The COL applicant is to provide in its Final Safety Analysis Report a description of the Maintenance Rule program and a plan for implementing it to meet the requirements of 10 CFR 50.65.

The Maintenance Rule, 10 CFR 50.65(a)(4), is applicable to all electrical maintenance activities (offsite, onsite, and SBO equipment). COL applicants referencing the APR1400 design are required to develop programs for maintenance risk assessment and maintenance rule implementation under DCD Tier 2, Section 17.6. In RAI 104-7961, Question 08.02-4 (ML15205A403), the staff requested a discussion on how APR1400 meets the requirements of 10 CFR 50.65(a)(4), pertaining to the offsite power transmission lines. In its response to RAI 104-7961, Question 08.02-4 (ML15233A124), the applicant stated the two circuits of the offsite preferred power sources are designed in accordance with IEEE Std. 765, Standard for Preferred Power Supply for Nuclear Power Generating Stations, so that a failure of one offsite preferred power source does not affect the capacity and capability of the other offsite preferred power source. Furthermore, the applicant stated that the COL applicant is to include transmission lines and their associated components into their design, as part of COL Item 8.2(1). Since the applicant has a COL information item, COL 17.6(1), to address plant-specific provisions related to the Maintenance Rule 10 CFR 50.65, and given that the description of a Maintenance Rule program is the COL applicants responsibility, the staff determined that the applicant addressed adequately how compliance with the maintenance rule will be achieved, and this issue is resolved.

Underground or inaccessible power cables connecting offsite power to safety buses or power and control cables to equipment with accident mitigating functions could be subjected to wetted environments or submergence. COL Item 8.3(6) states that the COL applicant is to provide testing, inspection, and monitoring programs for detecting insulation degradation of underground and inaccessible power cables within the scope of 10 CFR 50.65. In RAI 102-8017, Question 08.03.01-10 (ML15205A366), the staff requested additional information on the inspection, testing and monitoring programs to detect the degradation of inaccessible or underground power cables that support offsite power, to provide a description of the condition monitoring methods that would be used to detect cable insulation degradation. In its response to RAI 102-8017, Question 08.03.01-10 (ML16093A039), the applicant described the tests to detect degradation by infrared imaging thermography, very-low-frequency ac testing, and partial discharge, as applicable. The staff determined that this is acceptable and this issue is resolved since tests will be performed to detect insulation degradation, and the COL applicant will establish a testing, monitoring, and testing program. Additional details can be found in Section 8.3.1.4.4.5, Conformance to RG 1.75 of this report regarding the detection of insulation degradation.

8.2.4.7 Compliance with RG 1.206, BTP 8-3 Grid Stability Electrical grid stability is a key element in determining if a COL design fully meets the requirements of GDC 17. Since the grid is site specific, RG 1.206 calls for the DCD to include 8-22

interface requirements for the COL application. COL Item 8.2(3) directs the COL applicant to describe the switchyard voltage related to the transmission system provider/operator (TSP/TSO) and the formal agreement between the nuclear power plant and the TSP/TSO. Furthermore, COL Item 8.2(3) directs the applicant to describe the capability and analysis tool of the TSP as well as describe the protocols for the plant to remain cognizant of grid vulnerabilities. The staff determined that the APR1400 DCD directs a COL applicant to provide the necessary interface requirements between the nuclear power plant (NPP) and grid operator, and therefore, conforms to RG 1.206.

The applicant provided a requirement for the COL applicant to perform sufficient analyses to demonstrate grid stability and provides a COL information item that fully incorporates the scope of the stability analyses called for in RG 1.206. Specifically, DCD Tier 2 Section 8.2.3, Combined License Information, in COL item 8.2(3) provides a requirement that the COL applicant provide the results of the grid stability analyses to demonstrate that the offsite power system does not degrade the normal and alternate preferred power sources to a level where the preferred power sources do not have the capacity or capability to support the onsite Class 1E electrical distribution system in performing its intended safety function. The staff finds that the COL item conforms to RG 1.206 regarding grid stability. In addition, DCD Tier 2 Section 8.2.1.4, Separation Between Preferred Power Supply I and Preferred Power Supply II, states that the stability analysis will include the following contingencies: APR1400 turbine generator trip, loss of the largest unit supplying the grid, loss of the largest transmission circuit or inter-tie, and loss of the largest load on the grid. This list is in full conformance to RG 1.206 and is therefore, acceptable.

RG 1.206 discusses the equipment that must be considered in the specification of offsite power supplies. COL Item 8.2(2) in DCD Tier 2 Section 8.2.3 directs the applicant to provide information on the location of rights-of-way, transmission towers, voltage level, and length of each transmission line from the site to the first major substation that connects the line to the transmission network and conforms to RG 1.206.

DCD Tier 2, Section 8.2.2.3, states that the APR1400 design is in conformance to BTP 8-3.

The staff determined that the APR1400 DCD directs a COL applicant that references the APR1400 design to provide a site-specific grid stability analysis as stated in COL Item 8.2(7) and therefore, determined that it conforms to BTP 8-3.

8.2.4.8 Compliance with BTP 8-6, Adequacy of Station Electric System Voltages BTP 8-6, Adequacy of Station Electric Distribution System Voltages, addresses the issue of degraded grid voltage conditions, their potential effect on the Class 1E loads and the need to provide specific protection of the loads from those effects. DCD Tier 2, Section 8.2.2.3, Conformance with NUREG-0800, under BTP 8-6 states that the APR1400 design provides a second level of undervoltage protection with time delays to protect the Class 1E equipment from sustained undervoltages. This design aspect is addressed in DCD Tier 2 Section 8.3.1.1.3.11, Protective Relaying System and is evaluated in Section 8.3.1.4.15, Conformance to BTP 8-6 of this report.

8.2.4.9 Compliance with SECY-91-078 DCD Tier 2, Section 8.2.1.3, Offsite Power System Components and Circuits, states that the UATs and SATs are three-winding transformers connected to the onsite non-safety-related and 8-23

safety-related buses through their low-voltage side windings. Both non-safety-related and safety-related buses are normally supplied from the UATs. In RAI 16-7915, Question 08.01-1 (ML15142A611), the staff explained that each UAT and SAT has two secondary voltage windings, rated 13.8 kV and 4.16 kV. From DCD Tier 2 Figure 8.1-1, Electric Power System Single-Line Diagram, it is noted that the 13.8 kV winding of each UAT and SAT is connected to non-Class 1E buses. The 4.16 kV winding is connected to 4.16 kV safety-related Class 1E buses, as well as permanent non-safety buses. The staff also explained that in accordance with SECY-91-078, EPRIs Requirements Document and Additional Evolutionary LWR Certification Issues, (ML072150592), offsite power shall be directly supplied to the Class 1E emergency power supply safety-related buses without any intervening non-Class 1E buses. The staff noted that both Class 1E and non-class 1E buses are connected to the same UAT, and similarly for the SAT, rendering the emergency Class 1E buses/switchgear vulnerable to potential failure due to a failure of the non-Class 1E bus/switchgear. In addition, the safety loads could be subjected to transients caused by the non-safety loads, and adds additional failure points between the offsite power sources and the safety loads. Therefore, the staff determined that the proposed design does not meet the SECY-91-078 requirements.

Furthermore, 10 CFR Part 50, GDC 17 requires, in part, that the onsite electrical distribution system shall have sufficient independence, redundancy, and testability to perform their safety functions assuming a single failure. The proposed design does not provide capability to minimize the probability of losing electric power at the safety bus, since there is potential that the Class 1E buses are vulnerable to failures as a result of failures of the non-Class 1E buses. Therefore, the staff determined that the proposed design does not meet the GDC 17 requirement. Furthermore, SRP Chapter 8.2, Offsite Power System, Acceptance Criterion 4, and Chapter 8.3.1, AC Power Systems (Onsite), Acceptance Criteria 4J, discuss this requirement.

Additionally, the staff reviewed the DCD Tier 2, Section 8.1, Section 8.2, Section 8.3, and associated single line diagrams. The description in these sections and the single lines of APR1400 offsite and onsite power distribution system design show that both Class 1E and non-Class 1E circuits are sharing the windings of the UAT and SAT, rendering the Class 1E system vulnerable due to a potential fault at the non- Class 1E bus, and this design does not meet the GDC 17 and the requirements of SECY-91-078.

As discussed and evaluated in Section 8.1 in this SER, the staff issued RAI 16-7915, Question 08.01-1 (ML15142A611) with this concern. Staff also requested additional information in subsequent RAIs, RAI 338-8426, Question 08.01-14 and RAI 539-8730 Question 08.01-21.

The details of these questions, the responses from the applicant, and staff evaluation are discussed in Section 8.1 of this report.

In summary, considering both Class 1E and non-Class 1E buses are connected to the same UAT, and similarly, for the SAT, the staff finds that the applicant demonstrated through the large motor starting study and the FMEA, that the Class 1E equipment will be able to perform their intended function under various scenarios and transients. Furthermore, the staff finds that ITAAC are provided to verify that transients or failures occurring in the non-Class 1E buses will not cause failure of the Class 1E loads. Thus, the staff finds that the APR1400 electrical design conforms to SECY-91-078 since: (1) there is an alternate source to feed the non-safety loads and (2) the safety buses and equipment will be able to perform their intended function. The staff considers this issue resolved, as discussed in Section 8.1 of this report.

8-24

8.2.4.10 Compliance with RG 1.204 SRP 8.2 states that adequate provisions are made in the design of the plant and the offsite and onsite power systems for grounding, surge protection, and lightning protection. The reviewer evaluated the plant/station grounding systems, the methods of equipment and structural grounding, ac power system neutral grounding and ground fault current limiting features, surge and lightning protection features for outdoor equipment and circuits, and the measures for isolation of instrumentation grounding systems. Acceptable guidelines for the design, installation, and performance of station grounding systems and surge and lightning protection systems are found in: (1) RG 1.204; (2) IEEE Std. 665-1995, IEEE Guide for Generating Station Grounding; (3) IEEE Std. 666-1991, IEEE Design Guide for Electric Power Service Systems for Generating Stations; (4) IEEE Std. 1050-1996, IEEE Guide for Instrumentation and Control Equipment Grounding in Generating Stations; and (5) IEEE Std. C62.23-1995, IEEE Application Guide for Surge Protection of Electric Generating Plants.

The applicant stated in the DCD Tier 2, Section 8.2.2.2, Conformance with NRC Regulatory Guides, that the APR1400 design conforms to RG 1.204 and has additional information in Section 8.3.1.1.8, Grounding and Lightning Protection Criteria. COL Item 8.3(4) states the COL applicant is to describe and provide detailed ground grid and lightning protection. COL Item 8.3(10) states that the COL applicant is to provide insulation coordination of surge and lightning protection. In RAI 28-7942, Question 08.02-1 (ML15174A376), the staff requested per RG 1.206 that the applicant identify the potential effects that must be considered during testing, the margins being applied, and how the design incorporates these requirements for offsite power supplies, specifically regarding the surge protective devices, grounding, and lightning systems. In its response to RAI 28-7942, Question 08.02-1 (ML15210A367), the applicant stated that COL Item 8.2(8) will be revised so that the COL applicant is to identify the potential effects that must be considered during testing in the offsite power system. Furthermore, the applicant added new COL Item 8.3(12) such that the COL applicant is to provide the analysis for the station and switchyard grounding system with underlying assumptions, based on site-specific parameters including soil resistivity and site layout. DCD Tier 2 Section 8.3.1.3.8, Grounding, discusses compliance with IEEE Std. 665 and IEEE Std. 1050, as endorsed by RG 1.204. The staff determined that grounding and lightning protection is addressed per RG 1.206 and the issue is resolved since the applicant: (1) has included a discussion on station grounding, system grounding, equipment grounding, safety grounding, and instrumentation grounding; (2) provided information in DCD Tier 2 Section 8.3.1.3.8; and 3) added COL items.

The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response and finds that RAI 28-7942, Question 08.02-1, is resolved and closed.

8.2.5 Combined License Information Items The following is a list of item numbers and descriptions from DCD Tier 2, Section 8.2.3 and Chapter 1, Table 1.8-2, Combined License Information Items:

Combined License Information Items Item No. Description DCD Section 8-25

8.2(1) The COL applicant is to identify the circuits from the transmission Tier 2, 8.2.1 network to the onsite electrical distribution system that are supplied by two physically independent circuits.

8.2(2) The COL applicant is to provide information on the location of Tier 2, 8.2.1.1 rights-of-way, transmission towers, voltage level, and length of each transmission line from the site to the first major substation that connects the line to the transmission network.

8.2(3) The COL applicant is to describe the switchyard voltage related Tier 2, 8.2.1.1 to the transmission system provider/operator (TSP/TSO) and the formal agreement between the nuclear power plant and the TSP/TSO. The COL applicant is to describe the capability and the analysis tool of the TSP. The COL applicant is also to describe the protocols for the plant to remain cognizant of grid vulnerabilities.

8.2(4) The COL applicant is to describe and provide layout drawings of Tier 2, 8.2.1.2.

the circuits connecting the onsite distribution system to the preferred power supply.

8.2(5) The COL applicant is to describe design for the switchyard Tier 2, 8.2.1.2.

equipment, including breaker arrangement, electrical schematics of breaker control system, protective devices and their settings, and auxiliary power supplies (ac and dc) for control and protection.

8.2(6) The COL applicant is to provide a high-impedance ground fault Tier 2, 8.2.1.2.

detection feature that provides an alarm in the MCR and RSR upon detection of a high-impedance ground fault at the primary side of the MT or SATs.

8.2(7) The COL applicant is to provide an FMEA of the switchyard Tier 2, 8.2.1.2.

components to assess the possibility of simultaneous failure of both circuits as a result of single events. In addition, the COL applicant is to provide the results of grid stability analyses to demonstrate that the offsite power system does not degrade the normal and alternate preferred power sources to a level where the preferred power sources do not have the capacity or capability to support the onsite Class 1E electrical distribution system in performing its intended safety function.

8.2(8) The COL applicant is to determine the specific type of the OPDP Tier 2, 8.2.1.3 system, which properly address and meet the requirements of B.1. and B.2. of Branch Technical Position (BTP) 8-9, taking into account the site specific design configuration, installation condition, (field) performance testing and qualification status, and operation experiences of the OPDP system. The COL applicant 8-26

is also to provide the detailed design of the OPDP system selected for the APR1400 site.

The COL applicant is to perform a field simulation on the site specific design of the offsite power system to ensure that the settings of the OPDP system are adequate and appropriate for the site.

8.2(9) The COL applicant is to describe how testing is performed on the Tier 2, 8.2.1.3 offsite power system components and identify the potential effects that must be considered during testing.

8.2(10) The COL applicant is to provide the required number of Tier 2, 8.2.2.1 immediate access circuits from the transmission network.

8.2.6 Conclusion As set forth above, the staff has reviewed all of the relevant information that is applicable to the APR1400 offsite ac power system design and evaluated its compliance with GDC 2, GDC 4, GDC 5, GDC 17, GDC 18, 10 CFR 50.63, and 10 CFR 50.65, and conformance to RGs, standards, and BTPs committed to by the applicant. The staff also reviewed the COL information items in DCD Tier 2, Table 1.8-2. The staff concludes that the applicant has provided sufficient information in the DCD and identified necessary analyses to support the bases for their conclusions of their offsite power system design for the COL applicant. The staff concludes the design of the APR1400 offsite power system design meets the appropriate regulatory requirements listed in DCD Tier 2, Section 8.2.2, Analysis, and shown in the staffs technical evaluations in Section 8.2.4 and COL Information Items in Section 8.2.5 of this report.

8.3 Onsite Power Systems 8.3.1 AC Power Systems The APR1400 standard plant is designed to provide reliable electric power from the Class 1E ac Power System for the safe shutdown of the reactor.

8.3.1.1 Introduction The safety function of the onsite ac power system (assuming the offsite power system is not functioning) is to provide sufficient capacity and capability to ensure that the SSCs important to safety perform as intended. The onsite power system must satisfy the requirements of 10 CFR Part 50, Appendix A, GDC 2, GDC 4, GDC 5, GDC 17, and GDC 18, and must perform its design function during all plant operating and accident conditions.

8.3.1.2 Summary of Application DCD Tier 1: In DCD Tier 1, Section 2.6.1, AC Electric Power Distribution System, the applicant stated that the onsite ac power system provides electrical power for systems that are essential to reactor shutdown, containment isolation and heat removal, reactor core cooling, and 8-27

preventing a significant release of radioactive material to the environment. The onsite ac power system distributes power to safety-related and non-safety-related plant loads during normal and abnormal operations.

The safety-related Class 1E divisions are independent and physically separated. An alternate feed (AAC source) is provided between Class 1E Train A and B, to provide the alternate ac source to safety systems, safety-related support systems, or components to bring and maintain the plant to safe shutdown condition when both Class 1E Train A and B EDGs are not available during a loss of offsite power (LOOP). Independence is maintained between the Class 1E trains (Trains A, B, C and D)

In DCD Tier 1, Section 2.6.2, Emergency Diesel Generator System, the applicant stated that the EDGs provide a standby source of Class 1E power to safety-related and non-safety-related loads during conditions that result in a loss of preferred power to Class 1E buses.

DCD Tier 1, Section 2.6.7, Lightning Protection and Grounding System, provides the lightning and grounding system information while Section 2.6.8, Lighting Systems, describes the plant lighting system. The containment electrical penetrations are provided in DCD Tier 1, Section 2.6.5, Containment Electrical Penetration Assemblies, to protect from fault currents that are greater than their continuous current rating and maintain containment integrity.

DCD Tier 2: The applicant has provided a DCD Tier 2 system description of the onsite ac power system in Section 8.3.1, Alternating Current Power Systems, summarized here, in part, as follows:

The onsite ac power supply system supplies all electrical loads of the plant and is subdivided into the Class 1E safety-related and the non-Class 1E ac power system. The safety-related Class 1E supplies electrical power to safety-related loads and a limited number of non-safety-related loads. The non-Class 1E supplies electrical power to the remaining plant non-safety-related loads.

ITAAC: The ITAAC associated with DCD Tier 2, Section 8.3.1, AC Power System, are provided in DCD Tier 1, Table 2.6.1-3, AC Electric Power Distribution System ITAAC; Table 2.6.2-3, Emergency Diesel Generator System ITAAC; Table 2.6.7-1, Grounding and Lightning Protection System ITAAC; Table 2.6.8-1, Lighting System ITAAC; and Table 2.6.5-1, Containment Electrical Penetration Assemblies ITAAC.

TS: TS applicable to the onsite ac power system can be found in DCD Tier 2, Chapter 16, Section 3.8.1, AC Sources - Operating; Section 3.8.2, AC Sources - Shutdown; Section 3.8.3, Diesel Fuel Oil, Lube Oil, and Starting Air; Section 3.8.9, Distribution Systems -

Operating; and Section 3.8.10, Distribution Systems - Shutdown. Bases for these TSs are in B3.8.1, AC Sources - Operating; B3.8.2, AC Sources - Shutdown; B3.8.3, Diesel Fuel Oil, Lube Oil, and Starting Air; B3.8.9, Distribution Systems - Operating; and B3.8.10, Distribution Systems - Shutdown.

Conceptual Design: DCD Tier 2 contains conceptual design information, related to the following systems:

  • The Switchgear Building (Auxiliary Building). Conceptual design information for this structure is included in Section 1.2, General Plant Description, and Section 8.3.

8-28

  • The auxiliary power and generator transformer areas. Conceptual design information for these components is included in Section 8.2.
  • The lightning protection and grounding system grid. Conceptual design information for this system is included in Section 8.3.1.
  • The electrical distribution system safety-related equipment in geographically separated essential service water buildings. Conceptual design information for this system is included in Section 3.2, Classification of Structures, Systems, and Components, Table 3.2-1, Classification of Structures, Systems, and Components.

APR1400 Plant Interfaces: DCD Tier 2, Table 1.8-1, Index of System, Structure, or Component Interface Requirements for APR1400, contains information related to the following plant interfaces that will be addressed in the COL designs:

  • Switchyard: Onsite ac power transmission system connections to the switchyard and the connection to the plant power distribution system.

8.3.1.3 Regulatory Basis The relevant requirements of NRC regulations for the onsite ac power system, and the associated acceptance criteria, are given in Section 8.3.1 of NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition, and are summarized below. Review interfaces with other SRP sections can be found in Section 8.3.1 of NUREG-0800.

1. GDC 2, Design basis for protection against natural phenomena, as it relates to SSCs of the ac power system being capable of withstanding the effects of natural phenomena without the loss of the capability to perform their safety functions.
2. GDC 4, Environmental and dynamic effects design bases, as it relates to SSCs of the ac power system being capable of withstanding the effects of missiles and environmental conditions associated with normal operation, maintenance, testing, and postulated accidents.
3. GDC 5, Sharing of structures, systems, and components, as it relates to sharing of SSCs of the ac power systems of different nuclear power units.
4. GDC 17, Electric power systems, as it relates to the onsite ac power system's: (1) capacity and capability to permit functioning of SSCs important to safety assuming no offsite power is available; (2) independence, redundancy, and testability to perform its safety function assuming a single failure; and (3) provisions to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, 8-29

the loss-of-power generated by the nuclear power unit or the loss-of-power from the transmission network.

5. GDC 18, Inspection and testing of electric power systems, as it relates to inspection and testing of the onsite power systems.
6. GDC 50, Containment design basis, as it relates to the design of containment electrical penetrations containing circuits of the ac power system and the capability of electric penetration assemblies in containment structures to withstand a loss-of-coolant accident (LOCA) without loss of mechanical integrity and the external circuit protection for such penetrations.
7. Section 50.55a(h) of 10 CFR, Codes and Standards, as it relates to the incorporation of IEEE Std. 603-1991, Standard Criteria for Safety Systems for Nuclear Power Generating Stations, (including the correction sheet dated January 30, 1995).
8. Section 50.63 of 10 CFR, Loss of all alternating current power, as it relates to the redundancy and reliability of the emergency onsite ac power sources, as a factor in limiting the potential for SBO events.
9. Section 50.65(a)(4) of 10 CFR, Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, as it relates to the assessment and management of the increase in risk that may result from proposed maintenance activities before performing the maintenance activities for the onsite ac power system. These activities include, but are not limited to, surveillances, post-maintenance testing, and corrective and preventive maintenance. Compliance with the maintenance rule, including verification that appropriate maintenance activities are covered therein, is reviewed under SRP Chapter 17, Quality Assurance. Programs for incorporation of requirements into appropriate procedures are reviewed under SRP Chapter 13, Conduct of Operations.
10. Section 50.34(f)(2) of 10 CFR, Contents of applications; technical information, as it relates to; automatic main control room (MCR) annunciation for bypassed or deliberately induced inoperability of safety-related systems, establishing and maintaining natural circulation in hot standby conditions during a LOOP, and providing power for pressurizer safety and relief valves, and the pressurizer level instrumentation.
11. Section 52.47(b)(1) of 10 CFR, Contents of applications; technical information, which requires that a DC application contain the proposed ITAAC that are necessary and sufficient to provide reasonable assurance that, if the inspections, tests, and analyses are performed and the acceptance criteria met, a facility that incorporates the DC is built and will operate in conformity with the DC, the provisions of the Atomic Energy Act of 1954, as amended, and the NRC rules and regulations.

Acceptance criteria and guidance adequate to meet the above requirements include:

1. RG 1.6, Independence Between Redundant Standby (Onsite) Power Sources and Between Their Distribution Systems, Regulatory Positions D.1, D.3, and D.4, as they relate to the independence between redundant onsite ac power sources and their respective ac load groups.

8-30

2. RG 1.9, Application and Testing of Safety-Related Diesel Generators in Nuclear Power Plants, as it relates to the design and testing of the onsite power supply.
3. RG 1.32, Criteria for Power Systems for Nuclear Power Plants, as it relates to the design, operation, and testing of the safety-related portions of the onsite ac power system. Except for sharing of safety-related ac power systems in multi-unit nuclear power plants, RG 1.32 endorses IEEE Std. 308-2001 Standard Criteria for Class 1E Power Systems for Nuclear Power Generating Stations.
4. RG 1.47, Bypassed and Inoperable Status Indication for Nuclear Power Plant Safety Systems, as it relates to the bypass and inoperable status of the onsite power supply.
5. RG 1.53, Application of the Single-Failure Criterion to Nuclear Power Plant Protection Systems, as it relates to the application of the single-failure criterion.
6. RG 1.63, Electric Penetration Assemblies in Containment Structures for Nuclear Power Plants, as it relates to the capability of electric penetration assemblies in containment structures to withstand a loss of coolant accident without loss of mechanical integrity and the external circuit protection for such penetrations.
7. RG 1.75, Physical Independence of Electrical Systems, as it relates to the physical independence of the circuits and electrical equipment that comprise or are associated with the onsite ac power system.
8. RG 1.81, Shared Emergency and Shutdown Electric Systems for Multi-Unit Nuclear Power Plants, as it relates to the sharing of SSCs of the ac power system. Regulatory Position C.2a states that multi-unit sites that share ac systems should be limited to two units.
9. RG 1.118, Periodic Testing of Electric Power and Protection Systems, as it relates to the capability to periodically test the onsite ac power system.
10. RG 1.153, Criteria for Safety Systems, as it relates to the design, reliability, qualification, and testability of the power, instrumentation, and control portions of safety systems of nuclear plants, including the application of the single-failure criterion in the onsite ac power system.
11. RG 1.155, Station Blackout, as it relates to the capability and the capacity of the onsite ac power system for an SBO, including the operation of the AAC power source(s).
12. RG 1.160, Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, as it relates to the effectiveness of maintenance activities for ac power systems.
13. RG 1.182, Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants, as it relates to conformance to the requirements of 10 CFR 50.65(a)(4) for assessing and managing risk when performing maintenance.
14. RG 1.206, Combined License Applications for Nuclear Power Plants (LWR Edition), as it relates to power system analytical studies and stability studies to verify the capability of the offsite power systems and their interfaces with the onsite power system.

8-31

8.3.1.4 Technical Evaluation The staff has reviewed the onsite ac power system presented in DCD Tier 2, Section 8.3.1.

This section provides descriptive information, analyses, and referenced documents, including electrical single-line diagrams, tables, and conceptual plant physical arrangement. The review is to evaluate whether the APR1400 onsite ac power system satisfies applicable regulatory requirements to ensure its intended safety functions are met during all plant operating and accident conditions. The onsite ac power system for APR1400 consists of standby power sources, distribution systems, and auxiliary supporting systems provided to supply power to safety related equipment or equipment important to safety for all normal operating and accident conditions.

NUREG-0800, Table 8-1, lists GDCs, RGs, standards, and BTPs that are applicable for electrical power systems. The staff has reviewed the following APR1400 DCD information that relates to compliance with requirements applicable to onsite ac power system design and conformance to applicable guidance as described below:

8.3.1.4.1 GDC 2, Design bases for protection against natural phenomena GDC 2 requires that SSCs important to safety, which include the onsite ac power systems, be capable of withstanding the effects of natural phenomena without the loss of the capability to perform their safety functions.

The APR1400 onsite ac power distribution system has two redundant divisions divided into four independent trains: Division I with Trains A and C and Division II with Trains B and D. Each Class 1E electrical train consists of Class 1E EDG and power distribution equipment. Each division of Class 1E Safety-related distribution equipment is located in separate fire zones in a Seismic Category I room. Each safety-related Class 1E division is located in separate rooms in these buildings, which provide physical separation among the four redundant trains. All Class 1E equipment and components such as switchgear, load centers, Motor Control Centers (MCCs), and load center transformers will meet the Seismic Category I requirements. The nature and magnitude of the natural phenomena considered in the APR1400 design are described in DCD Tier 2, Chapter 2, Site Characteristics. The APR1400 design criteria for wind, tornado, water level (flood), and seismic events (earthquake) have been evaluated in Section 3.3, Wind and Tornado Loadings, Section 3.4, Water Level (Flood) Design, and Section 3.7, Seismic Design, respectively, of DCD Tier 2, Chapter 3, Design of Structures, Systems, Components, and Equipment.

As stated in DCD Tier 2 Section 8.1.3.2, Onsite Power System, and Section 8.3.1.1.2, Class 1E Onsite AC Power System, all Class 1E components of the APR1400 onsite ac power system are located in Seismic Category I structures that are protected from the effects of natural phenomena such as wind, hurricane, tornadoes, tornado missiles, flood, and earthquake. Part 50 of 10 CFR, Appendix B, (Criterion III - Design Control) requires that this equipment, as installed, is seismically qualified in accordance with the COL applicants Quality Assurance Program (QAP). The staff evaluated the adequacy of a COL applicants QAP in Chapter 17 of this report. The location of the onsite ac power system inside Seismic Category I structures, the design of the onsite ac power system as Class 1E, and the seismic qualification of that equipment, will provide assurance that equipment and structures will be designed to withstand the effects associated with natural phenomena without loss of capability to perform their safety functions during an accident.

8-32

Based on the above discussion, the staff finds that the APR1400 onsite ac power system meets the requirements of GDC 2 since the onsite ac power system design is capable of withstanding the effect of natural phenomena without the loss of the capability to perform its safety functions.

8.3.1.4.2 GDC 4, Dynamic and environmental effects design bases GDC 4 requires that SSCs important to safety, which include the onsite ac power system, be capable of withstanding the effects environmental conditions associated with normal operation, maintenance, testing, and postulated accidents, as well as protected against dynamic effects such as missiles, pipe whipping, and discharge of fluids. Specifically, the onsite ac power system must be designed to accommodate the effects of and to be compatible with the environmental conditions, and to be appropriately protected against dynamic effects, including the effects of missiles that may result from equipment failures.

The staff has reviewed the applicants onsite Class 1E ac distribution system components as described in DCD Tier 2, Section 8.3.1.1.2. These are located in Seismic Category I structures, and rooms constructed in such a manner that any internal hazard only affects their respective division. There are two such functionally independent and physically separated divisions, divided into four independent trains: Division I with Trains A and C and Division II with Trains B and D. Class 1E electrical distribution equipment is located away from high- or moderate-energy lines and potential internal missile areas. These rooms are also provided conditioned air that maintains ambient environmental conditions during normal operations and Design Basis Events (DBEs), as discussed in DCD Tier 2, Section 9.4.5.4.4, GDC 17, Electric Power Systems.

The Class 1E ac power system is supplied power from one of the two mobile GTG in case of a beyond-design-basis external event. The COL applicant is to provide and to design a mobile GTG and its support system as described in COL Item 8.3(1). The staff determined that there was a lack of information regarding mobile GTGs. Therefore, in RAI 61-7984, Question 08.03.01-5 (ML15189A483), the staff requested additional information regarding the design basis and methodology to determine the capacity, anticipated physical location, and connection configuration of the mobile GTGs to the plant power distribution system. In its response to RAI 61-7984, Question 08.03.01-5 (ML15251A244), the applicant provided a summary of design aspects, as follows.

The APR1400 engages two types of mobile GTGs to cope with each phase of mitigation strategies for Beyond Design Basis External Events (BDBEEs). Two redundant 480 V and one 4.16 kV mobile GTG are credited to power the Class 1E load center and switchgear, respectively. The mobile GTG details with anticipated location, storage, and connection configuration to plant power distribution system are provided in DCD Tier 2, Section 19.3, Beyond Design Basis External Events, and Technical Report APR1400-E-P-NR-14005-P, Revision 0, Evaluations and Design Enhancements to Incorporate Lessons Learned from Fukushima Dai-chi Nuclear Accident. The applicant revised the DCD Tier 2, Figure 8.1-1, Electric Power System Single Line Diagram, Section 8.3.1.1, Description of AC Power System, Section 8.3.3, Combined License Information, and Figure 8.3.1-1, Onsite AC Electrical Power System. The staff reviewed the response related to design basis and methodology to determine capacity and other parameters of the equipment to be used for mitigation strategies during BDBEE, and determined that the applicant has provided adequate information which is also provided as a COL Item 8.3(1). The COL Item 8.3(1) states that COL applicant will provide design of the mobile GTG and its support structure suitable to the site-8-33

specific environment. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and finds that RAI 61-7984, Question 08.03.01-5, is resolved and closed.

The mitigation strategy for BDBEE and these power sources during BDBEE are discussed in Section 19.3 of this report.

Furthermore, to meet the GDC 4, all SSCs important to safety must be qualified. For the equipment located in harsh environments, the environmental qualification program for electrical equipment provides reasonable assurance that equipment remains functional during and following exposure to harsh environmental conditions as a result of a DBE. Environmental qualification of mechanical and electrical equipment described in DCD Tier 2, Section 3.11, Environmental Qualification of Mechanical and Electrical Equipment, lists GDC 4 as one of the acceptance criteria. DCD Tier 2, Table 3.11-1, Ventilation Areas, of Section 3.11, lists safety-related electrical and I&C equipment located in a harsh environment that must be qualified. In DCD Tier 2 Section 8.3.1.2.1, Criterion 4 - Environmental and Dynamic Effects Design Bases, the applicant discussed that the equipment and components of the Class 1E onsite ac power system are to be qualified. Environmental qualification of the equipment, important to safety are discussed in Section 3.11 of this report. In DCD Tier 2, Section 8.3.1.2.1, the applicant further stated that Class 1E electrical distribution equipment is located away from high- or moderate-energy lines and potential internal missile areas. Conformance with GDC 4 for equipment related to protection from dynamic effects is also addressed in Chapter 3 of this report.

Based on the above, the staff determined that the onsite ac power system design for APR1400 can perform safety-related functions following physical effects of an environmental hazard. The staff determined that the onsite Class 1E power system is designed to provide power to systems important to safety during normal, abnormal, accident and post-accident conditions, as the Class 1E equipment will be qualified for the harsh environment and will be protected from the dynamic effects that may result from equipment failures and from events and conditions outside the nuclear power unit. Thus, the onsite ac power system design for APR1400 meets the requirements of GDC 4.

8.3.1.4.3 GDC 5, Sharing of structures, systems, and components GDC 5 requires SSCs important to safety not be shared among other nuclear units unless it can be shown that such sharing will not significantly impair their ability to perform their safety functions. The APR1400 design is considered as a single unit with no shared SSCs. The SSCs of the onsite ac power system for the APR1400 are not shared between individual nuclear power units. Additional discussion is in Section 8.1.4.3, Compliance with GDC 5, of this report. Therefore, GDC 5 and RG 1.81, Shared Emergency and Shutdown Electric Systems for Multi-Unit Nuclear Power Plant, do not apply to the onsite ac power system. However, GDC 5 may be applicable to a COL applicant that references the APR1400 design if its application includes multiple units.

8.3.1.4.4 GDC 17, Electric power systems GDC 17 requires, in part, that an onsite ac power system be provided to permit functioning of SSCs important to safety. GDC 17 requires that this system have the safety function to provide sufficient capacity and capability to assure that acceptable fuel design limits and design conditions of the RCS are not exceeded as a result of AOOs, and that the core is cooled and 8-34

component integrity and other vital functions are maintained in the event of postulated accidents. The systems to which the onsite ac power system supplies power that accomplishes these functions are governed by GDC 33, Reactor coolant makeup; GDC 34, Residual heat removal; GDC 35, Emergency core cooling; GDC 38, Containment heat removal; GDC 41, Containment atmosphere cleanup; and GDC 44 Cooling water for SSCs important to safety; during normal and accident conditions, as necessary for the specific system condition. GDC 17 requires further that this onsite ac power system have sufficient independence, redundancy, and testability to perform its safety functions assuming a single failure, and include provisions to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss-of-power generated by the nuclear power unit or the loss-of-power from the transmission network. Conformance with these requirements is accomplished by meeting the requirements of GDC 17.

As set forth below, the applicant has established the onsite ac power systems compliance with GDC 17 by demonstrating conformance to the applicable guidance. The staffs evaluation of whether the APR1400 onsite ac system design conforms to the applicable guidance that is set forth in RG 1.6, RG 1.9, RG 1.32, RG 1.53, RG 1.75, RG 1.153, RG 1.155, RG 1.204, NUREG/CR 0660, Enhancement of Onsite Emergency Diesel Generator Reliability; and SECY-91-078, is discussed in the following sections.

8.3.1.4.4.1 Conformance to RG 1.6 DCD Tier 2, Section 8.3.1.2.2, states conformance to RG 1.6. RG 1.6 is related to the independence between redundant standby onsite power sources and between their distribution systems. The staff reviewed the safety-related onsite ac design that provides independence between the redundant standby power sources that supply the safety-related loads. The APR1400 safety-related onsite ac power distribution system has two independent load groups i.e., divisions (Division I and II), each of which is normally powered from the preferred offsite power source and can be powered by an independent and redundant onsite standby power source, that is an EDG. The two divisions can be further divided into two pairs of trains (i.e.,

Trains A and C for Division I, and Trains B and D for Division II) as a divisional pair. Each divisional pair can power the full complement of safety-related systems and components, to supply the loads for safe shutdown during a LOCA concurrent with a LOOP.

The applicant stated that the two safety-related Class 1E divisions are normally functionally independent and physically separated from each other. The Class 1E switchgear buses have no automatic connection to any loads or buses in different trains. However, the applicant did not explain how the Class 1E buses are functionally independent and physically separated.

In RAI 95-8080, Question 08.03.01-8, the staff requested that the applicant explain how the four Class 1E buses (trains) are functionally independent. Also the staff noted from the DCD Tier 2 Table 8.3.1-2, Class 1E Loads (Division I), that loading of safety-related buses are not identical. The staff requested these clarifications: a) why these buses are not identical in loading, b) if the variation of loading for four EDGs is evaluated as acceptable for shutdown of the plant, when a divisional pair is considered for safety function/safe shut-down, and c) under the worst case scenario, if an EDG of the Division II is under maintenance/out of service, explain how the single failure (one EDG fails to start) in Division I can perform the required safety functions or bring the plant to a safe shutdown.

8-35

In its response to RAI 95-8080, Question 08.03.01-8 (ML15303A056), the applicant responded to the above questions as follows:

a) The four Class 1E electrical trains (A, B, C, and D) are functionally independent as each Class 1E is made up of dedicated systems and components to the particular train. An EDG, with its own control and protection system, has no physical and functional interfaces like signal exchange or interlock with other trains. Also for each Class 1E EDG, a dedicated and functionally independent load sequencer and control scheme are provided, which will initiate starting of its EDG in the event of an accident condition.

b) The applicant reevaluated the loading tables and updated the DCD Tier 2 Table 8.3.1-2, Class 1E Loads (Division I) and Table 8.3.1-3, Class 1E Loads (Division II) to reflect the identical loading. There are minor differences of twenty one (21) kilowatts (kW) in loading between divisions I and II which is due to different design conditions related to heating, ventilation, and air conditioning (HVAC) system for the train A and train B.

c) Redundant divisions of the Class 1E power system, Trains A and C for Division I, and B and D for Division II are provided to meet the single failure criterion.

Should a LOCA with a LOOP occur during the LCO completion time (72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />),

the plant would have sufficient emergency power with two available EDGs (combination of Train A and Train C, or Train B and Train D) to mitigate the accident and safely shutdown the plant. In a LOOP condition, the plant can transition to a safe shutdown condition on a minimum of one EDG, as long as the one available EDG is either Train A or Train B. If both Train A and Train B EDGs are not available with a LOOP, the AAC source would be connected to Train A or Train B in order to enable a controlled cooldown of the plant to a safe shutdown condition.

In RAI 95-8080, Question 08.03.01-8, the staff also asked why the AAC power source is not connected to all four Class 1E trains. In its response to RAI 95-8080, Question 08.03.01-8 (ML15303A056), the applicant responded that the AAC source will be connected only to Class 1E Division 1 Bus 1A and Division II Bus 1B, and not connected to all four divisions, because these two buses are designated as the dedicated Class 1E 4.16 kV switchgears for safe shutdown during a LOOP or an SBO.

Based on the above clarifications, the staff determined that the four (4) Class 1E electrical trains for the power distribution system (Train A and Train C for Division I, and Train B and Train D for Division II) are functionally independent because they are made up of dedicated power, control, protection and EDG system related to each Class 1E train, and do not have any physical or functional interfaces with the other trains and redundant divisions. Also, the staff determined that the onsite power system is designed with the physical and electrical independence from an offsite power system so that single failure does not prevent separation of the redundant portions of the onsite power system from the offsite power system. The staff determined that these design features conform to RG 1.6, and that the APR1400 onsite power systems have sufficient independence and redundancy in this respect to perform their safety functions assuming a single failure.

8-36

The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and finds that RAI 95-8080, Question 08.03.01-8, is resolved and closed.

8.3.1.4.4.2 Conformance to RG 1.9 In DCD Tier 2, Section 8.3.1.1.3, Class 1E Emergency Diesel Generators, the applicant stated that EDGs for the onsite ac power system conform to the guidance of RG 1.9, Application and Testing of Safety-Related Diesel Generators in Nuclear Power Plants, that endorses IEEE Std.

387-1995, Criteria for Diesel Generator Units Applied as Standby Power Supplies for Nuclear Power Generating Stations. The staff has reviewed the four safety-related EDGs that are provided as the standby onsite ac power source for the APR1400 plant and supply power to the station safety-related and selected non-safety-related loads in the event of a LOOP or voltage degradation of the Class 1E buses. Each EDG is assigned to its respective safety-related Class 1E division. The four EDGs and associated equipment are located in their own separate room of the auxiliary building and EDG Building. The EDG building is a Seismic Category I structure, and is built to provide physical protection for the EDGs. Within the building, the four EDGs and their support systems are physically separated from each other by a concrete wall to protect against internal hazards. APR1400 EDGs include the following design features, as stated in DCD Tier 2, Section 8.3.1.1.4, Electrical Equipment Layout:

  • The EDGs are designed to be automatically initiated in the event of an accident or a LOOP. They are rated to have a continuous load rating plus margin. They are also sized to accelerate all of the loads in the loading sequence without exceeding the allowable voltage and frequency limits stated in RG 1.9.
  • Each EDG has an independent air starting system with storage to provide at least five starts.
  • Trains A and B EDGs are rated at 9,100 kW continuous rating and 10,010 kW short-time rating (two hours), and Trains C and D EDGs are rated at 7,500 kW continuous rating and 8,250 kW short-time rating.
  • The EDG units have the minimum target reliability factor of 0.95 in accordance with RG 1.9 and RG 1.155.
  • An emergency start signal overrides the engine and generator protection trips.
  • When operating in emergency mode, bypassed conditions are annunciated in the MCR and locally to alert the operators of the abnormal condition.
  • Controls and indications to start up, shut down, and parallel the generator with the preferred power source are available from the MCR and the remote shutdown room (RSR).
  • Motive and control power supplies to EDG auxiliary support components are from the DC and I&C System (as Uninterruptible Power Supply) of the same division.

In RAI 57-7965, Question 08.03.01-2 (ML15189A490), the staff requested a confirmation of the EDG rating, as the staff determined that the EDG ratings in Tier 2, Chapter 16, TS Bases B 3.8.1 are different from the DCD Tier 2, Section 8.3.1.1.3. In its response to RAI 57-7965, 8-37

Question 08.03.01-2 (ML15231A806), the applicant confirmed that the ratings of the EDGs in DCD Tier 2, Section 8.3.1.1.3 are consistent with the calculations and the TS Bases will be revised to be consistent with DCD Tier 2, Section 8.3.1.1.3. Since the continuous and short time rating of the EDGs are confirmed based on the calculation results, the staff considers RAI 57-7965, Question 08.03.01-2, to be resolved. The TS Chapter 16, Bases Section B 3.8.1, AC Sources Operating was revised and the staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response. The staff finds that RAI 57-7965, Question 08.03.01-2, is resolved and closed.

DCD Tier 2, Section 8.3.1.1.2.2, Single Failure Criteria, states that the Class 1E onsite ac power system consists of two redundant load groups (Division I and Division II), with four independent Trains (A, B, C, and D), as shown in DCD Tier 2, Figure 8.3.1-1, Onsite AC Electrical Power System. One of the two divisions (Trains A and C or Trains B and D),

including associated Class 1E EDGs and electrical distribution systems, is required to supply the loads for safe shutdown during a LOCA concurrent with a LOOP. It also states that the four independent Class 1E buses of the onsite power system and the connection between the onsite and offsite power systems are provided with physical separation and electrical isolation.

In RAI 95-8080, Question 08.03.01-8 (ML15203A930), the staff asked for an explanation of how the four Class 1E buses (trains) are functionally independent as the staff noted that loading of the safety buses, Train A and C, and Train B and D are not identical. Furthermore, the staff requested that if variation of loading for four DGs is evaluated as acceptable for shutdown of the plant, when a divisional pair is considered for safety function/safe shutdown. In its response to RAI 95-8080, Question 08.03.01-8 (ML15303A056), the applicant stated that the four electrical trains with one EDG in each train of the Class 1E onsite power system are functionally independent as: (1) each Class 1E train is made up of dedicated systems and components to the particular train, including ac and dc power distribution systems and a Class 1E EDG in each train; (2) each train has its own control and protection schemes and there are no physical or functional interfaces with other trains including no signal exchanges or interlocks; and (3) for each Class 1E EDG, a dedicated and functionally independent load sequencer and control scheme are provided. In the event of an accident condition which requires EDG operation,

[(e.g., LOOP, safety injection actuation signal (SIAS), auxiliary feedwater actuation signal (AFAS) or containment spray actuation signal (CSAS)], a start of each Class 1E EDG is initiated irrespective of the conditions of the other trains. The staff accepted the response as the staff determined that EDG trains are dedicated to each train without any interfaces to other dedicated trains, and are therefore functionally independent.

The applicant stated that based on the updated EDG load information, the 4.16 kV load data of Trains A and C safety buses are identical to those of Trains B and D safety buses. DCD Tier 2, Table 8.3.1-2 and Table 8.3.1-3 reflect the identical loading. The applicant also clarified the difference in the loading of safety buses Trains A and C and Trains B and D, which arises due to different design conditions for ventilation loads for the Train A and Train B HVAC system.

The capacity difference of 21.6 kW is due to the fact that the ambient temperature is such that the Train B electric duct heater requires a higher capacity than that for Train A. Therefore, the staff concluded that the EDG loading for Trains A and C safety buses are identical to those of Trains B and D safety buses. Also minor variations in loading for the four EDGs are due to different local environmental design conditions of the Train A and Train B HVAC systems loads, and is acceptable. Therefore, the staff considers this issue resolved. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and finds that RAI 95-8080, Question 08.03.01-8, is resolved and closed.

8-38

In RAI 61-7984, Question 08.03.01-7 (ML15189A483), the staff requested clarifications on EDG related information provided in DCD Tier 2, Section 8.3.1.1.3. These are discussed below with the applicants responses:

  • Target Reliability Factor of the EDG: DCD Tier 2, Section 8.3.1.1.3, states that the EDG units have the minimum target reliability factor of 0.95 in accordance with RG 1.9. Since the reliability factor is dependent on all other factors (redundancy of EDGs, frequency of LOOP, and probable time needed to restore offsite power), a higher reliability of the EDGs will result in a lower probability of a SBO with a corresponding decrease in coping duration for a given plant.

Moreover, this is a site specific item to verify the reliability during the operation of the plant, the staff considered that this should be a COL item and should be added in the DCD Tier 2 Section 8.3.1 and DCD Tier 2 Chapter 1, Introduction and General Description of the Plant. A COL applicant that references the APR1400 DC will establish procedures to monitor and maintain EDG reliability during plant operations to verify the selected reliability level target is being achieved as intended in RG 1.155. The staff also requested a discussion on the methodology and relevant attributes of the reliability program. In its response to RAI 61-7984, Question 08.03.01-7 (ML15306A581), the applicant stated that the target reliability factor of the EDG units was assumed to be 0.95 from a conservative approach, and the definitive target reliability will be chosen by the COL applicant. Therefore the DCD Tier 2, Section 8.3.1.1.3, Section 8.4.1.2, Station Blackout Coping Duration, and Section 8.4.3, Combined License Information will be revised to add two COL Items 8.3(3) and COL 8.4(1). COL Item 8.3(3) will add that the COL applicant will establish procedures to monitor and maintain EDG reliability during plant operations to verify the selected reliability target level is being achieved as intended in RG 1.155. COL Item 8.4(1) will add that the COL applicant is to validate the SBO coping duration in accordance with the methods specified in RG 1.155. COL 8.4(1) is discussed in Section 8.4 of this report. The staff reviewed the information leading to monitoring and maintaining of the EDG reliability and addition of a COL Item to accomplish that. The staff accepted the response because the COL applicant will establish procedures to monitor and maintain EDG reliability during plant operations to verify that the selected reliability target is achieved as intended in RG 1.155, and the issue in RAI 61-7984, Question 08.03.01-7, on target reliability factor, is resolved. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and finds that RAI 61-7984, Question 08.03.01-7, is resolved and closed.

  • Generator of the EDG: The staff requested additional information of the generator of the EDG such as type and pertinent generator characteristics. In its response to RAI 61-7984, Question 08.03.01-7 (ML15306A581), the applicant provided the generator information and discussed the ac synchronous generator, its excitation system, and voltage regulator. The electric generator, excitation system and voltage regulator system are Class 1E and Seismic Category I. DCD Tier 2, Section 8.3.1.1.3.8, Electric Generator and Subsystems and includes the description of the components of the generator. Also DCD Tier 2, Section 8.3.1.1.3.2, EDG Support Systems discusses the EDG support systems such as starting air, lubrication, air intake and exhaust, HVAC and fuel oil. Based on the review of the response on the generator information, the staff determined that 8-39

adequate information on the generator and support systems is provided and finds the response acceptable. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and finds that RAI 61-7984, Question 08.03.01-7, is resolved and closed.

  • Loading Sequence Time: In DCD Tier 2, Section 8.3.1.1.3.6, Load Shedding and Sequencing Criteria, the staff noted that the EDGs are started on an ESF actuation system (ESFAS) and ready for operation within 17 seconds. However, DCD Tier 2 Table 8.3.1-2, shows EDG loading sequence time from 5 seconds to 30 seconds. The staff requested clarification if the loading sequence time of 5-30 seconds begins after the 17 seconds when EDG becomes ready for operation.

In its response to RAI 61-7984, Question 08.03.01-7 (ML15306A581), the applicant stated that the EDGs are started on a LOOP and/or an ESFAS signal (SIAS, AFAS) or CSAS) and ready for operation within 17 seconds. The applicant clarified that the EDGs are ready for operation within 17 seconds which is the maximum amount of time required for EDG starting and acceleration up to the rated voltage and frequency before the EDG output breaker closes and is connected to the associated Class 1E 4.16 kV bus ready to take on load.

Therefore, the DCD Tier 2, Table 8.3.1-2 loading sequence times represent the time immediately after the 17 seconds from the onset of a LOOP and the EDG output breaker is closed. The staff accepted the response because the applicant clarified the timing for EDGs to start and accelerate to rated voltage and frequency within 17 seconds vs. being ready for loading after this time which can be 5 to 30 seconds for individual loads. This is an adequate explanation, and the staff considers this issue to be resolved.

  • Starting and Loading: DCD Tier 2 Table 8.3.1-2, Class 1E Loads, shows that large induction motors are started in quick succession, from 5 to 30 seconds, and as a result, can cause a voltage reduction at the bus and can therefore potentially can cause a running motor to stall, or prevent a motor from starting.

The staff requested clarification as to how the EDG can: (1) adequately supply the Class 1E loads and can accept large loads in quick succession, (2) accomplish recovery from transients without tripping or causing the EDG to overspeed, and (3) meet the restoration of voltage and frequency to within 10 percent and 2 percent of nominal respectively with load step increase in accordance with RG 1.9. In its response to RAI 61-7984, Question 08.03.01-7 (ML15306A581), the applicant responded that based on the loading requirement, the EDG manufacturer design will account for the EDG and its support systems such that the EDG set shall be capable of meeting the given motor starting requirements without exceeding the following limitations during and immediately following a load application or rejection period. These design requirements below are incorporated into the vendor procurement specification for the EDG.

a) During the loading sequence voltage will not decrease to less than 75 percent of nominal or frequency will not decrease to less than 95 percent of nominal.

b) During recovery from transients caused by step load increases or resulting from the disconnection of the largest single load, the speed of 8-40

the EDG shall not exceed 75 percent of difference between nominal speed and the overspeed trip setpoint or 115 percent of nominal, whichever is lower.

c) Voltage shall be restored to within 10 percent of nominal and frequency shall be restored to within 2 percent of nominal in less than 2 seconds in accordance with RG 1.9.

To satisfy the voltage and frequency transient requirements of RG 1.9, the applicant stated that the generator takes advantage of the fast acting governor, static exciter, and voltage regulator. In addition, the generator inertia and reactance value will be adjusted to meet the requirements. After selection of the manufacturer, the load sequence analysis report will be developed and evaluated. Modeling of generator, engine, governor, excitation system, transformer, cable and motor loads are required for the computer simulation.

The staff reviewed the response and determined that EDG starting and loading will account for voltage and frequency without exceeding the limits set during and immediately following a load application and meets the guidance provided in RG 1.9. Therefore the staff accepted the response and this issue is resolved.

  • Capacity Margin: The staff requested a discussion regarding the margins provided for EDGs, specifically for capacity, voltage, frequency, in the early stage of the design. RG 1.9 states that the uncertainties inherent in safety load estimates at an early stage of design are sometimes of such magnitudes that it is prudent to provide a reasonable margin in selecting the load capabilities of the EDGs. In its response to RAI 61-7984, Question 08.03.01-7 (ML15306A581),

the applicant stated that during the early stage of design, the EDG should have a continuous load rating equal to the sum of the conservatively estimated connected loads that the diesel generator would power at any one time, plus a 10 to 15 percent margin. The electric motor drive ratings should be calculated using conservative estimates of these characteristics (e.g., pump runout conditions and motor efficiencies of 90 percent or less, and power factors of 85 percent or less) as per RG 1.9. Also EDG transient simulation is performed under the full load condition including the capacity margin (i.e., 10 percent to 15 percent) and evaluates the limited peak value of voltage and frequency as per the design requirement of RG 1.9. The staff reviewed this and considers that adequate margin is provided for the EDG capacity, and therefore accepted the response.

Therefore, this issue is considered resolved.

  • Tripping devices, alarm and annunciation: The staff noted that certain mechanical and electrical tripping devices were not addressed in DCD Tier 2, Section 8.3.1.1.3.3, Tripping Devices, such as Governor Failure, High bearing Temperature, High Winding Temperature, and Rotating Diode Failure. In its response to RAI 61-7984, Question 08.03.01-7 (ML15306A581), the applicant has revised DCD Tier 2, Section 8.3.1.1.3.3 with the aforementioned tripping devices. The staff accepted the response because the revised list of tripping devices included the required electrical and mechanical trips which are provided for EDG governor, generator field, and bearing, to protect the EDGs during testing. The staff considers this issue resolved. The staff confirmed that DCD 8-41

Revision 1 contains the changes as committed to in the RAI response, and finds that RAI 61-7984, Question 08.03.01-7, is resolved and closed.

In the Alarm and Annunciation category in DCD Tier 2, Section 8.3.1.1.3.3, the staff noted that the alarm and annunciations are provided in the MCR and RSR, but the applicant has not addressed the annunciations to survey the variables locally. In its response to RAI 61-7984, Question 08.03.01-7 (ML15306A581),

the applicant stated that the diagnostic monitoring and display system provides further detailed information of the EDG monitoring and alarms, trending display and analysis of parameters, and on-line testing, in the EDG control room. DCD Tier 2, Sections 8.3.1.1.3.3, Tripping Devices, and 8.3.1.1.3.9, Instrumentation and Control Systems, includes the above information. The staff accepted the response, as the applicant adequately addressed the EDG monitoring at MCR, RSR as well as local monitoring and alarm system of the EDGs so that EDG can be monitored for all normal operating and abnormal conditions. The staff considers this issue to be resolved. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and finds that RAI 61-7984, Question 08.03.01-7, is resolved and closed.

Accordingly, the staff concludes that the applicant adequately addressed the multiple issues in response to RAI 61-7984, Question 08.03.01-7, and meets the guidance in RG 1.9 with respect to EDG capacity, capability, and testability. Therefore the staff considers this issue to be resolved.

8.3.1.4.4.3 Conformance to RG 1.32 DCD Tier 2, Section 8.3.1.2.2, states conformance to RG 1.32. RG 1.32 is related to the criteria for power systems. The staff has reviewed the design criteria and design features for the APR1400 onsite ac power system to determine whether it will perform its safety functions under the conditions produced by the postulated DBE and whether methods for tests and surveillance of the safety-related power systems are adequate to verify this capability during the operational life of the plant. The staff has also reviewed electrical and physical separation of redundant power sources and distribution systems, initial plant startup test programs, electrical independence, and analyses described in the DCD. The onsite safety-related ac power system is divided into two divisions. Each division is located in its respective separate location within a Seismic Category I building, which also provides a physical separation from its redundant division. The staff determined that the onsite ac power system has been designed in accordance with IEEE Std. 308-2001, IEEE Standard Criteria for Class 1E Power Systems for Nuclear Power Generating Stations, as endorsed by RG 1.32, Criteria for Power Systems for Nuclear Power Plants. The boundary of Class 1E emergency power supply system for APR1400 is also consistent with IEEE Std. 308 to perform its required safety function. As an example, the isolation and separation of the non-Class 1E components from the Class 1E system prevent degradation of the Class 1E system to an unacceptable level. The staff determined that this design feature ensures that the Class 1E power for the safety related systems conform to their functional requirements, as the onsite ac power system has been designed in accordance with IEEE Std. 308, as endorsed by RG 1.32 to provide Class 1E power of adequate quality, which enables the safety-related systems to perform their credited functions, and which the staff therefore determined to be acceptable.

8-42

8.3.1.4.4.4 Conformance to RG 1.53 DCD Tier 2, Section 8.3.1.2.2, states that the onsite safety-related ac power systems have been designed to conform with RG 1.53, Application of the Single-Failure Criterion to Safety Systems, which endorses IEEE Std. 379-2000, Application of the Single-Failure Criterion to Nuclear Power Generating Station Safety Systems.

In RAI 95-8080, Question 08.03.01-8 (ML15203A930), the staff asked the applicant to provide an explanation that under the worst case scenario, if an EDG of the Division II is under maintenance (out of service), and with a single failure (1 EDG fail to start) in Division I, how the remaining EDG in Division I can perform the safety functions or bring the plant to a safe shutdown. In its response to RAI 95-8080, Question 08.03.01-8 (ML15303A056), the applicant responded that redundant divisions of the Class 1E power system, Trains A and C for Division I and Trains B and D for Division II, are provided to meet the single failure criterion. Because of the high risk profile of the emergency power system, availability of the EDGs is maximized by avoiding on-line maintenance or being taken out-of-service during normal operating conditions.

If an EDG becomes unavailable in one division, the plant does not fulfill the LCO TS 3.8.1 and the inoperable EDG needs to be restored within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> in accordance with TS 3.8.1, Action B.4. The staff accepted the response as this meets the requirement of GDC 17, and conforms to guidance in RG 1.53 and therefore the staff considers this issue resolved.

In the above response the applicant further described accident mitigation and safe shutdown of the plant for LOOP and LOCA conditions as follows.

a) Should a LOCA with a LOOP occur during the LCO completion time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, the plant would have sufficient emergency power with two available EDGs (combination of Train A and Train C in Division I, or, Train B and Train D in Division II) to mitigate the accident and safely shutdown the plant; b) In a LOOP condition, the plant can transition to a safe shutdown condition on a minimum of one EDG, as long as the one available EDG is either Train A or Train B based on the loads listed in DCD Tier 2, Table 8.3.1-2. Though in some configurations the plant maintains the capability of mitigating a Design Basis Accident (DBA)(e.g., LOCA) under a LOOP condition and failure of two EDGs (such as Train A and Train C or Train B and Train D), it is considered to be a beyond design basis condition; c) If both Train A and Train B EDGs are not available with a LOOP, the AAC source would be connected to Train A or Train B in order to enable a controlled cooldown of the plant to a safe shutdown condition.

In DCD Tier 2, Section 8.3.1.1.1, Non-Class 1E Onsite AC Power System, the staff noted that a non-Class 1E GTG AAC source is connected only to Class 1E Safety Bus 1A of Division I (one train of one division), and Safety Bus 1B (one train of other division) of Division II. In RAI 95-8080, Question 08.03.01-8 the staff requested clarification as to why the AAC source is not connected to Safety Buses 1C of Division I and 1D of Division II (i.e., why the AAC is not connected to all four safety-related buses of both Divisions I and II). In its response to RAI 95-8080, Question 08.03.01-8 (ML15303A056), the applicant stated that only the Class 1E Safety 8-43

Bus 1A of Division I and Class 1E Safety Bus 1B of Division II are designated as the dedicated Class 1E 4.16 kV switchgear for safe shutdown during a LOOP or an SBO, as described in DCD Tier 2 Section 8.3.1.1.2. For instance, the shutdown cooling pumps, the auxiliary charging pump, and spent fuel pool pumps, which are required to bring and maintain the plant to the safe shutdown conditions, are only connected to the Class 1E Safety Bus 1A of Division I and 1B of Division II. Therefore, only the Class 1E Safety Bus 1A of Division I and Class 1E Safety Bus 1B of Division II have connection provisions to the AAC GTG, which will be connected to and supply one of the safety buses as appropriate during an SBO. The staff reviewed the response and the system configuration and determined that one bus in each division will be able to bring and maintain the plant to the safe shutdown condition after a LOOP or an SBO occurs, and accepted the response. Therefore, the staff considers this issue to be resolved, as it meets the single failure criteria required in GDC 17, and guidance in RG 1.53.

In RAI 148-8104, Question 08.03.01-17 (ML15234A006) the staff requested additional information regarding the conformance to GDC 17 to specifically demonstrate that no single event will simultaneously fail the redundant power circuits. The staff requested additional information with inclusion of component identification, their functions, failure modes (loss of cooling, bus failure, loss of voltage, breaker and transformer failure), failure mechanism including identification of fault location, effect/impact on any safety-rated function, detection (alarm/trip) and immediate actions to be taken to mitigate the failed status of the system/equipment. This information is typically provided in Power System FMEA for onsite ac and dc systems. The staff wanted to ensure that onsite ac distribution system capability to maintain its safety-related function in the presence of a single failure in conformance to RG 1.53 is demonstrated by onsite ac Power System FMEA. In its response to RAI 148-8104, Question 08.03.01-17 (ML15301A937), the applicant attached the result of the FMEAs for the onsite ac and dc and Uninterrupted Power Supply (UPS) systems. The UPS system is also defined as 120 Vac Instrumentation and Control (I&C) system in the DCD Tier 2, Section 8.3.2, DC Power System. The staff reviewed the FMEA information, and requested additional clarifications in follow-up RAI 442-8550, Question 08.03.01-25 (ML16074A289) on cooling failure of the Main Transformer (MT) and its failure analyses. The staff also asked for addition of failure analysis of Class 1E power cable from UAT and SAT to the Class 1E switchgear. Additionally, regarding the FMEA of the UAT and SAT during plant abnormal loading condition, the staff asked for analyses related to partial or entire cooler bank failure scenario. In its response to RAI 442-8550, Question 08.03.01-25 (ML16134A395), the applicant revised the FMEA table to include the information of MT and UAT/SAT Class 1E power cable FMEA. The staff also reviewed the response for UAT potentially exceeding the pre-determined set-point for tripping UAT at high-high temperature and accepted the response that bus transfer occurred at such scenario to maintain the power supply to the onsite ac power system. The applicant revised the DCD Tier 2, Section 8.3.1.1.2.2, Single Failure Criteria, and presented the revised and new FMEA Table 8.3.1-7, Failure Modes and Effects Analysis for the Onsite AC Power System, in the DCD Tier 2, Section 8.3.1. The staff determined that the applicant adequately addressed the FMEA of various important-to-safety equipment and components related to Class 1E power system. The applicant also addressed the capability to maintain the safety-related function of the onsite power system in the presence of a single failure, in conformance to RG 1.153. The staff considers this issue resolved.

The staff determined that the applicant has adequately addressed the Class 1E and non-Class 1E onsite ac equipment/components and their functions, failure modes, failure cause, failure effects and counter measures, and annunciation/detection. These equipment included auxiliary transformers, main transformer, isolated phase bus duct, switchgear, EDG, medium voltage 8-44

feeder cable, and generator circuit breaker, which meets the GDC 17 requirement and conforms to RG 1.53, and therefore accepted by the staff. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and finds that RAI 148-8104, Question 08.03.01-17, and RAI 442-8550, Question 08.03.01-25 are resolved and closed.

8.3.1.4.4.5 Conformance to RG 1.75 DCD Tier 2, Section 8.3.1.2.2, states conformance to RG 1.75. RG 1.75 is related to the criteria for independence of electrical safety systems. Also DCD Tier 2, Section 8.3.1.1.2.3, System Independence, describes independence of the onsite power system. The staff has reviewed the isolation and separation of the non-Class 1E components from the Class 1E system that prevents degradation of the Class 1E system to an unacceptable level in accordance with RG 1.75, which endorses IEEE Std. 384-1992, Criteria for Independence of Class 1E Equipment and Circuits, and RG 1.32 which endorses IEEE Std. 308-2001, Standard Criteria for Class 1E Power Systems for Nuclear Power Generating Stations, for circuit breakers or fuses that are automatically opened by fault current. The DCD Tier 2, Section 8.3.1.1.10, Cable and Raceway Design Criteria, describes criteria for cable routing for the APR1400 onsite ac power systems. These criteria are for cable derating and cable tray fill, as well as cable independence and separation. The APR1400 onsite ac power distribution system consists of two redundant divisions. Each division of safety-related Class 1E distribution equipment is located in Seismic Category I buildings. Each safety-related division is located in separate rooms, which provide physical separation among the two redundant divisions. All Class 1E components such as switchgear buses, load centers, MCCs, and distribution transformers will meet the Seismic Category I requirements. Non-Class 1E circuits are electrically isolated from Class 1E circuits and associated circuits by the use of isolation devices, shielding, and wiring techniques, or separation distance. Thus, cable routing, derating, raceway fill, separation, identification of redundant Class 1E circuits, and isolation of non-Class 1E circuits from Class 1E circuits are in accordance with RG 1.75.

In DCD Tier 2, Section 8.3.1.1.2.3, System Independence, the applicant stated that non-Class 1E loads are connected to the Class 1E bus by Class 1E isolation devices, for conformance to RG 1.75 for separation and independence between Class 1E and non-Class 1E power systems.

However, RG 1.75 endorses IEEE Std. 384-1992, Standard Criteria for Independence of Class 1E Equipment and Circuits, which requires that the isolation devices be properly coordinated and periodically tested to ensure the overall protection coordination remains. In RAI 203-8214, Question 08.03.01-19 (ML15295A503), the staff requested for clarification that the applicant performs periodic testing of circuit breakers in accordance with RG 1.75 for isolation devices for the applicants design. RG 1.75 provides guidance related to periodic testing of isolation devices (e.g., visual inspection of fuses and fuse holders during every refueling outage is performed to demonstrate that the overall coordination scheme under multiple faults of non-safety-related loads provides protection for the safety-related loads). In its response to RAI 203-8214, Question 08.03.01-19 (ML16026A490), the applicant stated that during refueling outages, periodic testing of the electrical isolation will be performed so that overall coordination scheme is demonstrated to remain within limits specified in the design criteria, in accordance with RG 1.75, and that the DCD Tier 2, Section 8.3.1.1.2.3 includes the description of the periodic testing of electrical isolation devices. The staff determined that this is acceptable because isolation devices will be properly coordinated and periodically tested for conformance to RG 1.75, and this issue is therefore resolved. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and finds that RAI 203-8214, Question 08.03.01-19, is resolved and closed.

8-45

DCD Tier 2, Section 8.3.1.1.10 provides cable and raceway design criteria. In RAI 102-8017, Question 08.03.01-10 (ML15205A366), the staff requested that the applicant discuss potential degradation detection, as described in NRC Generic Letter (GL) 2007-01, Inaccessible or Underground Power Cable Failures that Disable Accident Mitigation Systems or Cause Plant Transients. The staff requested the following clarification to evaluate that the design meets GDC 17, since GDC 17 relates to the safety related onsite power systems capacity and capability:

1) DCD Tier 2, Section 8.3.1.1.4, Electrical Equipment Layout, states that all four EDGs are located in one building in separate rooms as shown in layout DCD Tier 2 Figure 8.2-1, Layout Drawings showing MT, UAT, SAT, MV Buses, but the drawing is a preliminary sketch and does not depict the physical separation of the EDGs. In RAI 102-8017, Question 08.03.01-10 (ML15205A366), the staff requested a discussion how the cabling and raceways are to be designed to provide physical separation and independence, for all 4 trains of cables/raceways originating from the Class 1E switchgear building and ending at the EDG building. In its response to RAI 102-8017, Question 08.03.01-10 (ML15260B211) and supplemented in a letter (ML16093A039), the applicant provided supplemental drawings to describe that out of the four EDGs, two EDGs (Train A and Train B) are each located in separate rooms of the EDG building whereas the other two EDGs are each located in separate rooms of the auxiliary building, using geographical quadrant division of the auxiliary building by train (i.e., four corners of the building). The applicant further stated that the cables between the EDG and the Class 1E switchgear of each train run on the raceways (trays or conduits) designated to each train. The raceways of each train do not interfere with the other trains since the physically separated quadrant divisions of the trains also apply to the raceway design. The staff reviewed the graphical drawing and determined that the response is acceptable as each EDG is located in a separate room, with physical separation and cables that are routed separately in each train to provide electrical isolation, and this satisfies GDC 17 and conforms to RG 1.75. Therefore the staff considers this issue to be resolved. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and finds that RAI 102-8017, Question 08.03.01-10, is resolved and closed.
2) COL Item, 8.3(6) states that the COL applicant is to provide testing, inspection, and monitoring programs for detecting insulation degradation of underground and inaccessible power cables within the scope of 10 CFR 50.65, Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants. In RAI 102-8017, Question 08.03.01-10 (ML15205A366), the staff requested an additional description of this program. Also the staff requested a description of the applicants condition monitoring methods in order to detect cable insulation degradation. In its response to RAI 102-8017, Question 08.03.01-10 (ML15260B211), and (ML16093A039), the applicant stated that the cables and terminations are periodically monitored to detect the degradation by infrared imaging thermography inspection, partial discharge test, visual inspection, and very-low-frequency ac testing, as applicable. For inaccessible or underground power cables, the very-low-frequency ac test is performed every two to five years according to importance of the cable, in parallel with partial discharge test as required. Additionally, condition monitoring to detect degradation of cable 8-46

insulation will be implemented in accordance with accepted industry practice.

RG 1.218, Condition Monitoring Techniques for Electric Cables Used in Nuclear Power Plants, describes cable monitoring methods and techniques that the staff considers acceptable for use in implementing the regulatory requirements with regard to monitoring the performance of electric cables used in nuclear power plants. According to this guidance, an applicant can use a number of monitoring techniques to evaluate cable condition, and a combination of monitoring techniques may be needed to validate cable performance. The applicant described the tests which are recommended in the RG 1.218, and therefore the staff accepted the response. The applicant addressed the condition monitoring program and stated that the program details will be established and chosen by the COL applicant per COL Item 8.3(6), which specifies that the COL applicant will provide testing, inspection and monitoring program for detecting insulation degradation of underground and inaccessible power cables within the scope of 10 CFR 50.65. The staff considers this issue to be resolved.

3) Another staff concern, related to inaccessible or underground cables, was that the operating experience, as documented in GL 2007-01, has shown that undetected degradation of electric cables could result in multiple equipment failures. In RAI 102-8017, Question 08.03.01-10, the staff requested a discussion of how the APR1400 design addressed the concerns detailed in GL 2007-01. In its responses to RAI 102-8017, Question 0803.01-10 (ML15260B211), and (ML16093A039), the applicant stated that in the APR1400 design, electrical duct banks and underground tunnels are designed to keep cables from degrading as a result of moisture or water by following proper installation methods, such as: a) a uniform slope of 1/16 inch (0.159 cm) per foot (30.48 cm) shall be maintained, with the slope toward a manhole or a drain point; b) all conduits and cable duct joints shall be watertight; c) conduit sleeves passing through the wall shall be installed with offset; d) all tunnels have sumps and pits to collect water at specified points; and e) sump pumps shall operate automatically as the water level reaches the set point of the level transmitter installed within the sump, and water drained by the sump pumps flows out to drain manholes. The applicant revised DCD Tier 2, Section 8.1.3.3, Section 8.3.1.1.10, Section 8.3.4, References, and DCD Tier 2 Table 1.9-5, Generic Communications Applicability to APR1400, to incorporate the design aspects mentioned above, and included GL 2007-01 in the reference sections of Section 8.1 and Section 8.3.1 in the DCD Tier 2. The staff reviewed the response and accepted it since the applicant adequately addressed the concerns related to degradation of cable insulation including for inaccessible or underground cable with proper methods as documented in GL 2007-01. Therefore, the staff considers this issue to be resolved. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and finds that RAI 102-8017, Question 08.03.01-10, is resolved and closed.

In RAI 210-8239, Question 08.03.01-20 (ML15295A507), the staff requested a discussion on the administrative programs that are developed to identify and distinguish: a) cable routing, separation, and cable identification of redundant Class 1E circuits; b) the independence of non-Class 1E circuits from Class 1E circuits; and, c) determining the raceway fill and whether cable derating is required when applicable. In its response to RAI 210-8239, Question 08.03.01-20 (ML15338A033), the applicant stated that the APR1400 applies a dedicated cable and raceway 8-47

numbering system in which cable routing, separation, and cable identification of redundant Class 1E circuits are distinguished by naming convention to efficiently manage cable routing and cable termination and verify that cable design fulfills the acceptance criteria of cable separation, filling criteria and ampacity. The cable management tool will confirm the cable channel and corresponding raceway channel; all non-Class 1E cables are routed in non-Class 1E raceways to ensure independence and separation between Class 1E and non-Class 1E circuits, and that raceway fill is automatically calculated and strictly monitored. Also, the cable management database tool calculates the ampacities of power cable installed in a raceway for adequacy of the cable size, with derating as required for the environment in which it is installed.

The applicant stated that the COL applicant will establish administrative program(s) with a cable database tool as necessary. The applicant revised DCD Tier 2, Table 1.8-2, Combined License Information Items, to add COL Item 8.3(7), which covers such administrative program(s). The staff reviewed the response and determined that it is acceptable as the administrative program with a cable database will be established to manage cable routing and ensure its installation according to acceptance criteria for separation to meet the RG 1.75. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and finds that RAI 210-8239, Question 08.03.01-20, is resolved and closed In DCD Tier 2, Section 8.3.1.1.7, Heat Tracing, the applicant stated that the heat tracing system is provided with non-Class 1E power to prevent freezing of fluid in pipes and equipment and to maintain the required temperature in critical process control systems. The staff requested a clarification in RAI 57-7965, Question 08.03.01-4 (ML15189A490), whether the Class 1E power is required for heat tracing for a Class 1E critical process system. In its response to RAI 57-7965, Question 08.03.01-4 (ML15231A804), the applicant stated that the equipment mentioned in DCD Tier 2, Section 8.3.1.1.7, does not require Class 1E power for heat tracing. However, there are sample lines for containment air monitors in the process and effluent radiological monitoring system as discussed in DCD Tier 2, Section 11.5.2.2, Gaseous process and effluent radiation monitoring and sampling systems, which are equipped with local heat tracing to which Class 1E power is supplied. The staff also requested the applicant to demonstrate the operability of auxiliary systems such as heat tracing, by conducting tests in accordance with RG 1.68, Appendix A-1.o, Auxiliary and Miscellaneous System. In its response to RAI 57-7965, Question 08.03.01-4 (ML15231A804), the applicant stated that the redundancy and electrical independence for these Class 1E equipment will be verified during the initial testing phase, and DCD Tier 2, Section 14.2.12.1.106, Process and Effluent Radiological Monitoring System Test, has been revised to reflect this requirement. The staff determined that Class 1E power is provided for the Class 1E system and will be tested for redundancy and electrical independence in accordance with RG 1.75, and therefore is considered to be acceptable. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and finds that RAI 57-7965, Question 08.03.01-4, is resolved and closed.

In RAI 102-8017, Question 08.03.01-11 (ML15205A366), the staff requested a clarification for whether a cathodic protection (CP) system is provided for the Class 1E related equipment such as buried pipes and aboveground carbon steel/metallic structures that need to be protected from corrosion. The staff requested information to understand the type of CP that the applicant will provide in the design (such as active impressed current system versus the passive sacrificial anode). In its response to RAI 102-8017, Question 08.03.01-1 (ML15260B211), the applicant revised DCD Tier 2, and added Section 8.3.1.1.11, Cathodic Protection, to include the CP system, describing the system and added a COL Item 8.3(8) as the detailed design depends on the site conditions. The staff accepted the response as adequate and considers it to be 8-48

acceptable. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and finds that RAI 102-8017, Question 08.03.01-11, is resolved and closed.

Based on the above discussion, the staff determined that the applicant satisfies the criteria by establishing and maintaining the independence of safety-related equipment and circuits, and auxiliary supporting features by physical separation and electrical isolation meeting the requirement of GDC 17, and conforming to RG 1.75, and that the proposed design is acceptable in regard to independence.

8.3.1.4.4.6 Conformance to RG 1.153 DCD Tier 2, Section 8.3.1.2.2, states conformance to RG 1.153, Criteria for Safety Systems.

RG 1.153 addresses the need for functional and design independence and separation requirements for onsite ac power system distribution for nuclear power plants. Meeting the detailed requirements of IEEE Std. 603-1991, Criteria for Safety Systems for Nuclear Power Generating Stations, with respect to independence and separation of the ac power distribution system divisions, will achieve the goals stated in RG 1.153.

The staff has reviewed the applicants onsite ac electrical distribution safety-related configuration and its functions to determine whether divisional pair functional independence and physical separation are in accordance with IEEE Std. 603-1991 for safety-related system independence. The IEEE standard addresses independence between redundant portions of a safety system and effects of a DBE. In the APR1400 design, this is accomplished by the separation of safety-related components between divisional pairs, as stated in DCD Tier 2, Section 8.3.1. The physical separation assures that a single failure or internal hazard, or both, in one divisional pair can only affect that one divisional pair. Therefore, during DBAs coincident with a single failure to any electrical component in a divisional pair, the second divisional pair will support safety-related function completion. The onsite ac power electrical distribution equipment (switchgear, load centers, MCCs, transformers, feeder breakers, load breakers) is sized to provide sufficient power to start and operate the connected loads.

For these reasons, the staff determined that the APR1400 onsite ac electrical distribution system is designed in accordance with the independence and separation requirements of RG 1.153.

8.3.1.4.4.7 Conformance to RG 1.155 DCD Tier 2, Section 8.3.1.2.2, states conformance to RG 1.155 Station Blackout. The SBO for the applicants onsite ac power system conformance to RG 1.155 and its conformance to SECY 90-016, Evolutionary Light Water Reactor Certification Issues and Their Relationship to Current Regulatory Requirements, issued January 1990, are addressed in Section 8.4, Station Blackout, of this report.

8.3.1.4.4.8 Conformance to RG 1.204 In DCD Tier 2, Section 8.3.1.2.2, the applicant has stated that its onsite ac grounding and lightning protection system conforms to RG 1.204, Guidelines for Lightning Protection of Nuclear Power Plants, which endorses IEEE Std. 665-1995, (Reaffirmed 2001), Guide for Generating Station Grounding; IEEE Std. 666-1991 (Reaffirmed 1996), Design Guide for Electric Power Service Systems for Generating Stations; IEEE Std. 1050-1996, Guide for Instrumentation and Control Equipment Grounding in Generating Stations; and IEEE Std.

8-49

C62.23-1995 (Reaffirmed 2001), Application Guide for Surge Protection of Electric Generating Plants. Also, the applicant stated that insulation coordination studies will be performed by the COL applicant, as described in COL Item 8.3(10), to provide for proper insulation levels of electrical equipment with overvoltage protective devices such as surge arresters and transient voltage surge suppressors. Achieving insulation coordination depends on site specific parameters such as voltage transients, characteristics of equipment such as transformers, and the operating characteristics of surge arresters. These studies will ensure maximum protection to the insulation of equipment.

The staff reviewed the plant grounding system described in DCD Tier 2, Section 8.3.1.1.8, Grounding and Lightning Protection Criteria. The applicant stated that:

(1) The plant ground grid, consisting of bare copper cables, limits the step and touch potentials to safe values under all fault conditions. The design and analysis are based on the procedures and recommendations of IEEE Std. 80-2000, IEEE Guide for Safety in AC Substation Grounding.

(2) The design of the grounding system follows the procedures and recommendations of IEEE Std. 665-1995, Standard for Generating Station Grounding.

(3) Each building has grounding systems connected to the plant grounding grid.

(4) The MG is grounded with a neutral grounding device having high impedance that limits the maximum phase current under short-circuit conditions.

(5) The isolated phase bus supports are grounded by connecting the base of each support to the ground grid.

(6) The onsite medium-voltage ac distribution system is resistance grounded at the neutral point of the low-voltage windings of the UATs and SATs.

(7) The neutral point of the EDG and AAC GTG windings is grounded through distribution transformers and loading resistors sized for continuous operation with a ground fault.

(8) The ground bus of all switchgears, load centers, and MCCs, is connected to the plant ground grid through at least two parallel paths.

(9) Each major piece of equipment, metal structure, or metallic tank has two diagonally opposed ground connections.

(10) Plant instrumentation is grounded through separate radial grounding systems that consist of isolated instrumentation ground buses and insulated cables.

(11) The dc systems are ungrounded.

Also, the applicant stated that the detailed ground grid and lightning protection studies will be performed by the COL applicant, as provided in COL Item 8.3(4).

8-50

The staff considers that the applicant adequately addressed the grounding design and methods which are in conformance to RG 1.204 and follows the guidance provided in IEEE standards mentioned above.

The staff reviewed the lightning protection provided for the main transformers, UATs, SATs, and switchyard facilities in DCD Tier 2, Section 8.3.1.1.8. The applicant stated that: (1) Each phase of all tie lines connecting the plant electrical systems to the switchyard and offsite transmission system is protected by lightning arresters; (2) Arresters are connected to the high-voltage terminals of the MT and SATs; (3) UAT is fed from the MG terminals using IPB and therefore does not require lightning protection; (4) Plant instrumentation and monitoring equipment located outdoors or connected to outdoor cables are provided with built-in surge suppression devices to protect the equipment from lightning-induced surges; and (5) Lightning protection is provided for all major plant structures, including the reactor containment building.

In RAI 148-8104, Question 08.03.01-15 (ML15234A006), the staff requested that the applicant provide the calculations for surge and lightning protection on insulation coordination as cited in RG 1.204 and also asked whether such calculations should be performed and provided by the COL applicant, as the calculations may depend on site-specific grid (interface) information. In its response to RAI 148-8104, Question 08.03.01-15 (ML15301A937), the applicant responded that insulation coordination for surge and lightning protection is performed in accordance with IEEE Std. C62.82.1-2010, Standard for Insulation Coordination - Definitions, Principles, and Rules, and IEEE Std. 1313.2, Guide for the Application of Insulation Coordination. The staff requested the assumptions used for such calculations. The applicant revised COL Item 8.3(10) and added that the site specific calculation will provide the underlying assumptions with the analysis to determine adequacy for insulation coordination of surge and lightning protection.

The staff reviewed the response and determined that the applicant has adequately responded to the issue and that the COL item will be complete with assumptions and analyses with the site specific calculations for surge and lightning protection. This issue is therefore resolved. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and finds that RAI 148-8104, Question 08.03.01-15, is resolved and closed. The COL applicant will perform the insulation coordination analyses under ITAAC Item 2.6 in DCD Tier 1, Table, 2.6.7-1, Grounding and Lightning Protection System Inspections, Tests, Analyses, and Acceptance Criteria. Accordingly, the staff determined that the onsite ac grounding and lightning protection system for the APR1400 conforms to RG 1.204.

8.3.1.4.4.9 Conformance to NUREG/CR-0660 In DCD Tier 2, Section 8.1, Table 8.1-1, Safety Related Loads, the applicant stated that NUREG/CR-0660, Enhancement of Onsite Diesel Generator Capability, will be followed for guidance related to EDGs. The staff has reviewed whether the EDG meets the recommendations of RG 1.9 and of NUREG/CR 0660, Enhancement of Onsite Emergency Diesel Generator Reliability, issued February 1979. NUREG/CR 0660 recommends that EDG systems include the following design features: (1) starting system air dryer; (2) continuous lube oil pre heat system when the diesel generator is in standby to provide reasonable assurance of its fast-starting and load-accepting capability; and (3) EDG support systems including local instrument panels are not impacted by vibration. DCD Tier 2, Section 9.5, Other Auxiliary Systems, addresses the conformance to NUREG/CR-0660 with respect to these design features. The diesel generator rooms are located in a Seismic Category I area and are designed to remain functional during and after a Safe Shutdown Earthquake, and all essential components are fully protected from floods, natural phenomena missiles, internally generated 8-51

missiles, pipe breaks and whip, jet impingement, and interaction with non-seismic systems in the vicinity. The emergency diesel engine cooling water system (EDECWS) meets the recommendations of NUREG/CR-0660. Each EDG has a separate and independent EDECWS so that the EDECWS performs the safety function under accident conditions, assuming a single active component failure. The four trains of the EDG provide reasonable assurance that a single active failure in an EDECWS does not lead to a loss of more than one EDG. The three-way thermostat valve meets the recommendation of NUREG/CR-0660. There are four separate and independent trains of the EDG so that the consequences of a single active failure in the emergency diesel engine starting system (EDESS), assuming a LOOP, do not lead to a loss of more than one EDG. Each EDG has a separate and independent EDESS. Air dryers are refrigerant type in accordance with the recommendations of NUREG/CR-0660.

The emergency diesel engine fuel oil system is not shared by other diesel generators. The safety functions are accomplished, assuming a single active component failure coincident with a LOOP, in terms of four redundant and independent trains of 100 percent EDGs, as recommended in NUREG/CR-0660.

In RAI 61-7984, Question 08.03.01-7 (ML15189A483), the staff asked why, in DCD Tier 2, Section 8.3.1.1.3, some EDG support systems, such as EDG Lubrication system, Air Intake and Exhaust system, and HVAC system are not discussed. In its response to RAI 61-7984, Question 08.03.01-7 (ML15306A581), the applicant responded that these systems are discussed in DCD Tier 2, Chapter 9, Auxiliary Systems, and DCD Tier 2, Section 8.3.1.1.3.2, EDG Support Systems and in addition, include the cross reference to Chapter 9 for the associated support system description for completeness. The staff reviewed the RAI response and considers this issue to be resolved. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and finds that RAI 61-7984, Question 08.03.01-7, is resolved and closed. The staff reviewed and determined that the EDG for the APR1400 design incorporates the recommendations of NUREG/CR-0660, as it includes the design features such as starting air system, cooling system, fast-starting and load-accepting capability that prevents single failure. Therefore, the staff considers the design features of EDG to be acceptable.

8.3.1.4.4.10 Conformance to SECY-91-078 DCD Tier 2, Section 8.1, Table 8.1-2 states conformance to SECY-91-078, Chapter 11 of the Electric Power Research Institutes (EPRIs) Requirements Document and Additional Evolutionary Light Water Reactor (LWR) Certification Issues. This SECY discusses the inclusion of an alternate power source to non-safety related loads and recommends that all the offsite sources should be directly connected to the Class 1E buses with no intervening non-safety buses for evolutionary plant designs.

The staff reviewed the DCD Tier 2, Section 8.1, Section 8.2, Section 8.3, and associated single line diagrams. The description in these sections and the single lines of APR1400 offsite and onsite power distribution system design show that both Class 1E and non-Class 1E circuits are sharing the windings of the UAT and SAT, rendering the Class 1E system vulnerable due to a potential fault at the non- Class 1E bus, and this design does not meet GDC 17 and the requirements of SECY-91-078.

As discussed and evaluated in Section 8.1.4 in this SER, the staff issued RAI 16-7915, Question 08.01-1 with this concern. Staff also requested additional information in subsequent 8-52

RAIs, RAI 338-8426, Question 08.01-14 and RAI 539-8730 Question 08.01-21. The details of these questions, the responses from the applicant, and staff evaluation are discussed in Section 8.1.4 of this report.

In summary, considering both Class 1E and non-Class 1E buses are connected to the same UAT, and similarly, for the SAT, the staff finds that the applicant demonstrated through the large motor starting study and the FMEA, that the Class 1E equipment will be able to perform their intended function under various scenarios and transients. Furthermore, the staff finds that ITAAC are provided to verify that transients or failures occurring in the non-Class 1E buses will not cause failure of the Class 1E loads. Thus, the staff finds that the APR1400 electrical design conforms to SECY-91-078 since: (1) there is an alternate source to feed the non-safety loads and (2) the safety buses and equipment will be able to perform their intended function. The staff considers this issue resolved, as discussed in Section 8.1 of this report.

8.3.1.4.5 GDC 18, Inspection and testing of electric power systems DCD Tier 2, Section 8.3.1.2.1, Compliance with General Design Criteria states compliance with GDC 18. GDC 18 requires that electric power systems important to safety, which include the onsite ac power system, be designed to permit appropriate periodic inspection and testing of important areas and features to assess the continuity of the systems and the condition of their components. These systems shall be designed with a capability to test periodically: (1) the operability and functional performance of the components of the systems, such as onsite power sources, relays, switches, and buses; and (2) the operability of the systems as a whole and under conditions as close to design as practical.

The two safety-related onsite power Divisions I and II, with two independent trains per divisions, of the APR1400 permit the testing of one division without affecting safety-related functions of the remaining division. During periodic testing of Class 1E systems, engineered safety feature actuation system (ESFAS) subsystems are actuated or simulated to verify the appropriate circuit breaker or contactor operational response. LOOP testing or combined LOOP and LOCA testing is performed during a plant shutdown condition. The EDG testing capability is described in DCD Tier 2, Section 8.3.1.1.3.7, Testability. Periodic tests are conducted on each EDG and its associated auxiliary systems. Periodic testing of the EDG meets the requirements of RG 1.9, IEEE Std. 387, and GL 84-15, Proposed Staff Actions to Improve and Maintain Diesel Generator Reliability, issued July 2, 1984. Periodic testing of each EDG demonstrates capability of load sequencing during an interval of not less than one hour. Testing is performed by manually synchronizing the EDG with the offsite power system.

Additionally, the generic TS would require an applicant to test the EDGs periodically to verify their capability to start and accept load.

The staff has evaluated whether the onsite ac power system provides the capability to perform integral testing of Class 1E systems on a periodic basis. Accordingly, the following RGs applicable to testing of the APR1400 onsite ac power system were reviewed. The staff determined that the applicant satisfies the requirements of the RGs discussed below and as such meets the requirement of GDC 18, that onsite ac power systems will be designed to permit appropriate periodic inspection and testing.

8-53

8.3.1.4.5.1 Conformance to RG 1.47 DCD Tier 2, Section 8.3.1.2.2, Conformance with NRC Regulatory Guides, states conformance to RG 1.47, Bypassed and Inoperable Status Indication for Nuclear Power Plant Safety Systems.

The current design of the plant protection systems (PPS) and engineered safety feature (ESF) systems are such that certain safety-related functions of a nuclear power plant may be bypassed or made inoperable during the performance of periodic tests or maintenance. RG 1.47 describes an acceptable method of complying with the requirements to indicate the inoperable or bypassed status of Class 1E systems or portions of such systems. The applicants DCD Tier 2, Section 8.3.1.2.2 states that APR1400 conforms to the requirements of RG 1.47. According to RG 1.47, and as described in DCD Tier 2, Section 7.5.1.3, Bypassed and Inoperable Status Indication, indication of a bypassed or deliberately induced inoperable component is annunciated in the control room to indicate the system or component condition.

Since safety-related onsite power system provides power to the PPS for I&C equipment status, the plant operator can identify systems actuated or controlled by the PPS in accordance with RG 1.47. DCD Tier 2, Section 7.1.2.38, Conformance to NRC RG 1.47, and Section 7.5.1.3, provides additional information on testability of bypassed or inoperable status indicators that are displayed.

This meets the requirement of BTP 8-5, Supplemental Guidance for Bypass and Inoperable Status Indication for Engineered Safety Features Systems, in assessing plant conditions and safety system performance. As discussed above, the staff determined that onsite ac system equipment and components are monitored, and if the system or its components are bypassed or deliberately rendered inoperable, that condition is annunciated in the MCR and RSR in accordance with RG 1.47, which is acceptable.

The staffs review was limited to the power supply for the PPS for the APR1400 design. The staff reviewed the ac onsite power system and confirmed that it is available to power the PPS and its auxiliary or supporting safety-related systems and, therefore, finds the application conforms to RG 1.47.

8.3.1.4.5.2 Conformance to RG 1.118 In DCD Tier 2, Section 8.3.1.2.2, Conformance with NRC Regulatory Guides, the applicant discusses conformance to RG 1.118, Periodic Testing of Electric Power and Protection System. RG 1.118 provides guidance on the capability for periodic surveillance testing and calibration of safety-related equipment to be provided while retaining the capability of the safety-related systems to accomplish their safety related functions in accordance with IEEE Std. 338-1987, Standard Criteria for the Periodic Surveillance Testing of Nuclear Power Generating Station Safety Systems. DCD Tier 2, Chapter 16, Section 3.8, Electrical Power Systems, sets forth TS that would require testing and calibration of safety-related system equipment of the APR1400 during power operation. This testing duplicates, as close as practical, the demonstration that safety-related equipment can perform its specified functions.

DCD Tier 2, Section 8.3.1.1.6, Testing of Onsite AC Power System, discusses testing of onsite ac power system equipment. Class 1E onsite electric power and protection systems are designed in compliance with GDC 18, RG 1.9, and RG 1.118. During periodic testing of Class 1E systems, ESFAS subsystems are actuated or simulated to verify the appropriate circuit 8-54

breaker or contactor operational response. The Class 1E 4.16 kV switchgear and 480 V load center circuit breakers can also be tested independently while the equipment is shut down.

These circuit breakers can be placed in a test position and exercised without operation of the associated equipment. LOOP testing or combined LOOP and LOCA testing is performed during a plant shutdown condition. The EDG testing capability is described in DCD Tier 2, Section 8.3.1.1.3.7, Testability. For EDG and its associated auxiliary systems, preoperational onsite acceptance tests and periodic tests are conducted to demonstrate required reliability.

Periodic testing of each EDG demonstrates capability of load sequencing during an interval of not less than one hour. Testing is performed by manually synchronizing the EDG with the offsite power system.

Since this performance characteristic will be verified by the above referenced TS and DCD Tier 1, Section 2.6.2, EDG System ITAAC, the staff concludes that the applicant adequately addressed the testing and therefore is resolved.

Based on the above, the applicants onsite ac power system will be designed to be testable during operation of the nuclear power generating station, as well as during those intervals when the station is shut down. The staff determined that this conforms to the positions of RG 1.118.

8.3.1.4.6 GDC 50, Containment design basis In DCD Tier 2, Section 8.3.1.2.1, Compliance with General Design Criteria, the applicant discusses compliance to GDC 50, Containment design basis. GDC 50 requires, in part, that the design of containment penetrations, including electrical penetrations containing circuits of the ac power system in containment structures, must withstand a LOCA without loss of mechanical integrity. In order to satisfy this requirement, the penetration assemblies in containment structures must be capable to withstand all ranges of overload and short circuit (SC) currents up to the maximum fault current vs. time conditions that could occur given single random failures of circuit protective devices.

As described below, APR1400 containment electrical penetration assemblies (EPAs) are Class 1E devices and are designed, constructed, and qualified in accordance with IEEE Std. 317-1983, IEEE Standard for Electric Penetration Assemblies in Containment Structures for Nuclear Power Generating Stations, as endorsed by RG 1.63, Electric Penetration Assemblies in Containment Structures for Nuclear Power Plants. Containment structures are classified as Seismic Category I in accordance with RG 1.29, Seismic Design Classification, to withstand a design basis seismic event without the loss of safety function. Additionally, the penetration assemblies are qualified for a harsh environment, as described in DCD Tier 2, Section 8.3.1.1.9, Containment Electrical Penetration, in accordance with IEEE Std. 323, IEEE Standard for Qualifying Class 1E Equipment for Nuclear Power Generating Stations.

In DCD Tier 2, Section 8.3.1.1.9, the applicant discusses that the containment electrical penetration assemblies are designed as follows: (1) Physically separated and electrically isolated to maintain independence and located in four quadrants of the reactor containment building; (2) Selection and setting of protective devices for containment EPAs to provide proper coordination with thermal capability of the containment EPA defined in IEEE Std. 317-1983; (3)

Primary and back-up protections are provided in order to protect EPAs from the damage due to SC or overload; (4) Protective devices located in separate panels or separated by barriers are independent so that failure of one device would not adversely affect the other; (5) Penetrations 8-55

would withstand the full range of fault current (minimum to maximum) available at the penetration; and (6) Protection devices are capable of being tested, calibrated, and inspected.

The staff requested additional clarification and information not specifically provided in the DCD, to determine if the EPA meets all requirements to satisfy GDC 50, as discussed above, in RAI 102-8017, Question 08.03.01-9 (ML15205A366). In its response to RAI 102-8017, Question 08.03.01-9 (ML15260B211), the applicant provided responses to the staffs questions which are summarized here:

1. DCD Tier 2, Section 8.3.1.1.9, discusses the protection of the EPA. The staff requested a confirmation that containment EPA contain only Class 1E protection devices for Class 1E circuits, as recommended in the guidance of IEEE Std. 384 Criteria for Independence of Class iE Equipment and Circuits. The applicant confirmed that Class 1E circuits pass through only Class 1E EPAs and these circuits are protected by the protection devices provided in the associated Class 1E medium voltage switchgear, 480V load centers, and 480V motor control centers.
2. DCD Tier 2, Section 8.3.1.1.9, discusses the testing of the EPA as per IEEE Std.

317-1983, Standard for Electric Penetration Assemblies in Containment Structures for Nuclear Power Generating Stations. The staff requested additional discussion that protection devices are capable of being tested, calibrated, and inspected. The staff specifically requested for the periodic inspection and testing program for containment penetration protective devices, including the circuit breakers used as containment penetration conductor overcurrent protection devices, as mentioned in DCD Tier 2, Section 8.3.1.1.9, with discussion of the periodic testing methods that will be performed to ensure functionality. The applicant confirmed that the protective devices are capable of being tested, calibrated and inspected. The inspections of the following are described that will ensure the functionality of the equipment components of the EPA: circuit breakers for motors, heaters, motor operated valves, and other equipment installed within the containment, low voltage circuit breaker overcurrent protective devices, and overcurrent relay for medium voltage circuit breaker. The applicant also confirmed that the panels in which the protective devices are located are independent so that a failure of one device would not adversely affect the other loads. The EPA is designed to withstand the full range of fault current available at the penetration and meets the IEEE Std. 317-1983.

Additionally the applicant confirms that the medium voltage cables are designed to be routed through penetration assemblies separate from the low voltage power and low voltage control/instrumentation cables, and the medium voltage power cables are to be routed through dedicated EPAs. The staff determined that the applicant adequately discussed the periodic inspection and testing program for containment penetration protective devices, and the periodic testing method that will be performed to ensure functionality.

GDC 18 requires that electric power systems important to safety shall be designed to permit appropriate periodic inspection and testing of important areas and features, such as wiring, insulation, connections, and switchboards, to assess the continuity of the systems and the conditions of their components. However, regarding the test interval of the EPA equipment/devices, the staff needed additional clarification. Since DCD Tier 2, Section 8-56

8.3.1.1.9, did not address the periodic inspection and testing of the Containment EPA, the staff requested that the proposed revision of the DCD Tier 2, Section 8.3.1.1.9, should provide reference to the periodic inspection and testing program and the details of the specific inspection/test as provided in the response to RAI 102-8017, Question 08.03.01-9, in compliance with GDC 18 and GDC 50. In its response to RAI 102-8017, Question 08.03.01-9 (ML15260B211), the applicant stated that the testing/inspection intervals are determined considering an overhaul capability of 18 months which corresponds to APR1400 refueling cycle.

The required testing /inspection interval for the protection devices for the EPA conductor is 60 months. All protection devices for the EPA conductors are divided into three groups: i) the first group is tested and inspected at the first overhaul, ii) the second group is tested and inspected at the second overhaul and iii) the third group is tested and inspected at the third overhaul.

Eventually every protection device for the EPA conductors will be tested and inspected within 60 months. All overcurrent relays for low voltage circuit breakers are tested and inspected in the first overhaul and subsequent overhauls. All overcurrent relays for medium voltage circuit breakers for the EPA conductors are to be tested and inspected every 18 months. The applicant stated that these inspection frequencies are based on vendor recommendations and operating experience of the current Korean operating fleet and are consistent with that of the reference plant, Shin Kori Nuclear, Units 3 and 4.

The staff was concerned that the periodic inspection and testing intervals provided in this response is not clarified adequately. The staff considered that an explanation was required as to how the inspection/test period is determined so that the equipment and components are not impacted from gradual undetected degradation. In follow-up RAI 421-8500, Question 08.03.01-23 (ML16061A074), the staff requested the applicant to provide a discussion as how the above test intervals are determined, and also to provide the expected interval in days/months for the next overhaul, as well as a typical schedule for the testing of the overcurrent relay for the medium voltage circuit breaker for containment electrical penetration conductor. The applicant provided in response (ML16146A796) a revised mark-up of DCD Tier 2, Section 8.3.1.1.9, with a description for periodic inspection and testing of the containment EPAs, to be conducted by the COL applicant. Therefore DCD Tier 2, Table 1.8-2 is also revised to include COL Item 8.3(5). The COL applicant will conduct periodic inspection and testing of the protection devices for the EPA conductors. The applicant stated that all circuit breakers for the EPA conductors shall be inspected and tested within 60 months, low voltage circuit breakers overcurrent protection devices shall be inspected and tested once per 18 months for 10 percent of each type of circuit breakers and overcurrent relays for medium voltage circuit breakers shall be inspected and tested once per 18 months. Based on the above information, the staff determined that the applicant has adequately addressed the testing and inspection of the protection devices of the EPA conductors, and their testing/inspection intervals. The staff determined that the design of the applicants containment electrical penetrations will satisfy GDC 50 to withstand a LOCA without loss of mechanical integrity because the design includes appropriate external circuit protection and its periodic testing and inspection so that the equipment and components are not impacted from gradual undetected degradation. Therefore, the staff considers this issue to be resolved. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and finds that RAI 421-8500, Question 08.03.01-23, is resolved and closed.

8-57

8.3.1.4.7 Compliance with 10 CFR 50.55a(h)

Section 50.55a(h) of 10 CFR, requires compliance with the relevant positions for plant protection and safety systems on design, reliability, qualification, and testability of the power and I&C portions of the protection and safety systems outlined in IEEE Std. 603-1991.

The safety and protection systems of the applicants onsite ac power system design are based on IEEE Std. 603, which will be confirmed by the electrical distribution system protection and coordination studies, and verified via ITAAC in DCD Tier 1, Table 2.6.1-3, AC Electric Power Distribution System ITAAC, Item 20. Accordingly, the staff determined that the APR1400 onsite ac power system design will meet the requirements of 10 CFR 50.55a(h). The aspects of IEEE Std. 603 that apply to the adequacy of I&C are evaluated in Chapter 7, Instrumentation and Controls, of this report.

8.3.1.4.8 Compliance with 10 CFR 50.63 The applicants compliance with 10 CFR 50.63, Loss of All Alternating Current Power, relates to use of the redundancy and reliability of the emergency generator unit as a factor in limiting the potential for SBO events. In particular, 10 CFR 50.63 requires, in part, that the specified SBO duration be based on the redundancy and reliability of the emergency onsite ac power sources. RG 1.9, Application and Testing of Safety-Related Diesel Generators in Nuclear Power Plants will be used to set the target reliability levels of emergency onsite ac power sources (i.e., EDG) as a factor in determining the coping duration for SBO and establishment of a reliability program for attaining and maintaining source target reliability levels.

Operating experience shows that EDGs of requisite reliability to support a specified coping duration are available. In accordance with RG 1.9, as part of the initial test program, the testing includes 25 valid start and load tests without failure on each EDG to demonstrate reliability. If the testing meets the above mentioned requirement, the EDGs will be considered sufficiently reliable to support the coping duration and will meet the requirements of 10 CFR 50.63. Further evaluation of this issue is contained in Section 8.4, Station Blackout, of this report.

8.3.1.4.9 Compliance with 10 CFR 50.65(a)(4)

Under 10 CFR 50.65(a)(4), COL applicants assess and manage the increase in risk that may result from proposed maintenance activities for onsite ac power equipment before performing the maintenance activities. These activities include surveillances, post maintenance testing, and corrective and preventive maintenance. In the DCD Tier 2, Chapter 17, Quality Assurance, the applicant discussed that compliance with the maintenance rule according to RG 1.160, Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, is characterized under DCD Tier 2, Section 17.6, The Maintenance Rule. The Maintenance Rule program is the COL applicants responsibility, and the COL information item is referenced in DCD Tier 2, COL Item 17.6(1). COL Item 17.6(1) states that the COL applicant is to provide, in its Final Safety Analysis Report (FSAR), a description of the Maintenance Rule program and a plan for implementing it to meet the requirements of 10 CFR 50.65. In DCD Tier 2, Section 8.3.1.2.2, the applicant discussed the compliance with the maintenance rule according to RG 1.160, Monitoring the Effectiveness of Maintenance at Nuclear Power Plants. These will be the responsibility of the COL applicant since these are activities related to the maintenance of the plant; therefore, the staff determined that the applicant complies with 10 CFR 50.65 (a)(4).

8-58

8.3.1.4.10 Compliance with 10 CFR 50.34(f) on Three Mile Island Action Plan Requirements The applicant provided information on compliance with 10 CFR 50.34(f) regarding the following three items:

1) Section 50.34(f)(2)(v) of 10 CFR, [Three Mile Island (TMI) Action Item I.D.3]:

Bypassed or deliberately induced inoperability of safety related systems is automatically annunciated in the MCR per RG 1.47, Bypassed and Inoperable Status Indication for Nuclear Power Plant Safety Systems. The staff determined that this satisfies the recommendation of TMI Item I.D.3 for safety related system status monitoring.

2) Section 50.34(f)(2)(xiii) of 10 CFR, [TMI Action Item II.E.3.1]: The EDG provides standby power to a number of pressurizer heaters in each safety-related Class 1E division. The heaters are capable of establishing and maintaining natural circulation at hot standby conditions during a LOOP, and they are also capable of being powered from offsite power or the EDG. The staff determined that this satisfies the redundancy recommended by TMI Action Item II.E.3.1.
3) Section 50.34(f)(2)(xx) of 10 CFR, [TMI Action Item II.G.1]: The EDG provides power for pressurizer safety and relief valves, and the pressurizer level instrumentation, as recommended by TMI Action Item II.G.1.

The staff noted that in DCD Tier 2 Section 8.3.1.1.2, TMI Action Items, TMI Item I.D.3, and TMI Item II.G.1, are not discussed except for TMI Item II.E.3.1, whereas DCD Tier 2, Table 8.1-2 (page 2 of 8) refers to applicable sections of 10 CFR 50.34 (f) related to TMI Action Items.

Table 8.1-2 shows that it is also applicable for DCD Tier 2, Section 8.3.2. In RAI 134-8033, Question 08.03.01-12 (ML15220A003), the staff requested clarification on this issue and confirmation that all TMI Action Items are considered as the basis for analysis for DCD Tier 2, Sections 8.3.1.2 and 8.3.2.2, as applicable. In its response to RAI 134-8033, Question 08.03.01-12 (ML15301A925), the applicant confirmed that TMI Items I.D.3, and TMI Item II.G.1, as well as II.E.3.1, are considered in the design of the Class 1E onsite ac and dc power systems. The applicant also revised DCD Tier 2 by adding Section 8.3.1.2.3, Conformance with 10 CFR 50.34 Related to TMI Action Plan Requirements (ac power) and Section 8.3.2.2.3 Conformance with 10CFR 50.34 Related to TMI Action Plan Requirements (dc power) for conformance with 10 CFR 50.34 related to TMI Action Plan requirements. Additionally, DCD Tier 2, Table 1.9-4, APR1400 Conformance with Additional TMI-Related Requirements (10 CFR 50.34(f)), Section 8.3.1.1.2, Section 8.3.1.2 and Section 8.3.2.2, will be revised for TMI Action Item references. The staff reviewed the addition of the TMI Action Items and determined that this is acceptable. Therefore, the staff considers this issue to be resolved.

DCD Tier 2, Section 8.3.1.1.2, states that Class 1E 4.16 kV switchgears A and B supply power to the non-Class 1E load of the pressurizer heaters back-up group in their division as required by the TMI Action Item Plan in NUREG-0737, Calculation of TMI Action Plan Requirements, Item II.E.3.1. The staff verified that if the onsite ac power system is bypassed or deliberately rendered inoperable, such a condition is automatically annunciated in the MCR, as recommended by RG 1.47. Accordingly, the staff determined that the APR1400 design complies with the requirements of 10 CFR 50.34(f)(2)(v) in regard to the onsite ac power system. Conformance with the requirements of 10 CFR 50.34(f)(2)(v) is further discussed in DCD Tier 2, Section 7.5.2.3, Bypassed and Inoperable Status Indication.

8-59

Additionally, the staff verified whether the APR1400 design provides EDG standby power supplies for pressurizer relief valves, block valves, and level indicators. The applicant stated that for the APR1400 design, there is no power-operated relief valve or block valves which requires any electrical power. The Class 1E 120 Vac I&C power system, backed up by EDGs and batteries, supplies power for pressurizer level indicator instruments as described in DCD Tier 2, Section 7.1.2.11, Conformance with 10 CFR 50.34(f)(2)(xx). Thus the staff determined that the applicant conforms with 10 CFR 50.34(f)(2)(xx). The TMI Action items are also evaluated in Chapter 7 of this report.

Based on the above discussions, the staff considers this issue to be resolved. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and finds that RAI 134-8033, Question 08.03.01-12, is resolved and closed.

8.3.1.4.11 Conformance to BTP 8-1 In DCD Tier 2, Section 8.1, Table 8.1-2, the applicant states that BTP 8-1, Requirements on Motor Operated Valves in the Emergency Core Cooling System (ECCS) Accumulator Lines, is applicable to APR1400 design. BTP 8-1 recommends that the motor operated isolation valves in the ECCS should be designed to facilitate automatic opening of the valve with visual indication and alarm in the control room. The details of how this BTP is applicable were not discussed in DCD Tier 2, Section 8.3.1.

In RAI 177-8166, Question 08.01-7 (ML15243A475), the staff stated that DCD Tier 2, Table 8.1-2 indicated that BTP 8-1, Requirements on Motor-Operated Valves in the ECCS Accumulator Lines, is applicable to DCD Tier 2, Section 8.3.1 and Section 8.1.3.3. Also DCD Tier 2, Table 1.9-2 indicated that the APR1400 design conforms to BTP 8-1. The staff also indicated that the SRP, Section 8.1 stated that the DCD should discuss the applicability, and since the DCD did not include a discussion related to BTP 8-1, the staff asked the applicant to provide such discussion in the DCD. In its response to RAI 177-8166, Question 08.01-7 (ML16026A461), the applicant stated that the design of motor operated valves in the ECCS accumulator lines conforms to BTP 8-1 and is addressed in DCD Tier 2, Section 6.3.2.5.1, Safety Injection Tanks, Section 7.3.1.4 Component Control Logic, Section 7.6.1.4, Component Cooling Water Non-essential Supply and Return Header Isolation Valve Interlocks and Figure 7.6-2, Interlocks for Safety Injection Tank Isolation Valve, and added references in DCD Tier 2, Section 8.3.1.2.3 and Table 1.9-2 to indicate conformance to BTP 8-1. The staff reviewed the response and determined that there was not specific mention in the referenced Sections (6.3.2.5.1, 7.3.1.4, 7.6.1.4, and Figure 7.6-2) about BTP 8-1. Therefore, in follow-up RAI 437-8540, Question 08.01-19 (ML16068A196), the staff requested that the applicant provide a clear reference to the applicability of BTP 8-1 in the referenced section(s). In its response to follow-up RAI 437-8540, Question 08.01-19 (ML16134A374), the applicant stated that the reference sections in its response to RAI 177-8166 (ML16026A461) are revised to reflect the correct reference sections. The design of the motor operated valves in the ECCS accumulator lines conforms to BTP 8-1 as currently addressed in DCD Tier 2, Section 6.3.2.1.1, Safety Injection Tank System, Section 6.3.2.5.1, Section 6.3.5.3.2, Valve Position and Control, Section 7.3.1.3, and Figure 7.6-2. That is, the references to DCD Tier 2, Sections 7.3.1.4, and 7.6.1.4 previously provided are to be replaced with correct references to DCD Tier 2, Sections 6.3.2.1.1, 6.3.5.3.2, and 7.3.1.3. Also, BTP 8-1 is included in the referenced sections to provide a clear reference to the applicability of BTP 8-1. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and finds that RAI 437-8540, Question 08.01-19, is resolved and closed.

8-60

The staff has reviewed DCD Tier 2, Sections 6.3.2.1.1, 6.3.2.5.1, 6.3.5.3.2, and 7.3.1.3, which describe features for safety injection as system motor operated isolation valves, and verified that the power supplied by the onsite safety-related ac system to those valves provides for their indications, alarm features, and control features in accordance with BTP 8-1. The staffs review determined that the power supply for these valve indication, alarm and control features are in accordance with the recommendations of BTP 8-1 and are acceptable.

8.3.1.4.12 Conformance to BTP 8-2 BTP 8-2, Use of Diesel Generator Sets for Peaking, recommends that emergency power diesel generator sets should not be used for peaking service, as frequent interconnection of the preferred and standby power supplies increases the probability of their common failure.

In RAI 177-8166, Question 08.01-8 (ML15243A475), the staff stated that APR1400 DCD Tier 2 Table 8.1-2, Criteria and Guidelines for Electric Power Systems, and Table 1.9-2, APR1400 Conformance with the Standard Review Plan, indicated that BTP 8-2 is applicable to the design. However, the DCD did not include a statement or discussion as to the application and implementation into the design of the electrical power systems. Therefore, the staff requested the applicant to provide a discussion in the DCD pertaining to the application of BTP 8-2 in the APR1400 design. In its response to RAI 177-8166, Question 08.01-8 (ML15352A274), the applicant clarified that the Class 1E EDGs are not used for peaking service and that they are only connected to the offsite power source, one at a time, for periodic testing as described in DCD Tier 2, Section 8.3.1.1.3.7, Testability. The applicant also confirmed that the design was in conformance with BTP 8-2 and revised DCD Tier 2, Section 8.3.1.2.4, Conformance with Branch Technical Positions, and other relevant sections discussed in Section 8.3.1.2.4, to include conformance with BTP 8-2. The staff reviewed the response and verified the proposed DCD changes and determined that the response is acceptable because the applicant added Section 8.3.1.2.4, Conformance with Branch Technical Positions, in the DCD to explain the application of BTP 8-2 in the design and to explain that the Class 1E EDGs are not used for peaking. The response is also acceptable because the discussion meets the intent of the applicability of BTP 8-2, which indicates that the use of EDG sets for peaking service leads to the conclusion that the required frequent interconnection of the preferred and standby power supplies increases the probability of their common failure. In BTP 8-2, the staff concludes that the potential for common failure modes should preclude interconnection of onsite and offsite power sources except for short periods for the purpose of load testing. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and finds that RAI 177-8166, Question 08.01-8, is resolved and closed.

In DCD Tier 2, Section 8.3.1.2.4, for BTP 8-2 the applicant states that EDGs will not be used for peaking service. The EDGs provide only standby power in the event of a loss of the offsite preferred power source(s). They are periodically connected to the offsite power source, one at a time, only for surveillance testing in accordance with station TS Surveillance Requirements (SRs) and post maintenance testing. DCD Tier 2, Section 8.3.1.2.4, states conformance to BTP 8-2. Accordingly, the staff determined that the APR1400 EDGs will not be used for peaking service, in accordance with BTP 8-2, and considers this issue to be resolved.

8.3.1.4.13 Conformance to BTP 8-4 BTP 8-4, Application of the Single Failure Criterion to Manually Controlled Electrically Operated Valves, establishes the acceptability of disconnecting power to electrical components of a fluid 8-61

system as one means of designing against a single failure that might cause an undesirable component action. DCD Tier 2, Section 8.1, Table 8.1-2 states BTP 8-4, Application of the Single Failure Criterion to Manually Controlled Electrically Operated Valves, as applicable to the APR1400 design. The DCD did not provide a discussion how the APR1400 design conforms to BTP 8-4.

In RAI 177-8166, Question 08.01-9 (ML15243A475) the staff stated in part that APR1400 DCD Tier 2 Table 8.1-2, Criteria and Guidelines for Electric Power Systems, indicates that BTP 8-4, Application of the Single Failure Criterion to Manually Controlled Electrically Operated Valves, is applicable to DCD Tier 2, Section 8.3.1. The staff noted that DCD Tier 2, Section 8.1.3.3, General Design Criteria, NRC Regulatory Guides, Branch Technical Positions, Generic Letters, and Industry Standards, and Table 1.9-2, APR1400 Conformance with the Standard Review Plan, states that APR1400 conforms to BTP 8-4. The guidance in SRP Section 8.1, states in part that the DCD should discuss the applicability of the criteria and guidelines listed and include a statement to the effect that they will be implemented or are implemented in the design of the electrical power systems. Therefore, the staff requested that the applicant provide a discussion in the DCD as to the application of BTP 8-4. In its response to RAI 177-8166, Question 08.01-9, (ML16056A005), the applicant stated that the APR1400 design of manually controlled electrically operated valves conforms to BTP 8-4 and provided descriptions of the electrically operated valves which are required to meet the single failure criterion addressed in BTP 8-4.

The applicant also provided changes with a description of BTP 8-4 applicability in DCD Tier 2, Section 8.3.1.2.4, Conformance with Branch Technical Positions, and referenced a previous change associated with the response to RAI 177-8166, Question 08.01-8 (ML15352A274). The staff reviewed the response and verified the proposed DCD changes and determined that the response is acceptable because the applicant added in DCD Tier 2, Section 8.3.1.2.4, Conformance with Branch Technical Positions, a description of the application of BTP 8-4, and the response to Question 08.01-8 had provided the reference to BTP 8-4 under the conformance with BTPs associated with NUREG-0800. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and finds that RAI 177-8166, Question 08.01-9, is resolved and closed.

8.3.1.4.14 Conformance to BTP 8-5 The conformance to BTP 8-5, Supplemental Guidance for Bypass and Inoperable Status Indication for Engineered Safety Features Systems, is discussed in DCD Tier 2, Section 8.3.1.2.4, Conformance with Branch Technical Position. In addition to conforming to RG 1.47, DCD Tier 2, Section 8.3.1.2.2, Conformance with NRC Regulatory Guides, states that additional guidance from BTP 8-5, has been incorporated into the design of the bypassed and inoperable status indicators. The purpose of this BTP is to provide supplemental guidance for implementing RG 1.47 and establish design criteria for bypass and inoperable status indication for engineered safety feature systems, thus providing accurate information for the operator and reducing the possibility for the indicating equipment to adversely affect the monitored safety systems. Since safety-related Class 1E onsite sources provides power to the PPS for I&C equipment status, the plant operator can identify systems actuated or controlled by the PPS in accordance with RG 1.47 and all bypassed or inoperable status indicators that are displayed are indicated in DCD Tier 2, Section 7.5.1.3, Bypassed and Inoperable Status Indication, and the staff finds this acceptable because the criteria for bypass and inoperable status indication meets BTP 8-5.

8-62

8.3.1.4.15 Conformance to BTP 8-6 In DCD Tier 2, Section 8.3.1.1.3.11, Protective Relaying System, the applicant states conformance to BTP 8-6, Adequacy of Station Electric Distribution System Voltages. BTP 8-6 prescribes that nuclear power plants implement a degraded voltage monitoring scheme to protect safety-related equipment on Class 1E buses from degraded voltage conditions. In DCD Tier 2, Section 8.3.1.1.3.11, the applicant stated that Class 1E buses are provided with separate bus voltage monitoring and protection schemes for degraded voltage and loss of voltage (LOV) conditions, respectively. There are four first-level undervoltage relays to detect LOV and four second-level undervoltage relays to detect degraded voltage relay (DVR) on each of the four Class 1E buses. These relays consist of a two-out of-four coincident logic in the component control system (CCS) that starts the EDG, trips the incoming breakers of the Class 1E 4.16 kV bus, sheds load, closes the EDG breaker on the switchgear, and begins sequencing.

The dropout for the first-level undervoltage relays for the Class 1E distribution system is set at a level below minimum voltage during motor starting. Its associated time delay is set to ride out power system transients and initiate action in a time that is consistent with the accident analysis.

The dropout for the second-level undervoltage relays for the Class 1E distribution system is set at a level above the minimum voltage that allows proper operation of safety loads with the worst-case line-up and minimum switchyard voltage. Its associated first time delay is set to establish existence of a sustained undervoltage longer than motor starting. The second time delay is limited so that the connected Class 1E equipment is not damaged. Voltage studies are to be performed in conformance with BTP 8-6, Section B.3. The results are to be verified by testing as described in BTP 8-6, Section B.4. Voltage studies are used to determine the relay pickup and time delays of all levels of the undervoltage protection described above. The capability to test and calibrate during power operation is provided, and annunciation in the MCR and RSR is provided for any bypasses incorporated into the design.

In RAI 61-7984, Question 08.03.01-6 (ML15189A483), the staff requested clarification of the proposed scheme, with a description of the analysis for voltage limit and time delay chosen for DVR scheme. In its response to RAI 61-7984, Question 08.03.01-6 (ML15251A244), the applicant stated that each Class 1E switchgear has an independent detection scheme for the first-level undervoltage relay (hereinafter loss of voltage relay (LVR)) and second-level undervoltage relay (hereinafter degraded voltage relay (DVR)). To prevent the Class 1E switchgears from a spurious trip of the preferred power supply (PPS), four LVRs and four DVRs are provided in each Class 1E switchgear with a two-out-of-four coincidence logic. When the voltage setpoint and time delay limit of the relays are exceeded, each LVR or DVR sends an individual detection signal to the Component Control System (CCS). Upon receipt of at least two individual detection signals out of four from LVRs or DVRs, the CCS gives a trip signal to the incoming circuit breaker of the Class 1E switchgear and an EDG loading sequencer initiation signal to the CCS group controller.

The applicant further stated that two-out-of-four coincidence logic precludes nuisance tripping of the Class 1E switchgear due to any erroneous operation of any single LVR or DVR and also provides reasonable assurance of secure operation of the EDG actuation and loading when a LOOP or a degraded voltage condition occurs with a single failure of any LVR or DVR. The voltage setpoint of the DVR is established after a voltage analysis on all electrical distribution systems has been performed in accordance with BTP 8-6. The setpoint determination of the LVR and DVR relays are part of a setpoint control program (SCP) as discussed in Section 5.5.19, Setpoint Control Program, Item a5, LCO 3.3.7 in DCD Tier 2, Chapter 16, Technical Specification. In DCD Tier 2, Chapter 16, Section B 3.3.7, EDG - Loss of Voltage Start 8-63

(LOVS), the applicant discussed trip setpoints and allowable values. The trip setpoints and allowable values are based on the analytical limits presented in DCD Tier 2, Chapter 15, Accident Analysis. The selection of these trip setpoints is such that adequate protection is provided taking account of all sensor and processing time delays. The applicant stated that the allowable values specified in the SCP are conservatively adjusted with respect to the analytical limits, as calibration tolerances, instrument uncertainties and instrument drift are included in the analysis. A description of the methodology used to calculate the setpoints, including the uncertainties is provided in the SCP, in DCD Tier 2, Section 5.5.19 of Chapter 16. Further discussion on the SCP will be provided in Chapter 16 of this report.

In RAI 61-7984, Question 08.03.01-6, the staff asked the applicant to provide a basis of the voltage studies, ensuring that no improper voltage protection logic can cause adverse effects on the Class 1E systems and equipment due to degraded voltage conditions. This is per the staffs position in Regulatory Issue Summary (RIS)-2011-12, Revision 1, that the applicant provide the basis for DVR settings, ensuring safety-related equipment is supplied with adequate voltage, based on bounding conditions for the most limiting safety-related load in the plant. In its response to RAI 61-7984, Question 08.03.01-6 (ML15251A244), the applicant responded that the chance of improper voltage protection logic causing adverse effects on the Class 1E systems and equipment is addressed by: (1) Voltage setpoint of the DVR is established on the minimum voltage analysis under the worst case loading condition, that will include starting and running large motors or the limiting load that is required to meet its intended function during design basis events and accidents; (2) Tolerance of the protective device is considered in the setpoint; (3) Time delay of the relays allows for a momentary voltage dip during transient conditions such that nuisance or spurious tripping does not occur, and (4) Each Class 1E switchgear has four DVRs and is separated from the PPS upon receipt of at least two trip signals from the LVRs or DVRs, to prevent spurious tripping of a Class 1E switchgear incoming breaker caused by a DVR malfunction.

The applicant stated that the DVR and LVR protection schemes are designed in accordance with recommendations of IEEE Std. 741, Standard Criteria for the Protection of Class 1E Power Systems and Equipment in Nuclear Power Generating Stations, in DCD Tier 2, Section 8.3.1.1.3.11. Since the staff has not endorsed IEEE Std. 741, in follow-up RAI 422-8536, Question 08.03.01-24 (ML16061A075), staff requested confirmation that the applicant meets all staff positions described in BTP 8-6 for DVR and LVR protection schemes as stated by the applicant in DCD Tier 2, Section 8.3.1.1.3.11. In its response to RAI 422-8536, Question 08.03.01-24 (ML16134A188), the applicant stated that the Class 1E 4.16 kV bus degraded voltage relay scheme is designed to meet the requirements of BTP 8-6, as described in DCD Tier 2, Sections 8.3.1.1.2.3, System Independence, and as described in detail in DCD Tier 2, Section 8.3.1.1.3.11, Protective Relaying System. The applicant further provided the conformance to the BTP 8-6 in a table, as part of the response to RAI 422-8536, Question 08.03.01-24, with respect to the staffs position in BTP 8-6. The applicant stated that DCD Tier 2, Sections 8.3.1.1.3.11 and 8.3.1.3.4, Equipment Protection and Coordination Studies, clarifies that the degraded voltage and loss of voltage protection are designed in accordance with BTP 8-6.

In addition, in follow-up RAI 422-8536, Question 08.03.01-24, the staff asked for clarification with respect to the BTP 8-6 requirement that the subsequent occurrence of a safety injection actuation signal (SIAS) should immediately separate the Class 1E distribution system from the offsite power system. In addition, the DVR logic should appropriately function during the occurrence of an SIAS followed by a degraded voltage condition. In its response to RAI 422-8-64

8536, Question 08.03.01-24 (ML16134A188), the applicant stated that the first time delay is selected to be long enough to ride through motor starting and acceleration time. The time delay duration is typically set based on the total sequence loading time of the required Class 1E loads for accident mitigation, including relay operation time. In a degraded voltage condition, the DVR relay provides an alarm to the operator in the MCR when the first time delay of DVR is exceeded. In the case of a SIAS following the first DVR time delay, the Class 1E bus is immediately disconnected from the offsite power system by the DVR control scheme in accordance with BTP 8-6, Section B.1.b.i. The applicant stated that the setpoint of the two DVR time delays will be based on the total sequence loading time and equipment characteristic that are to be established by the protective device coordination of the COL applicant as described in COL Item 8.3(9).

The staff determined that the applicant has adequately responded on the selection of DVR and LOV relay scheme and its methodology of determination of setpoints, and time delays as described above. Since the voltage measurement per BTP 8-6 and verification will be performed during the initial testing program, and as required by the ITAAC, the staff determined that the analysis of the LOV relay and DVR in the APR1400 DCD conforms to BTP 8-6. Since the setpoint of the two DVR time delays will be based on the total sequence loading time and equipment characteristic, the staff accepts that this will be a part of COL applicants power system analysis as identified in COL Item 8.3(9). The staff determined that the applicants response and revisions of DCD have adequately addressed these issues of DVR relay scheme, determination of setpoints and time delays, and considers these issues to be resolved. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and finds that RAI 422-8536, Question 08.01-24, is resolved and closed.

8.3.1.4.16 Conformance to BTP 8-7 DCD Tier 2, Section 8.1, Table 8.1-2 states BTP 8-7, Criteria for Alarms and Indications Associated with Diesel Generator Unit Bypassed and Inoperable Status, is applicable to APR1400. BTP 8-7 recommends that the alarms should be displayed in the control room and at the diesel generator unit for all disabling conditions, which will indicate the EDG units capability to adequately respond to an emergency demand. DCD Tier 2, Section 8.3.1.2.4 addressed the conformance with BTP 8-7, except for BTP 8-7 Position number 3. Position number 3 states bypassed indication for a shared diesel generator at the MCR is required. However, the EDG units of APR1400 are not shared with other units; therefore the staff accepts this condition and finds it acceptable. To allow operators to respond to emergency demand, DCD Tier 2, Section 7.5.1.3, Bypassed and Inoperable Status Indication describes how EDG bypass or inoperable conditions are automatically alarmed in the MCR and provide operators with accurate information about the status of each EDG. EDG indications and alarms are listed in DCD Tier 1, Table 2.6.2-2, Emergency Diesel Generator Components List. This listing is consistent with RG 1.9, Application and Testing of Safety-Related Diesel Generators in Nuclear Power Plants, Regulatory Positions 1.6 through 1.9. BTP 8-7, Section B, Item 6, states, RG 1.9, Positions C.1.6 through C.1.8, set forth further guidance to be addressed regarding status and anomalous conditions indication and alarms for diesel-generators. Therefore, the staff determined that the DCD conforms to BTP 8-7.

8.3.1.4.17 Conformance to RG 1.206 RG 1.206, Combined License Applications for Nuclear Power Plants, provides guidance regarding the information to be submitted in an application for a combined license for a nuclear 8-65

power plant. However, the applicant included RG 1.206 as applicable guidance document for DCD Tier 2, Section 8.2, Section 8.3, and Section 8.4 in DCD Tier 2, Table 8.1-2. In DCD Tier 2, Section 8.3.1.3, Electrical Power System Calculations and Distribution System Studies for AC System, the applicant discussed the various calculations related to power systems that have been performed.

RG 1.206, Section C.I.8.3.1.3 Description under AC Power System, provides guidance to the following studies and calculations:

  • Load Flow/Voltage Regulation Studies and Under/Overvoltage Protection
  • Short-Circuit Studies
  • Equipment Sizing Studies
  • Equipment Protection and Coordination Studies
  • Insulation Coordination (Surge and Lightning Protection)
  • Power Quality Limits
  • Grounding In DCD Tier 2, Section 8.3.1.3, the applicant stated that the electrical power system calculations and distribution system studies utilized Electrical Transient Analyzer Program (ETAP), Nuclear Version 12.0.0N, to analyze the ac distribution system for load flow and voltage regulation and under/overvoltage protection, SC studies, equipment sizing studies, equipment protection and coordination studies, insulation coordination (surge and lightning protection), power quality limits, as specified in RG 1.206, Section C.I.8.3.1.3. The applicant stated that ETAP is qualified to 10 CFR Part 50, Appendix B, Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants, American Society of Mechanical Engineers (ASME) NQA-1, Quality Assurance Requirements for Nuclear Facility Applications. It is also subject to 10 CFR Part 21, Reporting of Defects and Noncompliance.

DCD Tier 1, Section 2.6.1, AC Electric Power Distribution System, ITAAC Item 11, will verify the Class 1E electric power distribution system equipment and circuits are rated to withstand maximum fault currents for the time required to clear the fault from its power source, and analyses and inspection will be performed to conclude that the Class 1E distribution equipment and circuits are sized to carry the worst-case load current for the time required to clear the fault.

The applicant stated that the grounding calculation requires site-specific details and will be part of the COL applicants calculation added in COL Item 8.3(4). The staff issued RAI 28-7942, Question 08.02-1 (ML15174A376). In its response to RAI 28-7942, Question 08.02-1 (ML15210A367), the applicant added Section 8.3.1.1.8, Grounding and Lightning Protection Criteria, to provide a description of the station and equipment grounding and also added COL item 8.3(12), which will provide analysis for station and switchyard grounding system based on the site specific parameters such as soil resistivity and site layout. The staff accepted this as the ground grid calculations depends on the area of the site and need site specific soil resistivity and therefore the COL applicant should perform these calculations.

In DCD Tier 2, Section 8.3.1.3.6, Power Quality Limits, the applicant addressed the THD and its acceptable limit for electrical distribution system design. Nonlinear loads such as battery chargers and inverters contribute to total harmonic distortions (THD) to the power distribution system. Therefore the electrical distribution system is designed so that THD does not affect Class 1E safety equipment. As for THD, the COL applicant will analyze all procured equipment to verify the system THD is within the guidelines of IEEE Std. 519-1992, IEEE Recommended 8-66

Practices and Requirements for Harmonic Control in Electrical Power Systems. The applicant stated that power quality analysis requires site-specific details and will be part of the COL applicants calculation added in COL Item 8.3(11).

To verify that the as-built distribution system THD is within acceptable limits, DCD Tier 1, Section 2.6.1, AC Electric Power Distribution System, ITAAC Item 14 indicates that an analysis will be performed to show that THD does not exceed five percent on the Class 1E buses, as described in DCD Tier 2, Section 8.3.1.3.6. DCD Tier 2, Section 8.3.1.3.6, also states, An analysis is performed so that the THD (present on the Class 1E buses) is less than or equal to five percent. Since this ITAAC verifies that the THD is within acceptable limits, the staff determined that the applicant has adequately addressed the issue. The staff considers this issue to be resolved.

In order to verify bus transfer would be successful when a Class 1E bus loses its power supply, staff requested the methodology and parameters for bus transfer. In RAI 148-8104, Question 08.03.01-13 and Question 08.03.01-14, the staff requested the applicant to provide summaries and assumptions for the above studies, including bus transfer. In its response to RAI 148-8104, Question 08.03.01-13 and Question 08.03.01-14 (ML16015A417), the applicant provided the requested information in Technical Report APR1400-E-E-NR-14001-P, Revision 1, Onsite AC Power System Analysis. In this report, the applicant discussed the assumptions on equipment parameters, input data on switchyard system, plant auxiliary load data, and power source conditions and operating modes in order to model the power system in the ETAP. The applicant also provided bus transfer equipment data and major factors and assumptions for bus transfer analysis. Bus transfer is a process for transferring bus loads from one power source to the other, such as from UAT to SAT. During bus transfer the resultant voltage and frequency decay may cause excessive transient torque that may damage the motor, the mechanical coupling or the load itself. The applicant performed a bus transfer analysis and stated that the motor modeling, relay characteristics, and equipment operation data which affect bus transfer analysis are assumed based on the reference plants of the APR1400. The applicant discussed the major factors and assumptions for the bus transfer analysis in the technical report such as acceptance criteria on voltage profile, phase angle between sources and Volts/Hertz between sources during bus transfer. In addition, COL item 8.3(2) requires the COL applicant to provide a bus transfer study of the onsite power system. As part of COL item 8.3(2), the COL applicant will also provide final relay selection and settings for the bus transfer. Based on the review of the acceptance criteria, and analysis results, the staff determined that the applicant adequately addressed the issue related to bus transfer analysis.

The staff reviewed the data, acceptance criteria and analysis summary results of each of the studies performed including short circuit and load flow calculation. Based on the responses to RAI 148-8104, Question 08.03.01-13 and Question 08.03.01-14, staff required additional clarifications, as discussed below.

In RAI 413-8529, Question 08.03.01-22 (ML16053A056), the staff asked the applicant to address the following:

1. In Section 4.3, Source Condition and Operating Mode, of the technical report, various plant operating modes and source conditions are categorized, except that the EDG scenarios and modeling assumptions are not described in the technical report. The applicant was requested to discuss the scenario(s) when power is supplied from the EDG, with EDG loading based upon a LOOP 8-67

simultaneous with LOCA, and provide ETAP results in terms of bus voltages at the Class 1E buses.

2. In Section 5.1.9, Cable Data, of the technical report, the applicant stated that cable sizes and assumed lengths are based on the reference plant to facilitate ETAP model updates. The staff requested a summary of the modelling with design assumptions related to sizing (loading), derating, cable spacing, tolerance for lengths, raceway ambient temperatures, cable operating temperatures and other anticipated correction factors.
3. In Section 5.2.6, Bus Ratings, of the technical report, the isolated phase main bus rating is provided. The applicant is requested to provide the Tap Bus (Main bus to UAT) continuous and short-time current rating, and how these ratings are determined.

In its response to RAI 413-8529, Question 08.03.01-22 (ML16134A207), the applicant responded to the above staff questions, as follows:

1. The EDG operation was not included in the loading category. Therefore a loading category is being added in the revised technical report (Revision 2) to address the loading case, when the Class 1E EDGs supply the worst-case electrical load for safe shutdown.
2. In the ETAP model, the cables are modeled on the basis of the reference plant.

Though the reference plant did not use ETAP modeling, the applicant used the information such as cable ampacity, allowable continuous current value for each cable size of different voltage levels, and also considered the cable grouping, cable spacing and derating effects due to ambient temperature. Also fire stops and other conditions have been considered that have impact on current carrying capability of cables. The adequacy of the branch cable sizes in terms of voltage drop has been reviewed in the ETAP model for APR1400 design.

3. The applicant stated that the tap bus from main bus to UAT has a continuous rating of 2700 Ampere, at 24 kV voltage rating, and has a short-time rating of 690 kA. The short-time current rating of the UAT tap bus has been determined using an impedance diagram, with selecting a fault location subjected to the fault contribution from the 765 kV grid source (reference switchyard voltage), MG, main transformer and one UAT.

The staff reviewed the above responses and accepted the methodology of determining the equipment ratings that are used from the reference plant, accepted the ETAP modeling for cables, and also noted the change in the technical report for inclusion of the additional operating mode (loading category of EDG operation under LOOP and LOCA) and additional source condition of EDG.

Since the applicant used ETAP to perform the calculation for all the power system studies, the staff performed an audit on May 25, 2016, on how the applicant developed the ETAP models for each of the calculations and reviewed the equipment parameters and system input data that were used to support the above analyses. The applicant provided a document summary during the audit and all calculations were posted in applicants electronic portal. During the audit, the 8-68

staff reviewed onsite ac system load flow analysis, SC analysis, motor starting analysis, harmonic analysis, bus transfer analysis and onsite dc system SC analysis. The audit on the dc system analysis is discussed in Section 8.3.2.4.18 of this report. During the audit, the staff observed that all electrical calculations are comprehensive, extensive, and adequately detailed with background information, assumptions and methodologies based on the industry standards and procedures (see audit report, ML16300A205). However, based on the staffs questions on EDG loading category, the technical report has been revised. The applicant revised the bus transfer scheme time table in the bus transfer analysis. The staff accepted the summary results of the ac and dc onsite power system calculations. The audit on the dc onsite power system calculation and its acceptance are discussed in Section 8.3.2.4.18 of this report. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and finds that RAI 413-8529, Question 08.03.01-22, is resolved and closed.

8.3.1.5 Combined License Information Items A list is provided for all of the ac and common to both ac and dc onsite power system COL information items and descriptions from DCD Tier 2, Chapter 8, Section 8.3.3, Combined License Information, and Chapter 1, Table 1.8-2:

Combined License Information Items Item No. Description DCD Section 8.3(1) The COL applicant is to provide and to design a mobile GTG and Tier 2, 8.3.1.1 its support equipment.

8.3(2) The COL applicant is to provide a bus transfer study of the onsite Tier 2, 8.3.1.1 power system. Based on the bus transfer study, the COL applicant is also to provide final relay selection and settings for the bus transfer.

8.3(3) The COL applicant is to establish procedures to monitor and Tier 2, 8.3.1.1.3 maintain EDG reliability during plant operations to verify the selected reliability level target is being achieved as intended in RG 1.155.

8.3(4) The COL applicant is to describe and provide detailed ground Tier 2, 8.3.1.1.8 grid and lightning protection.

8.3(5) The COL applicant is to conduct periodic inspection and testing Tier 2, 8.3.1.1.9 of the protection devices for the EPA conductors. All circuit breakers for the EPA conductors shall be inspected and tested in 60 months, low voltage circuit breaker overcurrent protection devices for the EPA conductors shall be inspected and tested once per 18 months for 10% of each type of circuit breakers, and overcurrent relay for medium voltage circuit breakers for the EPA conductors shall be inspected and tested once per 18 months.

8.3(6) The COL applicant is to provide testing, inspection, and Tier 2, 8.3.1.1.10 monitoring programs for detecting insulation degradation of 8-69

underground and inaccessible power cables within the scope of 10 CFR 50.65.

8.3(7) The COL applicant is to establish Administrative Program(s), Tier 2, 8.3.1.1.10 including application of dedicated cable and raceway management database tool as necessary, which is (are) developed on the basis of the cable and raceway numbering system to efficiently manage cable routing and cable termination and verify that the cable design fulfills the acceptance criteria (i.e., separation, filling criteria, and ampacity).

8.3(8) The COL applicant is to provide the detailed design of the Tier 2, 8.3.1.1.11 cathodic protection (CP) system as applicable to the site conditions.

8.3(9) The COL applicant is to provide protective device coordination. Tier 2, 8.3.1.3.4 8.3(10) The COL applicant is to provide the analysis and underlying Tier 2, 8.3.1.3.5 assumptions used to demonstrate adequacy for insulation coordination of surge and lightning protection.

8.3(11) The COL applicant is to provide the analysis and underlying Tier 2, 8.3.1.3.6 assumptions used to demonstrate adequacy for power quality limits (harmonic distortion).

8.3(12) The COL applicant is to provide the analysis for the station and Tier 2, 8.3.1.3.8 switchyard grounding system with underlying assumptions, based on the site specific parameters including soil resistivity and site layout 8.3.1.6 Conclusion As set forth above, the staff has reviewed all of the relevant information that is applicable to the APR1400 onsite ac power system design and evaluated its compliance with GDC 2, GDC 4, GDC 5, GDC 17, GDC 18, and GDC 50, and conformance to RGs, standards, and BTPs committed to by the applicant. The staff also reviewed the COL information items in DCD Tier 2, Table 1.8-2. The staff concludes that the applicant has provided sufficient information in the DCD and identified necessary analyses to support the bases for their conclusions of their onsite ac power system design for the COL applicant. The staff concludes the design of the APR1400 onsite ac power system design meets the appropriate regulatory requirements listed in DCD Tier 2, Section 8.3.1.2, and shown in the staffs technical evaluations in Section 8.3.1.4 and COL Information Items in Section 8.3.1.5 of this report.

8.3.2 DC Power System The APR1400 onsite dc power system is designed to provide reliable electric power from the safety-related Class 1E distribution system to provide for the safe shutdown of the reactor.

8-70

8.3.2.1 Introduction The safety function of the onsite dc power system, assuming the offsite power system is not functioning, is to provide sufficient capacity and capability to ensure that the SSCs important to safety perform as intended. The objective of the staffs review is to determine whether the onsite dc power system satisfies the requirements of 10 CFR Part 50, Appendix A, and GDC 2, GDC 4, GDC 5, GDC 17, GDC 18, and GDC 50 and will perform its design function during all plant operating and accident conditions.

8.3.2.2 Summary of Application DCD Tier 1: In DCD Tier 1, Section 2.6.3, DC Power System, and Section 2.6.4, Instrumentation and Control Power System, the applicant stated that the safety-related Class 1E dc system provides power to safety-related dc loads and safety-related Class 1E uninterruptible ac power to safety related I&C power system loads during normal and abnormal operations.

In DCD Tier 1, Section 2.6.3, the applicant stated that the non-Class 1E dc and uninterruptible power supply system provides non-Class 1E I&C power during normal and abnormal operations to non-safety-related loads.

DCD Tier 2: The applicant has provided a system description in DCD Tier 2, Section 8.3.2, which is summarized here, in part, as follows:

The onsite Class 1E 125 Vdc power system is composed of four independent subsystems (Trains A, B, C and D) and provides power to the plant safety system dc loads and essential I&C system loads. Each dc power subsystem consists of a battery, two battery chargers (normal and standby), a dc control center, and distribution panels. There are two non-Class 1E dc power systems: (a) Non-Class 1E 125 Vdc power system, and (b) Non-Class 1E 250 Vdc power system. The non-safety dc power system provides dc control power and ac motive power for various non-safety-related balance of plant equipment.

ITAAC: The ITAAC associated with DCD Tier 2, Section 8.3.2, are given in DCD Tier 1, Section 2.6.3, DC Power System; Section 2.6.4, Instrumentation and Control Power System, Table 2.6.3-3, DC Power System ITAAC; and Table 2.6.4-3, Instrument and Control Power System ITAAC.

TS: TS applicable to the onsite dc power system can be found in DCD Tier 2, Chapter 16, Section 3.8.4, DC Sources - Operating; Section 3.8.5, DC Sources - Shutdown; Section 3.8.6, Battery Cell Parameters; Section 3.8.7, Inverters - Operating; Section 3.8.8, Inverters - Shutdown; Section 3.8.9, Distribution Systems - Operating; and Section 3.8.10, Distribution Systems - Shutdown. Bases for these TSs are in B3.8.4, DC Sources -

Operating; B3.8.5, DC Sources - Shutdown; B3.8.6, Battery Parameters; B3.8.7, Inverters

- Operating; B3.8.8, Inverters - Shutdown; B3.8.9, Distribution Systems - Operating; and B3.8.10, Distribution Systems - Shutdown.

8.3.2.3 Regulatory Basis The relevant requirements of the NRC regulations for the onsite dc power system, and the associated acceptance criteria, are given in NUREG-0800, Section 8.3.2, and are summarized below.

8-71

1. GDC 2, Design bases for protection against natural phenomena, as it relates to SSCs of the dc power system being capable of withstanding the effects of natural phenomena without the loss of the capability to perform their safety functions.
2. GDC 4, Environmental and dynamic effects design bases, as it relates to SSCs of the dc power system being capable of withstanding the effects of missiles and environmental conditions associated with normal operation, maintenance, testing, and postulated accidents.
3. GDC 5, Sharing of structures, systems and components, as it relates to sharing of SSCs of the dc power systems among nuclear power units.
4. GDC 17, Electric power systems, as it relates to the onsite dc power system's: (1) capacity and capability to permit functioning of SSCs important to safety; (2) independence, redundancy, and testability to perform its safety function assuming a single failure; and (3) provisions to minimize the probability of losing electric power from any of the remaining supplies as a result of or coincident with the loss of power generated by the nuclear power unit or the loss of power from the transmission network.
5. GDC 18, Inspection and testing of electric power systems, as it relates to inspection and testing of the onsite power systems.
6. GDC 50, Containment design basis, as it relates to the design of containment electrical penetrations containing circuits of the dc power system and the capability of electric penetration assemblies in containment structures to withstand a LOCA without loss of mechanical integrity and the external circuit protection for such penetrations.
7. Section 50.63 of 10 CFR, Loss of all alternating current power, as it relates to the redundancy and reliability of the emergency onsite dc power sources, as a factor in limiting the potential for SBO events.
8. Section 50.65(a)(4) of 10 CFR, Requirements for monitoring the effectiveness of maintenance at nuclear power plants, as it relates to the assessment and management of the increase in risk that may result from proposed maintenance activities before performing the maintenance activities for the onsite dc power system. These activities include, but are not limited to, surveillances, post-maintenance testing, and corrective and preventive maintenance. Compliance with the maintenance rule, including verification that appropriate maintenance activities are covered therein, is reviewed under SRP Chapter 17, Quality Assurance and Reliability Assurance. Programs for incorporation of requirements into appropriate procedures are reviewed under SRP Chapter 13, Conduct of Operations.
9. Section 50.55(a)(h) of 10 CFR, Codes and standards, as it relates to the protection and safety system and incorporation of IEEE Std. 603-1991, Standard Criteria for Safety Systems for Nuclear Power Generating Stations, (including the correction sheet dated January 30, 1995).
10. Section 52.47(b)(1) of 10 CFR, Contents of applications; technical information, which requires that a DC application contain the proposed ITAAC that are necessary and sufficient to provide reasonable assurance that, if the inspections, tests, and analyses are performed and the acceptance criteria met, a facility that incorporate the DC is built 8-72

and will operate in conformity with the DC, the provisions of the Atomic Energy Act of 1954, as amended, and the NRC rules and regulations.

Acceptance criteria adequate to meet the above requirements include:

1. RG 1.6, Independence Between Redundant Standby (Onsite) Power sources and Between Their Distribution Systems, Regulatory Positions D.1, D.3, and D.4, as they relate to the independence between redundant onsite dc power sources and their respective dc load groups.
2. RG 1.32, Criteria for Power Systems for Nuclear Power Plants, as it relates to the design, operation, and testing of the safety-related portions of the onsite dc power system. Except for sharing of safety-related dc power systems in multi-unit nuclear power plants, RG 1.32 endorses IEEE Std. 308-2001, Standard Criteria for Class 1E Power Systems for Nuclear Power Generating Stations.
3. RG 1.47, Bypassed and Inoperable Status Indication for Nuclear Power Plant Safety Systems, as it relates to the bypass and inoperable status of the onsite dc power supply system.
4. RG 1.53, Application of the Single-Failure Criterion to Nuclear Power Plant Protection Systems, as it relates to the application of the single-failure criterion of the onsite dc power system.
5. RG 1.63, Electric Penetration Assemblies in Containment Structures for Nuclear Power Plants, as it relates to the capability of electric penetration assemblies in containment structures to withstand a LOCA without loss of mechanical integrity and the external circuit protection for such penetrations.
6. RG 1.75, Physical Independence of Electrical Systems, as it relates to the physical independence of the circuits and electrical equipment that comprise or are associated with the onsite dc power system.
7. RG 1.81, Shared Emergency and Shutdown Electric Systems for Multi-Unit Nuclear Power Plants, as it relates to the sharing of SSCs of the dc power system. Regulatory Position C.1 states that multi-unit sites should not share dc systems.
8. RG 1.118, Periodic Testing of Electric Power and Protection Systems, as it relates to the capability to periodically test the onsite dc power system.
9. RG 1.128, Installation Design and Installation of Vented Lead-Acid Storage Batteries for Nuclear Power Plants, as it relates to the installation of vented lead-acid storage batteries in the onsite dc power system.
10. RG 1.129, Maintenance, Testing, and Replacement of Vented Lead-Acid Storage Batteries for Nuclear Power Plants, as it relates to maintenance, testing, and replacement of vented lead-acid storage batteries in the onsite dc power system.
11. RG 1.153, Criteria for Safety Systems, as it relates to the design, reliability, qualification, and testability of the power, instrumentation, and control portions of safety 8-73

systems of nuclear plants, including the application of the single-failure criterion in the onsite dc power system.

12. RG 1.155, Station Blackout, as it relates to the capability and the capacity of the onsite dc power system for an SBO, including batteries associated with the operation of the AAC power source(s).
13. RG 1.160, Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, as it relates to the effectiveness of maintenance activities for dc power systems. Compliance with the maintenance rule, including verification that appropriate maintenance activities are covered therein, is reviewed under SRP Chapter 17.
14. RG 1.206, Combined License Applications for Nuclear Power Plants, as it relates to power system analytical studies and stability studies to verify the capability of the offsite power systems and their interfaces with the onsite power system.

8.3.2.4 Technical Evaluation The staff reviewed the onsite dc power system of the DCD. The DCD provides descriptive information, analyses, and referenced documents, including electrical single-line diagrams, tables, and physical arrangements. The onsite dc power system of the DCD includes a safety related 125 Vdc power system, and two types of non-safety dc power system, comprising of a 125 Vdc and a 250 Vdc system. This review evaluates whether the APR1400 onsite dc power system satisfies the applicable regulations to ensure its intended safety functions are met during all plant operating and accident conditions.

NUREG-0800, Table 8-1 lists GDC, RGs, IEEE standards, and BTPs that are applicable for the onsite dc power systems. The staffs review and evaluation of the APR1400 onsite dc power system design is provided below.

8.3.2.4.1 GDC 2, Design bases for protection against natural phenomena GDC 2 requires that SSCs important to safety, which include the onsite dc power systems, be capable of withstanding the effects of natural phenomena without the loss of the capability to perform their safety functions. Compliance to GDC 2 is addressed in DCD Tier 2, Section 8.3.2.2.1 , Conformance with General Design Criteria, as described below.

The APR1400 onsite dc power distribution system consists of two divisions, and four independent subsystems (Trains A, B, C, and D), two trains per division (Trains A and C for Division I, and Trains B and D for Division II). Each division of safety-related Class 1E dc distribution equipment is located in Seismic Category I buildings. Each dc power subsystem consists of a battery, two battery chargers (normal and standby), a dc control center, and distribution panels. The onsite dc power system also includes a safety-related Class 1E 120 Vac I&C power system.

The Class 1E 125 Vdc power systems, located in a Seismic Category I structure, are designed to remain functional in the event of a SSE, operating basis earthquake, tornadoes, hurricanes, floods, and other DBEs including missile impact and internal accidents. Class 1E batteries are located in the auxiliary building. Each battery is located in a separate room and each room is equipped with a separate ventilation system powered from the corresponding train.

8-74

All Class 1E components such as batteries, battery chargers, inverters, switch boards, and other components meet the Seismic Category I requirements. The nature and magnitude of the natural phenomena considered in the design are described in DCD Tier 2, Chapter 2, Site Characteristics. The APR1400 design criteria for wind, hurricane, tornado, flood, and earthquake have been evaluated in Section 3.3, Wind and Tornado Loadings, Section 3.4, Water Level (Flood) Design, and Section 3.7, Seismic Design, respectively, of DCD Tier 2, Chapter 3, Design of Structures, Systems, Components, and Equipment.

All Class 1E components of the APR1400 onsite dc power system are located in Seismic Category I structures, protected from the effects of natural phenomena such as tornadoes, tornado missiles, and flood. Part 50 of 10 CFR, Appendix B, Criterion III, Design Control, requires that this equipment, as installed, is seismically qualified in accordance with the COL applicants QAP. The staff evaluated the adequacy of a COL applicants QAP in Chapter 17 of this report.

The onsite Class 1E dc power system is located inside Seismic Category I structures, and the equipment and components are seismically qualified. Therefore, the staff determined that the dc power system equipment and components will be designed to withstand the effects associated with natural phenomena, specifically earthquake, tornadoes, hurricanes, floods, and other DBEs including missile impact and internal accidents, without loss of capability to perform their safety functions during an accident or will be protected from such phenomena by the structures within which that equipment is located. Based on the above, the staff determined that the APR1400 onsite dc power system meets the requirements of GDC 2.

8.3.2.4.2 GDC 4, Dynamic and environmental effects design bases GDC 4 requires that SSCs important to safety, which include the onsite dc power systems for the APR1400, be capable of withstanding the effects of environmental conditions associated with normal operation, maintenance, testing, and postulated accidents, as well as protected against dynamic effects such as missiles, pipe whipping, and discharge of fluids.

In DCD Tier 2, Section 8.3.2.1.2, Class 1E DC Power System, and Section 8.3.2.2.1, the applicant provided details of the physical layout. The APR1400 safety-related Class 1E dc power system components are located in Seismic Category I structures and buildings in an area absent of high or moderate energy lines, potential missile areas, and in rooms constructed in such a manner that any internal hazard only affects the respective division. Each ventilation system of the Class 1E battery rooms limits hydrogen accumulation to less than one percent of the total volume of the battery area. The staff determined that this design satisfies the guidance set in IEEE Std. 484-2002, IEEE Recommended Practice for Installation Design and Installation of Vented Lead-Acid Batteries for Stationary Applications. Also, an automatic fire detection system is installed in each battery room with provision for local alarm and annunciation in the MCR. The staffs review of the design details and construction of safety related structures indicates that no high energy lines are routed through the dedicated electrical rooms containing batteries, battery chargers, inverters, MCCs, panel boards, or switch boards. In addition, these rooms are also provided conditioned air that maintains ambient environmental conditions within the equipment qualification limits during normal operations, DBEs, and SBO.

In addition, for that equipment located in harsh environments, the environmental qualification program for electrical equipment provides reasonable assurance that equipment remains functional during and following exposure to harsh environmental conditions as a result of a DBE.

8-75

Environmental qualification of mechanical and electrical equipment described in DCD Tier 2, Section 3.11, Environmental Qualification of Mechanical and Electrical Equipment, lists GDC 4 as one of the acceptance criteria. DCD Tier 2, Section 3.11, Table 3.11-2, Equipment Qualification Equipment List, lists safety-related electrical and I&C equipment located in a harsh environment that must be qualified. Based on the above, the staff determined that the onsite dc power system design for APR1400 can perform safety-related functions following physical effects of an internal hazard.

Considering the ambient temperature controls and plant design described above, the onsite dc power system components of the APR1400 are capable of withstanding the effects of missiles and environmental conditions associated with normal operation and postulated accidents.

Accordingly, the staff determined that the APR1400 dc power systems meet the requirements of GDC 4.

8.3.2.4.3 GDC 5, Sharing of structures, systems, and components GDC 5 requires SSCs important to safety, which includes the dc power system, not be shared among other nuclear units unless it can be shown that such sharing will not significantly impair their ability to perform their safety functions. The DCD for APR1400 design is based on one unit plant. The safety-related dc onsite power systems and components (i.e., batteries, chargers, or inverters) for the APR1400 are not shared between individual nuclear power units. Thus, the staff determined that GDC 5 and RG 1.81 are not applicable to the dc power system of APR1400. However, GDC 5 may be applicable to a COL applicant that references the APR1400 design if its application includes multiple units.

8.3.2.4.4 GDC 17, Electric power systems GDC 17 requires that the onsite power supplies, including the dc power supplies, and the associated electrical distribution system, have sufficient capacity, capability, independence, redundancy, and testability to perform their safety functions, assuming a single failure. Thus, no single failure should prevent the onsite power system from supplying electric power, thereby enabling safety functions and other vital functions. Compliance with GDC 17 is discussed in DCD Tier 2, Section 8.3.2.2.1, Conformance with General Design Criteria.

The onsite Class 1E 125 Vdc power system is composed of two redundant divisions, and four independent subsystems (Trains A, B, C and D) and provides power to the plant safety system dc loads and essential I&C system loads. Each dc power subsystem consists of a battery, two battery chargers (normal and standby), a dc control center, and distribution panels. The onsite dc power system also includes a safety-related Class 1E 120 Vac I&C power system. There are five non-Class 1E dc power systems: (a) Two non-Class 1E 125 Vdc power systems for auxiliary building; (b) One non-Class 1E 250 Vdc power system for Turbine-Generator building (c) One non-Class 1E 125 Vdc for compound building, and (d) One non-Class 1E 125 Vdc for the AAC GTG building. The non-safety dc power system provides dc control power and ac motive power for various non-safety-related balance of plant equipment.

Under normal conditions, the dc distribution systems are designed to provide power for switchgear group controls, uninterruptible power supplies, inverters, diesel generator control, relays, solenoid valves, dc motors, emergency dc lighting, and other electric devices and components. Under abnormal and accident conditions when there is no ac power, batteries provide power to the assigned loads.

8-76

The Class 1E dc power system is divided into two redundant divisions and four trains, two per division: Trains A and C for Division I, and Trains B and D for Division II. The redundant divisions of the Class 1E dc power system are located in separate rooms and provide electrical and physical separation and independence to meet the single failure criterion. If one safety-related power division is inoperable because of a single failure, the other division can accomplish the intended safety function.

Each division and its subsystems include a battery, two battery chargers (normal and standby),

a dc control center, and distribution panels, and the divisions are redundant and physically separated from each other.

The APR1400 onsite dc power system components have the independence and redundancy required by GDC 17 to perform their safety-related functions in the presence of a single failure.

Battery sizing is determined in accordance with the methodology in IEEE Std. 485-2010, IEEE Recommended Practice for Sizing Lead-Acid Batteries for Stationary Applications, endorsed by RG 1.212, Sizing of Large Lead-Acid Storage Batteries. The battery sizing takes into account the worst-case battery load conditions to develop the duty cycle and includes specific load characteristics such as in-rush current. Battery cell discharge performance characteristic curves are used to calculate the cell capacity necessary for satisfactory battery performance based on the worst-case operating loads and duty cycle. Duty cycle development and load characteristics are shown in DCD Tier 2, Table 8.3.2-1, Class 1E 125 Vdc Power System Loads, and battery rating is shown in DCD Tier 2, Table 8.3.2-4, Electrical Equipment Ratings - Component Data.

The Class 1E batteries are qualified in accordance with IEEE Std. 535-2006, Standard for Qualification of Class 1E Vented Lead Acid Storage Batteries for Nuclear Power Generating Stations. The applicant stated that the COL applicant is to describe any special features of the design that would permit online replacement of an individual cell, group of cells, or entire battery, and will be part of the COL applicants calculation added in COL 8.3 (15).

Other considerations for sizing the battery are in accordance with IEEE Std. 485, which recommends a 10 percent design margin in the cell size, a minimum battery temperature of 18 °C (65 °F), and 25 percent margin as an aging factor.

In RAI 163-8178, Question 08.03.02-1 (ML15295A488), the staff required clarification on battery component data and duty cycle of various types Class 1E and non-Class 1E batteries as follows.

a) The staff requested an explanation for the differences in battery chargers output current ratings and battery capacity of Division I from those of Division II, and whether a divisional pair can be replaced by the other pair of lower capacity, without any impact to operation of the dc and I&C systems, and if any load shedding is involved in the design. In its response to RAI 163-8178, Question 08.03.02-1 (ML16012A553), the applicant stated that unlike the Class 1E dc system, the non-Class 1E dc system is not made up of redundant systems and each division (I and II) is independent of each other. The staff examined the scenario of three feedwater pump turbines, each with a dc emergency lube oil pump (EBOP). Two of the EBOPs are assigned to Division I and the third is assigned to Division II, thereby loads on the non- Class 1E 125 Vdc are different.

The staff accepted the differences in loading for non-Safety dc system Division I and II switchgear. Therefore, this issue is resolved. Also the applicant stated 8-77

that the load shedding is considered for the non-Class 1E batteries, to provide back-up power up to eight hours, as shown in DCD Tier 2, Table 8.3.2-2, Non-Class 1E DC Power System Loads. However the staff could not identify the load shedding details in this table. In follow-up RAI 441-8549, Question 08.03.02-3 (ML16074A288) the staff asked about this information. In its response to follow-up RAI 441-8549, Question 08.03.02-3 (ML16134A350), the applicant provided revised DCD Tier 2, Table 8.3.2-2, with supplemental information that included time intervals for continuous, momentary, and non-continuous/random loads, which shows the shedding of loads over the duty cycle period. The staff accepts this response as the load shedding sequence is identified. Therefore, the staff considers this issue to be resolved. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and finds that RAI 441-8549, Question 08.03.02-3, is resolved and closed.

b) DCD, Tier 2, Table 8.3.21, shows that the duty cycle is 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> long for Train A and 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> for Train C (Notes 5 and 8 in Table 8.3.2-1) for Class 1E batteries.

Similarly the duty cycle for Trains B and D is 8 and 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br />, respectively. In RAI 441-8549, Question, 08.02.03-3 (ML16074A288) the staff requested: (i) an explanation of the differences in duty cycles between the trains of one division such as Trains A and C in Division I or Trains B and D in Division II; (ii) considering the duty cycle diagram for APR1400 design for each battery train, discuss how the most critical time was determined and how the sections of the duty cycle were identified that controls battery size (Momentary, random and continuous); and (iii) identify the controlling portion of the duty cycle time in minutes as per guidance in Figure 1, Diagram of a Duty Cycle, of IEEE Std. 485 for random loads, representative of the two different duty cycles.

In its response to RAI 441-8549, Question 08.02.03-3 (ML16134A350), the applicant stated: (1) that the reason for difference in duty cycle is that both Train A and Train B batteries have a capacity of 2800 Ampere Hour (AH) which can provide backup power for two hours without load shedding and an additional six hours with load shedding. Train C and D batteries have a capacity of 8,800 AH which can provide backup power for 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> without load shedding. The reason for such difference in duty cycle comparing Trains A and B to Trains C and D is due to the mitigation strategies for BDBEE, as described in DCD Tier 2, Section 19.3, Beyond Design Basis External Event (BDBEE) and Technical Report APR1400-E-P-NR-14005-P, Revision 0. It is explained in these documents, that a load cycle of 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> is applied only to Trains C and D batteries to support operation during mitigation of BDBEE. Further information on BDBEE are provided in DCD Tier 2, Section 19.3 of this report; (2) The applicant also provided a discussion of the most critical time and duty cycle determination.

Each of the dc loads powered by the battery during its duty cycle is classified as continuous or non-continuous. Continuous loads are energized throughout the duty cycle. Non-continuous loads are energized only during a portion of the duty cycle as the process required, and removed automatically or manually. There are momentary loads which are of short duration. In addition there are certain loads, both continuous and non-continuous, that occur at random, and are energized at the most critical time of the duty cycle in order to simulate the worst-case load on the battery; and (3) To determine the most critical time, the battery 8-78

was sized without the random loads and the section that controls the battery size was identified. The random loads were then superimposed on the end of the controlling section of the duty cycle. The staff reviewed the above explanation of determining the duty cycle, and determined that the methodology follows the guidance provided in IEEE Std. 485, and the staff accepted the difference in duty cycle and load variation in the batteries. In addition, in its response to RAI 441-8549, Question 08.03.02-3 (ML16134A350), the applicant revised DCD Tier 2 Table 8.3.2-2 to reflect the dc load classification to identify the duty cycle for continuous, non-continuous and momentary loads with load descriptions, which also identifies the load shedding for the batteries during the duty cycle. In this response, the applicant provided the revised diagrams of the duty cycles. The staff reviewed the revised DCD Tier 2 Table 8.3.2-2 and the revised duty cycles and determined that the information is acceptable as the determination of duty cycle of the Class 1E batteries follows the methodology provided in IEEE Std.

485. Therefore, the staff considers this issue resolved. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and finds that RAI 441-8549, Question 08.03.02-3, is resolved and closed.

c) DCD, Tier 2, Table 8.3.24, Electrical Equipment Ratings - Component Data (page 2), indicates that the Class 1E 125 Vdc battery capacity is 8800 AH for Trains C and D. In RAI 441-8549, Question 08.02.03-3 (ML16074A288), the staff requested: (1) a discussion on the capacity determination of such a large battery and due to its size, whether there will be any impact on the SC capability limitation of the dc power distribution system; (2) that the applicant provide the time to recharge the battery from a fully discharged state on the worst case duty cycle, to approximately 95 percent capacity during operating conditions; and (3) to confirm the acceptance criteria for selecting the DC system equipment (batteries, battery chargers, inverters, DC switchgear, panels, and connecting cables) are such that the equipment ratings are sufficient to start and operate required loads during normal and off-normal plant conditions including DBA.

In its response to RAI 163-8178, Question 08.03.02-1 (ML16012A553), the applicant stated that: (1) the Class 1E Trains C and D batteries, which also include the BDBEE mitigation loads, are calculated to be 8,527 AH and 8,561 AH, respectively, and the capacity of Trains C and D batteries are selected as 8,800 AH, which are 4,400 AH times two banks in parallel. In its response to RAI 441-8549, Question 08.03.02-3 (ML16134A350), the applicant provided the battery cell sizing worksheet, based on the IEEE Std. 485. The staff reviewed the battery sizing calculation and determined that Class 1E batteries of Trains A, B, C, and D capacity sizing followed the IEEE Std. 485 and assumed the following as applied to the battery design: a minimum electrolyte temperature is applied for derating of battery capacities, a design margin of 10 percent is added to account for future dc loads, and a design margin of 25 percent is added to account for aging. The staff accepted the design consideration and the margins assumed, as these parameters follow the guidance of IEEE Std. 485; and (2) To determine the maximum available SC current, which is the required interrupting capacity for feeder breakers/fuses and withstand capability of the dc distribution buses and disconnecting devices, the total SC current is the sum of that delivered by the battery, charger, and the loads (motors) as applicable. In order to perform the dc calculation, the applicant derived parameters of the equipment 8-79

from a reference plant (Shin Kori Nuclear Power Plant under construction in Korea). The applicant stated that the calculation result demonstrates that the impact of the large capacity Class 1E batteries (Trains C and D, 8,800 AH) can be accommodated by the selected SC ratings of the connected equipment, such as breaker, and dc distribution bus. The staff audited the dc system SC calculation on May 25, 2016. The staff provided its conclusions of the audit in the audit report (ML16300A205), and accepted the methodology for conducting SC calculation, and summary results of the SC capacity of the dc power distribution equipment. The audit of the APR1400 dc system design calculation is further discussed under Section 8.3.2.4.18, Conformance to RG 1.206 of this report.

Therefore the staff considers this issue to be resolved.

DCD Tier 2, Section 8.3.2.1.2.6, System Capacity and Capability, states that the Class 1E batteries are qualified in accordance with IEEE Std. 535-2006. However, the staff noted that IEEE Std. 535-2006 was written under the assumption of an eight-hour duty cycle (Request for Interpretation of IEEE Std. 535-2006, dated November 17, 2008). Therefore, in RAI 441-8549, Question 08.02.03-3 (ML16134A350) the staff requested the applicant for consideration of the IEEE Std. 535-2013, IEEE Standard for Qualification of Class 1E Vented Lead Acid Storage Batteries for Nuclear Power Generating Stations, which provides guidance for qualification of batteries with duty cycles longer than eight hours. In its response to RAI 441-8549, Question 08.02.03-3 (ML16134A350), the applicant responded that instead of IEEE Std. 535-2006, IEEE Std. 535-2013 is applied to provide the methodology to be used to qualify these batteries for an extended duty cycle of 16-hour for Trains C and D batteries. The applicant revised the DCD Tier 2 Table 1.9-1, APR1400 Conformance with Regulatory Guides, Section 3.11.8, References, Section 8.1.3.3 and Section 8.3.4 to reflect the usage of IEEE Std. 535-2013.

The staff accepted this response since the methodology of qualifying batteries was revised to correctly include duty cycles greater than eight hours and applies for duty cycles greater than eight hours. The staff considers the issue to be resolved as the batteries for Trains C and D will be appropriately qualified as per guidance described in IEEE Std. 535-2013. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and finds that RAI 441-8549, Question 08.03.02-3, is resolved and closed.

Based on the above discussion, the staff determined that the Class 1E dc power system for APR1400 design is divided into two redundant divisions and four subsystems, two per division:

Trains A and C for Division I, and Trains B and D for Division II. The redundant trains are located in separate rooms to provide separation and electrical isolation. The Class 1E Battery size is determined in accordance with the methodology in IEEE Std. 485-2010, and is found to be adequate in capacity and capability. The staff determined that APR1400 onsite dc power system components such as batteries, battery chargers, dc control center, and distribution panels, have the independence, redundancy, and physical separation required by GDC 17 to perform their safety functions in the presence of a single failure.

GDC 17 specifies the safety function of the electric power systems as providing sufficient capacity and capability to assure that: (1) specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded as a result of AOOs; and (2) the core is cooled and containment integrity and other vital functions are maintained in the event of postulated accidents. The systems to which the onsite dc power system supplies control power that accomplishes these functions are governed by GDC 33, Reactor coolant makeup; GDC 34, Residual heat removal; GDC 35, Emergency core cooling; GDC 38, Containment heat removal; GDC 41, Containment atmosphere cleanup; and GDC 44 8-80

Cooling water; for SSCs important to safety during normal and accident conditions, as necessary for the specific system condition. Compliance is accomplished by meeting the requirements of GDC 17.

Compliance with GDC 17 is accomplished through the design of the onsite power dc distribution system capacity, capability, independence, and redundancy along with meeting the single-failure criteria.

8.3.2.4.5 Conformance to RG 1.6 DCD Tier 2, Section 8.3.2.2.1 states conformance to RG 1.6. RG 1.6 relates, in part, to the independence between redundant onsite dc power sources and between the associated distribution systems. Each APR1400 safety-related Class 1E division contains a battery, two battery chargers (normal and standby), dc control center, an inverter with a static bypass switch and distribution panels. Each division consists of four independent subsystems (Trains A, B, C, and D). There are no (automatic or manual) connections between the divisions. During normal bus alignments, two redundant divisions are physically separated and electrically independent preventing failure in one division from having a detrimental effect on another division that would prevent performance of a safety function. Accordingly, the staff determined that the safety-related dc power system provides uninterruptible Class 1E dc and ac power (I&C power) to the redundant safety-related load groups and conforms to the guidance provided in RG 1.6.

8.3.2.4.6 Conformance to RG 1.53 The applicant has stated that in DCD Tier 2, Section 8.3.2.2.1, the safety-related Class 1E dc power system has been designed in conformance to RG 1.53, which provides that safety-related systems will have the power to perform their safety-related function in the presence of a single failure. The applicant has provided onsite dc distribution system capability to maintain safety function in the presence of a single failure as discussed in DCD Tier 2, Section 8.3.2.1.2.4, Single Failure Criteria. In order to detect the presence of a single failure and to permit dc system monitoring, the dc system components have local battery charger and inverter indications and alarms, as provided in DCD Tier 2, Table 8.3.2-5, Electrical Equipment Status Information of Class 1E 125 Vdc and 120 Vac Power Systems. For example, dc switchboard and 480 Vac MCC voltage, battery charger output current and battery charge or discharge rate are indicated in the MCR and RSR. In addition, a dc switchboard undervoltage alarm indicates that the battery is being discharged, and a dc system ground alarm is provided in the MCR and RSR. Since the safety-related functions can be performed in the event of single failure, the staff determined that the APR1400 onsite dc power system conforms to the guidance provided in RG 1.53.

The staff needed a FMEA to determine that the applicant describes an acceptable method of single-failure analysis. In RAI 163-8178, Question 8.3.2-2, the staff requested the following:

DCD, Tier 2, Section 8.3.2.2, Analysis, Regulatory Guide 1.53[,] states that If one safetyrelated power division is inoperable because of a single failure, the other division can accomplish the intended safety function[.] Please explain how the transfer of divisional loads from the inoperable division to the redundant/standby division is achieved, both manually and automatically. Also demonstrate the online dc/UPS (I&C) power distribution system capability to maintain safety function in the event of a single failure by providing an FMEA.

8-81

In its response to RAI 163-8178, Question 8.3.2-2 (ML16012A553), the applicant stated that it performed a FMEA for the onsite dc/UPS systems and provided a table of the FMEA results for the Class 1E 125 Vdc and Class 1E Vital Power System (for I&C). The staff reviewed the FMEA table and determined that it shows that no single event will simultaneously fail the redundant divisions. Therefore the staff accepted the FMEA and considers this issue to be resolved. In its response to RAI 441-8549 (ML16134A350), the applicant revised the DCD to include the FMEA table in the DCD, Tier 2, with two additional tables, Table 8.3.2-6, Failure Modes and Effects Analysis for the 125 Vdc and Class 1E Vital Power System, and Table 8.3.2-7, Failure Modes and Effects Analysis for the 120 Vac Class 1E Vital Instrumentation and Control Power System, for the 125 Vdc and Class 1E Vital Power System and the 120 Vac Class 1E Vital I&C Power System and reviewed and accepted by the staff as discussed above.

The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and finds that RAI 441-8549, Question 08.03.02-3, is resolved and closed.

8.3.2.4.7 Conformance to RG 1.75 DCD Tier 2, Section 8.3.2.2.2, Conformance with NRC Regulatory Guides, states conformance to RG 1.75. RG 1.75 addresses the physical independence of the circuits and electrical equipment that comprise or are associated with the onsite dc power system. Station routing of Class 1E and non-Class 1E raceways, cable trays and cables has been designed to meet independence, separation criteria, routing, fire protection, and identification requirements of IEEE Std. 384-1992, IEEE Standard Criteria for Independence of Class 1E Equipment and Circuits, as endorsed by RG 1.75. The DCD Tier 2, Section 8.3.1.1.10, Cable and Raceway Design Criteria, describes raceway and cable routing for the applicants onsite power systems, including dc power, and includes information on cable tray fill, cable independence, and necessary separation. Each safety-related division for APR1400 is located in separate Seismic Category 1 rooms in the auxiliary building. This arrangement provides physical separation through the use of safety class structures for the majority of the electrical equipment and circuits.

Administrative programs will be developed to distinguish cable routing, derating, raceway fill, separation, and cable identification of redundant Class 1E circuits, and the independence of non-Class 1E circuits from Class 1E circuits is in accordance with RG 1.75. For the conformance to RG 1.75 for dc systems, the staff requested additional information in RAI 210-8239, Question 08.03.01-20 regarding Class 1E circuits. In its response to RAI 210-8239, Question 08.03.01-20 (ML15338A033), the applicant included COL Item 8.3(7) in DCD Tier 2, Table 1.8-2. This is discussed in Section 8.3.1 of this report under Conformance to RG 1.75.

The staff accepted the response because the COL applicant will establish Administrative Programs to manage Class 1E cable installation, to meet the acceptance criteria such as cable separation, and tray fill. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and finds that RAI 210-8239, Question 08.03.01-20, is resolved and closed.

RG 1.75 does not distinguish between ac and dc power system cables. The function and voltage class of the cables includes 125 Vdc and 250 Vdc control and low voltage power cables.

The staff determined that the physical independence of the circuits and electrical equipment for the onsite dc power system satisfies RG 1.75. However, the staff issued an RAI to the applicant to clarify the periodic testing of circuit breaker/isolation device recommendations in RG 1.75.

8-82

In RAI 203-8214, Question 08.03.01-19 (ML15295A503), the staff requested for clarification that the applicant performs periodic testing of circuit breakers in accordance with RG 1.75 for isolation devices for the applicants design. RG 1.75 provides guidance related to periodic testing of isolation devices (e.g., visual inspection of fuses and fuse holders during every refueling outage is performed to demonstrate that the overall coordination scheme under multiple faults of non-safety-related loads provides protection for the safety-related loads). In its response to RAI 203-8214, Question 08.03.01-19 (ML16026A490), the applicant stated that during refueling outage, periodic testing of the electrical isolation will be performed so that the overall coordination scheme is demonstrated to remain within limits specified in the design criteria, in accordance with RG 1.75, and the DCD Tier 2, Section 8.3.1.1.2.3, System Independence, has been revised to include the description of the periodic testing of electrical isolation devices. The staff determined that the applicant has adequately addressed this issue.

Therefore, the staff determined that this is acceptable and considers this issue to be resolved.

The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and finds that RAI 441-8549, Question 08.03.02-3, is resolved and closed.

In RAI 163-8178, Question 08.03.02-2 the staff requested additional clarification on the independence and separation between the non-safety trains and safety trains of 120 Vac I&C power system and also of 125 Vdc power system. In its response to RAI 163-8178, Question 08.03.02-2 (ML16012A553), the applicant stated that the locations of the 125 Vdc and 120 Vac are such that these equipment are divided into four trains and the equipment for each train is located in a dedicated dc and instrumentation and control power (IP) equipment room in the seismic Category I auxiliary building, that corresponds to each train, (e.g., room numbers 078-A56A, 078-A56B, 078-A05C and 078-A05D), and the applicant attached a location drawing to this RAI response. Independence of the Class 1E 125 Vdc and 120 Vac I&C power system is achieved by physical separation and electrical isolation from non-safety-related equipment in accordance with RG 1.75 and IEEE Std. 384. Also physical separation of the Class 1E equipment from non-safety-related equipment is ensured in the design since the Class 1E dc and 120 Vac I&C power system equipment is located in the dc and IP equipment rooms in four quadrants of the auxiliary building. There is no non-safety equipment in the dc and IP rooms.

In the current design of APR1400, there is only one case where a Class 1E 120 Vac I&C power supplies a non-safety-related load. In this case, an isolation device, qualified in accordance with RG 1.75 and IEEE Std. 384, is placed between the Class 1E power source and the non-safety-related load so that the Class 1E power source will not be adversely impacted by a fault current arising from the non-Class 1E circuit. The applicant stated that design concept of the dc/UPS (I&C) system equipment layout described in DCD Tier 2, Section 8.3.1.1.4, Electrical Equipment Layout, apply to all of the Class 1E electrical equipment including the Class 1E dc and 120 Vac I&C power system equipment.

The staff verified the physical design layout and found that the Class 1E dc and 120 Vac I&C equipment is located in separate dedicated rooms. Also in case of a non-safety system powered from a safety system, the applicants design includes the isolation device qualified by RG 1.75 requirements to provide required separation and independence. Based on the above response, the staff determined that the APR1400 onsite dc power system conforms to the guidance of RG 1.75, as the design provides physical independence and electrical separation of the Class 1E dc and I&C circuits and electrical equipment that comprise or are associated with the onsite dc power system, from the non-Class 1E equipment and power system.

8-83

8.3.2.4.8 Conformance to RGs 1.128 and 1.129 DCD Tier 2, Section 8.3.2.2.2, Conformance with NRC Regulatory Guides, states that the design and installation of vented lead acid storage batteries conforms to IEEE Std. 484-2002, Recommended Practice for Installation Design and Installation of Vented Lead-Acid Batteries for Stationary Applications, as endorsed by RG 1.128, for proper design and installation for large lead-acid storage batteries. RG 1.128 relates to the installation of vented lead-acid storage batteries in the onsite dc power system. Stationary lead-acid batteries provide normal response and instrument power and backup energy for emergencies. IEEE Std. 484-2002 recommends common or standard practices for the design of battery installations and the battery installation procedures. The methods described are applicable to installations and battery sizes using vented lead-acid batteries designed for float operation with a battery charger serving to maintain the battery in a charged condition as well as to supply the normal dc load.

Testing related to initial design and installation of safety-related batteries for the APR1400 is described in DCD Tier 1, Table 2.6.3-3, DC Power System ITAAC.

In addition, DCD Tier 2, Section 8.3.2.2.2 also states that the maintenance and testing of vented lead acid batteries conforms to RG 1.129. RG 1.129 relates to maintenance, testing, and replacement of the batteries for the onsite power system. It also indicates that maintenance and testing of safety-related batteries for the APR1400 is in accordance with IEEE Std. 450-2010, Recommended Practice for Maintenance, Testing, and Replacement of Vented Lead-Acid Batteries for Stationary Applications, as endorsed by RG 1.129. Detailed battery surveillance testing that would be required is in the DCD Tier 2, Chapter 16, Section 3.8.4, DC Sources -

Operating. The staff reviewed and determined that the installation of vented lead-acid storage batteries in the onsite dc power system follow the guidance in RG 1.128 and the maintenance, testing, and replacement of the batteries follows the RG 1.129. Accordingly, the staff determined that the installation, testing and maintenance methods of vented lead-acid storage batteries, including the ITAAC, conform to the guidance in RG 1.128 and RG 1.129.

8.3.2.4.9 Conformance to RG 1.153 DCD Tier 2, Section 8.3.2.2.2, Conformance with NRC Regulatory Guides, states that the APR1400 design conforms to RG 1.153. RG 1.153 relates to the design, reliability, qualification, and testability of the power, instrumentation, and control portions of safety systems of nuclear plants, including the application of the single-failure criterion in the onsite dc power system. It also addresses the need for minimum functional and design independence and separation requirements for onsite dc power system distribution for nuclear power plants. Meeting the detailed requirements of IEEE Std. 603-1991, Criteria for Safety Systems for Nuclear Power Generating Stations, with respect to independence and separation of the dc power distribution system divisions, will achieve the goals stated in RG 1.153.

The staff has reviewed the applicants onsite dc electrical distribution safety-related configuration and its functions to determine whether functional independence and physical separation of each division is in accordance with IEEE Std. 603-1991 for safety-related system independence. The IEEE standard addresses independence between redundant portions of a safety system and effects of a design basis event. In the APR1400 design, this is accomplished by the separation of safety-related components among divisions. The physical separation assures that a single failure or internal hazard, or both, in one division can only affect that division as described in DCD Tier 2, Section 8.3.2.1.2.4, Single Failure Criteria. Therefore, during DBAs coincident with a single failure to any electrical component in a division, the 8-84

remaining divisions will support safety-related function completion. The onsite dc power electrical distribution equipment (i.e., batteries, battery chargers, control boards, inverters, and panel boards) is sized to provide sufficient power to start and operate the connected loads.

Accordingly, the staff determined that the APR1400 onsite dc electrical distribution system is designed in accordance with the independence and separation requirements of RG 1.153.

The redundancy of the safety-related divisions maintains power to the safety-related loads so that equipment may complete its safety-related functions in the event of a single failure.

Electrical independence and physical separation is provided between redundant onsite distribution divisions, so a failure in one division does not prevent the accomplishment of safety-related functions in the other division, as described in DCD Tier 2, Section 8.3.2.1.2.5, System Independence. Since there is no interconnection or inadvertent closure of interconnecting devices between redundant divisions, malfunctions are prevented.

The safety-related Train A and Train B Class 1E 125 Vdc batteries are sized to provide back-up power for two hours without load-shedding to loads connected to the Class 1E distribution equipment, when the ac supply to the battery charger is lost. With load shedding, the Class 1E batteries can provide an additional six hours. Battery minimum operating voltage is 1.81 V/cell at 25 °C (77 °F). (See DCD Tier 2, Table 8.3.2-4, Class 1E DC and I&C Power System, for nominal Values.) Each safety-related train contains two 100 percent capacity battery chargers (one normal, one standby). Each safety-related battery charger is sized to supply continuous steady-state loads while recharging its respective battery. These battery charger parameters are alarmed in the MCR and RSR to alert operators of abnormal conditions.

The power supply for I&C system is comprised of two inverters per division (one inverter per train) providing power at a nominal 120 Vac, single-phase, 60 Hz to the four independent vital ac distribution panels. The inverter limits the output voltage waveform THD to below maximum recommended limits (five percent) as recommended in IEEE Std. 519-1992. Each inverter includes a static bypass switch to transfer power from the inverter to the EDG backed bypass source. The static bypass switch automatically transfers to the bypass source on inverter failure, inverter overload, inverter output undervoltage or overvoltage, or manually. The automatic transfer switch is a make-before-break type with automatic synchronization between the inverter and regulating transformer upon inverter faults and overload condition. Transfer to the bypass source is only possible when the bypass source is available. A manual transfer switch transfers full load to the alternate power source, bypassing the inverter and auto transfer switch, for maintenance purposes. Two power sources are interlocked to prevent paralleling.

During its review, the staff found that the applicant did not address important considerations that affect the design life of batteries and chargers in dc and I&C systems, and how power quality is maintained. Therefore, in RAI 163-8178 Question 08.03.02-2, the staff requested the applicant to provide information on the design life of the batteries and chargers and the methods for maintaining power quality.

In its response to RAI 163-8178, Question 08.03.02-2 (ML16012A553), the applicant stated that the design life of the battery chargers is affected by the change in behavior of materials and components (e.g., resistors, capacitors, wires, connectors, semiconductors, tubes, switches, and electromechanical devices) through time under actual service, environmental, and maintenance conditions. Therefore, to guarantee the design life of the batteries and battery chargers, a QAP that applies to design, qualification, production, quality control, installation, maintenance, and periodic testing will be implemented. With regard to power quality in the 8-85

dc/UPS (I&C) system, the output ripple of the battery chargers is maintained within the battery manufacturers acceptable limits by adding output filters. Since the output ripple of the battery chargers is an important consideration that affects the design life of the batteries, therefore by adding filters, the ripple voltage at the dc input side of the inverter is reduced to prevent it from adversely affecting the inverter operation. The staff reviewed the additional information related to the design life of the batteries and chargers in dc and I&C systems, and how power quality is maintained, and determined that the APR1400 dc and I&C power supply system has the capacity and capability to provide power to all safety loads needed to ensure that fuel design limits and RCS pressure boundary design conditions are not exceeded and the core is cooled and containment integrity and other vital functions are maintained during all facility operating modes, including AOOs and DBAs, even in the event of a single failure. Since the applicant has a QAP to address the design, qualification, maintenance and testing of the batteries and battery chargers, the staff finds that the batteries and battery chargers have the capacity and capability to provide power to all safety loads.

Therefore, the staff determined that the dc power distribution system divisions conform to the guidance in RG 1.153 pertaining to the independence and separation of the dc power distribution system divisions, and accordingly comply with the requirements in GDC 17 in regard to those criteria and conforms to RG 1.153 for design, reliability, and testability and meets the single-failure criteria. The staff determined that the applicant adequately addressed the requirement for onsite dc systems per GDC 17 and guidance in RG 1.153, and determined that this is acceptable.

8.3.2.4.10 GDC 18, Inspection and testing of electric power systems GDC 18 requires that electric power systems important to safety, which include the onsite dc power system, be designed to permit appropriate periodic inspection and testing of important areas and features to assess the continuity of the systems and the condition of their components. These systems shall be designed with a capability to test periodically: (1) the operability and functional performance of the components of the systems, such as onsite dc power sources, inverters, battery chargers, switchboards, and buses; and (2) the operability of the systems as a whole and under conditions as close to design as practical.

All safety-related dc power system equipment and components are periodically inspected and tested in accordance with the TS as detailed in DCD Tier 2, Chapter 16. Also, the dc control center (dc switchboard) and 120 Vac panelboards voltage, battery charger output current, and battery charge or discharge rate are indicated in the MCR and the RSR. For example, a dc switchboard undervoltage alarm will indicate when the battery is being discharged, and a dc system ground alarm is provided in the MCR and RSR. DCD Tier 1, Table 2.6.3-2, DC Power System Equipment Alarms/Displays and Control Functions, verifies the design of electrical display parameters that will be monitored in the MCR and RSR. All safety-related I&C power equipment and components are periodically inspected and tested in accordance with the Technical Specification (TS), in DCD Tier 2, Chapter 16. DCD Tier 1, Table 2.6.4-2, Instrument and Control Power System Equipment Alarms/Displays and Control Functions, verifies the design of electrical display parameters that will be monitored in the MCR and RSR.

DCD Tier 2, Section 8.3.2.2.2, Conformance with NRC Regulatory Guides, states that the safety-related dc power system and I&C power system are designed to permit periodic inspection and testing of important areas and features to assess the continuity of the dc power system and I&C power system and the condition of their components. The staff determined that 8-86

the battery, battery charger, and inverter capacities can be periodically tested in accordance with technical specifications detailed in DCD Tier 2, Chapter 16 and complies with GDC 18 in this regard.

8.3.2.4.11 Conformance to RG 1.47 DCD Tier 2, Section 8.3.2.2.2 states conformance to RG 1.47, as it relates to the bypass and inoperable status of the onsite dc power system. The DCD shows that bypassed or deliberately induced inoperability of the Class 1E dc power system batteries, battery chargers, and inverters is automatically annunciated in the MCR to indicate the bypassed system or component in accordance with RG 1.47. The DCD also provides additional information used in the design of the bypass and inoperable status indicators for the engineered safety feature systems (see DCD Tier 2, Section 7.5.1.3, Bypassed and Inoperable Status Indication). This meets the requirement of BTP 8-5 in assessing plant conditions and safety system performance. As discussed above, the staff determined that the dc system equipment and components are monitored, and if the system or its components are bypassed or deliberately rendered inoperable, that condition is annunciated in the MCR in accordance with RG 1.47, which is acceptable.

8.3.2.4.12 Conformance to RG 1.118 and RG 1.129 Battery and battery charger capacities at APR1400 are periodically tested in accordance with TS detailed in DCD Tier 2, Chapter 16 in accordance with RG 1.118. RG 1.118 provides guidance on the capability for periodic surveillance testing and calibration of safety-related equipment to be provided while retaining the capability of the safety-related systems to accomplish their safety-related functions in accordance with IEEE Std. 338-1987, Standard Criteria for the Periodic Surveillance Testing of Nuclear Power Generating Station Safety Systems. There are two battery chargers installed, one operational and the other in standby mode. Battery charger maintenance and testing is performed during power operation through the use of the standby battery charger. Testing that could cause perturbations to the dc electrical distribution systems or challenge continued steady-state operation of safety-related systems is normally performed during plant shutdown. Testing performed during plant shutdown includes battery performance or modified performance discharge tests. Inverter maintenance that involves removing the inverter from service is also performed during plant shutdown. Additional specific testing of the safety related dc power system components during shutdown is detailed in DCD Tier 2, Chapter 16.

RG 1.129 is related to the maintenance, testing, and replacement of vented lead-acid storage batteries for nuclear power plants. DCD Tier 2, Section 8.3.2.2.2 states conformance to RG 1.129. Periodic dc system component testing, in accordance with RG 1.129, is performed based on the component manufacturer recommendations and IEEE Std. 450-2010, Recommended Practice for Maintenance, Testing, and Replacement of Vented Lead-Acid Batteries for Stationary Applications. The COL applicant is to develop the maintenance program to optimize the life and performance of the batteries (COL Items 8.3(13)).

In DCD Tier 2, Section 8.3.2.3.6, Monitoring and Testing, it is stated that the Class 1E dc power system is designed to be testable during normal operation as well as when the station is shut down. Batteries are tested and inspected in accordance with the manufacturers recommendations, IEEE Std. 450-2010, and IEEE Std. 484-2002, Recommended Practice for Installation Design and Installation of Vented Lead-Acid Batteries for Stationary Applications.

8-87

The COL applicant is to describe any special features of the design that would permit online replacement of an individual cell, group of cells, or entire battery as included in COL Item 8.3(15).

The staff reviewed the details as described in the above discussions related to testing and determined that the applicants onsite dc power system can be appropriately accessed for required periodic inspection and testing, enabling verification of important system parameters, performance characteristics, and features, as well as detection of degradation and/or impending failure under controlled conditions. The APR1400 safety-related onsite dc power system has been designed to permit periodic inspection and testing to assess the operability and functionality of the systems and the condition of their components. Therefore, the staff determined that the APR1400 onsite dc power system meets the guidance in RG 1.118, RG 1.129 and complies with the requirements of GDC 18.

8.3.2.4.13 GDC 50, Containment design basis DCD Tier 2 Section 8.3.2.2.1, Conformance with General Design Criteria, states compliance with GDC 50. GDC 50 requires, in part, that the design of the reactor containment structure, including access openings, penetrations (including electrical penetrations containing circuits of the dc power system in containment structures), must withstand a LOCA without loss of mechanical integrity. In order to satisfy this requirement, the penetration assemblies in containment structures must be capable to withstand all ranges of overload and SC currents up to the maximum fault current versus time conditions that could occur given single random failures of circuit protective devices. The compliance of containment electrical penetration assembly design, qualification, and protection has been reviewed and evaluated under Section 8.3.1 of this report, and is described in DCD Tier 2, Section 8.3.1.1.9, Containment Electrical Penetrations. The design provisions described in that section apply to the onsite dc power circuits. All APR1400 containment electrical penetration assemblies for onsite Class 1E ac and dc systems are designed, constructed, and qualified in accordance with IEEE Std. 317-1983, IEEE Standard for Electric Penetration Assemblies in Containment Structures for Nuclear Power Generating Stations, and IEEE Std. 741-2007, IEEE Standard Criteria for the Protection of Class 1E Power Systems and Equipment in Nuclear Power Generating Stations. Protective device coordination studies are performed in accordance with IEEE Std. 141-1993, IEEE Recommended Practice for Electric Power Distribution for Industrial Plants, and IEEE Std. 242-2001, IEEE Recommended Practice for Protection and Coordination of Industrial and Commercial Power Systems, to verify that breakers closest to a fault open before upstream breaker. This is described in DCD Tier 2, Section 8.3.1.1.3.11, Protective Relaying System, for Class 1E power system including electrical penetration in the reactor containment building.

The IEEE Std. 317-1983 is endorsed by RG 1.63, and the staff determined that the applicants commitment to follow these standards in the design of electric penetration assemblies provides assurance that a LOCA will not cause the electrical penetrations of a containment structure to exceed the design leakage rate, thus limiting the consequences of a LOCA as prescribed by GDC 50.

In order to determine compliance with GDC 50 with respect to the dc circuits, staff requested additional information. In RAI 102-8017, Question 08.03.01-9 (ML15205A366), and a follow-up RAI 421-8500, Question 08.03.01-23, the staff requested for additional clarification and information not specifically provided in the DCD, to determine if the EPA meets all requirements to satisfy GDC 50 for Class 1E circuits. These questions are applicable to dc and I&C power 8-88

system conductor protection and reliability. These questions and the applicants responses are discussed in DCD Tier 2, Section 8.3.1.4.6, GDC 50, Containment design basis of this report.

The staff has reviewed the applicants responses for EPA related questions on protection of EPA conductors and reliability, which includes both ac and dc onsite power system and accepted the information provided which meets the GDC 50 criteria. Therefore, the staff considers this issue to be resolved.

8.3.2.4.14 Compliance with 10 CFR 50.55a(h)

DCD Tier 2, Section 7.1.2.3, Conformance with 10 CFR 50.55a(h)(2), and Section 7.1.2.4, Conformance with 10 CFR 50.55a(h)(3), states compliance with 10 CFR 50.55a(h).

10 CFR 50.55a(h) requires compliance with the relevant positions for plant protection and safety systems on design, reliability, qualification, and testability of the power and I&C portions of the protection and safety systems outlined in IEEE Std. 603-1991. The safety and protection systems of the applicants onsite dc power system design are based on IEEE Std. 603, which will be confirmed by the electrical distribution system protection and coordination studies, and verified via ITAAC (DCD Tier 1, Table 2.6.3-3, DC Power System ITAAC). Accordingly, the staff determined that the APR1400 onsite dc power system design will meet the requirements of 10 CFR 50.55a(h). The aspects of IEEE Std. 603 that apply to the adequacy of I&C are evaluated in Chapter 7, Instrumentation and Controls of this report.

8.3.2.4.15 Compliance with 10 CFR 50.63 DCD Tier 2, Section 8.3.2.2.2 discusses that Class 1E onsite dc power systems are designed to meet the requirements of 10 CFR 50.63 and to have sufficient capacity and capability to be able to withstand and recover from an SBO event as per guidance provided in RG 1.155. As discussed in the section below, the applicant has met the requirements of 10 CFR 50.63 with respect to the onsite dc power system. In particular, 10 CFR 50.63 requires, in part, that the specified SBO duration be based on the redundancy and reliability of the emergency onsite dc power sources. The dc power systems have adequate capability and capacity to enable the plant to withstand and recover from an SBO event of specified duration. See Section 8.4 of this report for the staffs evaluation of this matter, with the exception of battery capacity and capability, which is discussed below.

8.3.2.4.16 Conformance to RG 1.155 DCD Tier 2, Section 8.3.2.2.2 states conformance to RG 1.155. RG 1.155 relates to the capability and the capacity of the applicants onsite dc power system for an SBO, including batteries associated with the operation of the AAC power source. Class 1E onsite dc power systems are designed to meet the requirements of 10 CFR 50.63 and to have sufficient capacity and capability to enable the APR1400 to withstand and recover from an SBO event. The AAC GTG is available to supply the electrical loads that are required to be operational within 10 minutes of the initiation of an SBO event in accordance with Position C3.2.5 of RG 1.155.

Restoration of ac power also restores power to the battery charger that supplies the auxiliary dc power for those loads and I&C loads. The Class 1E battery has sufficient capacity to provide uninterrupted dc power from the initiation of the SBO event to the restoration of the ac power for the battery charger. Conformance with RG 1.155 is evaluated in Section 8.4, Station Blackout of this report.

8-89

The DCD Tier 2 Section 8.3.2 states that IEEE Std. 485-2010, IEEE Recommended Practice for Sizing Lead-Acid Batteries for Stationary Applications will be used for sizing batteries.

IEEE Std. 485 calls for consideration of AC Power Lost loads (i.e., SBO loads) along with the lowest expected battery temperature under normal conditions. Since batteries provide the least power at their lowest operating temperature, they will be appropriately sized following this guidance. This is verified in DCD Tier 1, Section 2.6.3, DC Power System, Table 2.6.3-3, DC Power System ITAAC. These ITAAC will verify that the applicants onsite dc power system, as related to adequate sizing of the installed batteries. The ITAAC in addition to the 10 CFR 50.65, which addresses maintenance and testing of the batteries, will ensure the APR1400 standard design will be able to withstand or cope with, and recover from, an SBO by providing capability for maintaining core cooling and an appropriate level of containment integrity. Compliance with the 10 CFR 50.65 for the dc power system is discussed in Section 8.3.2.4.17 of this report.

The staff determined that the AAC GTG power supply configuration is such that it is available to supply the electrical loads that are required to be operational within 10 minutes of the initiation of an SBO event and recovers from an SBO event and meets RG 1.155. Since the capacity of onsite dc sources used for SBO response is adequate to address the SBO load profile and specified duration to meet the requirements of 10 CFR 50.63, the staff determined that the APR1400 onsite dc power system batteries conform to RG 1.155, and therefore considers this to be acceptable.

8.3.2.4.17 Compliance with 10 CFR 50.65(a)(4)

Under 10 CFR 50.65(a)(4), COL applicants assess and manage the increase in risk that may result from proposed maintenance activities for onsite dc power equipment before performing the maintenance activities. These activities include surveillances, post maintenance testing, and corrective and preventive maintenance to optimize the life and performance of the batteries.

The DCD Tier 2, Section 8.3.2.2.2 states the compliance with the maintenance rule according to RG 1.160, Monitoring the Effectiveness of Maintenance at Nuclear Power Plants. The Maintenance Rule is also addressed as a COL item in DCD Tier 2, Section 17.6, Maintenance Rule.

The staff determined that the applicant addressed adequately the issue because: (1) the Maintenance Rule program is the COL applicants responsibility, (2) the COL information item referenced in DCD Tier 2, COL Item 8.3(13) optimizes the life and performance of the batteries, and (3) COL Item 17.6(1) requires the COL applicant to provide a description of the Maintenance Rule program and a plan for implementing it to meet the requirements of 10 CFR 50.65.

8.3.2.4.18 Conformance to RG 1.206 RG 1.206 provides guidance regarding the information to be submitted in an application related to power system analytical studies for a nuclear power plant. The applicant has performed electrical power system calculations and distribution system studies for dc systems, summarized in DCD Tier 2, Section 8.3.2.3, Electrical Power System Calculations and Distribution System Studies for DC System. The electrical power system calculations and distribution system studies were performed in accordance with the guidance provided in IEEE Std. 946 and other referenced IEEE standards to analyze the dc distribution system for load flow and voltage regulation, short-circuit studies and equipment sizing studies. The following 8-90

are the dc electrical power system calculations and distribution system studies performed for the APR1400 design:

  • Load flow and Under/Overvoltage Protection
  • Short-Circuit Studies
  • Equipment Sizing Studies
  • Equipment Protection and Coordination Studies The final dc load flow analysis that supports the adequacy of the dc onsite power system will be provided in DCD Tier 1, Section 2.6.3, ITAAC Item 5. Accordingly, the staff determined that the applicant has adequately addressed the issue. The COL applicant, per COL Item 8.3(14), is to provide a short circuit (SC) analysis of the onsite dc power system with actual data. Also the COL applicant, per COL Item 8.3(9) is to provide protective device coordination.

As described in DCD Tier 2, Section 8.3.1.1.3.11, Protective Relaying System, protective device coordination studies will be performed in accordance with IEEE Std. 141-1993 and IEEE Std. 242-2001 to verify the protection feature coordination capability to limit the loss of equipment due to postulated fault conditions. The studies will be completed prior to placing the electrical equipment in service and will be verified by DCD Tier 1, Section 2.6.3, ITAAC Item 5.

Since performance of the ITAAC will ensure the studies are completed in accordance with acceptable methodology, and that COL applicant will provide protective device coordination of the onsite (ac/dc) power system as identified in COL Item 8.3(9), the staff determined that the applicant has adequately addressed the protective coordination study required per RG 1.206.

The battery charger sizing calculation was performed in accordance with IEEE Std. 946-2004, IEEE Recommended Practice for the Design of DC Auxiliary Power Systems for Generating Stations.

In accordance with RG 1.206, DCD Tier 2, Section 8.3.2.3 adequately addressed the dc system studies and analyses. The applicant provided a document summary during the audit and all calculations were posted in the applicants electronic portal. The staff reviewed the dc system SC calculation methodology and summary of results and determined that the Class 1E battery capacity can accommodate the available SC current at the dc buses where the battery is connected. This verifies that the capacity of the dc power system equipment is adequate to withstand the SC condition. During the audit on May 25, 2016, the staff observed that the dc system calculation is adequately detailed with background information, assumptions and methodologies based on the industry standard procedures and determined that it is acceptable.

(See Audit Report ML16300A205).

As discussed above, the staff determined that the preliminary studies are completed and will be verified by ITAAC described in DCD Tier 1, Section 2.6.3, DC Power System. Since performance of the ITAAC will ensure the studies are completed in accordance with acceptable methodology, the staff finds that the APR1400 design conforms to RG 1.206 with respect to the power system analytical studies.

8.3.2.5 Combined License Information Items In this list below, only COL Information Items related solely to the onsite dc power system are provided. All other COL Information Items which are common for both the onsite dc and the ac 8-91

power system and equipment, are listed in the COL information items table of Section 8.3.1 of this report.

Combined License Information Items Item No. Description DCD Section 8.3(13) The COL applicant is to develop the maintenance program to Tier 2, 8.3.2.2.2 optimize the life and performance of the batteries.

8.3(14) The COL applicant is to provide a short-circuit analysis of the Tier 2, 8.3.2.3.2 onsite dc power system with actual data.

8.3(15) The COL applicant is to describe any special features of the Tier 2, 8.3.2.3.6 design that would permit online replacement of an individual cell, group of cells, or entire battery.

8.3.2.6 Conclusion As set forth above, the staff has reviewed all of the relevant information that is applicable to the APR1400 onsite dc power system design and evaluated its compliance with GDC 2, GDC 4, GDC 5, GDC 17, GDC 18, and GDC 50, and conformance to RGs, standards, and BTPs committed to by the applicant. The staff also reviewed the COL information items in DCD Tier 2, Section 8.3.3. The staff concludes that the applicant has provided sufficient information in the DCD and identified necessary analyses to support the bases for their conclusions of the onsite dc power system design for the COL applicant. The staff concludes that the design of the APR1400 onsite dc power system meets the appropriate regulatory requirements listed in DCD Tier 2 Section 8.3.2.1, Non-Class 1E DC Power Systems, and Section 8.3.2.4 of this report, and shown in the staff technical evaluations in Section 8.3.2.4 and combined license information items in Section 8.3.2.5 of this report.

8.4 Station Blackout 8.4.1 Introduction Section 50.2 of 10 CFR, Definitions, defines a SBO as the complete loss of ac electric power to the essential and nonessential switchgear buses in the nuclear power plant. An SBO involves a LOOP concurrent with a turbine trip and failure of the onsite emergency ac (EAC) power system. The EDGs are considered to be the EAC. The SBO does not include the loss of available ac power to buses fed by station batteries through inverters or by AAC sources.

Because safety systems depend on ac power, 10 CFR 50.63 (SBO rule) requires each NPP to be capable of withstanding and recovering from an SBO of a specified duration. The staff reviewed and evaluated the application to determine its compliance with the requirements of 10 CFR 50.63 and conformance to the applicable guidance.

8.4.2 Summary of Application DCD Tier 1: The applicant provided the Tier 1 information related to the SBO in Section 2.6.6, Alternate AC Source. The applicant stated that an AAC source supplies power to safety-8-92

related loads to maintain the plant in a safe shutdown condition during an SBO. The AAC source also provides power to PNS buses during a LOOP condition. The AAC source can be connected to Class 1E trains and PNS trains. The AAC source is a GTG that is independent from the EDGs and the offsite power sources.

DCD Tier 2: The applicant provided a system description for the SBO in Section 8.4, summarized as follows:

The APR1400 design includes a 4.16 kV non-Class 1E AAC GTG to provide power to required shutdown loads to bring the plant to safe shutdown during an SBO. The non-Class 1E AAC GTG is designed to meet the requirements of 10 CFR 50.63, RG 1.155, and NUMARC 87-00, Revision 1, Guidelines and Technical Bases for NUMARC Initiatives Addressing Station Blackout at Light Water Reactors, Revision 1, issued August 1991 (ML12137A732). The SBO coping duration for the plant is 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br />. The non-Class 1E AAC GTG is not normally directly connected to either the preferred offsite power sources or the onsite Class 1E 4.16 kV switchgear buses. The AAC GTG is manually connected to the designated Class 1E 4.16 kV switchgears (Train A or Train B) by the operator within 10 minutes from the onset of the SBO event. To minimize the potential for common-cause failures with the onsite Class 1E EDGs, the applicant provided a diverse non-Class 1E power source i.e., a GTG and the non-Class 1E AAC GTG is provided with a diverse starting and cooling systems. The non-Class 1E AAC GTG, including the related auxiliary equipment, is installed in a separate building.

ITAAC: The ITAAC associated with DCD Tier 2, Section 8.4 are provided in DCD Tier 1, Section 2.6.6, Table 2.6.6-1, Alternate AC Source ITAAC.

TS: There are no TS for this area of review.

8.4.3 Regulatory Basis The relevant requirements of NRC regulations related to SBO, and the associated acceptance criteria, are given in Section 8.4 of SRP, as summarized below:

1. Section 50.63 of 10 CFR, Loss of all Alternating Current Power, as it relates to the capability to withstand for a specified duration and recover from an SBO as defined in 10 CFR 50.2.
2. Section 50.65 (a)(4) of 10 CFR, Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, as it relates to the assessment and management of the increase in risk that may result from proposed maintenance activities before performing the maintenance activities for the SBO equipment. These activities include, but are not limited to, surveillances, post-maintenance testing, and corrective and preventive maintenance.
3. Section 52.47(b)(1) of 10 CFR, Contents of Applications; Technical Information, which requires that a DC application contain the proposed ITAAC that are necessary and sufficient to provide reasonable assurance that, if the inspections, tests, and analyses are performed and the acceptance criteria met, a facility that incorporates the DC is built and will operate in conformity with the DC, the provisions of the Atomic Energy Act of 1954, as amended, and the NRC rules and regulations.

Acceptance criteria adequate to meet the above requirements include:

8-93

1. RG 1.155, Station Blackout, as it relates to compliance with 10 CFR 50.63. NUMARC 87-00, Revision 1, issued November 1987, Guidelines and Technical Bases for NUMARC Initiatives Addressing Station Blackout at Light Water Reactors, also provides guidance acceptable to the staff for meeting these requirements. Table 1 of RG 1.155 provides a cross-reference to NUMARC 87-00, Revision 0.
2. RG 1.9, Application and Testing of Safety-Related Diesel Generators in Nuclear Power Plants, and RG 1.155, as they relate to the reliability program implemented to ensure that the target reliability goals for onsite EDG power sources are adequately maintained.
3. SECY-90-016, Evolutionary Light Water Reactor (LWR) Certification Issues and Their Relationships To Current Regulatory Requirements, as it relates to the diversity and the capacity of the AAC power source 8.4.4 Technical Evaluation The staff reviewed DCD Tier 2 Section 8.4, to determine whether the design is capable of withstanding and recovering from an SBO of a specified duration as required by 10 CFR 50.63.

The staff used the guidelines provided in RG 1.155 and the SRP to evaluate the designs compliance with the requirements of 10 CFR 50.63. The staffs review included verifying whether the effectiveness of maintenance activities for equipment used to meet 10 CFR 50.63 is monitored as required by 10 CFR 50.65(a)(4). Compliance with 10 CFR 50.65(a)(4) in regards to maintenance activities related to SBO equipment is evaluated in Chapter 17, Quality Assurance and Reliability Assurance of this report.

8.4.4.1 Compliance with 10 CFR 50.63 10 CFR 50.63, requires that each NPP be capable of: (1) withstanding (coping with) and recovering from an SBO of a specified duration (known as coping duration), and (2) maintaining adequate core cooling and appropriate containment integrity for the SBO coping duration.

RG 1.155 and Section 8.4 of SRP provide guidance for complying with the requirements of 10 CFR 50.63. Aspects of the staffs review for compliance with 10 CFR 50.63 are discussed below.

8.4.4.1.1 SBO coping duration Per SRP Section 8.4, the SBO coping duration is defined as the time from the onset of an SBO to the time when either offsite or onsite (emergency) ac power is restored to at least one of the safe shutdown buses. 10 CFR 50.63 (a)(1) requires that the SBO coping duration be based on four factors: (1) the redundancy of the onsite EAC power sources; (2) the reliability of the onsite EAC power sources; (3) the expected frequency of LOOP; and (4) the probable time needed to restore offsite power. RG 1.155, Position C.3.1, Acceptable Station Blackout Duration Capability, provides a method for determining the SBO coping duration based on the above four factors, as specified in Table 2, Acceptable Station Blackout Duration Capability (Hours).

Per 10 CFR 50.63, SBO coping duration is based on the redundancy of the onsite EAC power sources and this is referred to in RG 1.155, Table 2, as the EAC power configuration group. Per 10 CFR 50.63, the SBO coping duration is based on the reliability of the onsite EAC power sources and this is referred to in RG 1.155, Table 2, as the EDG reliability. 10 CFR 50.63 also uses the expected frequency of LOOP and probable time needed to restore offsite power to determine the coping duration, and in RG 1.155, Table 2, these are addressed in the offsite power design characteristic group.

8-94

In DCD Tier 2, Section 8.4.1.2, the applicant determined the SBO coping duration of 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> in accordance with Table 2 of RG 1.155. For the EAC power configuration group, the applicant selected group C from RG 1.155, Table 3, Emergency AC Power Configuration Groups, because: (1) the APR1400 design includes four independent Class 1E EDGs (two EDGs per Division), and (2) one Class 1E EDG is required to operate the ac-powered decay heat removal systems (i.e. either Train A in Division I or Train B in Division II). However, the staff determined that based on Table 3, the EAC power configuration group would not be C since group C is based on one out of two EDGs for decay heat removal. DCD Tier 2, Section 8.4.1.2.a states that one EDG (Train A or Train B) is required to operate ac decay heat removal system during a LOOP since one EDG (Train A or Train B) has 100 percent capability for decay heat removal during a LOOP. In RAI 24-7928, Question 08.04-1 (ML15159A489), the staff requested the applicant to explain the selection of the EAC power configuration group C. In its response to RAI 24-7928, Question 08.04-1 (ML15188A391), the applicant clarified that only Train A or Train B EDGs supply 100 percent of the decay heat removal loads. The applicant further explained that since one out of the two EDGs (Train A and Train B) is required to remove decay heat to achieve and maintain safe shutdown during a LOOP, the APR1400 onsite EAC power configuration group remains C. The staff determined that since only two out of the four EDGs are capable of supplying all decay heat removal ac loads, and one out of the two EDGs is required for decay removal during a LOOP, the EAC power configuration group C conforms to Table 3 of RG 1.155. Therefore, the staff determined that the applicants response is acceptable. The staff considers RAI 24-7928, Question 08.04-1, to be closed.

For the EDG reliability, the applicant selected a target reliability of 0.95 for each Class 1E EDG.

RG 1.155, Position C.1.1, Emergency Diesel Generator Target Reliability Levels, states that the minimum EDG reliability should be targeted at 0.95 per demand for each EDG for plants in EAC Group C. The staff determined that since the EAC power configuration group for the design is C, the target reliability of 0.95 for each EDG is acceptable in accordance with Position C.1.1 of RG 1.155.

In addition, the applicant stated that the reliable operation of the EDGs is ensured by a reliability program that is in accordance with RG 1.155, Position C.1.2, Reliability Program. RG 1.155 Position C.1.2, Reliability program, states that an EDG reliability program would typically be composed of the following five elements or their equivalent: (1) individual EDG reliability target levels consistent with the plant category and coping duration selected from RG 1.155 Table 2, (2) surveillance testing and reliability monitoring programs designed to track EDG performance and to support maintenance activities, (3) a maintenance program that ensures that the target EDG reliability is being achieved and that provides a capacity for failure analysis and root-cause investigations, (4) an information and data collection system that services the elements of the reliability program and that monitors achieved EDG reliability levels against target values, and (5) identified responsibilities for the major program elements and a management oversight program for reviewing reliability levels being achieved and ensuring that the program is functioning properly. In this section of the report, the staff determined that the applicant satisfied RG 1.155 Position C.1.2 element (1) by selecting an individual EDG reliability target level of 0.95 consistent with the plant category and coping duration from RG 1.155 Table 2. In RAI 61-7984, Question 08.03.01-7 (ML15189A483), the staff requested the applicant to provide the relevant attributes of the EDG reliability program to verify how the applicant maintains EDG reliability. In its response to RAI 61-7984, Question 08.03.01-7 (ML15306A581), the applicant stated that the management items of the EDG reliability program includes: (1) Reliability monitoring, (2) Routine checks, (3) Performance of surveillance, (4) Equipment and material maintenance, (5) Investigation and analysis of events, (6) Implementation of a reliability 8-95

database system, and (7) Resolution and termination of problems. The staff determined that since the applicant included performance of surveillance and reliability monitoring in the EDG reliability program, this satisfies RG 1.155 Position C.1.2 element 2, which discusses surveillance testing and reliability monitoring programs. Since the applicant included equipment and material maintenance, routine checks, and investigation and analysis of events in the EDG reliability program, the staff determined that this conforms to RG 1.155, Position C.1.2 element 3, which states that a maintenance program that ensures that the target EDG reliability is being achieved and that provides a capacity for failure analysis and root-cause investigations. The applicant included implementation of a reliability database system in the EDG reliability program, and the staff determined that this conforms to RG 1.1.55, Position C.1.2 element 4 for an information and data collection system. Lastly, RG 1.155, Position C.1.2 element 5 recommends a management oversight program for reviewing reliability levels being achieved and ensuring the reliability program is functioning properly. Since the applicant included items for the resolution and termination of problems in the EDG reliability program, the staff determined that this conforms to RG 1.155, Position C.1.2 element 5, which recommends a management oversight program. Therefore, the staff determined that the applicants EDG reliability program includes all elements recommended by RG 1.155, Position C.1.2.

Additionally, the applicant added new COL Item 8.3(3) to DCD Tier 2, Section 8.3.1.1.3, Class 1E Emergency Diesel Generators, which stated that the COL applicant is to establish procedures to monitor and maintain EDG reliability during plant operations to verify the selected reliability target level is being achieved as intended in RG 1.155. Per COL Item 8.3(3), the COL applicant is to establish the EDG reliability program that includes RG 1.155, Position C.1.2 elements (1) - (5). COL Item 8.3(3) is addressed in Section 8.3 of this report. The staff determined that since the applicant provided a COL information item to address the design-specific reliability program for the EDG, the applicant has adequately addressed conformance to RG 1.155, Position C.1.2. In conclusion, the staff determined that the design conforms to RG 1.155, Positions C.1.1 and C.1.2.

For the offsite power design characteristic group, the applicant selected group P3 for conservatism in accordance with RG 1.155, Table 4, Offsite Power Design Characteristic Groups. In DCD Tier 2, Section 8.4.1.2, the applicant stated that the probable time needed to restore offsite power is incorporated into the P3 group. The applicant further stated that the P3 group is selected because the offsite power system is site-specific and not part of the design. DCD Tier 2, Section 8.2.1 states that the transmission system and plant switchyard are site-specific and as such, the offsite power recovery capability is based on site-specific information. The staff determined that since the site has not been selected, the site-specific data for the expected frequency of LOOP due to severe weather is unavailable. The staff also determined that since the offsite power system (i.e., transmission system and plant switchyard) is site-specific, the offsite power recovery capability is based on site-specific information.

Therefore, the staff determined that, the most conservative group P3 for the offsite power design characteristic is selected for the APR1400 design, and as such, the group P3 is acceptable.

The staff noted that since the factors associated with the transmission network and plant switchyard are subject to change with the site-specific design, the COL applicant must provide a site-specific evaluation for the SBO coping duration according to the method specified in RG 1.155. In its response to RAI 61-7984, Question 08.03.01-7 (ML15306A581), the applicant added new COL Item 8.4(1) such that the COL applicant will validate the SBO coping duration in accordance with RG 1.155. The staff determined that the applicant has adequately addressed the issue since the COL applicant will address the SBO coping duration with site-8-96

specific parameters, per COL Item 8.4(1). The applicant revised DCD Tier 2, Sections 8.4.1.2 and 8.4.3 to add COL Item 8.4(1). The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and considers RAI 61-7984, Question 08.03.01-7 regarding verification of the SBO duration resolved and closed.

RG 1.155 Position C.3.1, Minimum Acceptable Station Blackout Duration Capability, states that a method for determining an acceptable minimum SBO duration capability is given in Table 2, Acceptable Station Blackout Duration Capability (Hours), of RG 1.155. In DCD Tier 2, Section 8.4.1.2, the applicant determined the SBO coping duration of 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> in accordance with Table 2 of RG 1.155, the selection of the EAC power configuration (i.e., group C), EDG target reliability (i.e., 0.95), and offsite power design characteristic group (i.e., P3), corresponds to a 16 hour1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> coping duration, per Table 2 of RG 1.155. The staff determined that the 16-hour SBO coping duration that the applicant selected is consistent with Position C.3.1, and Table 2 of RG 1.155, considering the selected factors. Therefore, the staff determined that the design complies with 10 CFR 50.63 (a)(1) for the SBO coping duration.

8.4.4.1.2 AAC Power Source 10 CFR 50.2, Definitions, defines an AAC power source as an ac power source that is available to and located at or nearby a NPP, and that: (1) is connectable to but not normally connected to the offsite power or onsite EAC power systems, (2) has minimum potential for common mode failure with offsite power or the onsite EAC power sources, (3) is available in a timely manner after the onset of SBO, and (4) has sufficient capacity, capability, and reliability for operation of all systems required for coping with SBO and for the time required to bring and maintain the plant in a safe shutdown. Criteria 1 and 2 of 10 CFR 50.2 specify the requirements for independence of the AAC power source from the offsite power and onsite EAC power sources. 10 CFR 50.2, Criterion 2 on minimizing common-mode failures pertains to the diversity of the AAC power from the onsite EAC power sources. Guidance for complying with the requirements of an AAC power source is provided in RG 1.155, Position C.3.2.5 for independence and diversity, Position C.3.3, Modifications to Cope with SBO, and Appendix B, Guidance Regarding System and Station Equipment Specifications. In addition, SRP Section 8.4.III.3, AAC Power Sources, states that one acceptable means of complying with the requirements in 10 CFR 50.63 involves the provision of an AAC source of sufficient capacity, capability, and reliability (for operation of all systems necessary for coping with SBO and for the time necessary to bring the plant to, and maintain it in, safe-shutdown condition (non-DBA)) that will be available on a sufficiently timely basis.

In DCD Tier 2, Section 8.4.1,System Description, the applicant stated that a 4.16 kV non-Class 1E AAC GTG is used to mitigate an SBO. In the sections below, the staff reviewed compliance of the design with the requirements of 10 CFR 50.2 with respect to the AAC power source using the guidance provided in RG 1.155 and SRP 8.4.

8.4.4.1.2.1 Diversity RG 1.155, Position C.3.3.5, Criterion 2, in part, provides guidance for the AAC power source selection to satisfy a requirement to minimize the potential for common cause failure with the preferred source or the EAC power sources. This requires that the AAC power source is diverse from the EAC power source.

8-97

In DCD Tier 2, Section 8.4.1.3, the applicant stated that the AAC power source is a gas turbine engine and minimizes the potential for common-cause failures with the Class 1E EDGs. In DCD Tier 2, Section 9.5, Other Auxiliary Systems, the applicant identified the EDGs as having diesel engines. Since the AAC GTG and the EDGs have different engines, the staff determined that the AAC is diverse from the EDGs, and as such, the potential for common cause failure between the two sources is minimized. Furthermore, the applicant also stated in DCD Tier 2 Section 8.4.1.3 that the AAC GTG is provided with diverse starting and cooling systems.

Therefore, the staff determined that the design conforms to RG 1.155, Position C.3.3.5, Criterion 2 in regards to the diversity of the AAC power source.

8.4.4.1.2.2 Independence RG 1.155, Position C.3.3.5, Criteria 1 and 2, and Appendix B, and SRP, Section 8.4.III.3, AAC Power Sources, Criterion B provide guidance for the independence of the AAC power source.

RG 1.155, Position C.3.3.5, Criterion 1 states that AAC should not normally be directly connected to the units onsite EAC system. RG 1.155, Criteria 2 discusses minimizing common cause failure with the units EAC sources. RG 1.155, Appendix B states that independence from existing safety-related systems is required if AAC is connected to Class 1E buses and separation should be provided by two circuit breakers in series. SRP, Section 8.4.III.3 Criterion B, in part, addresses electrical isolation and physical separation so that failure of the AAC power components should not adversely affect the Class 1E ac power systems.

In DCD Tier 2, Section 8.4.1.3, the applicant stated that the non-Class 1E AAC GTG is not normally directly connected to the preferred offsite power sources or the onsite Class 1E 4.16 kV switchgear buses. The AAC power source is manually connected to the designated Class 1E 4.16 kV switchgears (Train A or train B) by the operator during an SBO event. DCD Tier 2, Figure 8.1-1, Electric Power Systems Single-Line Diagram (Division II), shows that the AAC GTG is connected to the offsite power sources through the PNS switchgears and to the onsite Class 1E switchgears through normally open circuit breakers. The staff determined that since the AAC GTG is not normally connected to the offsite or onsite emergency power systems, the APR1400 design conforms to RG 1.155, Position C.3.3.5, Criterion 1.

In DCD Tier 2, Section 8.4.1.3, the applicant further stated that the isolation between the Class 1E systems and the non-Class 1E systems is provided by two circuit breakers in series in accordance with RG 1.155, Appendix B requirements. Specifically, in its response to RAI 165-8192, Question 08.04-7(a) (ML15322A404), the applicant stated that the two circuit breakers consist of a non-Class 1E circuit breaker at the AAC switchgear and a Class 1E circuit breaker at the Class 1E switchgear. RG 1.155 Appendix B recommends that the separation of the AAC source from the safety-related systems be provided by two circuit breakers in series (i.e. one Class 1E circuit breaker at the Class 1E bus and one non-Class 1E at the non-Class 1E bus).

The staff determined that since the non-Class 1E AAC power source is separated from the Class 1E systems by two circuit breakers (i.e. one non-Class 1E circuit breaker at the non-Class 1E AAC switchgear and a Class 1E circuit breaker at the Class 1E switchgear), the electrical isolation of the AAC power source from the safety-related systems conforms to Appendix B of RG 1.155.

In DCD Tier 2, Section 8.4.1.3, the applicant stated that the AAC GTG and its auxiliary equipment is installed in a separate AAC GTG building. The applicant further stated that no single-point vulnerability exists in which a weather-related event or single active failure disables any portion of the onsite EAC sources or the offsite power sources and simultaneously fails the 8-98

AAC source. In DCD Tier 2, Section 8.3.1.1.4, the applicant stated that the Class 1E EDGs and associated equipment are located in separate rooms of the auxiliary building and EDG building. The staff determined that the physical separation between the AAC power source and the Class 1E EDGs (i.e. onsite EAC power source) is achieved since the AAC GTG is located in a building physically separated from the EAC (EDG) sources.

The separation criteria for cables and raceways are described in DCD Tier 2, Section 8.3.1.1.10, and the staff evaluation is detailed in Section 8.3.1 of this report. For physical separation of the AAC power source, the staff requested additional information in RAI 165-8192, Question 08.04-7(a). In its response to RAI 165-8192, Question 08.04-7(a) (ML15322A404),

the applicant stated that cables connecting the AAC switchgear 3N and each Class 1E switchgear 1A and 1B are separated from cables connecting the Class 1E switchgears to the offsite power system as practicable. The applicant stated that impact on the connections of the AAC power source is minimized for events that affect the offsite power system. The staff noted that the applicant did not provide the safety classification and separation for the connected cables for the AAC power source. In RAI 412-8525, Question 08.04-14(b) (ML16053A055), the staff requested the applicant to discuss conformance to RG 1.75, Criteria for Independence of Electrical Safety Systems, in regards to the separation of cables associated with the AAC power source. In its response to RAI 412-8525, Question 08.04.-14(b) (ML16119A489), the applicant provided the safety classification and separation of these cables. The applicant confirmed that the separation between the non-safety related cables and the safety-related cables for the AAC power source complies with RG 1.75 and IEEE Std. 384-1992, IEEE Standard Criteria for Independence of Class 1E Equipment and Circuits. The staff determined that the response is acceptable since cable separation between non-Class 1E and Class 1E cables is in accordance with RG 1.75, and this issue is resolved. In its response to RAI 412-8525, Question 08.04-14(c) (ML16119A487), the applicant has revised the DCD Tier 2, Section 8.4.1.3 to include the above physical separation of the AAC power source. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and considers RAI 412-8525, Question 08.04-14(c) pertaining to the physical separation of the AAC power source resolved and closed.

To verify that AAC will not adversely affect the onsite or offsite power systems or their specified functions, in RAI 165-8192, Question 08.04-7(a) (ML15295A490), the staff requested the applicant to discuss conformance to the independence criteria set forth in SRP, Section 8.4.III.3, Criterion B. In its response to RAI 165-8192, Question 08.04-7(a) (ML15322A404), the applicant provided additional information concerning the electrical isolation, control and protection schemes, and physical separation (as discussed above in this section of the report) for the AAC power source. Regarding the electrical isolation of the AAC power source, the applicant stated that the power and control circuits of the AAC switchgear 3N are isolated from the Class 1E switchgears 1A and 1B by Class 1E isolation devices, which conform to RG 1.75 and IEEE Std. 384-1992. RG 1.75, which endorses IEEE Std. 384-1992, requires that the isolation devices be properly coordinated and periodically tested to ensure overall protection and coordination. In RAI 203-8214, Question 08.03.01-19 (ML15295A503), the staff requested the applicant to discuss the periodic testing for the Class 1E isolation devices to verify conformance with RG 1.75. In its response (ML16026A490), to RAI 203-8214, Question 08.03.01-19, the applicant stated that during refueling outage, periodic testing of the electrical isolation will be performed so that the overall coordination scheme is demonstrated to remain within limits specified in the design criteria, in accordance with RG 1.75. The staff determined that the Class 1E isolation devices will be periodically tested in accordance with RG 1.75. The staff also determined that the electrical isolation of the power and control circuit of the AAC 8-99

power source ensures that safety-related onsite power systems are not adversely affected by the AAC source. In its response to RAI 412-8525, Question 08.04-14(c) (ML16119A487), the applicant revised the DCD Tier 2, Section 8.4.1.3 to include additional information regarding the independence, including physical separation and electrical isolation of the AAC power source.

The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and considers RAI 412-8525, Question 08.04-14(c) pertaining to the independence, separation and isolation of the AAC power source resolved and closed.

Regarding the control and protection schemes for the AAC power source, in RAI 165-8192, Question 08.04-7(a) (ML15295A490), the staff requested information for the control and protection schemes for the AAC source conforming to SRP Section 8.4.III.3. In its response to RAI 165-8192, Question 08.04-7(a) (ML15322A404), the applicant stated that: (1) interlock and permissive schemes are provided for circuit breakers connecting the AAC GTG to the Class 1E switchgears to prevent unintended connections between the AAC GTG and Class 1E switchgears, and (2) interlock and permissive schemes are provided for the incoming circuit breakers from the offsite power sources, the Class 1E EDGs, and the AAC power source to prevent parallel operation of the these power sources being connected to the Class 1E switchgears. The applicant further stated that the control schemes of the AAC power system do not interface with the load shedding and sequencing schemes of the Class 1E EDGs. The staff determined that the interlock and permissive schemes for the AAC power source ensure that the AAC power source does not inadvertently impact the functioning of the offsite and/or safety-related onsite power systems since the AAC is manually connected and protective schemes are provided for controlled operation of the AAC. The staff determined that the AAC power will not impact the load shedding and sequencing functions associated with the EDGs since there is no interface between the respective control schemes, and therefore, this issue is resolved. In its response to RAI 412-8525, Question 08.04-14(c) (ML16119A487), the applicant revised the DCD Tier 2, Section 8.4.1.3 to include additional information for control protection schemes of the AAC power source. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and considers RAI 412-8525, Question 08.04-14(c) pertaining to the protection schemes of the AAC power source resolved and closed.

In conclusion, the staff determined that the electrical isolation and physical separation of the AAC source from the onsite and offsite power systems, the electrical ties between these systems, and the provisions for the AAC source minimizes the potential for the loss of any system (i.e., preferred or onsite) given the loss of one of the other systems. Therefore, the staff determined that the independence of the AAC source conforms to the guidelines in Position C.3.3.5, Criteria 1 and 2, and Appendix B, and SRP, Section 8.4.III.3 Criterion B.

8.4.4.1.2.3 Availability RG 1.155, Position C.3.3.5, Criterion 3 and SRP, Section 8.4.III.3 provide guidance for the availability of the AAC source.

RG 1.155, Position C.3.3.5, Criterion 3 and SRP Section 8.4.III.3, recommend that the AAC power source be available in a timely manner after the onset of the SBO as demonstrated by test, and have provisions to be manually connected to one or all of the redundant safety buses to maintain safe shutdown. In DCD Tier 2, Section 8.4.1.3, the applicant stated that the AAC GTG, upon receiving a starting signal, attains rated voltage and frequency within two minutes.

The AAC GTG is then manually connected to the designated Class 1E 4.16 kV switchgear (Train A or Train B) by the operator within 10 minutes from the onset of the SBO event. The 8-100

SBO loads required for plant shutdown are manually connected by the operator in MCR and RSR. In DCD Tier 2, Section 8.4.1.1, the applicant stated that the AAC GTG will be manually connected to required shutdown equipment within 10 minutes. In RAI 24-7928, Question 08.04-2 (ML15159A489), the staff asked for clarification to understand the term shutdown equipment. In its response to RAI 24-7928, Question 08.04-25 (ML15188A391), the applicant clarified that the shutdown equipment was intended to mean shutdown bus, and revised DCD Tier 2, Section 8.4.1.1 to document the editorial change. The staff confirmed that DCD Revision 1 contains the change as committed to in the RAI response, and considers RAI 24-7928, Question 08.04-2, resolved and closed.

The connection of the GTG to the Class 1E bus is manual, and DCD Tier 1, Table 2.6.6-1, Alternate AC Source ITAAC, ITAAC Item 4, demonstrates by test that the AAC is started and connected manually to the Class 1E train bus within 10 minutes of the onset of an SBO.

Furthermore, in its response to RAI 165-8192, Question 08.04-7(b) (ML15322A404), the applicant stated that operator actions necessary for SBO coping including placing the AAC power source in service will be identified in the emergency operating procedures (EOPs) and associated technical guidelines. The COL applicant is required to develop the EOPs per COL Item 13.5(5). The staff determined that the AAC is available according to RG 1.155, Position C.3.3.5, Criterion 3 and SRP, Section 8.4.III.3.

8.4.4.1.2.4 Capacity, Operability, and Reliability RG 1.155, Position C.3.3.5, Criteria 4 and 5 provide guidance for the capacity, operability, and reliability of the AAC power source. SECY-90-016 also provides guidance for the capacity of the AAC power source.

RG 1.155, Position 3.3.5, Criterion 4 recommends that the AAC power system has sufficient capacity to operate the systems necessary for coping with an SBO for the time required to bring and maintain the plant in safe shutdown. In DCD Tier 2, Section 8.4.1.1, the applicant stated that the AAC GTG has sufficient capacity, capability, and reliability to operate the system necessary for coping with the SBO for the time required to bring and maintain the plant in a safe shutdown condition. The applicant provided AAC ITAAC Item 2 in DCD Tier 1, Table 2.6.6-1, Alternate AC Source ITAAC, to verify that the AAC source is sized with capacity to accommodate SBO or LOOP conditions. The total SBO loads and LOOP loads on AAC in kilowatts (KW) are specified in DCD Tier 2, Table 8.3.1-4, AAC GTG Loads (SBO), and Table 8.3.1-5, AAC GTG Loads (LOOP), as 8688 KW and 6074 KW, respectively. DCD Tier 2, Table 8.3.1-6, Electrical Equipment Ratings and Component Data, states the rated output of the AAC as 9700 KW at 4.16 kV. In RAI 165-8192, Question 08.04-8 (ML15295A490), the staff requested the applicant to provide kilovolt amperes (KVA) values for the AAC GTG and the total SBO loads. In its response to RAI 165-8192, Question 08.04-8 (ML15322A404), the applicant revised DCD Tier 2, Table 8.3.1-4 with the total AAC GTG loads under SBO as 8694 KW. The applicant further stated that the capacities of the AAC GTG and the SBO total loads are 12,125 KVA and 10,228 KVA, respectively. The staff determined that since the capacity of the AAC GTG bounds the SBO loads and LOOP loads required to bring and maintain the plant in a safe shutdown condition, the AAC GTG has capacity to supply power to the SBO and LOOP loads for the time required to bring and maintain the plant in a safe shutdown. In addition, the staff performed an audit to review the methodology for sizing the AAC generator. Based on the audit, the staff verified that the continuous loading used for sizing the AAC generator was in accordance with RG 1.9 (see audit report ML16300A205). Therefore, the staff determined that the design conforms to RG 1.155, Position C.3.3.5, Criterion 4 since the AAC has adequate 8-101

capacity, and therefore, this issue is resolved. In its response to RAI 412-8525, Question 08.04-16 (ML16085A361), the applicant revised the DCD Tier 2, Section 8.4.1.4 to include the KVA of the AAC GTG. The staff confirmed that DCD Revision 1 contains the change as committed to in the RAI response, and considers RAI 412-8525, Question 08.04-16 resolved and closed.

SECY-90-016 recommends that the AAC power source, which is of diverse design in accordance with RG 1.155 (see details in Section 8.4.4.1.2.1 of this report), be capable of powering at least one complete set of normal safe shutdown loads. As discussed above, the staff determined that the AAC GTG has capacity to supply power to the SBO and LOOP loads for the time required to bring and maintain the plant in a safe shutdown. Therefore, the staff finds that the design conforms to the SECY-90-016 with respect to the capacity of the AAC power source since the AAC GTG has adequate capacity to power the SBO and LOOP loads required for safe shutdown.

RG 1.155, Position C.3.3.5, Criterion 5 provides the guidance for complying with the requirements of 10 CFR 50.2, Definitions, concerning the reliability and operability of the AAC power source. Specifically, Criterion 5 recommends that: (1) the reliability of the AAC power system meet or exceed 95 percent reliability as determined in accordance with EPRI Technical Report NSAC-108, Reliability of EDGs at U.S. Nuclear Power Plants, dated September 1986, or equivalent methodology, and (2) the AAC power system be inspected, maintained, and tested periodically to demonstrate operability and reliability. In DCD Tier 2, Section 8.4.1.3, the applicant stated that the reliability of the AAC GTG system meets or exceeds 95 percent as determined in accordance with NSAC-108. The staff determined that the reliability criteria is satisfied per NSAC-108. In its response to RAI 165-8192, Question 08.04-6(b) (ML15322A404),

the applicant revised DCD Tier 2, Section 8.4.1.6, Periodic Testing and Inspection, to state that the AAC GTG is periodically tested and inspected to demonstrate operability and reliability.

DCD Tier 2 Section 8.4.1.6 further states: (1) the AAC power source is started and brought to operating conditions that are consistent with its function as an AAC power source at least every three months, and (2) the AAC GTG is started once every refueling outage to verify its availability within 10 minutes and to perform its rated load capacity test. Since the AAC power source is tested periodically and inspected, the staff determined that this demonstrates operability of the AAC. Additionally, in the above-mentioned RAI response, the applicant stated that periodic maintenance of the AAC GTG and its support systems will be planned and implemented under the framework of the Maintenance Rule. In Section 8.4.4.2, Compliance with 10 CFR 50.65 (a)(4) in regards to the SBO - Requirements for monitoring the effectiveness of maintenance at nuclear power plants, of this report, the staff determined that the applicant has adequately addressed compliance with the Maintenance Rule since the COL applicant will develop and implement the Maintenance Rule program. Therefore, the staff determined that the design conforms to RG 1.155, Position C.3.3.5, with respect to the operability and reliability of the AAC power source.

8.4.4.1.2.5 SBO Coping Capability Section 50.63 of 10 CFR, requires, in part, that each NPP be capable of coping with an SBO of a specified duration and maintaining adequate core cooling and appropriate containment integrity for the SBO coping duration. Pursuant to 10 CFR 50.63(c)(2), an AAC will constitute acceptable capability to withstand SBO provided an analysis is performed which demonstrates that the plant has this capability from onset of the SBO until the AAC and required shutdown equipment are started and lined up to operate. Furthermore, if the AAC power source meets the applicable requirements of 10 CFR 50.63 and can be demonstrated by test to be available 8-102

to power the shutdown buses within 10 minutes of the onset of SBO, no coping analysis is required. Per SRP Section 8.4, there are two options available to cope with an SBO, an ac-independent approach and an AAC approach. The applicant selected an AAC approach.

Guidance for meeting the requirements for an SBO coping capability using an AAC power source is provided in RG 1.155, Positions C.3.2.5 and C.3.3, and SRP Section 8.4.III.3 of the SRP.

RG 1.155, Position C.3.2.5 recommends that if the AAC source meets the recommendations of Position C.3.3.5 and can be demonstrated by test to be available to power the shutdown buses within 10 minutes of the onset of SBO, no coping analysis is required. In Section 8.4.4.1.2.1, Diversity, through Section 8.4.4.1.2.4, Capability, Operability, and Reliability, of this report, the staff determined that the AAC GTG meets the recommendations of RG 1.155, Position C.3.3.5 with respect to diversity, independence, availability, capacity, operability, and reliability of the AAC power source. In addition, tests will be performed per DCD Tier 1, Table 2.6.6-1, Alternate AC Source ITAAC, ITAAC Item 4 to demonstrate that the AAC GTG is capable of supplying power to the shutdown buses within 10 minutes of the onset of the SBO. In accordance with RG 1.155, Position C.3.2.5, the staff determined that no coping analysis is required to demonstrate SBO coping capability since the staff previously determined that the AAC meets the recommendations of Position C.3.3.5 of RG 1.155, and can be demonstrated by test to be available to power the shutdown buses within 10 minutes of the onset of the SBO.

Therefore, the staff determined that the AAC power source provides SBO coping capability, such that the AAC is capable of supplying power to the loads necessary for coping with an SBO for the time required to bring and maintain the plant in a safe shutdown in accordance with RG 1.155, Positions C.3.3.5 and C.3.2.5 as required by 10 CFR 50.63(c)(2).

RG 1.155, Position C.3.3, Modifications to cope with an SBO, provides guidance on certain modifications that may be needed to cope with an SBO. In DCD Tier 2, Section 8.4.2.2, Conformance with NRC Regulatory Guides, the applicant stated that the design conforms to RG 1.155, Position C.3.3, but only discussed conformance to Position C.3.3.5 with regards to the AAC power source. Thus, in RAI 165-8192, Question 08.04-6(b) (ML15295A490) the staff requested the applicant to discuss conformance to RG 1.155, Position C.3.3 (except C.3.3.5).

The paragraphs below discuss the staffs evaluation of the applicants response to RG 1.155, Positions C.3.3.1, C.3.3.2, C.3.3.3, C.3.3.4, C.3.3.6, and C.3.3.7.

RG 1.155, Position C.3.3.1 discusses extending battery capacity, if required. In its response to RAI 165-8192, Question 08.04-6(b) (ML15322A404), the applicant stated that no additional dc equipment is required because in the event of an SBO, the AAC GTG will energize the shutdown bus within 10 minutes of the SBO, and the shutdown bus will provide power for the dc loads necessary for the SBO coping duration via the battery charger and distribution bus. The staff determined that since the AAC power source will be available within 10 minutes of the onset of the SBO to power the shutdown bus associated with the dc equipment, as discussed in Section 8.4.4.1.2.3, Availability, of this report, no additional battery modifications are needed.

The staff determined that the applicant has adequately addressed the issue and conforms to RG 1.155, Position C.3.3.1.

RG 1.155, Position C.3.3.2 discusses the capacity of the condensate storage tank when it is not sufficient to remove decay heat. In its response to RAI 165-8192, Question 08.04-6(b)

(ML15322A404), the applicant stated that no additional make-up water source is required because each auxiliary feedwater storage tank provides the required water volume to provide sufficient flow to the steam generator(s) for decay heat removal and has 100 percent capacity 8-103

water volume to achieve a safe cold shutdown as stated in DCD Tier 2, Section 10.4.9 Auxiliary Feedwater System. The staff determined that no additional make-up water source is required for SBO mitigation since the auxiliary feedwater system provides the necessary water for decay heat removal. The staff determined that the applicant has adequately addressed conformance to RG 1.155, Position C.3.3.2.

RG 1.155, Position C.3.3.3 discusses the compressed air capacity when it is not sufficient to remove decay heat and maintain containment integrity. In its response to RAI 165-8192, Question 08.04-6(b) (ML15322A404), the applicant stated no alternative sources of compressed air are necessary to support an SBO condition. In DCD Tier 2, Section 9.3.1., Compressed Air and Gas Systems, the applicant stated that failure of the instrument air system does not affect a safe shutdown function during an SBO. The staff determined that since safe shutdown during an SBO is not impacted by the loss of compressed air, no alternative source of compressed air is required. Therefore, the staff determined that there is sufficient compressed air capacity to remove decay heat and maintain containment integrity and no modifications are needed to cope with an SBO. The staff determined that the applicant has adequately addressed the issue and conforms to RG 1.155, Position C.3.3.3.

RG 1.155, Position C.3.3.4, Item 1 states that if a system is required for primary coolant charging and makeup, reactor coolant pump seal cooling or injection, decay heat removal, or maintaining appropriate containment integrity specifically to meet the SBO duration: (1) the system should be capable of being actuated and controlled from the control room, and (2) the system must operate within 10 minutes of a loss of all ac power and it should be capable of being actuated from the control room. In its response to RAI 165-8192, Question 08.04-6(b)

(ML15322A404) and in its response to follow-up RAI 412-8525, Question 08.04-13(b) and RAI 412-8525, Question 08.04-15(b) (ML16123A384), the applicant stated that the MCR and RSR contain all of the control and/or monitoring provisions for the operator to manually actuate the components of the systems necessary to cope with an SBO condition. The staff determined that since systems required to cope with the SBO are actuated and controlled from both the MCR and RSR, the design conforms to RG 1.155, Position C.3.3.4.

RG 1.155, Position C.3.3.6 discusses that if a system or component is added specifically to meet the recommendations on SBO duration: (1) system walk downs and initial tests of systems or components added to meet SBO be performed to verify that the modifications were performed properly, and (2) failures of added components that may be vulnerable to internal or external hazards within the design basis (e.g., seismic events) not affect the operation of systems required for the DBA. In its response to RAI 165-8192, Question 08.04-6(b)

(ML15322A404), the applicant stated that pre-operational tests will be performed to demonstrate that the AAC GTG will perform its intended function, per ITAAC Items 2 and 4 listed in DCD Tier 1, Table 2.6.6-1, Alternate AC Source ITAAC. The applicant further stated that: (1) failure of the AAC power source or associated components due to operational events (internal or external hazards) will not affect the operation of safety related systems required for the DBAs and (2) the effects caused by failure of the AAC power source due to operational events are limited since the AAC power source is physically and electrically isolated from safety-related equipment. The staff determined that since initial tests will be performed for the AAC power source prior to operation, the AAC performance will be verified. In addition, in Section 8.4.4.1.2.2 of this report, the staff determined that the AAC is physically separated and electrically isolated from the safety-related systems, and failure of the AAC source should not impact the functioning of the safety-related systems. Therefore, the staff determined that the design conforms to RG 1.155, Position C.3.3.6.

8-104

RG 1.155, Position C.3.3.7 states that systems or components added to mitigate SBO be inspected, maintained, and tested periodically to demonstrate equipment operability and reliability. In its response to RAI 165-8192, Question 08.04-6(b) (ML15322A404), the applicant stated, periodic testing and inspection will be performed to verify the operability and reliability goals of the AAC GTG in the plant reliability assurance program. In addition, the applicant stated that periodic maintenance of the AAC GTG and its support systems will be planned and implemented under the Maintenance Rule program. In Section 8.4.4.1.2.4, Capacity, Operability, and Reliability, of this report, the staff determined that the AAC GTG is periodically tested and inspected to demonstrate operability and reliability in accordance with RG 1.155, Position C.3.3.5 Criterion 5. In addition, in Section 8.4.4.2, Compliance with 10 CFR 50.65 (a)(4) in regards to the SBO - Requirements for monitoring the effectiveness of maintenance at nuclear power plants, of this report, the staff determined that the COL applicant will monitor the effectiveness of maintenance activities related to the AAC power system in accordance with 10 CFR 50.65(a)(4), per COL Item 17.6(1). Therefore, the staff determined that the design conforms to RG 1.155 Position C.3.3.7.

In summary, the staff determined that the applicant has adequately addressed conformance to RG 1.155, Positions C.3.3.1, C.3.3.2, and C.3.3.3 since no additional dc equipment, make-up water source, and sources of compressed air are required. The staff also determined that the design conforms to RG 1.155, Positions C.3.3.4, C.3.3.6, and C.3.3.7, because of the control and monitoring provisions for the AAC power source. The initial tests verify the AAC power source performance, and the periodic testing and inspection verify the operability and reliability goals of the AAC GTG. Therefore, the staff determined that the design conforms to RG 1.155, Position C.3.3 including Position C.3.3.5 for which evaluation is provided in Sections 8.4.4.1.2.1-4 of this report. The staff considers RAI 165-8192, Question 08.04-6(b) to be closed.

In its response to RAI 412-8525, Question 08.04-13(a) (ML16123A384), the applicant also revised the DCD Tier 2, Section 8.4.1.1 to state conformance to RG 1.155, Position C.3.3 as summarized above. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and considers RAI 412-8525, Question 08.04-13(a) resolved and closed.

SRP, Section 8.4.III.3, AAC Power Source, recommends that the AAC power source satisfy performance, quality, design, and maintenance criteria to meet the requirements of 10 CFR 50.63. In RAI 165-8192, Question 08.04-7(b) (ML15295A490), the staff requested the applicant to discuss conformance to Criteria D - G, I, and K - M of SRP, Section 8.4 III.3. In its response to RAI 165-8192, Question 08.04-7(b) (ML15322A404), the applicant discussed conformance to the SRP, Section 8.4 III.3, Criteria D, E, F, G, I, K, L and M. The staffs evaluation of each criteria is discussed in the paragraphs below.

SRP Section 8.4.III.3, Criterion D states that plant staff in the control room monitor the performance of the AAC power source and as a minimum, monitoring should include the voltage, current, frequency, and circuit breaker position. In its response to RAI 165-8192, Question 08.04-7(b) (ML15322A404), the applicant stated that performance of the AAC power source (voltage, current, frequency, volt-ampere reactive, watts, watt-hour, and power factor) and status of circuit breaker position will be monitored from the control room. The staff determined that the performance of the AAC power is monitored as recommended by SRP Section 8.4.III.3, Criterion D since the monitoring includes the voltage, current, frequency, and circuit breaker position for the AAC power source. Additional monitoring parameters as well as 8-105

protective trips for the AAC GTG are provided in the DCD Revision 2 Sections 8.4.1.3.1, AAC Instrumentation and Control, 14.2.12.1.89, Alternate AC Source System Test (Mechanical),

and 14.2.12.1.90, Alternate AC Source System Test (Electrical).

SRP Section 8.4.III.3, Criterion E states, in part, that electrical cables connecting the AAC power source to the shutdown buses are protected against the events that affect the preferred ac power system. In its response to RAI 165-8192, Question 08.04-7(b) (ML15322A404), the applicant stated that cables connecting the AAC power source to the Class 1E buses are appropriately separated from the cables connecting the Class 1E buses as practicable such that the impact on the connections of the AAC power source is minimized for the events that affect the offsite power system. The separation criteria for cables and raceways are described in DCD Tier 2, Section 8.3.1.1.10 and the staffs evaluation is in Section 8.3.1 of this report. The staff determined that the separation of electrical cables connecting the AAC power source are provided and are acceptable. Thus, the design conforms to SRP Section 8.4.III.3, Criterion E.

SRP Section 8.4.III.3, Criterion F states that non-safety-related AAC power source(s) and associated dedicated dc system(s) should meet the QA guidance in Section 3.5, Quality Assurance and Specification Guidance for Station Blackout Equipment That is not Safety-Related, Appendix A, and Appendix B to RG 1.155. In its response to RAI 165-8192, Question 08.04-7(b) (ML15322A404), the applicant stated that QA of the AAC GTG follows the designs QAP described in DCD Tier 2, Section 17.5, Quality Assurance Program Description - Design Certification. In its response to follow-up RAI 412-8525, Question 08.04-15(c) (ML16123A384),

the applicant stated that the support systems of the AAC GTG are included in the QA program for the AAC GTG. In Section 8. 4.4.1.5, Quality Assurance and Specification Guidance for Non-Safety-Related Equipment required to meet 10 CFR 50.63, of this report, the staff determined that the QA requirements for the AAC GTG will be implemented in accordance with the QA guidance in RG 1.155 Position C.3.5 and Appendix A per COL Item 17.5 (1). The staffs evaluation for the QAP is in Section 17.5 of this report.

SRP Section 8.4.III.3, Criterion G states in part that the AAC power system is equipped with a dedicated dc power system that is electrically independent from the blacked-out units preferred and Class 1E power systems. In its response to RAI 165-8192, Question 08.04-7(b)

(ML15322A404), the applicant stated a dedicated non-Class 1E 125 Vdc power system including a 500 AH battery is provided in the AAC GTG building for the AAC power system. The applicant stated that the battery is sized based on the worst-case duty cycle of dc loads for the AAC system in accordance with IEEE Std. 485-2010, IEEE Recommended Practice for Sizing Lead-Acid Batteries for Stationary Applications. The staff determined that the AAC power source has a dedicated dc system associated with the AAC power source because the battery is sized in accordance with IEEE Std. 485-2010 as endorsed by RG 1.212, Sizing of Large Lead-Acid Storage Batteries. The staff determined that the AACs dedicated dc system conforms to SRP Section 8.4.III.3, Criterion G.

SRP Section 8.4.III.3, Criterion I states that the AAC power system is provided with a fuel supply that is separate from the fuel supply for the onsite EAC power system. In its response to RAI 165-8192, Question 08.04-7(b) (ML15322A404), the applicant stated that a diesel fuel oil storage tank and a day tank separate from the onsite EDG system are provided for the AAC GTG. The staff determined that the design meets SRP Section 8.4.III.3, Criterion I since the fuel supply for the AAC power source is separate from the fuel supply for the onsite EAC power source.

8-106

SRP Section 8.4.III.3, Criterion K states, in part, that the AAC power system is capable of operating during and after an SBO without any support system receiving power from the preferred power supply or the blacked-out units EAC power sources. In its response to RAI 165-8192, Question 08.04-7(b) (ML15322A404), the applicant stated the AAC GTG will be manually started to supply power to Class 1E switchgear without receiving power from any external ac or dc power source. The applicant stated that the AAC has its own dedicated dc power system to establish the electric field excitation of the AAC generator. The staff determined that since the AAC GTG can operate without an external ac or dc power sources, the design conforms to SRP Section 8.4.III.3, Criterion K.

SRP Section 8.4.III.3, Criterion L states that the portions of the AAC power system subjected to maintenance activities are/will be tested before returning the AAC power system to service. In its response to RAI 165-8192, Question 08.04-7(b) (ML15322A404), the applicant stated that portions of the AAC GTG and its support systems subjected to maintenance activities will be tested before returning the AAC GTG and its support systems to service. The staff determined that the design meets SRP Section 8.4.III.3, Criterion L since the AAC power source and its support systems are tested and portions of the AAC power system, as required, subjected to maintenance activities will be tested before returning the system to service.

SRP Section 8.4.III.3, Criterion M states that plant-specific technical guidelines and emergency operating procedures will be implemented (or are in place, as applicable) that identify those actions necessary for placing the AAC power source in service. In its response to RAI 165-8192, Question 08.04-7(b) (ML15322A404), the applicant stated that the COL applicant is to provide a program for developing the EOPs as specified in COL Item 13.5(5), and will identify actions necessary for placing the AAC power source in service. The staff determined that since the COL applicant will address the EOPs and technical guidelines that will identify actions necessary for placing the AAC power source in service, the applicant has adequately addressed the recommendations of SRP Section 8.4.III.3, Criterion M.

The staff has determined that the design conforms to SRP Section 8.4.III.3, because the criteria for the performance, quality, design, and maintenance of the AAC power source are satisfied, as discussed in the above paragraphs. Therefore, the staff determined that the design satisfies the requirements of 10 CFR 50.63 regarding the AAC power in accordance with SRP Section 8.4.III.3, and as such, the AAC power source is capable of performing its design function during an SBO. The staff considers RAI 165-8192, Question 08.04-7(b) to be resolved.

In its response to RAI 412-8525, Question 08.04-15(a) (ML16123A384), the applicant revised the DCD Tier 2, Section 8.4.1 to include the information related to the performance, quality, design, and maintenance of the AAC power source as recommended by SRP Section 8.4.III.3.

The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and considers RAI 412-8525, Question 08.04-15(a) resolved and closed.

In conclusion, the staff determined that the AAC power source is capable of supplying power to the SBO loads for the time required to bring and maintain the plant in a safe shutdown in accordance with RG 1.155, Positions C.3.2.5 and C.3.3, and SRP Section 8.4.III.3 because the AAC power source meets the applicable guidance, as discussed above. Therefore, the staff determined that the design complies with 10 CFR 50.63(c)(2) with regards to the SBO capability of the AAC power source.

8-107

8.4.4.1.3 Recovery from SBO Section 50.63(a)(1) of 10 CFR, requires each NPP to be capable of recovering from an SBO. In DCD Tier 2, Section 8.4.1.5, Recovery from SBO, the applicant stated that power to the Class 1E buses will be restored from either the onsite Class 1E EDGs or the offsite power sources within the SBO coping duration. Thus, in order to recover from an SBO, either the offsite power source or the EDGs will restore power to the onsite power system. Per COL Item 8.4(2), the COL applicant is required to identify local power sources and transmission paths that could be made available to resupply power to the plant following the loss of a grid or an SBO. The staff determined that the applicant has adequately addressed the issue of recovering from an SBO since recovery is achieved by restoring the EDG or offsite power. Therefore, the staff determined that the design complies with 10 CFR 50.63(a)(1).

8.4.4.1.4 Procedures and Training to Cope with SBO Section 50.63 (c)(1)(ii) of 10 CFR, requires that the applicant provide a description of the procedures that will be implemented for SBO events for the specified SBO duration and for recovery therefrom. RG 1.155, Positions C.1.3 and C.2 provide guidance on procedures for:

(a) restoring EAC when the EAC is unavailable and (b) restoring offsite power and use of nearby power sources when offsite power is unavailable, respectively. RG 1.155, Position C.3.4 provides guidance on procedures and training necessary for coping with an SBO for at least the coping duration and for restoring normal long-term cooling/decay heat removal once ac power is restored.

In DCD Tier 2, Section 8.4.2.2, the applicant stated that conformance to RG 1.155, Position C.3.4 is described in DCD Tier 2, Section 13.5, Plant Procedures, and Section 13.2, Training.

In DCD Tier 2, Sections 13.5 and 13.2, COL items are provided for procedures and training for the plant personnel, but none is specifically related to RG 1.155, Positions C.3.4. Thus, in RAI 24-7928, Question 08.04-5 (ML15159A489), and follow-up RAI 258-8333, Question 08.04-11 (ML15293A574), the staff requested the applicant to clarify whether the COL applicant is required to address procedures related to RG 1.155, Positions C.1.3, C.2, C.3.4, and to incorporate the clarification in DCD Tier 2, Section 8.4. In its responses to RAI 24-7928, Question 08.04-5 (ML15188A391) and RAI 258-8333, Question 08.04-11 (ML15350A378), the applicant stated that the COL applicant will address the procedures related to RG 1.155, Positions C.1.3, C.2, and C.3.4 in the plant EOPs per COL Item 13.5(5). COL Item 13.5(5) states that the COL applicant is to provide a program for developing and implementing EOPs.

The applicant also stated that the COL applicant will address the training related to RG 1.155, Position C.3.4 per COL Item 13.2(3). COL Item 13.2(3) states that the COL applicant is to provide a licensed plant staff training program in accordance with NEI 06-13A, Section 13.2.1.I.3, Design Certification. Additionally, the applicant revised DCD Tier 2, Section 8.4.2.2, Conformance with NRC Regulatory Guides, to include statements that the COL applicant is to address the procedures and training related to RG 1.155, Positions C.1.3, C.2, and C.3.4 as specified in COL Item 13.5(5) and COL Item 13.2(3). The staff determined that the applicant has adequately addressed the issue since the COL applicant will develop the procedures to cope with and recover from an SBO per COL Item 13.5(5) and the training to cope with an SBO per COL Item 13.2(3). Therefore, the staff determined that the design conforms to RG 1.155, Position C.1.3, C.2, and C.3.4, and as such, complies 10 CFR 50.63 (c)(1)(ii) and the issue is resolved. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and considers RAI 24-7928, Question 08.04-5 and RAI 258-8333, Question 08.04-11 resolved and closed.

8-108

8.4.4.1.5 Quality Assurance and Specification Guidance for Non-Safety-Related Equipment Required to Meet 10 CFR 50.63 RG 1.155, Position C.3.5 provides guidance on QA and specifications for SBO equipment that is not safety-related. The guidance for the QA and specifications is described in RG 1.155, Appendix A, Quality Assurance Guidance for Non-Safety Systems and Equipment, and Appendix B, Guidance Regarding System and Station Equipment Specifications, respectively.

In addition, RG 1.155, Position C.3.5 stated that equipment installed to meet the SBO rule must not degrade the existing safety-related systems.

Appendix A of RG 1.155 provides guidance on the QAP for non-safety-related systems and equipment used to meet the SBO rule and not already covered by existing QA requirements. In its responses to RAI 165-8192, Question 08.04-7(b) (ML15322A404), and follow-up RAI 412-8525, Question 08.04-15(c) (ML16123A384), the applicant stated that the QA of the AAC GTG including its support systems follows the designs QAP addressed in DCD Tier 2, Section 17.5.

In DCD Tier 2, Section 17.5, the applicant stated that the APR1400 QAP description, as provided in Topical Report APR1400-K-A-TR-11005-NP, KHNP Quality Assurance Program Description for the APR1400 Design Certification (ML16123A406), describes the QA requirements for safety-related equipment as well as non-safety-related SSCs important to safety such as SBO equipment. Furthermore, DCD Tier 2 Section 17.5, COL Item 17.5 (1) states that the COL applicant is required to establish and implement a QAP that is applicable to site-specific design activities related to the plant construction and operation phases. The staff requested the applicant to clarify the QA for the AAC GTG in accordance with RG 1.155, Position C.3.5 and Appendix A during a conference call. In its response (MLTBD), the applicant revised the AAC GTGs QA information in Table 8.4.2-1, Conformance to RG 1.155 Appendix B, Alternate AC Sources, and Table 8.4.2-2, Conformance to NUREG-0800, Section 8.4.III.3 Criteria D to I and K to M, to specifically state that the AAC GTG follows the QA requirements in accordance with Position C.3.5 and Appendix A of RG 1.155. Since, (1) the COL applicant will establish and implement the QAP applicable to site-specific design activities, and 2) the QA for the AAC GTG, as provided in the designs QAP, will follow the QA guidance provided in RG 1.155 Position C.3.5 and Appendix A, the staff finds that the QA requirements for the AAC GTG will be implemented in accordance with the guidance in RG 1.155 Position C.3.5 and Appendix A per COL Item 17.5 (1). The staff confirmed that the DCD Revision 3 contains the changes as committed to in the RAI responses, and considers RAI 165-8192, Question 08.04-7(b) and RAI 412-8525, Question 08.04-15(c) pertaining to the QA information for the AAC GTG resolved and closed.

Appendix B of RG 1.155, provides guidance for the specifications of non-safety-related system and station equipment such as the AAC sources used to mitigate an SBO. The relevant attributes of the RG 1.155 Appendix B specifications for the AAC power source include the diversity from existing EDGs, independence from existing safety-related systems, capacity to supply SBO loads, QA, instrumentation and monitoring, and common cause failure with safety-related systems. In Section 8.4.4.1.2, AAC Power Source, of this report, the staff determined that the AAC power source: (1) is diverse from the EDGs, (2) is independent from safety-related systems, and (3) has sufficient capacity to power the SBO loads in accordance with RG 1.155. The staff also determined that the diversity and independence of the AAC power source from safety-related systems minimizes the potential for common-cause failure. In Section 8.4.4.1.2.5, SBO Coping Capability, of this report, the staff determined that the AAC power source is controlled and monitored from the control room in accordance with RG 1.155, Position C.3.3.4 and SRP Section 8.4.III.3. In addition, in its response to RAI 412-8525, Question 08.04-8-109

15(c), the applicant clarified that the AAC GTG has its own independent support systems not subject to a water source, instrument air or water delivery system of the other non-safety-related systems described in RG 1.155, Appendix B. The applicant will revise DCD Section 8.4.2.2.e to include the above-mentioned clarification in the RAI response. Therefore, the staff determined that the design conforms to RG 1.155, Appendix B with regards to the specifications of the AAC power source. The staff confirmed that the DCD Revision 3 contains the changes as committed to in the RAI response, and considers RAI 412-8525, Question 08.04-15(c) pertaining to the support systems of the AAC GTG resolved and closed.

Position C.3.5, of RG 1.155 recommends that the non-safety related equipment installed to meet the SBO rule be as independent as practicable from existing safety-related systems so that it does not degrade the safety-related systems. As discussed in Section 8.4.4.1.2.2, Independence, of this report, the non-safety related AAC power source is independent from the safety-related systems in accordance with Position C.3.3.5 and Appendix B of RG 1.155 and Section 8.4 of SRP. Therefore, the staff determined that the APR1400 design conforms to Position C.3.5 of RG 1.155 in regards to the independence of the non-safety related equipment.

In summary, the staff determined that the design conforms to RG 1.155 Position C.3.5 since QA, specifications, and independence are met.

8.4.4.2 Compliance with 10 CFR 50.65 (a)(4) in regards to the SBO - Requirements for monitoring the effectiveness of maintenance at nuclear power plants Section 50.65(a)(4) of 10 CFR, relates to the assessment and management of the increase in risk that may result from proposed maintenance activities. These activities include surveillances, post maintenance testing, and corrective and preventive maintenance related to systems and equipment used to mitigate an SBO.

Section 50.65(b)(2)(i) of 10 CFR, states, in part, that the scope of the monitoring program specified in the Maintenance Rule shall include non-safety related SSCs that are used in plant EOPs. In DCD Tier 2, Section 8.4.2.1, Conformance with 10 CFR Part 50, the applicant stated that the AAC GTG performance monitoring is included in the reliability assurance program and the Maintenance Rule program that are described in DCD Tier 2, Sections 17.4, Reliability Assurance Program, and 17.6, Maintenance Rule. In DCD Tier 2, Section 17.6, the applicant stated that the COL applicant is responsible for establishing and implementing a Maintenance Rule program in accordance with 10 CFR 50.65. COL Item 17.6(1) states that the COL applicant is to provide in its FSAR a description of the Maintenance Rule program and a plan for implementing it to meet the requirements of 10 CFR 50.65. In RAI 165-8192, Question 08.04-9 (ML15295A490) the staff requested the applicant to confirm that all systems, including the AAC GTG support systems, provided to mitigate the SBO comply with 10 CFR 50.65(a)(4). In its response to RAI 165-8192, Question 08.04-9 (ML15322A404), the applicant confirmed that the AAC power systems, including the AAC GTG support systems, comply with the Maintenance Rule requirements of 10 CFR 50.65 since they are included in the EOPs. The applicant revised DCD Tier 2, Section 8.4.2.1, to incorporate the information regarding the applicability of the Maintenance Rule program to the AAC power systems. Since the non-safety related AAC GTG and its support systems are used in the plant EOPs, the staff determined that the AAC GTG and its support systems will be covered by the Maintenance Rule program to be developed by the COL applicant per COL Item 17.6(1). Therefore, the staff determined that the effectiveness of maintenance activities related to the AAC power system will be monitored in accordance with 10 CFR 50.65(a)(4) per COL Item 17.6(1). Since the applicant has provided a COL information 8-110

item to address plant-specific provisions related to the Maintenance Rule 10 CFR 50.65, given that the description of a Maintenance Rule program is the COL applicants responsibility, the staff determined that the applicant addressed adequately compliance with the Maintenance Rule, and this issue is resolved. The staff confirmed that DCD Revision 1 contains the changes as committed to in the RAI response, and considers RAI 165-8192, Question 08.04-9 resolved and closed.

8.4.5 Combined License Information Items The following is a list of item numbers and descriptions from DCD Tier 2, Section 8.4 and Chapter 1, Table 1.8-2:

Combined License information Items Item No. Description DCD Section 8.4(1) The COL applicant is to validate the SBO coping duration Tier 2, 8.4.1.2 according to the method specified in RG 1.155.

8.4(2) The COL applicant is to identify local power sources and Tier 2, 8.4.1.3 transmission paths that could be made available to resupply power to the plant following the loss of a grid or the SBO.

8.4(3) The COL applicant is to specify the specific parameters for Tier 2, 8.4.1.3.1 monitoring, alarms, mechanical and electrical trip for testing, and emergency trips 8.4(4) The COL applicant is to develop detailed procedures for Tier 2, 8.4.1.4 manually aligning the alternate ac power supply when two (Trains A and B) of the four diesel generators are unavailable during a LOOP event.

COL Item 9.5(14) is related to the AAC power source. COL Item 9.5(14) states that the COL applicant is to provide a reliable starting method for the AAC GTG.

8.4.6 Conclusion The staff has reviewed the SBO-related information provided in the DCD and the RAI responses for the APR1400 design against the guidelines of RG 1.155 and the SRP. The staff concludes that the AAC power source meets the guidance in RG 1.155 and the SRP, Section 8.4 on AAC power sources. The staff also concludes that, based on the above technical evaluation, the APR1400 design is capable of withstanding and recovering from an SBO for the sixteen hours coping duration. Accordingly, the staff determined that the design is in compliance with the requirements of 10 CFR 50.63 and 10 CFR 50.65, as they relate to the capability to achieve and maintain safe shutdown in the event of an SBO.

8-111

Retrieved from "https://kanterella.com/w/index.php?title=ML18197A219&oldid=1926465"