ML19324C991

Amendment 28 to Updated Final Safety Analysis Report, Chapter 8, Electrical Power Systems - Redacted

ML19324C991
Person / Time
Site:	Browns Ferry
Issue date:	10/04/2019
From:	Tennessee Valley Authority
To:	Office of Nuclear Reactor Regulation
References
Download: ML19324C991 (250)

Text

BFN-26 TABLE OF CONTENTS 8.0 ELECTRICAL POWER SYSTEMS 8.1 Summary Description ................................................................................................................ 8.1-1 8.2 Generators ................................................................................................................................ 8.2-1 8.3 Transmission System ................................................................................................................ 8.3-1 8.3.1 General ...................................................................................................................... 8.3-1 8.3.2 Power Generation Objective ...................................................................................... 8.3-1 8.3.3 Power Generation Design Basis ................................................................................ 8.3-1 8.3.4 Safety Design Basis ................................................................................................... 8.3-2 8.3.5 Description ................................................................................................................. 8.3-3 8.3.6 Analysis ..................................................................................................................... 8.3-4 8.3.7 Inspection and Testing ............................................................................................... 8.3-5 8.4 Normal Auxiliary Power System ................................................................................................ 8.4-1 8.4.1 General ...................................................................................................................... 8.4-1 8.4.2 Auxiliary Power System Objective ............................................................................. 8.4-3 8.4.3 Power Generation Design Basis ................................................................................ 8.4-3 8.4.4 Safety Design Basis ................................................................................................... 8.4-4 8.4.5 Description ................................................................................................................. 8.4-4 8.4.6 Safety Evaluation ....................................................................................................... 8.4-10 8.4.7 Inspection and Testing ............................................................................................... 8.4-15 8.4.8 Modifications and Safety Evaluations ........................................................................ 8.4-16 8.5 Standby AC Power Supply And Distribution .............................................................................. 8.5-1 8.5.1 Safety Objectives ....................................................................................................... 8.5-1 8.5.2 Safety Design Basis ................................................................................................... 8.5-1 8.5.3 Description ................................................................................................................. 8.5-2 8.5.4 Safety Evaluation ....................................................................................................... 8.5-13 8.5.5 Inspection and Testing ............................................................................................... 8.5-17 8.6 250-V DC Power Supply And Distribution ................................................................................. 8.6-1 8.6.1 Safety Objective ......................................................................................................... 8.6-1 8.6.2 Safety Design Basis ................................................................................................... 8.6-1 8.6.3 Description ................................................................................................................. 8.6-1 8.6.4 Safety Evaluation ....................................................................................................... 8.6-4 8.6.5 Inspection and Testing ............................................................................................... 8.6-5 8.7 120-V AC Power Supply And Distribution.................................................................................. 8.7-1 8.7.1 Power Generation Objective ...................................................................................... 8.7-1 8.7.2 Power Generation Design Basis ................................................................................ 8.7-1 8.7.3 Description ................................................................................................................. 8.7-1 8.7.4 Inspection and Testing ............................................................................................... 8.7-4 8.0-i

BFN-26 TABLE OF CONTENTS (Cont'd) 8.0 ELECTRICAL POWER SYSTEMS 8.8 Auxiliary DC Power Supply And Distribution ............................................................................. 8.8-1 8.8.1 48-V DC Power System ............................................................................................. 8.8-1 8.8.2 24-V DC Power System ............................................................................................. 8.8-2 8.9 Safety Systems Independence Criteria And Bases For Electrical Cable Installation ................. 8.9-1 8.9.1 Cable Insulation, Coatings, and Floor and Wall Penetrations .................................... 8.9-2 8.9.2 Raceways .................................................................................................................. 8.9-3 8.9.3 Containment Penetration ........................................................................................... 8.9-6 8.9.4 Control Room and Local Panels ................................................................................ 8.9-7 8.9.5 Separation of Class 1E Electrical Equipment ............................................................. 8.9-8 8.9.6 Cable Routing ............................................................................................................ 8.9-10 8.9.7 Fire Detection and Protection..................................................................................... 8.9-12 8.9.8 Conduit Cable and Cable Tray Markings ................................................................... 8.9-12 8.10 Station Blackout ............................................................................................................................ 8.10-1 8.10.1 Description ...................................................................................................................8.10-1 8.10.2 Containment Cooling ...................................................................................................8.10-1 8.0-ii

BFN-26 ELECTRICAL POWER SYSTEMS LIST OF TABLES Table Title 8.4-1 Auxiliary Power Supplies and Bus Transfer Schemes, Sheets 1-19 8.4-2 Deleted 8.4-3 Deleted 8.4-4 Deleted 8.4-5 Deleted 8.4-6 Deleted 8.4-7 Deleted 8.4-8 Deleted 8.4-9 Deleted 8.4-10 Deleted 8.4-11 Deleted 8.4-12 Deleted 8.4-13 Deleted 8.4-14 Deleted 8.5-1 Design Basis Loss-of-Coolant Accident on One Unit, Other Units Operating Prior to Power Loss, Normal Power Not Available, Diesel Generator Power Available 8.5-2 Deleted 8.5-2a Deleted 8.5-3 Deleted 8.5-4 Deleted 8.5-5 CSCS Load Starting - Normal Power 8.5-6 Diesel Generator Ratings 8.5-7 Deleted 8.5-8 Deleted 8.5-9 Deleted 8.6-1 250-V DC Connected Loads 8.6-3 Deleted 8.8-1 Deleted 8.8-2 Deleted 8.8-3 Evaluation of the 24-V DC Power Supply 8.9-1 Deleted 8.0-iii

BFN-26 ELECTRICAL POWER SYSTEMS LIST OF ILLUSTRATIONS Figure Title 8.3-1 (Deleted)

SECURITY RELATED INFORMATION TEXT WITHHELD UNDER 10 CFR 2.390 8.3-7 (Deleted) 8.3-7a (Deleted) 8.3-7b (Deleted) 8.3-8 (Deleted) 8.3-8a (Deleted) 8.3-8b (Deleted) 8.3-9 (Deleted) 8.3-9a (Deleted) 8.3-9b (Deleted) 8.3-10 (Deleted) 8.3-10a (Deleted) 8.3-10b (Deleted) 8.3-11 (Deleted) 8.3.11a (Deleted) 8.3-11b (Deleted) 8.3-12a (Deleted) 8.3-12b (Deleted) 8.3-13a (Deleted) 8.3-13b (Deleted) 8.3-14a (Deleted) 8.3-14b (Deleted) 8.3-15a (Deleted) 8.3-15b (Deleted) 8.3-15c (Deleted) 8.3-16 (Deleted) 8.3-17 (Deleted) 8.4-1a Normal Auxiliary Power System Key Diagram 8.4-1b Standby Auxiliary Power System Key Diagram 8.4-2 Normal and Auxiliary Power System Key Diagram 8.4-3 4160-V Shutdown Auxiliary Power Schematic Diagram 8.4-4 Logic Diagram - Degraded Voltage and Loss-of-Voltage Relay Channels 8.0-iv

BFN-26 8.0-v

BFN-26 ELECTRICAL POWER SYSTEMS LIST OF ILLUSTRATIONS (Cont'd)

Figure Title 8.5-1 Diesel Generator Panel - One-Line Diagram 8.5-2 sht 1 Diesel Starting Air System Diesel Generator A - Flow Diagram 8.5-2 sht 2 Diesel Starting Air System Diesel Generator A - Flow Diagram 8.5-2 sht 3 Cooling System and Lubricating Oil System Diesel Generator 1A - Flow Diagram 8.5-2 sht 4 Diesel Starting Air System Diesel Generator 3A - Flow Diagram 8.5-2 sht 5 Diesel Starting Air System Diesel Generator 3A - Flow Diagram 8.5-2 sht 6 Cooling System and Lubricating Oil System Diesel Generator 3A - Flow Diagram 8.5-3a Fuel Oil System - Flow Diagram 8.5-3b Fuel Oil System - Flow Diagram 8.5-4a 4160-V Shutdown Board A - Single Line 8.5-4b 4160-V Shutdown Board 3EA - Single Line 8.5-4c 4160-V Shutdown Board B - Single Line 8.5-4d 4160-V Shutdown Board C - Single Line 8.5-4e 4160-V Shutdown Board D - Single Line 8.5-4f 4160-V Shutdown Board 3EB - Single Line 8.5-4g 4160-V Shutdown Board 3EC - Single Line 8.5-4h 4160-V Shutdown Board 3ED - Single Line 8.5-5 480-V Shutdown Board 2A - Single Line 8.5-6 480-V Shutdown Board 2B - Single Line 8.5-7 Deleted 8.5-7a 480-V Reactor MOV Board 2A - Single Line 8.5-7b 480-V Reactor MOV Board 2A - Single Line 8.5-7c 480-V Reactor MOV Board 1A - Single Line 8.5-7d 480-V Reactor MOV Board 1A - Single Line 8.5-7e 480-V Reactor MOV Board 3A - Single Line 8.5-7f 480-V Reactor MOV Board 3A - Single Line 8.5-8 Deleted 8.5-8a 480-V Reactor MOV Board 2B - Single Line 8.5-8b 480-V Reactor MOV Board 2B - Single Line 8.5-8c 480-V Reactor MOV Board 1B - Single Line 8.5-8d 480-V Reactor MOV Board 1B - Single Line 8.5-8e 480-V Reactor MOV Board 3B - Single Line 8.5-8f 480-V Reactor MOV Board 3B - Single Line 8.5-9a 480-V Reactor MOV Board 2C - Single Line 8.5-9b 480-V Reactor MOV Board 2C - Single Line 8.5-9c 480-V Reactor MOV Board 3C - Single Line 8.5-9d 480-V Reactor MOV Board 3C - Single Line 8.5-10 480-V Reactor MOV Board 2D - Single Line 8.5-11 480-V Reactor MOV Board 2E - Single Line 8.5-11a 480-V Reactor MOV Board 3D - Single Line 8.0-vi

BFN-26 ELECTRICAL POWER SYSTEMS LIST OF ILLUSTRATIONS (Cont'd)

Figure Title 8.5-11b Deleted 8.5-11c 480-V Control Bay Vent Board A - Single Line 8.5-11d 480-V Control Bay Vent Board B - Single Line 8.5-12a 480-V Diesel Auxiliary Board A - Single Line 8.5-12b 480-V Diesel Auxiliary Board A - Single Line 8.5-12c 480-V Diesel Auxiliary Board 3EA - Single Line 8.5-13a 480-V Diesel Auxiliary Board B - Single Line 8.5-13b 480-V Diesel Auxiliary Board B - Single Line 8.5-13c 480-V Diesel Auxiliary Board 3EB - Single Line 8.5-13d 480-V Standby Gas Treatment Bd Single Line 8.5-13e 480-V Diesel Auxiliary Board B - Single Line 8.5-14 Deleted 8.5-14a Diesel Generator Logic Diagram - Fast Start 8.5-14b Diesel Generator Logic Diagram - Slow Start 8.5-14c Diesel Generator Logic Diagram - Stop 8.5-15 Diesel Generator Logic Diagram - Automatic Loading 8.5-16a Standby AC Power Logic Diagram - Load Shedding, 4.16 kV Shutdown Board 8.5-16b Standby AC Power Logic Diagram - Load Shedding, 480-V Shutdown Board 8.5-16c Standby AC Power Logic Diagram - Load Shedding, 480-V Reactor MOV Board 8.5-17 Standby AC Power Logic Diagram - Automatic Loading of Shutdown Board, Normal Power Available 8.5-18 Diesel Start Attempts - Block Diagram 8.5-19 Deleted 8.5-20 Deleted 8.5-21 Deleted 8.5-22 Division I & II Assignments Units 1 & 2 8.5-23 Deleted 8.5-24 Unit 3 Interconnections with Units 1 & 2 8.5-25 480-V Shutdown Board 1A - Single Line 8.5-26 480-V Shutdown Board 1B - Single Line 8.5-27 480-V Shutdown Board 3A - Single Line 8.5-28 480-V Shutdown Board 3B - Single Line 8.6-1a Instrument and Controls DC and AC Power Systems Key Diagram 8.6-1b Instrument and Controls DC and AC Power Systems Key Diagram 8.6-1c Instrument and Controls DC and AC Power Systems Key Diagram (Safeguards Information-Located in Drawing Control) 8.6-1d Instrument and Controls DC and AC Power Systems Key Diagram 8.6-1e Instrument and Controls DC and AC Power Systems Key Diagram 8.6-1f Instrument and Controls DC and AC Power System Key Diagram 8.6-2a 250-V DC Power System - Typical Unit Arrangement 8.0-vii

BFN-26 ELECTRICAL POWER SYSTEMS LIST OF ILLUSTRATIONS (Cont'd)

Figure Title 8.6-2b Shutdown Boards 250-V Battery and Chargers - Single Line 8.6-2c Shutdown Boards 250-V Battery and Chargers - Single Line 8.6-3 Separations Scheme 250-V DC System for Engineered Safeguards and RCIC, Block Diagram 8.6-4 Deleted 8.6-5 DC Board 9-9 One-Line Diagram 8.6-6 Control Room Board DC - Single Line 8.7-1 Instrumentation and Controls AC Power System, One-Line Diagram 8.7-2 (Deleted) 8.7-3 Unit Preferred Power AC System, One-Line Diagram 8.7-4a AC Board 9-9 One-Line Diagram 8.7-4b sht 1 AC Boarding 9-9 Preferred and Nonpreferred Loads One-Line Diagram 8.7-4b sht 2 AC Board 9-9 Preferred and Nonpreferred Loads One-Line Diagram 8.7-4c sht 1 AC Board 9-9 Instrumentation and Control One-Line Diagram 8.7-4c sht 2 AC Board 9-9 Instrumentation and Control One - Line Diagram 8.7-4c sht 3 AC Board 9-9 Instrumentation and Control One - Line Diagram 8.7-4d Control Room DC Board - Single Line 8.8-1 (Deleted) 8.8-2 (Deleted) 8.8-3 (Deleted) 8.9-1 (Deleted) 8.0-viii

BFN-26 8.0 ELECTRICAL POWER SYSTEMS 8.1 Summary Description The Browns Ferry plant is connected into the TVA system network by seven 500-kV lines. One line is to Madison substation, two to Trinity substation, one line each to the West Point, Maury and Union substations, and one line to the Limestone 500-kV Substation.

Normal station power is from the unit station service transformers connected between the generator breaker and main transformer of each unit. Startup power is from the TVA 500-kV system network through the 500 to 22-kV main and 20.7- to 4.16-kV unit station service transformers (USST 3A is rated 22-kV - 4.16-kV).

Auxiliary power is available through the two common station service transformers which are fed from two 161-kV lines supplying the 161-kV switchyard, one line each from the Athens and Trinity substations.

The standby source of auxiliary power is from eight diesel-driven generators. These units start automatically on an accident signal, loss of voltage, or degraded voltage on the associated shutdown board from self-contained starting air systems.

250-V DC Battery Systems There are eleven 250-V DC battery systems for the station, each of which consists of a battery, battery charger, and distribution equipment. Three 250-V DC systems (the unit batteries) provide power for unit control functions and operative power for unit motor loads. Three 250-V DC systems (the station batteries) provide power for common plant and transmission system control functions, drive power for a 120/240-V AC plant preferred motor-generator set, emergency drive power for certain unit large motor loads, and alternate drive power for two 120/240-V AC unit preferred motor-driven generator sets for Units 2 and 3, and alternate power for one 120/240-V AC unit preferred UPS system. The five remaining 250-V DC systems (the shutdown board batteries) deliver control power to five of the eight 4160-V shutdown boards and four of the six 480-V shutdown boards. The unit and shutdown board batteries supply Engineered Safeguard System (ESS) loads. The station batteries supply only non-safety loads.

48-V DC Battery Systems There are three 48-V DC battery systems, each of which consists of a battery, battery charger, and distribution panel. Two of these systems provide power to the three MCR annunciator systems including the OPs Recorder and the third is the power source for part of the plant communication system.

8.1-1

BFN-26 120/240-V AC Unit Preferred Systems The Units 2 and 3, 120/240-V single phase AC unit preferred systems are each supplied by its associated motor-generator set which is normally driven by a low slip induction motor supplied from a 480-V AC shutdown board. An alternate 250-V DC drive motor with two 250-V DC sources is provided on the common shaft to provide a continuous 120/240-V AC single phase power source through an automatic transfer from the AC drive motor to the DC drive motor.

The Unit 1, 120/240-V single phase AC unit preferred system is supplied by an uninterruptible power supply (UPS) system normally supplied from the 480-V RMOV Board 1A. Two alternative 250-V DC sources are provided via a manual transfer switch to the inverter. The DC source of power is normally floating and will automatically pick up the load upon loss of the normal AC power.

This Unit Preferred Power system provides reliable power to non-safety related loads.

120/208-V AC Instrument and Control Power Buses There are two 120/208-V AC instrument and control power buses for each of the three generating units. The instrument and control power bus for each unit is supplied through a 208-208/120-V AC regulating transformer by its associated 480-to 120/208-V transformer which, in turn, is also supplied from an independent 480-V shutdown board. This provides an independent 120/208-V Class 1E 3-phase AC control power bus for each of the redundant control and instrumentation channels for each unit.

120/240-V AC Plant Preferred System A 120/240-V single phase AC plant preferred system is supplied from plant AC with an alternate from a motor-generator set with a 250-V DC drive motor that is started upon loss of normal plant AC power. This system supplies the plant non-safety related loads such as, chart drives, clocks, and certain communications equipment.

120/208-V AC Plant Computer Power System The 120/208-V AC plant computer power system is a computer power distribution panel supplied by an uninterruptible power supply (UPS). The UPS receives input power from a 480-V AC Non-Class 1E common board. The output of the UPS provides normal and alternate 120/208-V AC power to the plant computer distribution panel through a static transfer switch. A 250-V DC non-1E battery board provides back-up power to the UPS.

8.1-2

BFN-26 120-V Reactor Protection System There are two 120-V RPS buses for each of the three generating units. Each RPS bus is supplied by a motor-generator set which is normally powered from a 480-V Reactor MOV Board. Each bus has an alternate source from a single 480-120-V regulating transformer that may supply either bus. Each RPS bus also has redundant class 1E isolators to protect from low voltage, high voltage, and under frequency.

120/240-V AC Non-Safety Related Lighting Power System This system provides power to non-safety related loads and is available from cabinets throughout the plant.

24-V DC Power Systems The 24-V DC power system for each unit consists of two separate and independent 24-V DC channels. Each channel has a +24-V DC and a V DC battery charger connected in series with a common ground. The two battery chargers are connected in parallel with two 24-V batteries having a common ground. The prime source of power is from the battery chargers with the batteries serving as a backup source of power. Each channel has an independent local distribution panel.

The 24-V DC power system supplies 24-V DC power to various monitoring instrumentation during all modes of plant operation.

Power System Display Information The design of the control boards provides adequate display of power sources and distribution system status to Units 1 and 2 operators and to the Unit 3 operator.

The unit information displayed to the Unit 3 operator is equivalent to that displayed to the Units 1 and 2 operators. Each operator has a complete mimic bus showing the operator unit bus and the shutdown system. The operator also has control of the unit station service transformer and the start bus feeds to the unit boards.

The operator can control the unit board feed to the common supply system. These unit board breakers are manual breakers that supply power to the shutdown buses or boards. The automatic breakers at the shutdown buses or boards would determine which unit boards were feeding the shutdown system. Voltmeter selector switches and voltmeters provide 4-kV and 480-V bus voltage display. Major 4-kV feeder currents are displayed.

Shutdown system loading for Units 1, 2, or 3 is either automatic or coordinated through an operator. Manual loading of the system, utilizing either onsite or offsite 8.1-3

BFN-26 power, including those postulated for design basis events, will require coordination (two units requiring operation of RHR systems simultaneously). The main control room controls and instrumentation for common station service transformers including temperature alarms are located in the Unit 1 and Unit 2 control room area.

Normal and backup communication between the operators is available.

Control power display and control are essentially the same for all three units. There is no common control point for control power that is analogous to the diesel control boards in the Units 1 and 2 control room area.

8.1-4

BFN-28 8.2 GENERATORS The electrical generator of Unit 1 has a normal continuous 1330 MVA at 0.95 power factor and 22 kV. Each generator is hydrogen-cooled with liquid-cooled stator. For Units 2 and 3, the generator has a normal continuous rating of 1332 MVA at 0.93 power factor and 22 kV. The generator neutral is grounded through a neutral transformer and a secondary loading resistor. The generator is equipped with a shift driven automatic voltage regulator bus-fed from auxiliary transformers, an exciter field circuit breaker, rectifiers, and voltage regulating equipment. Current transformers are provided on the generator main and neutral terminals for relaying and metering. Each generator is connected through a generator breaker with force-cooled, isolated-phase bus to a bank of three single-phase transformers which step up the generator voltage from 22 to 500 kV. One spare transformer is provided.

Generator and Transformer Protective Relays High-speed, induction-type, percentage-differential relays protect the generator stator windings against faults, and an inverse-time overcurrent relay with voltage restraint protects it against abnormal overload. Generator or transformer grounds are detected by an induction-type overvoltage relay on the neutral transformer.

Reverse power relays are provided to detect motoring of the generator. Additional protective relays provided for generator protection include loss of field relay, volts/hertz relay, negative sequence relay, generator field ground relays (for Units 2 and 3, the generator field ground relay annunciates and does not provide any protective feature upon detection of generator field ground), Phase Unbalance Relay (alarm only), and generator breaker failure relay.

The main power transformers are protected by variable percentage differential relays with harmonic-restraint units. The main power transformer differential relay zone includes the generator breaker, main power transformer, and the 500-kV power circuit breakers. The unit station service power transformers are protected by percentage differential relays and instantaneous overcurrent relays. The unit station service power transformers have additional ground fault protection with a long time overcurrent relay connected in the transformer neutral ground circuit. Sudden-pressure devices on the main power transformers energize the auxiliary relay for their respective transformers which then energizes the common trip auxiliary relay.

The main power transformer or unit station service transformers common trip auxiliary relay operation (and differential relay operation) closes the turbine steam valves, removes generator excitation, opens the generator breaker and opens the associated power circuit breaker. The sudden pressure devices on the main power transformers and the unit station service power transformers energize an auxiliary relay which automatically operates the fire-protection water spray system 8.2-1

BFN-27 surrounding the transformer. Thermal detectors around the perimeter of each transformer also provide for the automatic initiation of the fire-protection water spray system.

Generator backup protection is provided by two directional offset mho distance relays, arranged in two-out-of-two logic, connected to bushing current transformers on the high-voltage side of the main power transformer, and by a breaker failure relay for the generator breaker.

8.2-2

BFN-26 8.3 Transmission System 8.3.1 General The Browns Ferry Nuclear Plant Units 1, 2, and 3 generators are connected into an existing network supplying large load centers. All three units are tied into TVA's 500-kV transmission system via seven 500-kV transmission lines. The 161-kV switchyard is supplied by two 161-kV transmission lines. The 500- and 161-kV switchyards supply startup, running, and shutdown power through stepdown transformers. The 161-kV switchyard also supplies the cooling tower power. These sources have the capacity and capability to meet the requirements of GDC-17.

The 500-kV connections consist of one line to the Madison 500-kV Substation; two lines to the Trinity 500-kV Substation; one line to the Maury 500-kV substation; one line to the West Point 500-kV Substation; one line to the Union 500-kV Substation; and one line to the Limestone 500-kV Substation.

The 161-kV switchyard is supplied by two 161-kV transmission lines. One of these lines connects to the Trinity 500-161-kV Substation, and the other connects to the Athens, Alabama, 161-kV Substation.

The switchyard layout is shown on Figure 8.3-2. The physical layout of the 500-kV and 161-kV lines is presented in Figure 8.3-2a. The TVA transmission network is shown in Figure 8.3-3 (historical reference only).

8.3.2 Power Generation Objective

1. The objective of the 500-kV switchyard is to receive the output of the station's Units 1, 2, and 3 generators and deliver this output to the 500-kV system network for transmission to system loads. It also serves as an offsite power source from seven 500-kV transmission lines through six unit station service transformers into plant auxiliary power distribution systems.

2. The objective of the 161-kV switchyard is to receive power from the 161-kV system network and deliver this power to station auxiliaries. It also serves as an offsite power source through two common station service transformers for Units 1, 2, and 3.

8.3.3 Power Generation Design Basis

1. The 500-kV switchyard is designed such that the output of the plant's Units 1, 2, and 3 generators may be transmitted to various parts of the 500-kV system network as the system load may require.

8.3-1

BFN-26 8.3.5 Description The 500-kV switchyard includes seven line bays and three transformer bays. The 500-kV switchyard arrangement is shown in Figures 8.3-4, 8.3-5, and 8.3-6. The four bus sections can be sectionalized by disconnect switches (see Figures 8.3-4, 8.3-5, and 8.3-6).

Normally the bus sections are tied together through the double breaker bays. This permits the output of each generator to be fed through the unit tie breakers to each bus section. A fault that would require a bus section to be isolated from the system would allow the units to continue to deliver their outputs to the remaining busses uninterrupted. Only those lines that are not served from a double breaker bay and only connected to the faulted bus would trip off. Each line has a capacity of at least 1750 MVA. Any of the 500-kV unit tie breakers may be removed from service without interrupting any unit's output. Any line breaker in a double breaker bay may be removed from service without disturbing the output of any unit. Either of the Trinity 500kV lines, which are in single breaker bays, may be removed from service by removing the affected line from service.

The 161-kV switchyard includes four bays assigned as follows (Figure 8.3-6a):

1. Common station service transformer A, cooling tower transformer 1, two 161-kV capacitor banks.

2. Athens 161-kV line,

3. 161-kV bus tie breakers, and

4. Trinity 161-kV line, common station service transformer B, Cooling Tower Transformer 2.

Two physically separated feeders are provided to the two common station service transformers which step down the voltage from 161 to 4.16-kV. Two separate feeders provide power to the cooling tower transformers. Power is received from the 161-kV TVA grid through the Trinity and Athens lines. Normally, the switchyard will be operated with both tie breakers closed and all transformers energized.

Disconnect devices are provided to permit isolation of a line or a transformer for maintenance. Both tie breakers can be taken out of service for maintenance without the loss of either common station service transformer.

8.3.5.1 500-kV/Relaying The 500-kV switchyard is provided with two sets of bus differential and carrier line protective relays. Breaker failure relays are provided for backup protection.

8.3-3

BFN-26 8.3.5.2 161-kV/Relaying The 161-kV lines are protected by three-zone step distance phase relays augmented with directional comparison carrier blocking and have directional overcurrent carrier ground and backup ground relays. When the line relays operate, the 161-kV breaker, and the secondary breakers of the transformer associated with the faulted line are tripped. The start buses and cooling tower 4-kV switchgear are transferred to the transformer supplied from the unfaulted line. The 161-kV breakers are equipped with high-speed and standard-speed reclosing.

Each of the 161- to 4.16-kV transformers is protected by variable percentage harmonic restrained differential relays, high set instantaneous overcurrent relays, secondary neutral longtime overcurrent relay, and a transformer sudden pressure device. These relays trip and lock out the 161-kV breaker, and the secondary breakers associated with one transformer. The start buses and cooling tower 4-kV switchgear are transferred to the transformer supplied from the unfaulted line.

In the event that the 161-kV breaker should fail to trip when required, breaker failure relaying is provided to operate within less than zone-2 time. Current supervision is provided from redundant current transformers.

8.3.6 Analysis The seven transmission lines connected to the 500-kV switchyard and the two transmission lines connected to the 161-kV switchyard have sufficient capacity to supply the total required power to the plant's electrical auxiliary power system under normal, shutdown, and loss of coolant accident (LOCA) conditions for any single transmission contingency. Power reaches each unit's auxiliary loads from the 500-kV system through its main transformer and its unit station service transformers (USSTs) and from the 161-kV system over two physically independent 161-kV transmission lines through the common station service transformers (CSSTs). These sources have sufficient capacity to supply all loads regardless of plant conditions.

Separation of the lines, the protection systems, and a strong transmission grid minimize the probability of simultaneous failures of offsite power sources.

Transient stability studies evaluate a LOCA in one unit. Additional stability studies (no design basis event) consider transmission contingencies. They show that the resulting disturbance to the offsite power sources is acceptable, and the transmission system remains stable.

Steady-state and transient stability studies show that the 500- and 161-kV networks are capable of supplying the offsite power requirements for normal, shutdown, and LOCA conditions. Due to the large number of diverse generating units and strong interconnections, the likelihood of an outage of a sufficient part of the transmission 8.3-4

BFN-26 system causing the loss of all sources of offsite power is considered to be extremely remote.

8.3.7 Inspection and Testing The electrical system is to be inspected and tested for:

a. Continuity of circuit,

b. Proper insulation from ground of all ungrounded circuits,

c. Proper grounding of grounded circuits,

d. All wiring checked for correctness,

e. Operational tests on all control and protective circuits,

f. Breaker timing, internal inspection, doble bushings, and bushing inspections,

g. Breaker dielectric-air, gas and oil,

h. Transformers--doble, bridge ratio, megger and oil tests, and

i. Protective relay characteristics and settings.

8.3-5

{ Redacted }

Figure 8.3-2

{ Redacted }

Figure 8.3-2a

{ Redacted }

Figure 8.3-3

{ Redacted }

Figure 8.3-4

{ Redacted }

Figure 8.3-5

{ Redacted }

Figure 8.3-6

{ Redacted }

Figure 8.3-6a

BFN-27 8.4 NORMAL AUXILIARY POWER SYSTEM 8.4.1 General The plant electric power system consists of the main generators, the main step-up transformers, the unit station service transformers (USSTs), the common station service transformers (CSSTs), the cooling tower transformers (CTTs), the batteries, and the electric distribution system as shown on Figures 8.4-1a, 8.4-lb, and 8.4-2.

Under normal plant operating conditions, the main generators supply electrical power through isolated-phase buses to the main step-up transformers and the unit station service transformers which are physically located adjacent to the Turbine Building. The primaries of the unit station service transformers are connected to the isolated-phase bus at a point between the load side of the generator breaker terminals and the low-voltage connection of the main transformers. The generator breaker has an interrupting capacity of 200,000 amperes at rated maximum voltage, a continuous current rating of 42,000 amperes with a 1.92 cycle interrupting time, and a rated voltage of 24.2kV (RMS). The maximum fault the breaker could be required to interrupt is less than 200,000 amperes. The generator breaker is used to isolate the main generator from the 500-kV system and the Normal Auxiliary Power System during startup and shutdown.

During normal operation, station auxiliary power is taken from the main generator through the unit station service transformers. During startup and shutdown, auxiliary power is supplied from the 500-kV system through the main transformers to the unit station service transformer with the main generators isolated by the main generator breakers. Auxiliary power is also available through the two common station service transformers (CSSTs) which are fed from the 161-kV system. Standby (onsite) power is supplied by eight diesel generator units (four for Units 1 and 2, and four for Unit 3).

Automatic high-speed transfers of the 4-kV unit boards to the CSST supplied 4-kV start buses are initiated by the generator or switchyard breaker failure relaying, USST protective relaying, main transformer protective relaying, or generator backup protection relaying. Automatic delayed under voltage transfer of the 4-kV unit boards (except for 1A, 1B, 2A, and 2B) to the CSST supplied 4-kV start buses are initiated by time delay voltage relays. The automatic delayed under voltage transfer of 4-kV unit boards 1A, 1B, 2A, and 2B has been disabled.

In the event of a main generator trip during normal operation, the generator breaker opens and auxiliary power is supplied from the 500-kV system through the main transformer. Failure of a preferred offsite circuit from the 500-kV switchyard for Unit 1 or 2 brings about an automatic transfer for both safety- and non-safety-related buses. The non-safety-related buses will be automatically transferred to the CSSTs.

The 4-kV shutdown buses for Units 1 and 2 transfer to the alternate units' 4-kV unit boards supplied from the opposite units unit station service transformers (USSTs) if 8.4-1

BFN-27 voltage is available. If this supply is not available, only the safety-related 4-kV shutdown boards (Class 1E system) are automatically transferred to the standby onsite electric power sources.

The offsite power circuits through the CSSTs have sufficient capacity to support the automatic transfer of the Unit 1 or 2 non-safety-related loads when there are no loads from the other units already aligned to the 4-kV start buses. However, the CSST powered 4-kV start buses do not have sufficient capacity to also support the automatic transfer of the Unit 1 or 2 safety-related loads. Therefore, during plant conditions where the alternate 500-kV offsite circuit from the alternate supply 4-kV unit board is not available to power the 4-kV shutdown bus, the automatic transfer of the normal supply 4-kV unit board to the 4-kV start bus is disabled by operator action to prevent overloading the 4-kV start buses.

If there are loads pre-aligned to the 4-kV start buses from the other units, the offsite power circuits through the CSSTs do not have sufficient capacity to support the automatic transfer of the Unit 1 or 2 non-safety-related loads. Similarly, if a CSST was out of service, the automatic transfer of the Unit 1 or 2 non-safety-related loads would over load the remaining in-service CSST. This is addressed by manually disabling the automatic transfer of selected 4-kV unit boards and/or 4-kV common boards to the 4-kV start buses.

With the most limiting actions in place, upon a loss of the normal 500-kV offsite circuit coincident with a LOCA, the affected non-safety-related 4-kV unit boards would be de-energized. The 4-kV shutdown boards would automatically load onto the diesel generators and would supply the safety-related loads needed to mitigate the consequences of the LOCA.

Because the Unit 1 or 2 safety-related loads are not allowed to automatically transfer to the CSSTs, the 161-kV offsite circuits via the CSSTs are not available to mitigate the immediate consequences of a LOCA on Unit 1 or 2. The 161-kV supplied CSSTs can still be credited as qualified alternate offsite circuits for Unit 1 or 2.

However, access to the alternate 161-kV offsite circuits will require a delayed manual transfer when operators can manually control the loads on the 4-kV start buses to support long term post accident recovery and shutdown. To support long term post accident recovery and shutdown of the non-accident units, operators can restore the de-energized 4-kV unit boards by manually transferring them to the CSST supplied 4-kV start buses as desired. The 4-kV shutdown boards could then be manually transferred from the diesel generators to the CSST supplied 4-kV unit boards as loads will allow.

Concerning Unit 3, failure of the preferred offsite circuit from the 500-kV switchyard to the main power transformer brings about an automatic transfer of the 4-kV unit boards with their connected shutdown boards to the CSSTs. If this supply is unavailable, the safety-related 4-kV shutdown boards are automatically transferred 8.4-2

BFN-27 to the standby (onsite) electric power sources. For Unit 3, the 161-kV offsite circuits via the CSSTs are the only alternate offsite sources.

The CSSTs are sized to accommodate all required safety-related and non-safety-related loads on receipt of an accident signal on Unit 3 when there are no loads from the other units already aligned to the 4-kV start buses. However, if there are loads pre-aligned to the 4-kV start buses from the other units, the offsite power circuits through the CSSTs do not have sufficient capacity to support the automatic transfer of the Unit 3 non-safety and safety-related loads. Similarly, if a CSST was out of service, the automatic transfer of the Unit 3 non-safety and safety-related loads would over load the remaining in-service CSST. This is addressed by manually disabling the automatic transfer of selected 4-kV unit boards and/or 4-kV common boards.

With the most limiting actions in place, upon a loss of the normal 500-kV offsite circuit coincident with a LOCA, the affected non-safety-related 4-kV unit boards would be de-energized. The 4-kV shutdown boards would automatically load onto the diesel generators and would supply the safety-related loads needed to mitigate the consequences of the LOCA.

The 161-kV supplied CSSTs can still be credited as qualified alternate offsite circuits for Unit 3. However, access to the alternate 161-kV offsite circuits will require a delayed manual transfer when operators can manually control the loads on the 4-kV start buses to support long term post accident recovery and shutdown. To support long term post accident recovery and shutdown of the non-accident units, operators can restore the de-energized 4-kV unit boards by manually transferring them to the CSST supplied 4-kV start buses as desired. The 4-kV shutdown boards could then be manually transferred from the diesel generators to the CSST supplied 4-kV unit boards as loads will allow.

8.4.2 Auxiliary Power System Objective The basic function of the normal auxiliary electrical power system is to provide power for plant auxiliaries during startup, operation, and shutdown, and to provide highly reliable power sources for plant loads which are important to its safety. The Normal Auxiliary Power System is to furnish power to start up and operate all the station auxiliary loads necessary for plant operation, and to furnish normal and alternate sources of power for safe shutdown. The emergency sources of power for safe shutdown will be provided by the standby (onsite) diesel generators in the Standby Auxiliary Power System.

8.4.3 Power Generation Design Basis

1. The Normal Auxiliary Power System shall be designed to furnish adequate sources and distribution of power to station auxiliaries required for the normal 8.4-3

BFN-27 station power-producing function, and for the station common functions necessary to support plant operation in a safe and efficient manner.

2. Two preferred offsite power circuits, and standby (onsite) power sources shall be available to serve these loads when required.

3. The system shall have a high degree of reliability.

8.4.4 Safety Design Basis

1. The normal auxiliary power system shall be designed to provide sufficient normal and alternate offsite power circuits to ensure a capability for prompt shutdown and continued maintenance of the plant in a safe condition.

2. The offsite power circuits and standby auxiliary power sources shall be sufficient in number and of such electrical and physical independence that no single event, as a minimum requirement, can negate all auxiliary power at one time.

3. The normal and alternate offsite power circuits for each unit shall each be sufficient to supply the power to shut down the unit and maintain it in a safe condition under normal or accident situations. One of these circuits shall be available within a few seconds following a loss of coolant accident to assure that core cooling, containment integrity, and other vital safety functions are maintained. The other circuit shall be available in sufficient time to assure that plant safety design limits are not exceeded. Only one unit is assumed to be in an accident condition.

4. The buses shall be arranged so that essential loads can be easily transferred to the standby onsite diesel generators.

5. Buses and service components shall be physically separated to limit or localize the consequences of electrical faults or mechanical accidents occurring at any point in the system.

8.4.5 Description Reference is made to Figures 8.4-1a and 8.4-2, which show the arrangement, source connections, and source ratings for this system. Further reference is made to Figures 8.4-1b and 8.4-2, which show the sources into the standby emergency auxiliary system. Table 8.4-1 is provided to explain the flow of power, transfers between normal and alternate sources, and pertinent operational comments on each of the boards and buses involved in the Normal and Standby Auxiliary Power Systems.

8.4-4

BFN-27 8.4.5.1 Unit, Common Station Service, and Cooling Tower Transformers The unit station service transformers are located outside the Turbine Building near their respective main generator leads, with isolated-phase bus ducts used for the primary connections. The common station service and cooling tower transformers are located outside. Lighting arresters are provided as shown in Figure 8.3-6a to protect the common station service transformers.

The transformers are three-phase, double-secondary, outdoor-type, oil-filled, Class OA/FA or OA/FA/FOA, rated for 55°C temperature rise but with 65°C rise insulation.

The transformers are designed, manufactured, and tested in accordance with TVA Standard Specifications. Transformer secondaries are wye-connected with resistance-grounded neutrals to provide positive relay operation on ground faults, to limit short-circuit damage, and to avoid damaging transient overvoltage during fault conditions. Common station service and cooling tower transformers are wye-connected on the 161-kv primary, and each has a delta-connected stabilizing winding. Unit station service transformers have delta-connected 20.7-kv primaries.

Each is capable of operating continuously with no loss of life at 112 percent of rating at 65°C temperature rise.

Unit station service transformer 1B, 2B, and 3B, which are fed from their respective unit generator or 500-k switchyard, supply normal power to the 4160-V Unit boards 1A, 1B, 2A, 2B, 3A, and 3B. Each of these transformers is equipped with on-load tap changers on the primary winding that can regulate the voltage over a +/-10 percent range. Load tap changers (LTC) operate from signals received from voltage sensors on either of the 4160-V transformer secondary windings. Upon receiving a voltage signal outside the limits of a set bandwidth, the voltage sensors transmit a signal to the load tap changers to compensate for the voltage change.

The on-load tap changers on the unit station service transformers have a voltage range of 18630-V to 22770-V with the equivalent of 17 possible transformation ratios. The nominal time required to change a tap position after receiving a signal from the voltage sensors is 1.10 seconds. Remote manual control of the load tap changers can also be accomplished from the Main Control Room. The control circuits of the on-load tap changers will block tap changer operation and alarm for sensed voltage outside the permissible range for tap changer operation. Alarms are also provided for tap changer "off position."

Common Station Service Transformers A and B are fed from the 16l-kV system and supplies power to 4160-V start buses 1A, 1B, 2A and 2B.

These transformers are equipped with no-load and automatic on-load tap changers that can regulate the voltage. The load tap changers operate from signals received 8.4-5

BFN-27 from voltage sensors on Start Boards 1 and 2 at the 4160-V transformer secondary winding side. Upon receiving a voltage signal outside the limits of the load tap changer bandwidth settings, the voltage sensors transmit a signal to the load tap changers to compensate for system voltage changes.

The on-load tap changers and the no-load tap changers on the Common Station Service Transformers have a combined equivalent of 65 possible transformation ratios. Each on-load tap changer has a plus and minus six steps from the neutral position (13 positions total). These automatic load tap changers are capable of operating at a rate of 1.1 seconds per tap change. Remote manual control of the load tap changers can also be accomplished from the Main Control Room. The control circuits of the on-load tap changers will block LTC operation and alarm for sensed voltage outside the permissible range for the tap changer operation. Alarms are also provided for tap changer "off position."

Unit station service transformer 1B and 2B are each capable of carrying the load consisting of the safety loads of Units 1 and 2 operating in Modes 1 through 5, or with Unit 1 or 2 during accident conditions and the other unit operating in Modes 1 through 5.

Unit station service transformer 3B is capable of continuously carrying the load consisting of all safety loads of Unit 3 operating in Modes 1 through 5 or during accident conditions.

8.4.5.2 4160-V Systems The 4160-V unit board switchgear consists of three boards per unit as shown in Figures 8.4-1a, 8.4-1b, and 8.4-2. The boards are connected so that they can be supplied from either a unit or a common station service transformer. The switchgear sections are heavy-duty, metal-clad, of standardized unit construction. Power connections from the station service transformer to the switchgear are with nonsegregated buses.

The overcurrent relays and devices are selected to provide full selective coordination on overloads, ground faults, and phase faults throughout the system from station service transformers through motor control center branch molded-case breakers. The control power for switchgear is supplied from 250-V DC power supplies with battery backup. The cooling tower switchgear (A, B, C, and D only) also has 120V AC breaker tripping.

Each board and the startup bus has its source breakers interlocked to prevent paralleling power sources, and each is provided with manual and automatic bus transfer schemes. Automatic transfers are initiated by generator and transformer protective relays, degraded under voltage on 4160-V shutdown boards and loss of voltage at the normal supply (except for loss of voltage on 4160-V unit board 1A, 1B, 8.4-6

BFN-27 2A, and 2B). Transfer is blocked through manually-reset lockout relays in case of faulted bus. Each bus section is provided with a manual-automatic transfer selector switch.

The breakers and transformers are rated according to standard electrical-industry practice where the impedance of the source, the short-circuit current, and the breaker short-circuit current capabilities are taken into account.

Equipment is designed and tested in accordance with NEMA and IEEE/ANSI Standards for metal-clad switchgear and power circuit breakers.

Each circuit breaker is provided with 250-V DC control power, stored-energy mechanism; mechanically-operated, cell-mounted auxiliary switch with sufficient contacts for all required interlocking; current transformers for metering and relaying; and necessary switchgear-type auxiliary relays for interlocking station auxiliaries and supervision.

Each switchgear bus section and incoming line is provided with two open-delta-connected potential transformers. Each motor breaker and 4160-480-V transformer primary breaker is provided with two current transformers (one in phase A and one in phase C) for metering and phase-overcurrent relaying, and one ground sensor current transformer for ground relaying. Each includes induction-type overcurrent relays, and an instantaneous ground overcurrent relay.

Each switchgear bus section has an undervoltage relay which will trip all motors on the bus in case of prolonged undervoltage.

Primary reading, two-element watt-hour meters are provided on each common station service transformer secondary breaker, each tap from the start buses, and for each 4-kV motor breaker.

Each station service transformer secondary breaker, and each start bus breaker is provided with three ammeters, one wattmeter, and one voltmeter with transfer switch. One ammeter and phase selector switch is provided on each motor and 4160-480-V transformer feeder. One voltmeter and phase selector switch is provided on each switchboard bus section.

Metal-enclosed, group-phase, insulated-conductor bus ducts are provided from common and unit station service transformer secondaries to the switchgear, for start buses, and connections from the start buses to switchgear. Bus ducts are furnished with a continuous current rating as required for the full transformer or load rating.

Each switchgear bus and startup bus section provided with a three-phase set of differential relays of the high-speed induction overcurrent type. Each source and 8.4-7

BFN-27 load breaker in each differential zone has three current transformers for this use only.

Each common and unit station service transformer and cooling tower transformer has differential overcurrent protection. Each secondary breaker is provided with three current transformers for differential relaying only.

Each main breaker and bus tie breaker is provided with three current transformers in addition to those for differential relaying, for use with metering and overcurrent relaying. Three induction-type overcurrent relays are provided, two for phase currents and one for residual or ground currents.

8.4.5.3 480-V Load Center Unit Substations Each substation consists of 4160-480-V transformers, primary terminal box, and close-coupled or bus duct connected 480-V, metal-enclosed switchgear. The 480-V distribution system is three-phase ungrounded.

Each substation bus is normally fed from its own transformer, with an alternate source consisting either of an adjacent 480-V bus section or of another transformer serving as standby. Substations serving station lighting have manually operated main breakers. Other substations have automatic and/or manual transfers to the alternate source.

Ventilated dry-type transformers are three-phase, delta-delta, 60kV BIL, rated for 80°C temperature rise. Transformers are AA/FA rated. A no-load tap changer handle, with means for pad locking, is provided on the outside.

Liquid-insulated transformers are enclosed with a curb to contain the liquid in case of a tank rupture.

Liquid-filled transformers are three-phase, delta-delta, 60-kV BIL, rated for 55°C temperature rise but with 65°C rise insulation for 12 percent margin in continuous capability. Transformers are class OA except where dual ratings are shown in Figures 8.4-1a, 8.4-1b, and 8.4-2, in which cases transformers are class OA/FA. A no-load tap changer handle, with means for padlocking, is provided outside the tank.

Main and bus tie breakers and the main switchgear bus are rated 1600, 800, or 600 amperes, depending on the maximum transformer capability, and in accordance with IEEE/ANSI Standard C37.16.

Each circuit breaker has three poles, and is electrically and mechanically trip-free with either long-time and instantaneous or long-time and short-time overcurrent trip devices, unless overcurrent relays are provided. The circuit breakers have manual 8.4-8

BFN-27 or electrical stored-energy closing mechanism, mechanical pushbutton trip, and position indicator, and they are equipped for mounting on the drawout mechanism in the breaker compartment.

Breakers controlling motors are electrically operated with time and instantaneous series overcurrent tripping.

Breakers serving motor control centers or panelboards are manually operated with short-time selective and long-time series overcurrent tripping, except for 480-V shutdown board feed to 480-V control bay vent boards which are electrically operated.

The 480-V lighting switchgear have main breakers with short-time selective and long-time series overcurrent tripping and have key interlocking between main breakers.

On other 480-V switchgear, the main breakers are provided with three current transformers, three induction-type overcurrent relays with hand-reset lockout relay, and a circuit breaker control switch.

Each incoming line has two potential transformers, ammeter and phase selector switch, voltmeter and phase selector switch, wattmeter, undervoltage and overvoltage relay and, except for selected safety boards, an auxiliary relay for initiating automatic bus transfer and automatically restoring normal condition. The 480-V shutdown boards and 480-V HVAC board have manual transfer only. Each automatic bus transfer scheme has a manual-automatic transfer selector switch.

Each bus which serves important unit auxiliary motors has two delta-connected potential transformers with voltmeter and phase selector switch, and induction-type undervoltage relay and auxiliary relay to trip selected large motors after prolonged loss of voltage. For the 480-V shutdown boards selection of motors tripped is based on safe shutdown requirements. Refer to Section 8.5.3.5 for description for 480-V shutdown boards.

Each 480-V main bus has a ground indicator.

Each electrically operated breaker has a test pushbutton for electrically closing and tripping the breaker only when the breaker is in the test position. Each electrically operated breaker uses 250-V DC control power.

8.4.5.4 480-V Motor Control Centers Motor control centers are in accordance with NEMA Standard IC1. Circuit equipment consists of molded-case, thermal-magnetic or magnetic only circuit breakers, contactors or starters, and auxiliary relays and timing relays as required.

8.4-9

BFN-27 Motor control centers have local indication and remote annunciation for loss of main bus voltage.

Each starter has one red indicating light connected across the load terminals to indicate that the contactor is energized.

Each single-speed motor starter has at least two hand reset overload relays, with the exception of selected MOVs which have throttling requirements which preclude the use of thermal overload protection. Each two-speed motor starter has at least two overload relays for each speed.

Starters and contactors are controlled with 120-V AC, single-phase, ungrounded supplies from 480/120-V control power transformers. Two-pole, 250-V control fuses are provided at each starter or contactor.

8.4.6 Safety Evaluation 8.4.6.1 Normal Auxiliary Power System Control Functions Components used in the Normal Auxiliary Power System are those which are widely applied throughout the utility and industrial applications. In such applications, the usage frequently demands reliability comparable to that of the requirements under consideration herein. More specifically, some examples of the components which are used are General Electric type IAV relays for the detection of bus undervoltage, General Electric type HFA, HGA, and HEA auxiliary relays for necessary multiplication of contacts to achieve simultaneous functions, ATC motor-driven timing relays, and General Electric type SB-1 or SBM control switches. These electrical devices are of the heavy duty type, conservatively rated and applied, with many years of operating experience. Control power is from the 250-V DC battery system or from 480/120-V or 480/240-V AC control power transformers.

The control circuitry is designed to provide certain automatic features as described herein and to allow the operators to take other appropriate action as may be required by the circumstances. The occurrence of automatic functions is adequately displayed in the control room so that the operators can observe that proper conditions have been established. For instance, should one of the 4.16-kV buses fail to be energized after loss of the normal power source, the operator has available in the control room the necessary annunciation and manual controls (except for the cooling tower switchgear) to operate the appropriate circuit breakers.

The Normal Auxiliary Power System provides adequate power to operate all the station auxiliary loads necessary for plant operation. The power sources for the plant auxiliary power supply are sufficient in number and capacity, and of such electrical and physical independence that no single probable event could interrupt all auxiliary power at one time. Loads important to plant safety are split and diversified 8.4-10

BFN-27 between switchgear sections, and means are provided for rapid location and isolation of system faults.

In the event of a total loss of all offsite power circuits, auxiliary power is supplied from standby diesel generators located on the site (safety-related boards only).

The multiplicity of lines feeding the 500-kV and 161-kV switchyards, the redundancy of transformers and buses within the plant, and the divisions of critical loads between buses yield a system that has a high degree of reliability. Also, the design utilizes physical separation of buses and service components to limit or localize the consequences of electrical faults or mechanical accidents occurring at any point in the system.

The plant is designed to shut down safely on complete loss of offsite electrical power. Upon loss of offsite power and reactor shutdown, standby power provides auxiliary cooling, lighting, and miscellaneous services to permit access to plant areas and to ensure continued removal of decay heat.

Shutdown power normally comes from offsite sources as described above. A high degree of reliability in the auxiliary power system contributes to continuity of operation and hence to safety.

If Unit 1 or 2 generator is incapacitated, the generator breaker will be opened and auxiliary power backfed from the 500-kV system. There are still three other alternate independent offsite power circuits: the offsite 500-kV system through the unaffected unit station service transformer B, the offsite 161-kV system through common station service transformer A, or the offsite 161-kV system through common station service transformer B. The first alternate circuit offsite power is from the opposite units 500-kV system via the USSTs. Because the Unit 1 and 2 safety-related boards are not allowed to automatically transfer to the CSSTs, the 161-kV circuits via the CSSTs are not available to mitigate the immediate consequences of an accident or transient. The 161-kV supplied CSSTs can still be credited as qualified alternate offsite circuit for Units 1 and 2. However, access to the 161-kV will require a delayed manual transfer when operators can manually control the loads on the 4-kV start buses to support long term post accident recovery and shutdown. Each offsite power circuit and the standby (onsite) sources may be connected to feed the shutdown boards, and each has capacity for operation of all systems required to shut down the unit and maintain it in a safe shutdown condition.

There are two independent shutdown buses that supply the Units 1 and 2 shutdown boards. These buses are normally connected to the 4-kV unit boards A and B.

Table 8.4-1 is a listing of the normal auxiliary power supplies and bus transfer schemes.

8.4-11

BFN-27 If the Unit 3 generator is incapacitated, the generator breaker will be opened and auxiliary power backfed from the 500-kV system. There are still two other alternate independent offsite power circuits: the offsite 161-kV system through common station service transformer A, or the 161-kV system through common station service transformer B. Should any of the alternate offsite power circuits not be immediately available, auxiliary power will be fed from the onsite standby diesel generator units.

Each offsite power circuit and the standby (onsite) sources may be connected to feed the shutdown boards, and each has capacity for operation of all systems required to shut down the unit and maintain it in a safe shutdown condition.

For Units 1, 2, and 3, under certain plant conditions automatic transfer of the safety and non-safety related boards to the alternate offsite power circuits may be disabled.

In the event that a main generator is incapacitated with a loss of the normal 500-kV offsite power circuit, the boards will be de-energized instead of automatically transferring to the CSST supplied 4-kV start buses. The onsite standby diesel generators would supply the associated safety-related 4-kV shutdown boards in both divisions. To support long term post accident recovery and shutdown of the non-accident units, operators can restore the de-energized 4-kV unit boards by manually transferring them to the CSST supplied 4-kV start buses as desired. The 4-kV shutdown boards could then be manually transferred from the diesel generators to the CSST supplied 4-kV unit boards as loads will allow. The 161-kV supplied CSSTs can still be credited as qualified alternate offsite circuits. However, access to the 161-kV circuits will require a delayed manual transfer when operators can manually control the loads on the 4-kV start buses to support long term post accident recovery and shutdown.

10 CFR-50, Appendix A, General Design Criteria 17 requires that electric power from the transmission network to the onsite electric distribution system shall be supplied by two physically independent circuits. Only one of these circuits is required to be available within a few seconds following a loss-of-coolant accident to assure that core cooling, containment integrity, and other vital safety functions are maintained. The other circuit is required to be available in sufficient time to assure that plant safety design limits are not exceeded. Although access to the alternate circuits is delayed with the automatic transfers disabled, there is no loss of redundancy since two offsite circuits remain capable of supplying plant loads. A delayed manual access to the alternate offsite circuits is a manual operator action that must be performed to support a design function in response to an accident.

Sufficient instrumentation and controls are available such that the operator actions to align the alternate offsite circuits can be taken from the main control room using plant procedures. Automatic protection of safety limits is still assured as the safety-related 4-kV shutdown boards still automatically load onto the diesel generators. Since the plant can remain on the diesel generators for several days, the timing of the manual transfers to the alternate circuits may be delayed without adversely impacting any plant safety design limits. Therefore, access to the alternate source may be a delayed manual transfer. With the automatic transfers 8.4-12

BFN-27 disabled, the electrical distribution system still meets the requirement of General Design Criteria 17 of two physically independent circuits.

At no time will loss of auxiliary power prevent scram, since stored pneumatic energy and normal reactor pressure, or stored pneumatic energy alone at low reactor pressure, are the means of driving in the control rods.

The Normal Auxiliary Power System is operated and instrumented either at the individual unit control boards or at the electrical control board which is common to all three units. The electrical control board is located between Units 1 and 2 control boards.

The control functions of the Normal Auxiliary Power System which are only unit-related, such as feeder and load breaker operation, are located on the respective unit control boards only. The electrical control functions which are shared by Units 1, 2, and 3, such as feeder breaker operation to the common 4160-V board, are located on the electrical control board.

Unit 3 is provided with a centralized control room physically separated from the common control room for Units 1 and 2. Units 1, 2, and 3 share the same Reactor Building bay.

The principal elements of the normal auxiliary electrical system are shown on the electrical system key diagrams in Figures 8.4-1a, 8.4-1b, and 8.4-2. All plant auxiliaries except the reactor feedwater pumps, high-pressure coolant injection pump, and reactor core isolation cooling system pump (these are steam turbine-driven) are powered by electric drives. Under startup, shutdown, and for normal operating conditions, all loads necessary for the operation of the reactors and turbine-generator sets and 4-kV common boards A and B are supplied from the unit station service transformers. Recirculation pump boards 1, 2, and 3 are supplied from separate windings on the common or unit station service transformers and supply only the variable frequency drives which power the recirculation pump motors. The high-voltage drop incurred during starting of these large motors can be confined to these buses and will have negligible effect on the rest of the system.

The 4160-V unit boards 1A, 1B, 1C, 2A, 2B, 2C, 3A, 3B, and 3C supply the remainder of the motors associated with the reactors and turbine-generator sets.

Safety-related loads required during shutdown conditions are supplied from the shutdown boards. Power to these shutdown buses and boards is normally supplied from the appropriate 4160-V unit boards. If necessary, power will be supplied from the standby diesel generators. All shutdown boards are located within seismic Class I buildings. Each 4160-V shutdown board and each 480-V shutdown board, and their transformers, are physically isolated from each other.

If all sources of power other than the diesel generators are lost, provision is made for manually connecting the diesel generators to backfeed a 4-kV unit board for the 8.4-13

BFN-27 purpose of operating a main turbine condenser as an alternate reactor cooling heat sink. Interlocks prevent paralleling the diesel generators with the normal auxiliary power sources should they return to availability. Operation in this mode does not interfere with the logic for automatic connection of diesel generators for independent operation upon receipt of an accident signal.

Loads and systems that are common to Units 1, 2, and 3, except standby emergency systems, cooling towers, and the Post Accident Sampling Facility (PASF), are supplied from common boards A and B, which are normally fed by the Units 1 and 2 unit station service transformers.

8.4.6.2 Automatic Manual Selection of Normal Power Source and Single Failures See Figure 8.4-3 for details of the automatic transfer scheme as applied to the shutdown bus circuit breaker trip-and-close circuits.

The 43-1 (automatic-manual) or 43-2 (automatic-manual) relay for the shutdown bus is tripped to the manual position by actuating the pushbutton located in the unit control room. This places the two unit board feed breakers to the shutdown bus in the manual mode. The operator then closes the unit board feed breaker that is to supply the shutdown bus. After the shutdown bus is energized, the operator resets the 43-1 or 43-2 relay to the automatic position; this places the shutdown bus on automatic transfer.

A single fault in the coil circuit of the relay could trip it to manual or prevent resetting to the automatic position. This would not trip or close any circuit breaker. The operator will have indication of the relay position by the relay target and a lighted pushbutton. The operator will be in full control and still have the same sources of power available to the shutdown buses as on automatic. With this portion of the system on manual, the automatic transfer of the unit boards from the unit station service transformer to the start bus will still make the primary offsite power source available to the shutdown system automatically. It would take a double fault for a failed 43-1 relay contact to cause a circuit breaker to trip or close.

An undervoltage on the normal power source to a shutdown bus will trip the source breaker and prevent it from closing. The remaining source is automatically selected and the bus is reenergized. This transfer takes place through the 30 percent residual voltage relay. A trip of the 4-kV unit board source breakers, if feeding the shutdown bus, will cause a 4-kV shutdown bus transfer identical to that of the source undervoltage transfer described above, except that the residual relay is bypassed, resulting in a fast transfer.

8.4-14

BFN-27 Both shutdown buses cannot be automatically paralleled unless a double fault occurs, since the trip-and-close circuits of each breaker are interlocked such that they cannot both be closed at the same time.

Automatic shutdown bus transfers are blocked for the following conditions:

1. Accident signal received (block begins 5 seconds after an accident signal and continues until the signal is cleared),

2. Any bus source breaker transfer switch turned to the emergency position,

3. Any source breaker lockout relay operation,

4. Shutdown bus lockout relay operation,

5. Backfeed switch in the backfeed position, and

6. Automatic-manual relay in the manual position.

8.4.7 Inspection and Testing An extensive and exacting inspection and testing program has evolved as standard procedure for all TVA generating station construction. The procedures are formalized by data sheets, check sheets and reports. The program is expanded in the case of nuclear plant construction to include tests required to assure reactor safety and to include expanded operational tests of functions related to reactor safety. The discussion here is limited to quality assurance and field setting of components in the auxiliary power system.

8.4.7.1 Shop Testing All transformers, switchgear, and motor control centers are subjected, as a minimum, to factory tests required under NEMA and ANSI standards. These tests include dielectric tests, electrical and mechanical operation of circuit breakers and contactors, and measurement of transformer constants.

Manufacturer's certified test reports are submitted to TVA for review and approval.

8.4.7.2 Inspection TVA inspects, as appropriate, manufacturer's work during production, and permits release of equipment for shipment from the factory only after assuring the equipment is complete, that it has been manufactured in accordance with the specifications, that specified tests have been performed, and that the equipment is of high quality.

The equipment is inspected for damage in shipment before acceptance at the jobsite.

8.4-15

BFN-27 8.4.7.3 Field Tests TVA performs all tests required to determine that the auxiliary power equipment functions safely, reliably, and as designed. These tests are made prior to energizing the equipment. Examples of these tests are: detailed check of small wiring, meggering of electrical power conductors, and phase relation and motor rotation checks. All protective relays and circuit breaker series overcurrent devices are set and tested with calibrated equipment in accordance with setting instructions issued or approved by design departments.

8.4.8 Modifications and Safety Evaluations 8.4.8.1 Upper and Lower Degraded Voltage Sensing Systems In response to 1977 NRC Guidelines Position 1 - Second Level of Under or Over Voltage Protection with a Time Delay, both upper and lower degraded voltage relaying systems have been installed on each 4-kV shutdown board. The 4-kV shutdown board A degraded voltage scheme, along with associated voltage monitoring relays, is shown on Figure 8.4-4. The degraded voltage relaying of the remaining seven (7) shutdown boards is identical to that of shutdown board A.

Setpoints mentioned in Section 8.4.8 are nominal values.

8.4.8.1.1 Over Voltage Sensing System Refer to Figure 8.4-4. The three (3) upper degraded voltage relays sense each of the three (3) phase-to-phase voltages on the shutdown board potential transformer secondaries. If two (2) of the three (3) relays sense a shutdown board voltage above their setpoint (4400-V) for more than five seconds, time delay pickup relay will pick up and give annunciation. The annunciation will alert the operator to reduce board voltage.

8.4.8.1.2 Undervoltage Sensing System Refer to Figure 8.4-4. The three (3) lower degraded voltage relays sense each of the three (3) phase-to-phase voltages on the shutdown board potential transformer secondaries. If two (2) of the three (3) relays sense a shutdown board voltage below their setpoint (3920-V), approximately 0.3 seconds, time delay relay will initiate timing.

Should a degraded voltage exist for approximately 4 seconds, the diesel generator will start.

8.4-16

BFN-27 Two other methods for starting the diesel generator are as follows:

a. For a loss of shutdown board voltage of greater than 1.5 seconds, relays will drop out and start the diesel generator. This transfer from offsite power to diesel generator power will not occur if voltage recovers to the reset setpoint (2870-V) within 1.5 seconds.

b. An accident signal (low reactor vessel water level or high drywell pressure coincident with low reactor pressure) or a pre-accident signal (low reactor vessel water level or high drywell pressure) for either Unit 1, 2, or 3 starts all eight diesel generator units with no time delay.

Should a degraded voltage exist for 6.9 seconds, time delay relays will pickup and initiate shutdown board A power system isolation, load shedding, and eventual closing of the diesel generator breaker when the diesel is up to normal speed and voltage. This initiation is inhibited if either diesel generator breaker 1818 or intertie breaker 1824 is closed. The closing of either of these breakers is referred to as "diesel generator voltage available signal" in Figure 8.5-4a. Time delay pickup relay (set at 1.3 seconds), allows time for shutdown board power system isolation and subsequent voltage decay before the diesel generator breaker 1818 close signal is issued.

For a sustained degraded voltage the diesel generator start signal is issued at approximately 4 seconds; the shutdown board power system isolation and load shedding signal is issued at approximately 6.9 seconds; and the diesel generator breaker 1818 close signal is issued at approximately 8.2 seconds.

The setpoints of the timers has been determined by analysis and includes, among other attributes, 5 percent repeatability.

For a loss of 4-kV shutdown board A voltage, the diesel generator breaker 1818 close signal is issued immediately provided the diesel generator is up to normal speed and voltage, shutdown board A power system isolation and load shedding has been initiated, and breakers 1716, 1614, and 1824 are tripped.

This initiation is inhibited if there is an accident signal from any unit and either breaker 1818 or 1824 is closed.

Loss of voltage relays can initiate diesel generator start, shutdown board A power system isolation, load shedding, and connection of the diesel generator independent of the degraded voltage sensing system. Except for diesel generator start, this initiation is inhibited for an accident signal in conjunction with either diesel generator breaker 1818 or intertie breaker 1824 being closed.

8.4-17

BFN-27 8.4.8.1.3 Degraded Voltage Sensing System Conformance to NRC Requirements (Maintained for Historical Reference)

The degraded voltage sensing system design requirements are given in 1977 NRC Guidelines Position 1 - Second Level of Under or Over Voltage Protection with a Time Delay; sections (a), (b), (c), (d), and (e).

Section(a) Requirements are as follows:

a. The selection of voltage and time set points shall be determined from an analysis of the voltage requirements of the safety-related loads at all onsite systems distribution levels.

Response

The results of the original analysis performed in response to section (a) is presented in FSAR Section 8.4.8.1.4. To support the restart of Units 1, 2, and 3, another voltage drop analysis has been performed. This new analysis specifies transformer tap settings which ensures that voltage levels at the 4160V and 480V busses are adequate without transfer to onsite (diesel) power under normal operating, accident, and refueling conditions, with maximum and minimum voltage levels at the 500 kV and 161 kV busses.

Section b) Requirements as follows:

b. The voltage protection shall include coincidence logic to preclude spurious trips of the offsite power source.

Response

The relay logic for each shutdown board is arranged in a two-out-of-three logic scheme, thereby satisfying this criterion.

Section c) Requirements are as follows:

c. The time delay selected shall be based on the following conditions:

1. The allowable time delay, including margin, shall not exceed the maximum time delay that is assumed in the FSAR accident analysis,

2. The time delay shall minimize the effect of short duration disturbances from reducing the availability of the offsite power source(s), and

3. The allowable time duration of a degraded voltage condition at all distribution system levels shall not result in failure of safety systems or components.

8.4-18

BFN-27

Response

The diesel generators and their operational sequence of core standby cooling systems is analyzed in FSAR Section 6.5 to ensure that the maximum time delay that is assumed in the accident analysis is not exceeded. The shutdown board voltage dips below the lower degraded voltage setpoint (3920-V) for less than three seconds during the start of its largest motor (RHR), therefore a 4 second lower degraded voltage time delay prior to issuing the diesel generator start signal will minimize the effects of short duration disturbances.

The effects of short term degraded voltage on downstream electrical equipment has been analyzed and will not result in failure of safety systems and components.

Section d) Requirement is as follows:

d. The voltage monitors shall automatically initiate the disconnection of offsite power sources whenever the voltage set point and time delay limits have been exceeded.

Response

This is the case of our design, refer to Figure 8.4-4.

Section e) Requirement is as follows:

e. The voltage relays are designed to satisfy the requirements of IEEE Std.

279-1971, "Criteria for Protection Systems for Nuclear Power Generating Stations."

Response

How the voltage relays satisfy the requirements of IEEE-279-1971 is discussed as follows:

Requirements of IEEE-279-1971 Seismic and Environmental Qualifications The voltage relays will be operable under seismic conditions.

a. These relays have been seismically qualified to a more severe seismic level at the other plants than that required for the Browns Ferry Nuclear Plant.

b. The associated time delay relays are seismically qualified for these specific applications by combinations of seismic and circuit analyses. The analysis compared the most severe seismic requirement imposed on the relay at its 8.4-19

BFN-27 mounting locations with the relay seismic capability established by vendor-supplied test data.

c. All equipment is located above probable maximum flood level. Monitors are mounted inside switchgear and are designed to operate under accident conditions.

Class 1E Qualifications All equipment is Class 1E. The relays are arranged in a two-out-of-three logic for each voltage condition; therefore, the failure of a single voltage monitor will not cause spurious system operation or cause the system to be inoperative. All voltage relays will be mounted in the shutdown system switchgear which is of compatible classifications. Time delay relays are located in 4kV logic panels for Units 1 and 2 and in the shutdown system switchgear for Unit 3. 4kV logic panels have compatible classification.

Independence Overvoltage relays and undervoltage relays are independent of each other. These conditions apply to each of the four shutdown boards associated with Units 1 and 2, and also to each of the four boards for Unit 3.

Redundancy of Equipment and Controls Each 4-kV shutdown board is supplied with three overvoltage and three undervoltage monitors. Each system of three monitors is connected so that a single failure will not result in the loss of the appropriate tripping function.

Reliability of Components Components used to monitor degraded grid voltage conditions have been selected to ensure voltage monitored system operation. These components comply with the quality control and quality assurance requirements as set forth in 10 CFR Part 50.

Testability The voltage monitors in each 4-kV shutdown board have the capability of being tested during normal operation. Provisions are made for periodic testing of voltage monitors and timing relays.

8.4.8.1.4 Voltage Drop Analysis (Summary)

Analyses were performed to verify the AC auxiliary power system is capable of supplying sufficient voltage to successfully start and run all safety motors required 8.4-20

BFN-27 for Units 1, 2, and 3 without transfer to onsite (diesel) power for normally expected system loading.

Design Bases

1. Maximum load will occur 60 seconds following a Unit 1, 2, or 3 LOCA.

2. 480-V load used in the analysis is the anticipated actual load.

3. Each 460-V safety motor is analyzed to ensure adequate starting and running voltage to the motor terminals.

Results The AC auxiliary power system is capable of supplying sufficient voltage to successfully start and run all safety motors without transfer to onsite (diesel) power for expected system loading.

The 4-kV safety motors have a normal operating range of +/- 10 percent with a 20 percent voltage drop allowed on starting.

The 460-V safety motors are considered to have an operating range of +/- 10 percent, with a 15 percent voltage drop allowed on starting (except 20 percent for compressor motors). For those motors that do not operate within this range, justification is provided in the form of engineering analysis or vendor documentation.

The 4-kV shutdown board degraded voltage relaying has two setpoints - high voltage and low voltage as follows:

a. The upper degraded voltage relaying annunciates when the 4-kV shutdown board voltage goes above 4400-V (110 percent of 4000-V). This annunciation will alert the operator to take action to reduce the shutdown board voltage.

b. The lower degraded voltage relaying initiates, after a time delay, a transfer of the shutdown board to the standby onsite (diesel) power distribution system when the board steady state voltage falls below 3920-V. This will ensure proper operation of all safety loads fed from the board. In addition, the lower degraded voltage relays have a fully adjustable reset point to allow for reset just above the relay operating setpoint (reset at less than or equal to 1.5 percent above trip value).

8.4-21

BFN-27 Concerning the 500-kV Offsite Power Source:

The Unit 1, 2, and 3 station service transformers with automatic onload tap changers can successfully supply all 4-kV and 460-V safety motors under all expected load and switchyard voltage variations without transfer to onsite (diesel) power, this includes normal running and startup conditions. The 4-kV shutdown board voltage dips below 3920-V for less than 3 seconds during the start of its largest motor (RHR). This time is well within the degraded voltage approximately 6.9 second pickup time to trip offsite power to the shutdown board in preparation for transfer to diesel power. The system will not transfer to onsite (diesel) power during normal motor startup conditions.

Concerning the 161-kV Offsite Power Source:

The common station service transformers A and B with automatic on-load tap changers can successfully supply all 4-kv and 460-V safety motors under an accident load and swithyard voltage variations without transfer to onsite (diesel) power due to a lower degraded voltage condition. Motor starting currents which cause the 4-kV shutdown board bus voltages to dip below the lower degraded voltage setpoint (3920-V) will recover before transfer to onsite power is initiated.

A way of exceeding the upper voltage setpoint (4000-V) was determined.

A combination of the following:

- Shutdown boards being fed from the 161-kV system

- Highest expected 161-kV switchyard voltage

- Light auxiliary power system load The upper degraded voltage relays annunciate after a time delay of approximately 5 seconds to alert the operator to take corrective action.

8.4-22

BFN-26 TABLE 8.4-1 Sheet 1 AUXILIARY POWER SUPPLIES AND BUS TRANSFER SCHEMES General Remarks

1. All breakers which may supply a given bus are interlocked to prevent paralleling supply sources.

2. Each bus has provision for manually transferring between normal and alternate sources. Manual transfers of all 4160-V buses are high speed except as otherwise indicated.

3. Bus transfers which are initiated automatically by undervoltage are time coordinated to avoid needless transfer of buses toward the load.

4. The term "high-speed transfer" applies to 4160-V bus transfers between stored-energy circuit breakers which are controlled for a dead time not exceeding 5 cycles.

5. The term "delayed transfer" applies to 4160-V bus transfers supervised by bus residual relays, which permit either the normal supply breaker to trip or the alternate supply breaker to close when the bus voltage decays to a value safe for connected motors. Normally the residual voltage relay will be set at 30 percent voltage. The delayed transfer for 4-V Unit Boards 1A, 1B, 2A, and 2B has been disabled.

6. Automatic bus transfer is blocked by operation of bus overcurrent or current differential relays for all 4160-V buses. Except for those minor 480-V buses normally supplied from main 480-V buses of the normal auxiliary power system, all 480-V automatic bus transfers are blocked by bus overcurrent protective devices.

7. The offsite power circuits through the CSSTs do not have the capacity to support all connected loads for electric plant alignments where there is an existing pre-load on the CSST supplied 4160-V start buses or if a CSST is out of service. This is addressed by manually disabling the automatic transfer of selected 4160-V unit boards and/or 4-kV common boards. See FSAR figures for any limitations on usage of power sources.

BFN-26 TABLE 8.4-1 Sheet 2 AUXILIARY POWER SUPPLIES AND BUS TRANSFER SCHEMES Power Sources Item Board and/or Main Bus Normal Alternate Remarks 1 4160-V Start bd 1 - Start COM SS TR A, COM SS TR B, Automatic high speed transfer from the normal to Bus 1A X-winding fed from X-winding fed from the alternate source is initiated by operation of Athens or Trinity Athens or Trinity of protective relays for the normal source common 161 kV lines 161 kV lines station service transformer, or for the 161-kV line feeding that transformer. The bus will be automatically returned to its normal source 40 cycles after return of voltage on the normal source. This time delay is to avoid needless switching during 161-kV line reclosing operations. If alternate source voltage is abnormally low, the normal source breaker will not trip (no transfer); if the normal source breaker trips again within 15 seconds, it will lock out with an alarm, and operator reset will be required.

2 4160-V Start bd 1 - Start COM SS TR B, COM SS TR A, (See Remarks under Item 1)

Bus 1B X-winding, fed from X-winding fed from Athens or Trinity Athens or Trinity 161 kV lines 161 kW lines 3 4160-V Start bd 2 - Start COM SS TR A, COM SS TR B, Automatic high speed transfer from the normal to Bus 2A Y-winding fed from Y-winding fed from the alternate source is initiated by operation of Athens or Trinity Athens or Trinity protective relays for the normal source common 161 kV lines 161 kV lines station service transformer, or for the 161-kV line feeding that transformer. Automatic delayed transfer from the normal to the alternate source is initiated by time delay undervoltage relays. The bus will be automatically returned to its normal source 40 cycles after return of voltage on the normal source. This time delay is to avoid needless switching during 161-kV line reclosing operations. If alternate source voltage is abnormally low, the normal source breaker will not trip (no transfer); if the normal source breaker trips again within 15 seconds, it will lock out with an alarm, and operator reset will be required.

BFN-26 TABLE 8.4-1 Sheet 3 AUXILIARY POWER SUPPLIES AND BUS TRANSFER SCHEMES Power Sources Item Board and/or Main Bus Normal Alternate Remarks 4 4160-V Start bd 2 - Start COM SS TR B, COM SS TR A, (See Remarks under Item 3)

Bus 2B Y-winding fed from Y-winding fed from Athens or Trinity Athens or Trinity 161 kV lines 161 kV lines 4a 4160-V Bus Tie Board Alternate 1 5 Shutdown Bus 1 (4160-V) 4 kV unit bd 1A or 4 kV unit bd 2B or The two independent shutdown buses normally 2B of preselected 1A (that source not supply 4160-V power to assigned 4160-V shutdown on-line unit preselected for boards, with each bus serving as the normal "normal") source to two boards and as the alternate source to the two other boards. Of the two possible Alternate 2 feeders to each shutdown bus from the two 4 kV unit boards, one feeder is preselected manually Same 4 kV unit bd as the normal source to that bus. Automatic of preselected delayed transfer from the normal to an alternate unit, but with a 1 source is initiated by undervoltage on the delayed manual normal source. Automatic high-speed transfer from transfer to start the normal to an alternate 1 source is initiated bus 1A or 1B when the normal source 4 kv unit board normal source breaker trips. If an alternate 1 source is not available, the transfer is prevented, and there is a delayed Alternate 3 manual transfer to the alternate 2 source. Automatic transfer is blocked after time delay in the presence of an accident signal. Alternate 3 source may be Two diesel generators selected manually only.

if required for back-feeding a preselected 4 kv unit bd (1A, 2B)

See also remarks for items 13, 14, 15, and 16.

BFN-26 TABLE 8.4-1 Sheet 4 AUXILIARY POWER SUPPLIES AND BUS TRANSFER SCHEMES Power Sources Item Board and/or Main Bus Normal Alternate Remarks Alternate 1 6 Shutdown Bus 2 (4160-V) 4 kV unit bd 1B or 4 kV unit bd 2A (See Remarks under Item 5) 2A, of preselected or 1B (that source on-line unit not preselected for "normal")

Alternate 2 Same 4 kV unit bd of preselected unit, but with a delayed manual transfer to start bus 1A or 1B Alternate 3 Two diesel generators, if required for back-feeding a preselected 4 kV unit bd (1B, 2A) See also remarks for items 13, 14, 15, and 16 7 4 kV Recirculation Pump Boards:

(a) Unit 1, Pump VFD 1A Unit SS TR 1A Start Bus 2A Automatic high-speed transfer from the normal to Board 1 Y-winding the alternate source is initiated by main generator unit trip relays. Automatic delayed transfer from the normal to the alternate source is initiated by high-speed voltage relay.

BFN-26 TABLE 8.4-1 Sheet 5 AUXILIARY POWER SUPPLIES AND BUS TRANSFER SCHEMES Power Sources Item Board and/or Main Bus Normal Alternate Remarks (b) Unit 1, Pump VFD 1B Unit SS TR 1A Start Bus 2B Board 1 Y-winding (c) Unit 2, Pump VFD 2A Unit SS TR 2A Start Bus 2A Board 2 Y-winding (d) Unit 2, Pump VFD 2B Unit SS TR 2A Start Bus 2B Board 2 Y-winding (e) Unit 3, Pump VFD 3A Unit SS TR 3A Start Bus 2A Board 3 Y-winding (f) Unit 3, Pump VFD 3B Unit SS TR 3A Start Bus 2B Board 3 Y-winding 8 4 kV Unit Boards, Unit 1 Alternate 1 (a) 4 kV unit bd 1A Unit SS TR 1B Start bus 1A Automatic high-speed transfer from the normal to X-winding alternate 1 source is initiated by generator or switchyard breaker failure relaying, USST protective relaying, main transformer protective relaying, or generator backup protection relaying (See General Remarks Numbers 5 and 7)

Alternate 2 Backfeed from shut- Manual only through backfeed switches down bus

BFN-26 TABLE 8.4-1 Sheet 6 AUXILIARY POWER SUPPLIES AND BUS TRANSFER SCHEMES Power Sources Item Board and/or Main Bus Normal Alternate Remarks Alternate 1 (See Remarks Item 8(a))

(b) 4 kV unit bd 1B Unit SS TR 1B Start bus 1B Y-winding Alternate 2 Backfeed from shut- Provisions are included for backfeeding diesel-down bus generator power from the 4-kV shutdown boards into the 4160-V unit boards for reactor plant shutdown cooling if all plant power, other than diesel generator power, is lost. The plant design includes a mode of operation for running one condenser circulating water pump to permit use of the condensers as a heat sink.

Alternate 1 (c) 4 kV unit bd 1C Unit SS TR 1A Start bus 1B Automatic high-speed transfer from the normal to the X-winding alternate 1 source is initiated by generator or switchyard breaker failure relaying. USST protective relaying, main transformer protective relaying or generator backup protection relaying. Automatic delayed transfer from the normal to the alternate 1 source is initiated by a time delay voltage relay.

(See General Remarks Number 7).

9 4 kV Unit Boards, Unit 2 Alternate 1 (a) 4 kV unit bd 2A Unit SS TR 2B Start Bus 1A (See Remarks Item 8(a))

X-winding Alternate 2 Backfeed from shut-down bus

BFN-26 TABLE 8.4-1 Sheet 7 AUXILIARY POWER SUPPLIES AND BUS TRANSFER SCHEMES Power Sources Item Board and/or Main Bus Normal Alternate Remarks Alternate 1 (b) 4 kV unit bd 2B Unit SS TR 2B Start Bus 1B (See Remarks Item 8(a))

Y-winding Alternate 2 Backfeed from shut-down bus Alternate 1 (c) 4 kV unit bd 2C Unit SS TR 2A Start bus 1A (See Remarks Item 8(c))

X-winding (See General Remarks Number 7) 10 4 kV Unit Boards, Unit 3 Alternate 1 (a) 4 kV unit bd 3A Unit SS TR 3B Start bus 1A Automatic high-speed transfer from the normal to X-winding the alternate 1 source is initiated by generator or switchyard breaker failure relaying, USST protective relaying, main transformer protective relaying, or generator backup protection relaying. Automatic delayed transfer from the normal to the alternate 1 source is initiated by a time delay voltage relay.

(See General Remarks Number 7)

BFN-26 TABLE 8.4-1 Sheet 8 AUXILIARY POWER SUPPLIES AND BUS TRANSFER SCHEMES Power Sources Item Board and/or Main Bus Normal Alternate Remarks Alternate 2 Backfeed from shut- Manual only through backfeed switches.

down boards Alternate 1 (b) 4 kV unit bd 3B Unit SS TR 3B Start bus 1B (See Remarks Item 10(a))

Y-winding Alternate 2 Backfeed from shut- Provisions are included for backfeeding diesel down boards generator power from the 4-kV shutdown boards into the 4160-V unit boards for reactor plant shutdown cooling if all plant power, other than diesel generator power, is lost. The plant design includes a mode of operation for running one condenser circulating water pump to permit use of the condensers as a heat sink.

Alternate 1 (c) 4 kV unit bd 3C Unit SS TR 3A Start bus 1A (See Remarks Item 10(a))

X-winding 11 4 kV Common Board A Unit SS TR 1A Start Bus 1A Automatic delayed transfer from the X-winding normal to the alternate source is initiated by undervoltage on the normal source, subject to voltage check on the alternate source. Automatic delayed transfer back to the normal source is initiated by return of normal voltage on the normal source. Manual transfers in either direction are the fast transfer type.

(See General Remarks Number 7) 12 4 kV Common Board B Unit SS TR 2A Start Bus 1B (See General Remarks Number 7)

X-winding Alternate 2 13 4 kV Shutdown Board A Shutdown Bus 1 Shutdown Bus 2 (See also remarks for items 5 and 6.)

BFN-26 TABLE 8.4-1 Sheet 9 AUXILIARY POWER SUPPLIES AND BUS TRANSFER SCHEMES Power Sources Item Board and/or Main Bus Normal Alternate Remarks Manual delayed transfer from Diesel Generator to Shutdown Bus when electrical loads permit operators manually transfer the boards to the alternate 4.16-kV Shutdown bus. Alternate 2 source is tripped in the presence of a common accidental signal.

Alternate 1 All diesel generators are automatically started Diesel generator A by an accident signal, or by loss of voltage on its shutdown board for 1.5 seconds, or degraded Alternate 3 voltage for 4 seconds. After 5 seconds without voltage on the shutdown board, all its supply Manual, access con- breakers and all its loads except 4160-480-V nection to diesel transformers are all automatically tripped.

generator 3A via 4-kv Alternate 1 source is then automatically shutdown board 3EA connected. Manual return to the normal auxiliary power system is permitted if normal auxiliary power system voltage returns.

Provision is made to manually select alternate 3 source.

Alternate 2 14 4 kV Shutdown Board B Shutdown Bus 1 Shutdown Bus 2 Alternate 1 Diesel generator B Alternate 3 Manual, access con-nection to diesel generator 3B via 4-kV shutdown board 3EB

BFN-26 TABLE 8.4-1 Sheet 10 AUXILIARY POWER SUPPLIES AND BUS TRANSFER SCHEMES Power Sources Item Board and/or Main Bus Normal Alternate Remarks Alternate 2 15 4 kV Shutdown Board C Shutdown Bus 2 Shutdown Bus 1 Alternate 1 Diesel generator C Alternate 3 Manual, access to diesel generator 3C via 4-kv shutdown board 3EC Alternate 2 16 4 kv Shutdown Board D Shutdown Bus 2 Shutdown Bus 1 Alternate 1 Diesel generator D Alternate 3 Manual, access to diesel generator 3D via 4-kV shutdown board 3ED 16a 4 kV Shutdown Board 3EA 4 kV Unit Board 3A Alternate 1 Provisions are included for backfeeding diesel generator power from the shutdown boards into the Diesel generator 3A 4160-V unit boards for reactor plant shutdown cooling if all plant power, other than diesel generator power, is lost. For this purpose, means are provided to manually synchronize 4-kV shutdown boards.

BFN-26 TABLE 8.4-1 Sheet 11 AUXILIARY POWER SUPPLIES AND BUS TRANSFER SCHEMES Power Sources Item Board and/or Main Bus Normal Alternate Remarks Alternate 1 16b 4 kV Shutdown Board 3EB 4 kV Unit Board 3A Diesel generator 3B Alternate 1 16c 4 kV Shutdown Board 3EC 4 kV Unit Board 3B Diesel generator 3C Alternate 1 16d 4 kV Shutdown Board 3ED 4 kV Unit Board 3B Diesel generator 3D

BFN-26 TABLE 8.4-1 Sheet 12 AUXILIARY POWER SUPPLIES AND BUS TRANSFER SCHEMES Power Sources Item Board and/or Main Bus Normal Alternate Remarks 17 480-V Water Supply Board Alternate 1 (a) Bus 1 4 kV unit bd 1B Bus 2 (Item 17b) Automatic transfer from the normal to the via TR TW1 alternate source is initiated by time-Alternate 2 undervoltage on the normal source. Return to the normal source is automatic upon return of voltage Bus 3 (Item 17c) to the normal source.

Alternate 1 (b) Bus 2 4 kV unit bd 2B Bus 1 (Item 17a) via TR TW2 Alternate 2 Bus 3 (Item 17c)

Alternate 1 (c) Bus 3 4 kV unit bd 3B Bus 2 (Item 17b) via TR TW3 Alternate 2 Bus 1 (Item 17a) 18 480-V Unit Boards (a) Unit 1, 480-V Unit Bd 1A 4 kV unit bd 1A 4 kV com bd B Automatic transfer from the normal to the via TR TU1A (via TR TEB) alternate source is initiated by time-undervoltage on the normal source. Return to the normal source is automatic upon return of voltage to the normal source.

(b) Unit 1, 480-V Unit Bd 1B 4 kV unit bd 1B 4 kV com bd B via TR TU1B (via TR TEB)

BFN-26 TABLE 8.4-1 Sheet 13 AUXILIARY POWER SUPPLIES AND BUS TRANSFER SCHEMES Power Sources Item Board and/or Main Bus Normal Alternate Remarks (b) Unit 1, 480-V Unit Bd 1B 4 kV unit bd 1B 4 kV com bd B via TR TU1B (via TR TEB)

(c) Unit 2, 480-V Unit Bd 2A 4 kV unit bd 2A 4 kV com bd B via TR TU2A (via TR TEB)

(d) Unit 2, 480-V Unit Bd 2B 4 kV unit bd 2B 4 kV com bd A via TR TU2B (via TR TEA)

(e) Unit 3, 480-V Unit Bd 3A 4 kV unit bd 3A 4 kV com bd A via TR TU3A (via TR TEA)

(f) Unit 3, 480-V Unit Bd 3B 4 kV unit bd 3B 4 kV com bd A via TR TU3B (via TR TEA) 19 480-V Lighting Boards (a) 480-V Lighting Bd 1 4 kV com bd A 4 kV com bd B Transfer between sources is manual only. Each via TR TL1 (via TR TEB) 480-V lighting board serves as the power source, via single phase voltage regulators (Unit 2 only) and 480-V to 240/120-V stepdown transformers, for three 240/120-V lighting boards per unit. These unit lighting boards serve various distribution cabinets in the plant.

(b) 480-V Lighting Bd 2 4 kV com bd A 4 kV com bd B via TR TL2 (via TR TEB)

(c) 480-V Lighting Bd 3 4 kV com bd B 4 kV com bd A via TR TL3 (via TR TEA) 20 480-V Common Boards

BFN-26 TABLE 8.4-1 Sheet 14 AUXILIARY POWER SUPPLIES AND BUS TRANSFER SCHEMES Power Sources Item Board and/or Main Bus Normal Alternate Remarks (a) 480-V Common Bd 1 Bus A 4 kV com bd A Bus B of Item 20a Automatic transfer from he normal to the via TR TC1A alternate source is initiated by time-undervoltage on the normal via TR TC1B source.

Bus B 4 kV com bd B Bus A of Item 20A Return to the normal source is automatic upon via TR TC1B return of voltage to the normal source.

(b) 480-V Common Bd 2 Bus A 4 kV com bd A Bus B of Item 20b via TR TC2A Bus B 4kV com bd B Bus A of Item 20b via TR TC2B (c) 480-V Common Bd 3 Bus A 4 kV com bd A Bus B of Item 20c via TR TC3A Bus B 4 kV com bd B Bus A of Item 20c via TR TC3B 21 480-V Service Building Main Board Bus A 4 kV com bd A Bus B of Item 21 Same as remarks for Item 20.

via TR TSBA Bus B 4 kV com bd B Bus A of Item 21 via TR TSBB 22 480-V Radwaste Boards Board 1 480-V Serv Bldg Bd 1) 480-V com bd 1 If the normal feed should fail, a manually (item 21) Bus A 2) 480-V Diesel Aux actuated transfer to the alternate source Bd-A may be made.

Board 2 480-V com bd 1 1) 480-V Serv Bldg Bd Item 20 Bus B (item 21)

2) 480-V Diesel Aux Bd-B Board 3 480-V Service 480-V Common board 1 Building board Bus A (Item 21) Bus B

BFN-26 TABLE 8.4-1 Sheet 15 AUXILIARY POWER SUPPLIES AND BUS TRANSFER SCHEMES Power Sources Item Board and/or Main Bus Normal Alternate Remarks 23 480-V Auxiliary Boiler Bd Bus A 480-V com bd 3, 480-V com bd 1, Both buses are normally fed from source shown, Bus A Bus B and with the manually operated bus tie breaker Bus B closed. Automatic transfer of both buses from 480-V com bd 3, 480-V com bd 1, the normal to the alternate source is initiated Bus Bus B by time-undervoltage on the normal source. Return to the normal source is automatic upon return of voltage to the normal source.

24 480-V Control Bay Vent Boards Board A 480-V Shutdown Bd 1A 480-V com Bd 1 The automatic transfer from the safety related normal source to the non-safety related alter-Board B 480-V HVAC Bd B 480-V com Bd 3 nate source has been disabled by opening the emergency feeder breaker for Control Bay Vent Board A and placing the transfer switch "43" in manual mode for Control Bay Vent Board B. Manual transfer to the alternate source will be administratively controlled.

25 480-V Turbine MOV Boards (a) Unit 1, Board 1A 480-V unit bd 1A 480-V com bd 1, Automatic transfer from the normal to the Bus A alternate source is initiated by time-initiated by time-undervoltage on the normal (b) Unit 1, Board 1B 480-V unit bd 1B 480-V com bd 2-Bus B source. Return to the normal source is automatic upon return of voltage to the normal source.

(c) Unit 1, Board 1C 480-V unit bd 1B 480-V com bd 2-Bus B (d) Unit 2, Board 2A 480-V unit bd 2A 480-V com bd 3-Bus B (e) Unit 2, Board 2B 480-V unit bd 2B 480-V com bd 2-Bus B (f) Unit 2, Board 2C 480-V unit bd 2B 480-V com bd 2-Bus A (g) Unit 3, Board 3A 480-V unit bd 3A 480-V com bd 3-Bus A (h) Unit 3, Board 3B 480-V unit bd 3B 480-V com bd 3-Bus B (i) Unit 3, Board 3C 480-V unit bd 3B 480-V com bd 2-Bus A

BFN-26 TABLE 8.4-1 Sheet 16 AUXILIARY POWER SUPPLIES AND BUS TRANSFER SCHEMES Power Sources Item Board and/or Main Bus Normal Alternate Remarks 26 480-V Condensate Demin-eralizer Boards (a) Unit 1 480-V unit bd 1A 480-V shdn bd 1B In case of failure of the normal source, automatic transfer is made to an energized alternate source. Upon restoration of the normal source, automatic return to normal is effected.

(b) Unit 2 480-V unit bd 2A 480-V shdn bd 2B (c) Unit 3 480-V unit bd 3A 480-V shdn bd 3B 27 480-V Reactor Building Vent Boards (a) Unit 1, Board 1A 480-V unit bd 1A 480-V com bd 1-Bus B See remarks of Item 23.

(b) Unit 1, Board 1B 480-V unit bd 1A 480-V com bd 1-Bus B (c) Unit 2, Board 2A 480-V unit bd 2A 480-V com bd 3-Bus A (d) Unit 2, Board 2B 480-V unit bd 2A 480-V com bd 3-Bus A (e) Unit 3, Board 3A 480-V unit bd 3A 480-V com bd 3-Bus B (f) Unit 3, Board 3B 480-V unit bd 3A 480-V com bd 3-Bus B 28 480-V Turbine Building Vent Boards (a) Unit 1, Board 1A 480-V unit bd 1A 480-V com bd 1-Bus A See remarks on Item 23.

(b) Unit 1, Board 1B 480-V unit bd 1B 480-V com bd 2-Bus B (c) Unit 2, Board 2A 480-V unit bd 2A 480-V com bd 3-Bus B (d) Unit 2, Board 2B 480-V unit bd 2B 480-V com bd 2-Bus A (e) Unit 3, Board 3A 480-V unit bd 3A 480-V com bd 3-Bus A (f) Unit 3, Board 3B 480-V unit bd 3B 480-V com bd 2-Bus A

BFN-26 TABLE 8.4-1 Sheet 17 AUXILIARY POWER SUPPLIES AND BUS TRANSFER SCHEMES Power Sources Item Board and/or Main Bus Normal Alternate Remarks 29 480-V Shutdown Boards (a) Unit 1, 480-V Shutdown Bd 1A 4 kV shutdown bd A 4 kV shutdown bd B Transfer from the normal to the alternate via TR TS1A via TR TS1E source is manual. Interlocking is provided to prevent manually transferring to a faulted board and to prevent paralleling two sources.

(b) Unit 1, 480-V Shutdown Bd 1B 4 kV shutdown bd C 4 kV shutdown bd B Remark (a) via TR TS1B via TR TS1E (c)

(c) Unit 2, 480-V shutdown Bd 2A 4 kV shutdown bd B 4 kV shutdown bd C via TS2A via TR TS2E (d) Unit 2, 480-V shutdown Bd 2B 4 kV shutdown bd D 4 kV shutdown bd C Remark (a) via TR TS2B via TR TS2E (e) Unit 3, 480-V Shutdown Bd 3A 4kV shutdown bd 3EA 4 kV shutdown bd 3EB Remark (a) via TR TS3A via TR TS3E (f) Unit 3, 480-V Shutdown Bd 3B 4 kV shutdown bd 3EC 4 kV shutdown bd 3EB Remark (a) via TR TS3B via TR TS3E 30 480-V Reactor MOV Boards Remark 29(a)

(a) Unit 1, 480-V Reac MOV Bd 1A 480-V Shutdown Bd 1A 480-V Shutdown Bd 1B Remark 29(a)

(b) Unit 1, 480-V Reac MOV bd 1B 480-V Shutdown Bd 1B 480-V Shutdown Bd 1A Remark 29(a)

(c) Unit 1, 480-V Reac MOV Bd 1C 480-V Shutdown Bd 1B 480-V Shutdown Bd 1A Remark 29(a)

BFN-26 TABLE 8.4-1 Sheet 18 AUXILIARY POWER SUPPLIES AND BUS TRANSFER SCHEMES Power Sources Item Board and/or Main Bus Normal Alternate Remarks (f) Unit 2, 480-V Reac MOV Bd 2A 480-V Shutdown Bd 2A 480-V Shutdown Bd 2B Transfer from the normal to the alternate source alternate source is manual. Interlocks prevent transferring a fault from one source to another and paralleling sources.

(g) Unit 2, 480-V Reac MOV Bd 2B 480-V Shutdown Bd 2B 480-V Shutdown Bd 2A Transfer from the normal to the alternate source is manual. Interlocks prevent transferring a fault from one source to another and paralleling sources.

(h) Unit 2, 480-V Reac MOV Bd 2C 480-V Shutdown Bd 2B 480-V Shutdown Bd 2A Transfer from the normal to the alternate source manual. Interlocks prevent transferring a fault from one source to another and paralleling sources.

(i) Unit 2, 480-V Reac MOV Bd 2D 480-V Shutdown Bd 2A 480-V Shutdown Bd 2B Transfer from the normal to the alternate source is initiated by manual actions at the 480V Shutdown Boards. These manual actions open the normal feeder breaker and close the alternate feeder breaker, which is sensed by time-undervoltage on the normal source. Interlocks prevent transferring a fault from one source to another and paralleling sources. Return to the normal source is manual upon return of voltage to the normal source.

(j) Unit 2, 480-V Reac MOV Bd 2E 480-V Shutdown Bd 2B 480-V Shutdown Bd 2A Transfer from the normal to the alternate source is initiated by manual actions at the 480V Shutdown Boards. These manual actions open the normal feeder breaker and close the alternate feeder breaker, which is sensed by time-undervoltage on the normal source. Interlocks prevent transferring a fault from one source to another and paralleling sources. Return to the normal source is manual upon return of voltage to the normal source.

(k) Unit 3, 480-V Reac MOV Bd 3A 480-V Shutdown Bd 3A 480-V Shutdown Bd 3B Transfer from the normal to the alternate source is manual. Interlocks prevent transferring a fault from one source to another and paralleling sources.

BFN-26 TABLE 8.4-1 Sheet 19 AUXILIARY POWER SUPPLIES AND BUS TRANSFER SCHEMES Power Sources Item Board and/or Main Bus Normal Alternate Remarks (l) Unit 3, 480-V Reac MOV Bd 3B 480-V Shutdown Bd 3B 480-V Shutdown Bd 3A Transfer from the normal to the alternate source is manual.

Interlocks prevent transferring a fault from one source to another and paralleling sources.

(m) Unit 3, 480-V Reac MOV Bd 3C 480-V Shutdown Bd 3B 480-V Shutdown Bd 3A Transfer from the normal to the alternate source is manual.

Interlocks prevent transferring a fault from source to another and paralleling sources.

(n) Unit 3, 480-V Reac MOV Bd 3D 480-V Shutdown Bd 3A 480-V Shutdown Bd 3B Automatic transfer from the normal to the alternate source is initiated by manual actions at the 480V Shutdown Boards. These manual actions open the normal feeder breaker and close the alternate feeder breaker, which is sensed by time-undervoltage on the normal source. Interlocks prevent transferring a fault from one source to another and paralleling sources. Return to the normal source is manual upon return of voltage to the normal source.

(o) Unit 3, 480-V Reac MOV Bd 3E 480-V Shutdown Bd 3B 480-V Shutdown Bd 3A Automatic transfer from the normal to the alternate source is initiated by manual actions at the 480V Shutdown Boards. These manual actions open the normal feeder breaker and close the alternate feeder breaker, which is sensed by time-undervoltage on the normal source. Interlocks prevent transferring a fault from one source to another and paralleling sources. Return to the normal source is manual upon return of voltage to the normal source.

31 480-V Diesel Auxiliary Boards (a) 480-V Diesel Aux Bd A 4 kV Shutdown Bd A 4 kV Shutdown Bd B Transfer from the normal to the alternate source via TR TDA via TR TDE is manual. Interlocks prevent transferring a fault from one source to another and paralleling sources.

(b) 480-V Diesel Aux Bd B 4 kV Shutdown Bd D 4 kV Shutdown Bd B Remark (a) via TR TDB via TR TDE (c) 480-V Diesel Aux Bd 3EA 480-V Shutdown Bd 3A 480-V Shutdown Bd 3B Remark (a)

(d) 480-V Diesel Aux Bd 3EB 480-V Shutdown Bd 3B 480-V Shutdown Bd 3A Remark (a) 32 480-V HVAC Boards (b) 480V HVAC Board B 4-kV Shutdown Bd 3ED 480-V Shutdown Bd 3B Transfer from the normal to the alternate source is manual.

Interlocking is provided to prevent manually transferring to a faulted board and to prevent paralleling two sources.

BFN-26 Table 8.4-2 (Deleted by Amendment 11)

BFN-26 Table 8.4-3 (Deleted by Amendment 11)

BFN-26 Table 8.4-4 (Deleted by Amendment 10)

BFN-26 Table 8.4-5 (Deleted by Amendment 10)

BFN-26 Table 8.4-6 (Deleted by Amendment 10)

BFN-26 Table 8.4-7 (Deleted by Amendment 13)

BFN-26 Table 8.4-8 (Deleted by Amendment 10)

BFN-26 Table 8.4-9 (Deleted by Amendment 10)

BFN-26 Table 8.4-10 (Deleted by Amendment 10)

BFN-26 Table 8.4-11 (Deleted by Amendment 11)

BFN-26 Table 8.4-12 (Deleted by Amendment 10)

BFN-26 Table 8.4-13 (Deleted by Amendment 10)

BFN-26 Table 8.4-14 (Deleted by Amendment 13)

BFN-27 8.5 STANDBY AC POWER SUPPLY AND DISTRIBUTION 8.5.1 Safety Objectives The safety objective of the Standby AC Power System is to provide a self-contained, highly reliable source of power, as required for the Engineered Safeguards System, so that no single credible event can disable the core standby cooling functions or their supporting auxiliaries.

8.5.2 Safety Design Basis

1. The system shall be designed so that a single failure will not jeopardize the effectiveness of the Emergency Core Cooling System.

2. A spurious accident signal shall be considered a single failure.

3. For the long term (greater than 10 minutes), three of the Unit 1 and 2 diesel generators, paralleled with the three respective Unit 3 diesel generators, shall be adequate to supply all required loads for the safe shutdown and cooldown of all three units in the event of loss of offsite power and a design basis accident in any one unit. This feature is considered to be a Defense-In-Depth capability feature because paralleling is not required to safely shutdown and cool all three units following an accident in one unit and loss of offsite power.

Reference GEH Report 002N4870, Revision 0, Task Report, Tennessee Valley Authority, Browns Ferry Nuclear Plant (BFN), Non-Accident Unit Shutdown Containment Response (EDMS R05 160531 001).

4. Adequate fuel supply shall be provided for operation of the diesel engines during the maximum-expected time interval between replenishment (seven days).

5. The Standby AC Power System and its associated equipment shall be capable of withstanding Design Basis Earthquake ground motions without impairment of its function.

6. The Standby AC Power System and its associated equipment shall be automatically initiated.

7. The Standby AC Power System shall be adequate to address accident signals, spurious and real, in both units in any order (real followed by spurious, or spurious followed by real).

8.5-1

BFN-27

8. The Standby AC Power System shall be adequate to supply sufficient power so that the reactor cores meet the 10 CFR 50, Appendix K, ECCS Criteria.

9. No operator action would be required in the short term (minimum of 10 minutes).

10. The Standby AC Power System shall be adequate to provide power for the long term to operate two RHR subsystems at design flow on each unit. This includes two RHR service water pumps on each reactor for cooling and two on the EECW System for the plant.

11. The Standby AC Power System will meet or exceed the requirements of IEEE-308 and -279.

12. The Standby AC Power System shall be testable.

13. Although the diesel generators are not required to meet the specific load, voltage, and frequency limits of Safety Guide 9, their capacity and capability shall be adequate to meet the intent of Safety Guide 9 for the adequacy of the onsite power supply.

14. The Standby AC Power System shall be adequate to supply sufficient power so that the ECCS components meet the NPSH requirements of Safety Guide 1.

8.5.3 Description 8.5.3.1 General The standby AC supply and distribution system for Units 1 and 2 consists of four diesel generators, four 4.16-kV shutdown boards, four 480-V shutdown boards, eight MOV boards, two 480-V diesel auxiliary boards, and one control bay ventilation board. In addition to its other functions, the system serves as the alternate supply to two 480-V condensate demineralizer boards, and emergency supply to two radwaste boards. Figure 8.4-1b (Subsection 8.4) shows the arrangement of this portion of the overall auxiliary system and how normal power feeds into this portion of the system. Eight diesel generators, (four for Units 1 and 2, and four for Unit 3) are provided as a standby power supply to be used on loss of the Normal Auxiliary Power System. Each of the diesel generators is assigned primarily to one 4.16-kV shutdown board. It is possible, through breaker ties to the shutdown buses, to make any diesel generator available to any 4.16-kV shutdown board. All AC loads 8.5-2

BFN-27 Necessary for the safe shutdown of the plant under accident or nonaccident conditions are fed from this distribution system.

The standby AC supply and distribution system for Unit 3 is separate from that of Units 1 and 2. It consists of four diesel generators (3A, 3B, 3C, and 3D), four 4.16 kV shutdown boards, two 480-V shutdown boards, one 480-V HVAC board, five MOV boards, two 480-V diesel auxiliary boards, one 480-V control bay vent board, and the SGTS board. In addition to its other functions, the system serves as the alternate supply to one condensate demineralizer board. For flexibility of operation, provisions have been made for the interconnection of 4.16-kV shutdown board A (Units 1 and 2) with 4.16-kV shutdown board 3EA (Unit 3). Similar interconnections have been provided between boards B and 3EB, C and 3EC, and D and 3ED. The interconnections are through manually controlled circuit breakers.

The Standby AC Power System, including the diesel generators, Diesel Generator Buildings, fuel oil storage, and associated mechanical and electrical equipment, is designed as seismic Class I equipment in accordance with Appendix C, "Structural Qualification of Subsystems and Components."

8.5.3.2 Diesel Generators Rating The diesel generators are General Motors Model Number 999. Each diesel engine is rated at 2550 kW (electrical) continuous, and 2800 kW for two hours in a 24-hour period. Each diesel generator is rated at 4.16-kV, three-phase, 60 Hz, 0.8 power factor, 3250 KVA continuous, and 3575 KVA for two hours in a 24-hour period.

Protective Relaying Figure 8.5-1 is a one-line diagram showing the protective relaying and instrumentation used with each diesel generator and located on the diesel generator protective relaying panels. There is one of these protective relaying panels for each diesel generator. The protective relaying applied to each diesel generator includes:

a. Differential overcurrent,

b. Reverse power,

c. Loss of excitation,

d. Overcurrent with voltage restraint,

• 8.5-3

BFN-27

e. Field overcurrent, and

f. Ground-fault current.

In the absence of an accident signal (low reactor vessel water level or high drywell pressure coincident with low reactor pressure), protective relaying items a through d (above) cause the tripping of the diesel generator breaker and the molded case switch in the diesel generator field circuit, while items e and f cause an alarm only.

In the presence of an accident signal, only differential overcurrent can cause tripping of the diesel generator breaker and molded case switch. Each diesel generator is wye-connected with its neutral grounded through a distribution transformer and secondary resistor. This method of grounding permits only a few amperes of fault current to flow on the occurrence of a ground on the system when the diesel generator is the only power source connected. A voltage relay connected across the secondary resistor is used to monitor the system for ground faults.

In addition to this protective relaying, an overspeed trip device and a field voltage relay are supplied with the diesel generator. On operation, the overspeed device stops the diesel generator and trips the main or emergency diesel generator breaker. Operation of the overspeed device causes tripping, whether or not an accident signal is present. The field voltage relay will cause an alarm on loss of field.

• EDG A, B, C, D, 3B, 3C, and 3D Only - In the absence of an accident signal (low reactor vessel water level or high drywell pressure coincident with low reactor pressure), protective relaying items a through c (above) cause the tripping of the diesel generator breaker and the molded case switch in the diesel generator field circuit, while item d only trips the diesel generator breaker and items e and f cause an alarm only.

Instrumentation Each diesel generator is instrumented to give readings of current, voltage, and real and reactive power in its Diesel Generator Room, in its respective Main Control Room, at each shutdown board to which it can be directly connected, and, for Units 1 and 2, at the diesel generator central information panel which is located near the Diesel Generator Rooms.

Control and Loading Logic The control of the diesel generators from the various points of control (i.e., Main Control Rooms, 4.16-kV shutdown boards, or locally at the diesel generator) is described as follows.

8.5-4

BFN-27

1. Main Control Rooms The Main Control Room controls function as described below only when the backup control switches located on the 4160-V shutdown boards are in the NORMAL position. Diesel electrical controls are arranged as follows.

A manual start switch for starting all the associated unit diesel generators at one time is located on each units panel 9-8. The central diesel control board (panel 9-23) has a manual start/stop station and synchronizing equipment for each of the diesel generators.

2. 4.16-kV Shutdown Boards The diesel generator controls on the 4.16-kV shutdown boards function as described below only when the associated backup control switch is in the EMERGENCY position.

Each diesel generator has a manual start/stop station and synchronizing equipment on the board to which it can be connected.

A two-position, backup control switch (NORMAL-EMERGENCY) for each diesel generator is located on each corresponding 4.16-kV shutdown board for divorcing diesel generator control from the control room. In the EMERGENCY position, the backup control switch enables all diesel generator control functions to be performed at the shutdown board, irrespective of faults in the control room diesel generator manual control circuits. This switch is under administrative control and is in the NORMAL position except when the plant is on backup control, in which case the switch is placed in the EMERGENCY position. Operation of the switch to the EMERGENCY position activates an alarm at the diesel generator control board.

3. Local at Diesel generator Start/stop and manual field-flash capabilities are available at the diesel-engine-generator control cabinet located at the diesel generator. This control is available only when the associated diesel generator logic panel is deenergized.

This control is primarily for maintenance, but could also be used to make the diesel generator available should control power at the logic panel be inadvertently lost.

A Unit 1 and Unit 2 central information panel is located in the Diesel Generator Building. This panel presents loading information and has communication facilities essential to load-dispatching supervision when either unit is on backup control. All unit actual backup operations are conducted from the appropriate backup panel and 8.5-5

BFN-27 shutdown boards or MOV boards; none is carried out at the central information panel.

Receipt of a common accident signal (low reactor vessel water level or high drywell pressure coincident with low reactor pressure) results in the starting of all eight diesel generators. Any diesel generator output breakers which are closed are signaled to open; further common accident trip signals are blocked. Should a subsequent RHR initiation signal be received, the diesel generator output breakers of the unit having the RHR initiation signal will be re-opened for that unit only, on a unit priority re-trip signal. The loads will then be resequenced onto the diesels for that unit.

For Units 1 and 2 only, with a real and spurious accident signal present the Unit 1 initiated unit priority re-trip signal will only re-trip the Division I diesel breakers while the Unit 2 initiated unit priority re-trip signal will only re-trip the Division II diesel breakers. This will ensure that a spurious unit priority re-trip signal will not re-trip all four Unit 1/2 diesel breakers, which would result in interrupting both divisions RHR and Core Spray pumps supplying the opposite unit in a real accident.

For combinations of real and spurious accident signals between Units 1 and 3, and Units 2 and 3, the Unit 1 or 2 unit priority re-trip signal will trip all four Unit 1/2 diesel generator breakers.

Operational Mode Switches (Control Room and 4160V Shutdown Boards)

A three position, operational mode selector switch for each diesel generator is located on the diesel control board and on the 4160-V shutdown board for which it is the normal power source.

The purpose of this switch is to modify the function of the diesel-engine governor (EG) and voltage regulator (VR) to suit the operational condition required. The selective positions on the switch are as follows:

a. Single unit,

b. Units in parallel, and

c. Parallel with system.

The operational mode switch in the control room is operative only when the backup control switch is in NORMAL, while each operational mode switch at a 4-kV shutdown board is operational only when an associated backup control switch is in 8.5-6

BFN-27 EMERGENCY. On fast start, the selectivity of the mode switches is defeated, and the diesel generator and voltage regulator are initially placed in single-unit mode.

125-V DC Diesel Control Power Control circuit voltage for the diesel generators is 125-V DC. Each diesel generator has its own battery. Each battery has a normal and an alternate battery charger.

The chargers are powered from the 480-V diesel auxiliary boards. The diesel batteries are located in the Diesel Generator Building. Each battery consists of 60 single cell containers for a total of 60 cells. At 77 degrees F and a minimum terminal voltage of 105 volts (nominally 125 volts), the discharging rate for each battery is 172 amperes (temperature corrected) for 30 minutes and 303 amperes for 1 minute.

The battery supplies all required 125-V DC loads, including the following:

a. Control power,

b. Governor booster pumps,

c. Fuel pump,

d. Field flashing,

e. Diesel generator DC motor driven lube oil soakback pumps, and

f. Diesel generator DC motor driven lube oil circulating pumps Items b and d require power for a short period of time during diesel start. Item e requires power in the event of a loss of discharge pressure for the AC motor driven soakback pump. Item f requires power in the event of a loss of discharge pressure for the AC motor driven circulating oil pump.

8.5.3.3 Diesel Air Starting System The diesel generator air starting system is shown on Figures 8.5-2 sheet 1, sheet 2, sheet 4, and sheet 5. Each diesel generator contains two completely independent air starting subsystems, either of which is capable of starting the engine. These dual subsystems are isolated by check valves. The air starting systems are not connected to any other control air system in the plant. The portions of the diesel generator air starting subsystems downstream of their respective check valves are designed to meet seismic Class I requirements. Technical Specifications Section 3.8.3 provides surveillance requirements for the diesel starting air system.

8.5-7

BFN-27 The air compressors are checked for operation and ability to recharge air receivers as part of the surveillance procedures.

8.5.3.4 Diesel Fuel Oil Storage and Transfer System This system is shown in Figures 8.5-3a and 8.5-3b. The system consists of three interconnected, horizontal, cylindrical tanks for each diesel unit, a total of twenty-four for the eight diesel generators. The tanks are embedded in the substructure of the Standby Diesel Generator Buildings. The minimum storage capacity contains an adequate fuel supply for operating each diesel generator at full load for seven days.

The seven day diesel generator run time is supported by meeting the Technical Specification requirements for minimum fuel oil level and fuel oil quality. The specific Emergency Diesel Generator (EDG) fuel oil volumes contained in the diesel fuel oil storage tank(s) necessary to ensure that EDG run-duration requirements are met, are calculated using Section 5.4 of American National Standards Institute (ANSI) N195-1976, Fuel Oil Systems for Standby Diesel-Generators, and are based on applying the conservative assumption that the EDG is Operated Continuously at Rated Capacity. The fuel oil calculation methodology is one of the two approved methods specified in Regulatory Guide (RG) 1.137, Revision 1, Fuel Oil Systems for Standby Diesel Generators, Regulatory Position C.1.c. In addition, to further help ensure minimum stored energy content requirements of the fuel oil are met, testing in accordance with ASTM D5865 is performed. Level annunciation is provided to signal when each diesel unit storage supply drops to seven days.

The diesel generator fuel storage tanks are constructed in accordance with the ASME Boiler and Pressure Vessel Code,Section VIII (Unfired Pressure Vessels). In addition to fill, transfers, sampling, and fuel supply lines, each tank is equipped with two manholes, vent, overflow, and provisions for removing condensation. The 7-day tank vent pipe is fitted with a flame proof vent cap. High- and low-level alarm switches are provided. Tanks are sloped to a low point for removal of accumulated condensate by a portable pump. Class I seismic design is used on piping and all components from each seven day diesel oil storage tank to each diesel engine. The pumps and piping used to transfer fuel oil from the 7-day fuel storage units to other 7-day fuel storage units or to the auxiliary boiler fuel oil storage tanks is not safety related. The transfer piping is designed to Class II seismic up to but not including the supply and return connections on each 7-day Fuel Storage Unit.

It is possible to transfer fuel from one seven day storage unit to any other by using the Class II transfer pumps provided. These transfer pumps, located in the Diesel Generator Buildings, are also capable of pumping from any of the eight diesel generator storage units to the two 70,000-gallon auxiliary boiler fuel storage tanks located in the yard through a Class II interconnection between the Class I diesel generator fuel storage unit and the auxiliary boiler fuel storage system. It is also 8.5-8

BFN-27 possible to transfer from the Class II system to the Class I fuel storage unit using the transfer pump located adjacent to the auxiliary boiler storage tanks. The Class I/Class II interfaces at the seven day fuel storage units connections will not jeopardize the Class I systems.

8.5.3.5 Distribution System 4.16 kV System Figure 8.5-4a is a one-line diagram of 4.16-kV shutdown board A. There are eight 4.16-kV shutdown boards: A, B (Figure 8.5-4c), C (Figure 8.5-4d),

D (Figure 8.5-4e), 3EA (Figure 8.5-4b), 3EB (Figure 8.5-4f), 3EC (Figure 8.5-4g),

and 3ED (Figure 8.5-4h). Shutdown board A is described. The other boards are similar.

The following source breakers are located on shutdown board A:

a. #1612 - Incoming breaker to shutdown bus 1 from unit board 1A through unit board breaker 1126,

b. #1614 - Incoming breaker from shutdown bus 1 to shutdown board A,

c. #1716 - Incoming breaker from shutdown bus 2 to shutdown board A,

d. #1818 - Incoming breaker from diesel generator A to shutdown board A, and

e. #1824 - Incoming breaker from diesel generator 3A (via shutdown board 3EA) to shutdown board A.

Feeders from each 4160-V shutdown board serve shutdown loads, as well as common plant shutdown loads. For example, each shutdown board supplies one RHR pump motor for the unit is served. Some of the common plant loads are raw cooling water pump motors and RHR service water pump motors.

All shutdown buses are individually protected by bus differential relaying, which trips and locks out all breakers connected to that bus. All shutdown boards are individually protected by bus differential relays, which trip and lock out all supply breakers to that board.

Incoming supplies from the 4160-V unit boards to the shutdown buses, or from the shutdown buses to the 4160-V shutdown boards, are protected by phase- and ground-overcurrent relays, which cause the tripping of the particular incoming breaker involved and the locking out of the other associated incoming breakers.

8.5-9

BFN-28 The incoming supply breakers from the diesel generators are protected by phase-overcurrent relays, which cause annunciation only. Additionally, to mitigate risks due to fire induced faults, the alternate supply breakers to boards A, B, C, and D from the corresponding U3 diesel generator have phase overcurrent relays set to trip and prevent fire propagation between fire areas. Diesel generator protective relaying is described in paragraph 8.5.3.2.

Only when the offsite source is being used are load feeders protected by phase- and ground-overcurrent relays, which cause the tripping of the particular load breaker involved. When only a diesel generator is supplying a shutdown board, ground-overcurrent relays will not trip load feeder breakers because of the high-resistance grounding of the diesel generator.

The relaying is selectively coordinated for both phase and ground faults so that only the breaker nearest the fault trips. If the preferred breaker were to fail to trip, the breaker next closest to the source would trip. This ensures that only the minimum number of load circuits is interrupted.

On loss of supply from a 4.16-kV shutdown bus, in the absence of an accident signal, there is automatic transfer of the affected 4.16-kV shutdown board to the Diesel Generator. When electrical loads permit, operators can manually transfer the boards to the alternate 4.16-kV shutdown bus. (See Subsection 8.4 "Normal Auxiliary Power System," for more complete details.) On loss of normal voltage to a shutdown board, a signal is given to start the corresponding diesel generator, and all motor feeder breakers in the board are tripped. The relays which start the diesel generator are set to operate in a shorter time than the relays which trip breakers feeding motor loads. The starting of the diesel generator is actually anticipatory to the complete loss of 4.16-kV shutdown bus voltage. The tripping of the motor feeder breakers is preparatory to bringing the diesel generator supply onto the board and the automatic load-sequencing of major motors, which occurs under accident conditions. Feeder breakers to the load center transformers feeding the 480-V system are not tripped on undervoltage.

Additionally, to mitigate the risk of spuriously paralleling feeder breakers due to a fire, 4kV Shutdown Board 3EA feeder breakers (Normal/Alternate/EDG) utilize a local mode switch which inhibits certain main control room functions during normal operations. The local mode switch must be actuated to enable main control room controls for manual shutdown board supply transfers between normal and alternate feeds, and paralleling of the associated EDG with offsite power. The capability to manually close these supply breakers from the MCR to re-energize a de-energized shutdown board is not inhibited by the mode switch.

8.5-10

BFN-27 Each incoming breaker to a shutdown bus is provided with 3 ammeters (1 per phase) and a wattmeter. Each incoming breaker to a shutdown board from a shutdown bus is provided with 3 ammeters, a wattmeter, and a watt-hour meter.

Each incoming breaker to a shutdown board from a diesel generator is provided with 3 ammeters, a wattmeter, and a varmeter. Voltmeters with voltmeter switches are provided to read shutdown board voltage and incoming voltage from any of the sources; transducers are provided on all incoming sources to provide current indication in the Main Control Room. Incoming sources to the shutdown boards also have transducers to provide current indication at the diesel generator central information panel.

Each motor feeder breaker is provided with a watt-hour meter and an ammeter and ammeter switch. Each feeder breaker to a transformer supplying 480-V power is provided with an ammeter and ammeter switch. Transducers are provided on all motor feeders to provide current indication in the control room (except for the control rod drive) pump motors.

There are two 250-V DC control buses in the shutdown boards separated into a normal bus and an emergency bus. The two buses are connected to a 250-V DC battery source with a manual transfer to an alternate battery source. All Core Standby Cooling Systems (CSCS) drives and incoming breakers have control power available to them through separate normal and emergency control bus fuses.

Undervoltage on either DC control bus is annunciated.

Shutdown boards A, B, C, D, and 3EB each have a separate 250-V DC battery for the normal source of control power. The control power to shutdown boards 3EA, 3EC, and 3ED is supplied from the unit batteries 1, 3, and 2, respectively. Manually transferred alternate control power sources have been provided for 4.16-kV shutdown boards. (See Subsection 8.6, "250-V DC Power Supply and Distribution,"

for more information.)

Each motor feeder breaker has a two-position, backup control transfer switch and a breaker control switch. In the NORMAL position, the breaker is controlled from the unit control room, and the control circuit is supplied by the NORMAL 250-V DC control bus. In the EMERGENCY position, the breaker is controlled only by the breaker control switch on that same 4160-V shutdown board panel, and the control circuit is supplied by the EMERGENCY 250-V DC control bus. Control circuits supplied by the EMERGENCY 250-V DC bus do not traverse the cable spreading room or control room.

8.5-11

BFN-27 480V System Figures 8.5-5 and 8.5-6 show 480-V shutdown boards 2A and 2B. These boards serve Unit 2 loads. There are similar shutdown boards--1A (Figure 8.5-25), 1B (Figure 8.5-26), 3A (Figure 8.5-27), and 3B (Figure 8.5-28) (for Units 1 and 3). Only boards 2A and 2B are discussed below.

Board 2A is normally fed from 4.16-kV shutdown board B, while board 2B is normally fed from 4.16-kV shutdown board D. Each of these boards has an alternate source of supply which comes from 4.16-kV shutdown board C. Each 480-V shutdown board has a manual transfer to its alternate supply. (See Subsection 8.4, "Normal Auxiliary Power System," for more complete details.)

Smaller loads important to plant safety or safe shutdown are fed directly from these shutdown boards or through motor control centers connected to these shutdown boards.

On loss of voltage for approximately 2 seconds, all electrically operated breakers except those essential to safe shutdown are automatically tripped.

The motor-control-center feeders serving reactor motor-operated valve loads are not disconnected from the shutdown boards on loss of voltage. In general, motors between 40 and 200 hp are served directly from these shutdown boards.

Overcurrent relaying is provided on the incoming breakers in the 480-V shutdown boards. This relaying trips and locks-out the associated breaker and also locks-out the alternate source breaker. Motor feeders are protected by dual magnetic overcurrent trip devices incorporating time delay and instantaneous trips. Feeders to motor control centers are protected by dual selective overcurrent trip devices incorporating long-time and short-time trips. The protection is coordinated so that only the breaker nearest the fault trips on the occurrence of a fault, with the exception of series overcurrent devices which are both dedicated to a radial feeder to a motor control center.

Instrumentation for current, voltage and power are supplied on the incoming circuits, and a voltmeter and voltmeter switch are provided to indicate board voltage. Since this is an ungrounded system, ground-fault indication is provided.

8.5-12

BFN-27 The control bus voltage is 250-V DC. (See Subsection 8.6, "250-V DC Power Supply and Distribution," for more complete details.) There is a single control bus with two sources from different batteries. Manual transfer between control bus voltage sources is provided. Undervoltage on the DC control bus is annunciated.

Figures 8.5-7a, 7b, 8a, 8b, 9a, 9b, 10, 11, 11c, and 11d are one-line diagrams of MOV boards 2A, 2B, 2C, 2D, and 2E and Control Bay Vent Boards A and B. Units 1 and 3 MOV boards are similar (See Figures 8.5-7c, -7d, -7e, -7f, 8.5-8c, -8d, -8e, -8f, 8.5-9c, -9d, and 8.5-11a). Only Unit 2 boards will be discussed. These boards serve the smaller, 480-V loads important to plant safety or safe shut-down. Each MOV board has two incoming sources--one from 480-V shutdown board 2A and one from 480-V shutdown board 2B. MOV board 2A is normally fed from 480-V shutdown board 2A with manual transfer to its alternate supply. MOV boards 2B and 2C are normally fed from 480-V shutdown board 2B with a transfer to their alternate supplies. The transfer for MOV boards 2B and 2C is manual. The transfer for MOV boards 2D and 2E is performed automatically by 480V MOV board controls following manual actions at the 480V Shutdown boards 2A and 2B which will open the normally closed normal feeder breaker and close the normally open alternate feeder breaker.

480-V Control Bay Vent Board A is normally fed from 480-V shutdown board lA.

480-V Control Bay Vent Board B is normally fed from 480-V HVAC Board B. 480-V HVAC Board B is normally fed from 4.16-kV shutdown board 3ED. 480-V HVAC Board B has a manual transfer to its alternative source of supply at 480-V shutdown board 3B.

The incoming source breakers are provided with long-time and short-time trips. The feeder breakers are provided with long-time and instantaneous trips. Voltage indication is provided on the incoming supplies. For the electrically operated breakers and contactors, AC control power is provided by control power transformers connected to the 480-V incoming supplies or individual control power transformers connected to the line side of the individual contactors.

Figures 8.5-12a, 8.5-12b, 8.5-12c, 8.5-13a, 8.5-13b, 8.5-13c, and 8.5-13e are one-line diagrams of the diesel auxiliary boards A, B, 3EA, and 3EB. These boards principally serve loads associated with the operation of the diesel generators and SGT trains A and B (Units 1 and 2 boards only). Other essential small loads are also served from these boards. Loss of only one of these boards will not negate the effectiveness of standby core cooling.

Diesel auxiliary board A is normally connected through a transformer to 4.16-kV shutdown board A, and diesel auxiliary board B is normally connected through a transformer to 4.16-kV shutdown board D. Both of these boards have an alternate 8.5-13

BFN-27 source of supply coming from 4.16-kV shutdown board B. Diesel auxiliary board 3EA is normally connected to 480-V shutdown board 3A, and diesel auxiliary board 3EB is normally connected to 480-V shutdown board 3B. Both of these boards have an alternate source of supply coming from 480-V shutdown boards 3B and 3A, respectively. The 480-V shutdown boards 3A and 3B have a source of supply coming from two 4160-V shutdown boards. Thus, each diesel auxiliary board has access to two diesel generators.

Manual transfer to the alternate supply is provided.

Long-time and short-time trips are provided on the incoming breakers. Long-time and instantaneous trips are provided on feeder breakers.

Voltage indication is provided on the incoming supplies. Since this is an ungrounded system, ground-fault indication is provided. For the electrically operated breakers and contactors, AC control power is provided by control transformers connected to the 480-V incoming supplies, or individual control power transformers connected to the line side of the individual contactors. 480-V shutdown boards 1B, 2B, and 3B act as the alternate feeds to condensate demineralizer boards 1, 2, and 3, respectively.

8.5.4 Safety Evaluation 8.5.4.1 Automatic Starting and Loading Figures 8.5-14a through 8.5-16c are logic diagrams which describe the automatic starting and loading of the diesel generators under accident conditions with all diesel generators operating. Figure 8.5-17 describes the automatic loading on the shutdown boards when normal auxiliary power is available.

Diesel generators shall automatically start on the following signals:

a. High drywell pressure or low reactor vessel water level on any unit shall generate a pre-accident signal which will start all D/Gs.

b. Low reactor water level on any unit shall generate a common accident signal which will start all D/Gs.

c. A sustained degraded voltage on any 4-kV shutdown board shall start its associated D/G. The time delay for the auto start of the D/G shall be greater than the voltage recovery time of starting the largest load with normal voltage available.

8.5-14

BFN-28

d. An undervoltage on any 4-kV shutdown board shall generate a loss of off-site power signal which will start its associated D/G.

e. High drywell pressure and low reactor pressure on any unit shall generate a common accident signal which will start all D/Gs.

The diesel generators are capable of being up to speed and ready to accept load within 10 seconds of receiving an automatic start signal. See Section 6.5 for timing assumptions in the Emergency Core Cooling System analyses. Figure 8.5-18 is a block diagram which shows the various start attempts that are automatically accomplished.

When each diesel generator reaches required speed and voltage, if voltage is not available on its respective shutdown board, the diesel generator will be connected to the shutdown board via the automatic closing of the diesel generator breaker. If voltage is available on the shutdown board when the diesel generator reaches rated speed and voltage, the diesel generator will continue to run at rated speed and voltage--immediately available for connection to the shutdown board should normal voltage be lost. The diesel generator is normally stopped by operator action. When the diesel generators are automatically connected to the shutdown boards, they are automatically loaded. The loads to be fed are determined on the basis of whether or not an accident signal is present. Table 8.5-1 shows the order and time at which loads are applied to a typical diesel generator under accident conditions.

Operation of the Diesel Generators for Units 1 and 2 During the Period Immediately Following an Accident (Approximately 0-10 Minutes)

The ECCS equipment of Units 1 and 2 assigned to Division I, are supplied from 4.16-kV shutdown boards A and B, and the Division II equipment are supplied from 4.16-kV shutdown boards C and D.

In the event of an accident signal in either Unit 1 or Unit 2, all the ECCS equipment associated with the accident unit will start. All eight diesel generators in the plant will be started on an accident signal in any unit as a pre-emergency action in case of a subsequent power blackout.

The diesel generators and Standby AC Power System is designed to accommodate spurious accident signals from any unit and in any order, real followed by a spurious signal, real coincident with a spurious signal, and spurious followed by a real accident signal. The BFN transient analysis documents that the spurious accident signal due to reactor pressure or level transients is not expected to occur for any design basis event in a non-accident unit (such as a loss of offsite power).

However, the spurious actuation of both divisions of the EECS accident signal logic 8.5-15

BFN-27 is conservatively assumed to occur in the non-accident unit due to the spurious actuation of components in the initiation circuitry. If the ECCS loads for both Units 1 and 2 were allowed to start during combinations of real and spurious accident signals, the combined Unit 1/2 ECCS pumps would overload the 4KV shutdown boards and their associated diesel generators. Therefore, during combinations of real and spurious accident signals the Units 1 and 2 ECCS preferred pump logic will assign the Unit 1 ECCS loads to the Division I 4KV shutdown boards and the Unit 2 ECCS loads to the Division II 4KV shutdown boards. If any RHR or Core Spray pumps were already running in the opposite unit (e.g. for shutdown cooling), the core spray and RHR (LPCI) logic sends redundant signals to initiate the ECCS preferred pump logic to trip the opposite units running RHR and Core Spray pumps.

The ECCS preferred pump logic signal also inhibits the RHR and Core Spray pumps automatic start logic in the opposite unit (after 60 seconds manual control of the pumps is restored). This ensures that any running RHR or Core Spray pumps in the opposite unit would be tripped, unloading the Unit 1/2 4KV shutdown boards prior to the accident unit starting its ECCS pumps on a real accident signal. For combinations of real and spurious accident signals, the Unit 1 and 2 ECCS preferred pump logic will allow the Unit 1 Division I RHR and Core Spray pumps (1A and 1C) to start and load on the Division I 4KV shutdown boards, and the Unit 2 Division II pumps (2B and 2D) will load on the Division II 4KV shutdown boards. This will ensure that the shared Unit 1/2 4KV shutdown boards are not overloaded while still maintaining the minimum number of required ECCS injection subsystems described in Table 6.5-3.

If an accident signal was initiated in only one unit (Units 1 or 2) and any RHR or Core Spray pumps were already running in the opposite non-accident unit (e.g. for shutdown cooling), the Core Spray and RHR (LPCI) logic sends redundant signals to initiate the ECCS preferred pump logic to trip all of the non-accident units running RHR and Core Spray pumps. This ensures that any running RHR or Core Spray pumps in the non-accident unit would be tripped, unloading the Unit 1/2 4kV shutdown boards prior to the accident unit starting all of its ECCS pumps (both divisions) on an accident signal, with or without a loss of offsite power.

Operation of the Diesel Generators During the Long-Term Decay Heat Removal Period (Greater Than 10 Minutes)

In the long term following an accident, the four diesel generators assigned to Units 1 and 2 and the four diesel generators assigned to Unit 3 may be paralleled as shown in Figure 8.5-24 (4.16-kV shutdown board A to 4.16-kV shutdown board 3EA, etc.).

Synchronizing equipment is provided in the Units 1 and 2 control room, and paralleling will be accomplished from this location.

8.5-16

BFN-27 8.5.4.2 Diesel Generator Loading A common accident signal starts all eight diesel generators in preparation for loading should a Loss of Offsite Power (LOP) occur. Any diesel generator output breakers that are closed at the time (e.g., for diesel load testing) are also tripped by the common accident signal; this trip signal is then blocked from retripping the breaker.

To prevent spurious accident signals from causing improper diesel loading, the diesel generator output breaker trip circuitry has been revised to include a unit priority re-trip. This unit priority re-trip is initiated by a confirmatory reactor vessel low water level signal or by low reactor pressure coincident with high drywell pressure from the RHR initiation logic. When initiated, the unit priority re-trip will, with an existing CAS signal, trip the diesel breakers on the unit where the RHRsignal originated. The loads are then resequenced onto the diesels of that unit. The other unit's diesel breakers are unaffected by this second trip.

For Units 1 and 2 only, the Core Spray logic initiated common accident signal and the LPCI logic initiated unit priority re-trip is required to ensure that the shared Unit 1/2 4KV shutdown boards are stripped prior to starting the RHR pumps, Core Spray pumps, and other required loads when the shutdown boards are being supplied by the diesel generators. With a real and spurious accident signal present between Units 1 and 2, the Unit 1 initiated unit priority re-trip signal will only re-trip the Division I diesel breakers while the Unit 2 initiated unit priority re-trip signal will only re-trip the Division II diesel breakers. This will ensure that a spurious unit priority re-trip signal will not re-trip all four Unit 1/2 diesel breakers, which would result in interrupting both divisions RHR and Core Spray pumps supplying the opposite unit in a real accident. The Standby AC Power Supply and Distribution System will accommodate the potential loading scenarios resulting from a single failure or a credible spurious accident signal in combination with a real accident signal, in any order, thus meeting safety design bases 2 and 7.

Diesel generator loading must consider the limitations of the diesel generator units and the maximum running loads applied during a simultaneous LOP/LOCA. The rated maximum power that the diesel generator can supply is a function of engine and generator temperatures. The rated power output is limited by turbo-charger operation when the diesel engine is cold and thermal design limits of the diesel engine and generator when either are hot. Intake air temperature also affects the rated maximum power output of the diesel engine. The resulting six independent diesel generator ratings that must be considered are shown in Table 8.5-6.

The diesel generator ratings for all eight diesel generators are shown in Table 8.5-6, and the load sequence is shown in Table 8.5-1. Each diesel generator has been evaluated for loading and voltage and frequency response and shown to be adequate for accident mitigation. Prior to Unit 2 restart, extensive testing was 8.5-17

BFN-27 performed on the BFN diesel generators. The test results for diesel generator loading and voltage response concluded that the diesel generators will perform their intended safety function by starting and accelerating all of the required loads within the required periods (Reference L44 890120 802).

8.5.4.2.1 Deleted 8.5.4.2.2 Deleted 8.5.4.3 Automatic Loading Under Accident Conditions with Normal Power Available A different sequence of loading is used when normal power is available. Table 8.5-5 and Figure 8.5-17 explain this starting sequence.

8.5.4.4 (Deleted) 8.5.5 Inspection and Testing The diesel generators were factory tested to demonstrate their ability to accelerate to rated speed and voltage within the specified time and to carry rated load.

Prior to plant operation, the automatic starting of the diesel generators from signals developed from undervoltage or simulated accident signals was demonstrated.

Automatic load shedding, with loss of normal power and startup of emergency core cooling loads with either normal or diesel generator power, was demonstrated.

During normal plant operation, the diesel generators are exercised by paralleling them with the normal power system and loading them to rated continuous KW load.

Functional tests of the automatic circuitry and a test of the complete diesel generator starting/emergency core cooling load startup can be conducted during the refueling outages for the respective unit.

Scheduled maintenance on the diesel generators is conducted in accordance with the manufacturer's recommendations.

Since any electrical board, bus, or diesel can be isolated for maintenance, all automatic transfers can be tested; and complete component tests of relays, buses, batteries, chargers, transformers or switchgear are possible. During the short periods of selected maintenance-type tests, the allowable outage times are in accordance with the technical specifications for the equipment involved.

8.5-18

BFN-27 For the more frequent online testing, such as engineered safeguards, diesels, etc.,

one function at a time is tested. Diesel start testing is on the same basis as an accident. Following simulated start, acceleration, and voltage regulator performance checks, the diesel is operated in parallel with the system at greater than 75 percent load to allow load testing and equalizing of temperatures before shutdown. If an accident occurs during a diesel test the diesel load is tripped and it remains running, available for accident service.

A complete portion of the Engineered Safeguards System can be tested from its sensors to the starting of the AC and DC equipment. In the case of a core spray loop, the test can include a core spray only, or the test can include starting of all diesels and accident alignment of the auxiliary power system.

Periodically, a complete accident load sequence is performed on each 4-kV shutdown board group. Since each 4-kV shutdown board operates as an independent train, this test is significant, even though it is not a complete test of all four diesels simultaneously.

The Defense-In-Depth paralleling capability feature (i.e., 4.16kV shutdown board A to 4.16-kV shutdown board 3EA, etc.) is periodically validated via testing.

The 4-kV and 480-V logic systems have on-line testability that allows systematic testing of all components to the output devices. These tests usually involve a disturbance of six loads or less, which have been selected for minimum disturbance to the units.

A real accident signal that appears while in a simulated accident mode will be recognized and a full accident sequence will be initiated.

Complete maintenance of the system, with minimum disturbance and the ability for complete component testing is provided. Engineered Safeguards Systems testing, through the operation of loads and/or one 4-kV shutdown board diesel group testing, is also provided. A high degree of automatic realignment of the system from a test mode to the accident mode in the presence of an accident signal is employed. For maintenance and some testing this feature is not available.

Complete testing is accomplished in as few separate tests as possible. Separate tests are based on independent operating units in most cases and, therefore, are good, representative tests. For the 480-V load shedding logic system testing, pendant test switches or pushbutton test switches are provided to simulate accident signals and diesel generator voltage available signals.

8.5-19

BFN-27 Testing and surveillance requirements and limitations are provided in the BFN Unit 1, Unit 2, and Unit 3 Technical Specifications.

8.5-20

BFN-21 TABLE 8.5-6 DIESEL GENERATOR RATINGS Rating (See Notes) Description Time

1. Engine - Maximum steady-state active 0 - 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> Short-Time power output 2860/2800kW (running kW)

2. Engine - Maximum steady-state active > 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> Continuous power output 2600/2550kW (running kW)

3. Engine - Maximum instantaneous active 0 - 3 minutes Instantaneous power output (Cold) (running kW + starting kW) 2850kW

4. Engine - Maximum instantaneous active > 3 minutes Instantaneous power output (Hot) (running kW + starting kW) 3048kW

5. Generator - Maximum steady-state 0 - 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> Short-Time apparent power output 3575KVA (running KVA)

6. Generator - Maximum steady-state > 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> Continuous apparent power output 3250KVA (running KVA)

Notes:

DG Ratings 1 and 2: Engine short-time and continuous maximum steady state active power output (running kW) is denoted in the table as Non-derated Rating/Derated Rating.

• Non-derated rating for intake air temperatures less or equal than 90°F.

• Derated Rating for either intake air temperatures greater than 90°F or a combination of intake air temperatures greater than 90°F and engine cooling heater outlet temperature greater than 190°F.

DG Ratings 3 and 4: Engine instantaneous cold and hot maximum instantaneous active power (running kW plus starting kW) is denoted in the table as Non-derated Rating.

• Due to BFNs elevation is less than 800 feet above sea level with maximum intake air temperatures of less than 115°F, the maximum instantaneous active power output does not require derating for temperature.

BFN-20 8.6 250-V DC POWER SUPPLY AND DISTRIBUTION 8.6.1 Safety Objective The safety objective of the 250-V DC power system is to provide a highly reliable source of control power and motive power as required for the Engineered Safeguards System (ESS) so that no single credible event can disable the containment isolation and core standby cooling functions and their supporting control power sources and circuits.

8.6.2 Safety Design Basis

1. The ESS 250-V DC power system shall be designed with adequate independence and redundancy so that the failure of any single active component will not prevent the required ESS from functioning.

2. Battery capacity shall be adequate so that any two unit batteries can supply for 30 minutes, without chargers available, the DC power required to supply DC loads required for shutdown and cooldown of all three units in the event of the loss of offsite power and a design basis accident in any one unit.

3. The ESS that are supplied from the 250-V DC power system shall be designed to operate at the required minimum voltage for individual components.

4. The ESS 250-V DC power system shall be capable of withstanding the design basis earthquake without impairment of its function.

5. The ESS 250-V DC power system shall be designed so that any component, including battery charger, battery, distribution center, and interconnecting wiring, can be tested without disabling any required ESS.

8.6.3 Description The 250-V DC power system consists of two subsystems, a six battery plant system, and a five battery control power system (shutdown board batteries).

1. The plant batteries are further categorized as unit batteries (Batteries 1, 2, and

3) and station batteries (Batteries 4, 5, and 6). The ESS loads for the three unit plant are supplied from Unit Batteries 1, 2, and 3. Batteries 1, 2, and 3 also supply some non-safety-related loads, but Batteries 4, 5, and 6 only supply non-safety-related loads.

The 250-V DC unit system consists of three 120-cell lead-acid batteries (one Class 1E battery and battery charger per unit and one Class 1E spare battery 8.6-1

BFN-20 charger common with the station system) together with the associated circuitry, switches, indicators, and alarms (Figure 8.6-1a).

The 250-V DC station system consists of three 120-cell lead-acid batteries (one Non-Class 1E battery and battery charger per unit and one Class 1E spare battery charger common with the Unit system) together with the associated circuitry, switches, indicators, and alarms (Figure 8.6-1f).

2. The 250-V DC control power supply system (Shutdown Board Batteries SB-A, SB-B, SB-C, SB-D, and SB-3EB) consists of five 120-cell lead-acid batteries (one battery and battery charger for each shutdown board, and one spare battery charger), together with the associated circuitry, switches, indicators, and alarms (Figure 8.6-1a). The batteries also supply 480-V shutdown boards for Units 1 and 2 and ATWS.

250-V Plant DC System The battery chargers are of the solid-state, rectifier type, capable of working independently. Each charger is capable of automatically regulating output voltage.

Each battery charger has the capacity to furnish floating, equalizing, and fast charge in accordance with the battery manufacturer's recommendations.

Each battery charger provides the 250-V DC supply during normal operations, keeps its associated battery fully charged at all times, and recharges the battery after a discharge. On loss of power to the charger, the battery supplies all required loads.

Each battery is equipped with a low-voltage alarm which is actuated before battery voltage falls to 240-V.

Each of the batteries for the 250-V DC system consists of 120 lead-calcium grid type cells.

The unit batteries have a 1-minute rating of 2080 amperes and an 8-hour discharge rating of 2320 ampere-hours.

The station batteries have a 1-minute rating of 2240 amperes and an 8-hour discharge rating of 2320 ampere-hours.

All ratings are to a final terminal voltage of 210-V at a temperature of 77F.

The three unit batteries have engineered safeguards control loads for the three units distributed among them so that redundant subsystems on each unit have separate normal and alternate power supplies. The battery board buses, motor-operated valve boards, and distribution panels supply nominal 250-V DC power to their loads 8.6-2

BFN-20 without interruption unless the supply battery is discharged and power to the charger is lost. All transfers from normal to alternate sources are done manually, under administrative control procedures.

The major connected loads for the 250-V DC power system are listed in Table 8.6-1, Figure 8.6-5, and Figure 8.6-6. The batteries in the 250-V plant DC system have the capacity to carry all their required selected loads for 30 minutes without recharging.

Each charger shall be sized to recharge its battery from the design minimum charge, based on actual duty cycle ampere-hour discharge, in approximately 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> under normal load conditions.

A typical arrangement of the 250-V plant DC system for one unit is shown in Figure 8.6-2a; and the interconnection scheme for this same portion for all three units, illustrating separation requirements, is shown in Figure 8.6-3.

250-V DC Control Power Supply System (for shutdown boards)

The 250-V DC control power battery chargers have similar characteristics to the chargers of the plant system except for size.

The batteries for the 250-V control power supply are of the lead-calcium grid construction. They have a one-minute rating of 500 amperes and an eight-hour discharge rating of 410 ampere hours, both ratings to a terminal voltage of 210-V at 77F. Although the safety-design basis requirement for battery capacity is 30 minutes, the batteries have a greater (three hour rating of 108 ampere to a terminal voltage of 210-V at 77F) capacity to supply all required loads allowing ample time for corrective action if a charger malfunction occurs.

Normal 250-V DC control power for 4160-V shutdown boards A, B, C, D, and 3EB is supplied by one of the DC control power supplies with an alternate supply from one of the unit battery boards through a manual transfer switch. 250-V DC control power for 480-V shutdown boards 1A, 2A, 1B, and 2B is supplied by one of the DC control power supplies with an alternate supply from one of the battery boards through a manual transfer switch. 250-V DC control power for 4160-V shutdown boards 3EA, 3EC, and 3ED, 480-V shutdown boards 3A and 3B, 480-V HVAC board B, the bus-tie board, and the cooling tower switchgear is from the unit battery boards.

Alternate supplies have been provided through manual transfer switches.

Separations between redundant control power circuits are maintained external to and within the switchgear. The major connected loads for the 250-V DC control power system are listed in Table 8.6-1 and Figure 8.6-5.

The batteries in the 250-V DC control power supplies have the capacity to carry all their required loads for 30 minutes without recharging. Each charger is sized to 8.6-3

BFN-28 recharge its battery from the design minimum charge, based on actual ampere-hour removed, in approximately 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> under normal load conditions.

The typical arrangement for 250-V DC control power supplies A, B, C, D, and 3EB is shown in Figures 8.6-2b and 8.6-2c. The key diagrams for the boards are shown in Figures 8.6-1a, b, d, and e.

8.6.4 Safety Evaluation 8.6.4.1 General The system is arranged and powered so that the probability of failure of power to any single battery board bus or shutdown board control bus is very low and that such a failure does not prevent the safe shutdown and cooldown of all three units in the event of the loss of offsite power and a design basis accident in any one unit.

The system is designed to meet the intent of the IEEE criteria for nuclear power plant protection systems (IEEE-279).

Each battery, and its associated equipment, is easily accessible for inspection and testing. The DC system is ungrounded and has a ground detection alarm. The most probable mode of battery failure would be deterioration of a single cell which can be detected well in advance by standard, routine battery inspections and testing.

The system is designed so that the batteries cannot be paralleled.

Each ESS battery and its associated earthquake-type racks and holddown bolts are designed as Class I equipment in accordance with Appendix C, "Structural Qualification of Subsystems and Components."

8.6.4.1.1 Plant DC System Each ESS 250-V DC unit battery board bus can be supplied from its own battery charger or from the spare charger. Each station battery board bus can be supplied from its own charger or from the spare charger. The charger switching is done manually and without normally paralleling the chargers; however, chargers are designed to operate in parallel. The chargers can be powered from normal plant auxiliary power or from the standby diesel-driven generator system.

The unit batteries are located in the control building each in its own ventilated, unit battery room. The station batteries are located in the Turbine Building. The station batteries supply loads that are not essential for safe shutdown and cooldown of the nuclear system and are not considered in the accident load calculations.

8.6-4

BFN-20 8.6.4.1.2 Shutdown Board Control Power Supply Each 250-V DC control power supply can receive power from its own battery, battery charger, or from a spare charger. The chargers are powered from normal plant auxiliary power or from the standby diesel-driven generator system. Zero-resistance short circuits between the control power supply and the shutdown board are cleared by fuses located in the respective control power supply A, B, C, D, or 3EB. Each power supply is located in the Reactor Building or Diesel Generator Building near the shutdown board it supplies. Each battery is located in its own independently ventilated battery room.

8.6.4.2 Loss of One 250-V DC Unit Battery The ESS 250-V DC system is arranged, and the batteries sized, such that the loss of any one unit battery will not prevent the safe shutdown and cooldown of all three units in the event of the loss of offsite power and a design basis accident in any one unit. Loss of control power to any engineered safeguards control circuit is annunciated in the Main Control Room of the unit affected.

8.6.4.3 Loss of One 250-V DC Control Power Supply Battery The loss of one battery affects normal control power for the 480-V and 4160-V shutdown board which it supplies. Complete loss of the control power to these shutdown boards results in loss of only those engineered safeguards supplied by these boards, which is acceptable.

8.6.5 Inspection and Testing Routine service and testing are based upon the recommendations of the manufacturer and sound maintenance practices. Typical inspections include visual examinations for leaks and corrosion and a check of all batteries for uniformity, as well as values of cell voltage, specific gravity of electrolyte, and electrolyte level.

The 250-V DC System is arranged and sized so that any one battery or battery charger may be removed from service for testing or repair without loss of capability to supply DC loads required for shutdown and cooldown of all three units in the event of the loss of offsite power and a design basis accident in any one unit.

8.6-5

BFN-26 Table 8.6-1 250-V DC CONNECTED LOADS Unit Battery Boards

1. Reactor Motor-Operated Valve Boards (3 per unit A, B, and C)

2. Circuit Breaker Board 9-9 (1 per unit)

3. 480-V Shutdown Board Controls (Unit 3)

4. 4160-V Shutdown Board Controls (Unit 3)

5. Bus-tie Board

6. Cooling Tower Switchgear

7. 480-V HVAC Board B

8. Distribution Board 9-24 (alternate)

Station Battery Board

1. Main Turbine Emergency Bearing Oil Pump (1 per unit)

2. Main Generator Emergency Seal Oil Pump (1 per unit)

3. Plant Preferred AC Motor Generator

4. DC Emergency Lighting at Diesel Generator Buildings

5. Distribution Board 9-24

6. Diesel Generator Air Compressors

7. Cooling Tower Switchgear

8. Turbine Building Distribution Board (1 per unit)

9. Reactor Building Lighting Cabinet (1 per unit)

10. Unit Preferred AC Motor Generator (Units 2 and 3) and Unit Preferred UPS Inverter (Unit 1)

11. Computer UPS Reactor MOV Board Loads

1. Autodepressurization Main Steam Relief Valves (MOV Boards A, B, and C)

2. Main Steam Relief Valves (MOV Boards A, B, and C)

3. Main Steam Isolation Valves Solenoids (MOV Boards A and B)

4. (Deleted)

5. Backup Scram Valves (MOV Boards A, B, and C)

6. RHR Shutdown Isolation Valves (MOV Board B)

7. Division I Engineered Safeguards Logic Power Supply (MOV Board B)

8. HPCI Turbine Controls and Auxiliaries (MOV Board A)

9. HPCI Valves (MOV Board A and B)

10. RCIC Turbine Controls and Auxiliaries (MOV Board C)

11. RCIC Valves (MOV Boards B and C)

12. Division II Engineered Safeguards Logic Power Supply (MOV Board A) 250-V DC Control Power Supplies

1. 4160-V Shutdown Board Controls (Units 1 & 2), and 3EB on Unit 3

2. 480-V Shutdown Board Controls (Units 1 & 2)

3. ATWS (Units 1, 2, and 3)

BFN-26 Table 8.6-3 (Deleted by Amendment 10)

BFN-22 8.7 120-V AC POWER SUPPLY AND DISTRIBUTION 8.7.1 Power Generation Objective The objective of the 120-V AC Power Supply and Distribution System is to supply both safety related and non-safety related 120-V AC power to all equipment and instrumentation requiring it during all modes of plant operation.

8.7.2 Power Generation Design Basis The 120-VAC Power Supply and Distribution System shall be capable of supplying all required loads through the use of several independent systems, depending on the continuity of power required by each load.

8.7.3 Description The supply and distribution of 120-V AC power is accomplished by the following systems:

a. 208/120-V AC Instrument and Control Power Supply System;

b. Plant Preferred 240/120-V AC System;

c. Unit Preferred 240/120-V AC System;

d. Reactor Protection System Power Supply;

e. Plant Nonpreferred 240/120-V AC System; and

f. 208/120-V AC Plant Computer Power System.

g. 120/240-V AC Non-Safety-Related Lighting Power System.

The 120-V AC Power Supply and Distribution System, and its relation with other plant electrical systems, is shown in Figures 8.6-1c, -1d, -1e, and -1f of Subsection 8.6.

8.7.3.1 208/120-V AC Instrument and Control Power Supply System The 208/120-V A-C Instrument and Control Power Supply System consists of six redundant, Class 1E instrument and control, buses (two buses for each unit). Each 120-V bus receives its normal or alternate power supply from an appropriate divisional 480-V shutdown board through a 480-208/120-V A-C 3-phase 8.7-1

BFN-22 instrumentation and control transformer and a 208-208/120-V regulating transformer.

Control room distribution Panel 9-9, Cabinets 2 and 3, are equipped with a normal and an alternate feeder. Transfer from the normal to the alternate supply is automatic upon I & C Bus undervoltage. The alternate supply is from the regulating transformer of another unit with the same electrical division as the normal supply.

On loss of normal auxiliary power, all I and C loads will lose power until the diesel generators have picked up the 480-V shutdown board loads.

8.7.3.2 Plant Preferred 240/120-V AC System The Plant Preferred 240/120-V AC System bus normally receives power from an AC lighting board with an automatic transfer to an alternate AC lighting board upon loss of power from the normal source. The preferred bus has, as an alternate source of power, a 250-V DC motor-driven generator (plant preferred M-G set). The plant preferred M-G set is started on loss of voltage to the bus and automatic transfer is made on presence of voltage from the generator. The M-G set will pick up all loads that do not require manual start. Plant preferred loads will lose power while the M-G set is started and transfer is made.

Transfer of the bus back to the normal power supply is automatic after the normal power supply becomes available for sufficient time to ensure its stability. The M-G set is then disconnected automatically from its DC power supply.

8.7.3.3 Unit Preferred 240/120-V AC System The unit preferred 240/120-V AC system, for Units 2 and 3, consists of a distribution bus with a M-M-G set as the primary source of supply. Upon failure of a M-M-G set, the bus can be transferred manually to either the unit preferred M-M-G set of one of the other units or to the appropriate 480-V reactor MOV board through the unit preferred AC bus transformer, as shown in Figure 8.7-3.

Each M-M-G set consists of a 480-V AC motor, a 250-V DC motor, a flywheel, and a 240/120-V 1-phase, AC generator (all direct-coupled) with the necessary controls.

The unit preferred bus is normally supplied from the generator driven by the AC motor with the flywheel and DC motor being driven. On loss of power to the AC motor, the DC motor is automatically energized with the flywheel driving the generator during the transfer period. Therefore, the unit preferred buses do not normally lose power at any time during loss of auxiliary power.

The unit preferred 240/120-V AC system for Unit 1 consists of a distribution bus with an uninterruptible power supply (UPS) as the primary source of power. Upon failure of the UPS, the bus is transferred automatically through a static switch to the 480-V 8.7-2

BFN-22 RMOV board via the unit preferred regulating transformer or transferred manually to the Unit 2 preferred M-M-G set as shown on Figure 8.7-3a.

The UPS consists of a 480-V AC to 250-V DC rectifier, 250-V DC to 120-V AC inverter, and a 120-V AC static switch. The rectifier is supplied from the 480-V RMOV Board. The inverter is normally supplied from the output of the rectifier. On loss of the output from the rectifier, a blocking diode conducts, and the 250-V DC is provided from the station batteries. The 120-V AC outputs of both the inverter and the regulating transformer are inputted to the static switch. On loss of the inverter output, the static switch transfers the load to the unit preferred regulating transformer. Therefore, the unit preferred bus does not normally lose power at any time during loss of auxiliary power.

8.7.3.4 Reactor-Protection System Power Supply The 120-V AC Reactor Protection System Power Supply is shown in Figures 7.2-1 and 7.2-7c and is described in paragraph 7.2.3.2.

8.7.3.5 120-V AC Distribution Panels There are four control room distribution panels (circuit breaker boards) supplied by one or more of the 120-V AC systems. There is one panel for each unit and one plant panel common to all units. The 120-V AC loads supplied from these panels are shown in Figures 8.7-4a, -4b sheets 1 and 2, -4c sheets 1, 2, and 3, and -4d.

8.7.3.6 Plant Nonpreferred 240/120-V AC System The Plant Nonpreferred 240/120-V AC System bus normally receives power from an AC lighting board with automatic transfer to an alternate AC lighting board upon loss of power from the normal source.

8.7.3.7 208/120-V AC Plant Computer Power System The 208/120-V AC plant computer power system consists of a 120/208-V AC UPS system which includes 480-120/208-V AC regulating transformer, a rectifier, an inverter and an automatic static transfer switch. The system provides a highly reliable 208/120-V AC normal power supply to the computer power distribution panel. The UPS receives input power from an appropriate 480-V AC Non-Class 1E Common Board. The output of the UPS provides normal and alternate 120/208-V AC power to a plant computer distribution panel through a static transfer switch. An appropriate 250-V DC non-1E battery board provides back-up power supply to the UPS. Provision for manual switching is also included to allow manual transfer of power between the inverter/rectifier and the regulating transformer for maintenance purposes.

8.7-3

BFN-22 8.7.3.8 120/240-V AC Non-Safety-Related Lighting Power System This system provides power to non-safety-related loads and is available from cabinets throughout the plant.

8.7.4 Inspection and Testing All equipment associated with the 120-V ac power supply system, except the plant preferred M-G set, is normally in operation at all times. The plant preferred M-G set and the DC motor drives of the unit preferred M-M-G sets can be periodically energized to ensure operability. Inspection of all other equipment is accomplished based upon the manufacturer's instructions and sound maintenance practices.

8.7-4

BFN-25 8.8 AUXILIARY DC POWER SUPPLY AND DISTRIBUTION 8.8.1 48-V DC Power System 8.8.1.1 Power Generation Objective The objective of the 48-V DC Power System is to provide a reliable, continuous, independent, and conveniently utilized 48-V DC power supply for the plant communications and annunciator systems during all modes of plant operations.

8.8.1.2 Power Generation Design Basis

1. The 48-V DC Power System shall supply power for all 48-V DC requirements.

2. The system shall be provided with two annunciator batteries and one communication (telephone) battery capable of supplying the connected load when power from the chargers is lost.

8.8.1.3 Description The 48-V DC Power System consists of three batteries, four battery chargers, and the associated buses, circuitry, and distribution panels required for the operation of the system. One battery and its charger is for the plant communications system.

The other two batteries and their chargers are for the annunciator system. The fourth charger is a spare unit and may be switched to supply power to any one of the three 48-V DC buses. The battery chargers are not normally operated in parallel but are designed to operate in parallel. The annunciator battery system is arranged so that the total station annunciator load may be supplied from one battery.

During normal operations each battery charger provides the prime source of 48-V DC power, with the battery supplying peak demands, normally keeps its battery fully charged, and recharges its battery after a discharge. After a significant discharge the spare battery charger may be paralleled with another battery charger to assist in battery charging or load carrying. On loss of power to the charger, the battery supplies all the required loads.

Loss of 48-V DC annunciator power from one battery will be annunciated and an automatic transfer to the other 48-V annunciator battery accomplished. Thus, only a brief interruption in annunciation will result, and the low-voltage alarm will be actuated for Units 2 and 3 only. For Unit 1, the 48-V DC power sources are divided to supply either the A or B annunciator equipment; therefore, a loss of either 48-V DC source will not interrupt annunciation operation. The loss of 48-V DC will be indicated in the MCR by the extinguishing of the Blue Annunciator PLC A or B status lights located at the top of each panel.

8.8-1

BFN-25 The battery chargers are of the solid-state, rectifier type, capable of working independently and automatically regulating output voltage within 1.0 percent when the load is between 0 percent and 100 percent with the battery connected or disconnected. The chargers provide float and equalize charge, to recharge the batteries and maintain them in a fully charged condition.

The batteries are lead-acid, lead-calcium grid construction type with 24 cells (nominal 48-V DC), and rated to carry the maximum load required by any one battery. Each battery is designed to have an 8-hour rating of 840 ampere-hours.

The 48-V batteries are mounted on sturdy earthquake-type racks suitable for easy maintenance and housed in the battery rooms which are adequately ventilated to prevent a concentration of combustible gases from the charging operation. Racks and holddown bolts are designed as Class I equipment in accordance with Appendix C, "Structural Qualification of Subsystems and Components."

The relation of the 48-V DC Power System to other associated electrical systems is shown in Figure 8.6-1c of Subsection 8.6.

8.8.1.4 Inspection and Testing Routine service and testing are based upon the recommendations of the manufacturer and sound maintenance practices. Typical inspections include visual examinations for leaks and corrosion, and checking all batteries for uniformity as well as values of cell voltage, specific gravity of electrolyte, and electrolyte level.

Any one battery or battery charger may be removed from the system for testing or repair without interrupting service to the system.

8.8.2 24-V DC Power System 8.8.2.1 Power Generation Objective The objective of the +/- 24-V DC Power System is to assure a supply of 24-V DC power to various monitoring instrumentation during all modes of plant operation.

8.8.2.2 Power Generation Design Basis

1. The 24-V DC Power System shall supply power for all 24-V DC requirements through the use of two independent channels for each unit.

2. Each channel shall be provided with separate batteries capable of supplying the connected load when power from the chargers is lost.

8.8-2

BFN-25 8.8.2.3 Description The +/- 24-V DC Power System for each unit consists of two separate and independent 24-V DC channels. Each channel has a +24-V DC and a V DC battery charger connected in series with a common ground. The two battery chargers are connected in parallel with two 24-V batteries having a common ground.

The channels are designed for reliability and to minimize electrical noise. The circuits are designed so that the loads which are needed most will have the greatest probability of being served. The prime source of power is from the battery chargers, with the batteries serving as a backup source of power. Each channel has an independent local distribution panel. The voltage of the channel is indicated on the distribution panel.

Each channel is protected from high voltage by an overvoltage relay. The relay operates the charger output circuit breaker and actuates an alarm in the control room when the voltage exceeds approximately 29-V. The alarm in the control room is also actuated on low voltage.

The main circuit breakers on the feeder lines from the battery chargers and batteries break both the + and - sides of the system, while the ground connection remains uninterrupted. Loss of power from the battery chargers does not result in loss of +/-

24-V DC supply.

The battery chargers are of the full-wave silicon rectifier type, capable of working independently. Each charger is capable of automatically regulating output voltage within +/- 2 percent of its rated value under the following conditions:

1. The load is between 0 percent and 100 percent, with the AC power feeding the charger deviating from the rated voltage by 10 percent.

Each battery charger has the capacity to deliver the maximum charging rate required by the battery, as recommended by the battery manufacturer, while also supplying the normal steady-state DC load. It is possible to recharge each battery from a totally discharged condition, maintain full charge once achieved, and to periodically give the battery an equalizing charge if required. Lead-calcium batteries do not require an equalizing charge if floated between 2.20 and 2.25-V per cell.

The batteries are lead-acid, lead-calcium type with 12 cells (nominal 24-V DC) and rated to carry the maximum load required by any one battery.

The 24-V batteries for each unit are mounted on a sturdy rack suitable for easy maintenance and housed in the unit battery room, which is adequately ventilated to prevent a concentration of combustible gases from the charging operation.

8.8-3

BFN-25 The relation of the 24-V DC Power System to other associated electrical systems is shown in Figure 8.6-1d of Subsection 8.6.

The +/- 24-V DC Power System is not a safety system and does not have a safety design basis. An evaluation of the total loss of +/- 24-V power is shown in Table 8.8-3. As shown by this evaluation, the complete loss of +/- 24-V DC power does not have unacceptable results nor does it prevent safe shutdown of the plant.

8.8.2.4 Inspection and Testing Service and testing is performed on a routine basis in accordance with recommendations of the manufacturers and sound maintenance practices. Typical inspections include visual inspections for leaks and corrosion, and checking all batteries for voltage, specific gravity, and level of electrolyte. At the time of installation, a full load discharge test is made to prove that battery capacity is adequate.

8.8-4

BFN-16 Table 8.8-1 (Deleted by Amendment 9)

BFN-16 Table 8.8-2 (Deleted by Amendment 7)

BFN-17 Table 8.8-3 EVALUATION OF THE 24-V DC POWER SUPPLY Results Consequence of Component Losing 24-V DC Supply Losing 24-V DC Supply

1. Source Range Monitors and (a) Loss of source range indication I. Plant shutdown - (all rods in)

SRM Trip Auxiliaries with annunciation of loss a. startup prevented by rod (alarm) block (b) Rod Block b. startup prevented by technical specifications II. In STARTUP MODE (MODE 2)-

a. rod withdrawal stopped by SRM rod block.

2. Intermediate Range Monitors (a) Loss of intermediate range I. In STARTUP MODE (MODE 2)-

and IRM Trip Auxiliaries indication with annunciation a. IRM Rod Block and of loss (alarm) IRM Scram (b) Rod Block II. In RUN MODE (MODE 1)-

a. None - Protection (c) Scram provided by APRM. SRM's and IRM's withdrawn.

3. Trip auxiliaries for off- (a) Off-gas valve isolation signal I. Off-gas valve closes gas radiation monitor and generated timer control

4. Stack Gas Radiation Monitor (a) Instrument failure alarm I. None - Off-gas line isolated on unit with failed 24-V DC system - log off-gas monitors available on all units.

5. Linear Off-gas Radiation (a) Loss of indication I. None - Backed up by two log Monitor off-gas radiation monitors powered from RPS bus.

6. RHR Service Water Effluent (a) Instrument Failure Alarm I. None - Sampling frequency Radiation Monitors increased if RHR service water system in operation.

7. Liquid Rad Waste Effluent (a) Instrument Failure Alarm I. None - Liquid radwaste Radiation Monitor discharge based on tank sampling. However, discharge would be stopped by operator if in progress.

8. Reactor Building Closed (a) Instrument Failure Alarm I. None - Closed system.

Cooling Water System However, sampling frequency Radiation Monitor could be increased.

9. Raw Cooling Water Effluent (a) Instrument Failure Alarm I. None - Increased sampling Radiation Monitor frequency as necessary.

BFN-16 Figure 8.8-1 Deleted by Amendment 9.

BFN-17 Figure 8.8-2 (Deleted by Amendment 17)

BFN-16 Figure 8.8-3 Deleted by Amendment 9.

BFN-27 8.9 SAFETY SYSTEMS INDEPENDENCE CRITERIA AND BASES FOR ELECTRICAL CABLE INSTALLATION Various criteria and bases establish the minimum requirements for preserving the independence of redundant reactor protection systems, engineering safety features systems, and Class 1E electrical systems through physical arrangement and separation, and assure necessary availability during any design basis event.

The electrical circuits associated with redundant or counterpart divisions, components, or subsystems of electrical systems important to safety are separated from each other by means of spacing or barriers or analysis to demonstrate functional redundancy (see Section 8.9.4). These electrical systems are designated as Class 1E systems, and include the Reactor Protection System (RPS), Primary Containment Isolation System (PCIS), the Neutron Monitor System (NMS) and the Engineered Safeguards System (ESS). The circuits associated with these Class 1E systems include their instrument signal circuits, their control circuits, and their power circuits.

A. Reactor Protection System (RPS)

The instrument signal circuits for the RPS are separated into four channels (A1, A2, B1, and B2), identified as Divisions IA, IIA, IB, and IIB, respectively. The manual signal circuits are separated into Channels A3 and B3, identified as Divisions IIIA and IIIB, respectively. The control and power circuits of the RPS are separated into two divisions, identified as Divisions A and B, with power and control Division A associated with signal Divisions IA, IIA, and IIIA, and power and control Division B associated with signal Divisions IB, IIB, and IIIB. Control and instrumentation of the RPS are described in FSAR Subsection 7.2.

B. Primary Containment Isolation System (PCIS)

Except as noted, control and power circuits for the inboard Primary Containment Isolation System valves are in Division I; similar circuits for the outboard valves are in Division II. Exceptions to this requirement are the RHR System I LPCI inboard injection valve, Reactor Water Cleanup outboard isolation valve, and the Main Steam Drain outboard isolation valve. Control and instrumentation of this isolation system are described in FSAR Subsection 7.3.

C. Engineered Safeguard System (ESS)

The separation concept places all electrical equipment of the ESS in either Division I or Division II. These two divisions include the electric power, control, and signal circuits for this equipment. The HPCI System, described in FSAR paragraph 6.4.1, has its associated electric circuits in Division II; (except for the inboard steam line isolation valve which is connected to Division I, see Section 8.9-B) and the 8.9-1

BFN-27 Automatic Depressurization System, described in FSAR paragraph 6.4.2, has its associated electric circuits in Division I. This depressurization system is a backup for the HPCI System and, thus, is a counterpart of the HPCI System.

The electric circuits associated with one of the two loops of the Core Spray System described in FSAR paragraph 6.4.3 are in Division I and the circuits of the other loop are in Division II. These respective divisions of electric circuits include the two pump motors and electrically-operated valves in each core spray loop.

The electric circuits associated with pumps A and C of the LPCI System, and their valves (described in FSAR paragraph 6.4.4), are in Division I; the electric circuits of pumps B and D, and their valves, are in Division II.

The circuits associated with the diesel generators, shutdown boards, and their interconnections are separated into eight groups of separation (four groups for Units 1 and 2 and four groups for Unit 3). The 480-V shutdown boards are separated from each other on a unit basis. Shutdown board 1A is separated from 1B, 2A from 2B, and 3A from 3B, with the ESS Division I loads supplied from boards A and ESS Division II from boards B. The 480-V reactor MOV boards are separated from each other on a unit basis. Reactor MOV board 1A and 1D are separated from 1B and 1E, etc. ESS Division I loads are supplied from reactor MOV boards 1A and 1D, while Division II loads are supplied from board 1B and 1E.

Essential common plant functions are divided into two redundant groups. These loads are connected to the diesel generator auxiliary boards and the control building vent boards. They are separated into two divisions for each function.

Refer to FSAR Figure 8.6-3 for the DC System separation.

8.9.1 Cable Insulation, Coatings, and Floor and Wall Penetrations Cable insulation materials have been selected to minimize excessive deterioration due to temperature, humidity, and radiation during the design life of the plant.

Insulation temperature ratings are such that the maximum normal ambient temperature plus any heat rise due to loading does not exceed the qualified temperature rating of safety-related cables.

The original ampacity of power cables in trays for all units was based on industry standards, such as Insulated Cable Engineers Association (ICEA) Standard P 426. A more recent publication, ICEA Standard P-54-440, incorporated the concept of uniform heating. A reevaluation of safety-related cables for Unit 2 and Unit 3 was performed based on ampacities from ICEA Standard P-54-440 and a conservative method of quantifying diversity which was inherent to ICEA Standard P-46-426 to ensure that the cables are not adversely affected by heating from adjacent cables.

8.9-2

BFN-27 Furthermore, evaluations have been performed on the safety-related cables in both conduits and trays for Unit 2 and Unit 3 to ensure that fire retardant coatings, fire wraps, installation configuration, and association with nonsafety cables do not adversely affect their current carrying capability.

Cables installed on cable trays pass the vertical flame test of Section 6.19.6 of ICEA Standard S-19-81. For plant areas containing safety-related equipment, the use of cables meeting only the minimum requirement of ICEA Standard S-19-81 requires a fire retardant cable coating (Flamemastic 77 or equal) on the cables' exposed surface in order to upgrade the effective flame retardancy to the ratings of IEEE 383-1974. Cables without certification to IEEE-383 or equal are coated with flame retardant material in accordance with the appropriate design criteria. Cables with certification to IEEE 383-1974 or equal flame retardant qualifications are not required to be coated, except at firestops. At fire barriers and pressure boundaries, any openings in the walls and floors for cable trays are sealed and the cables are coated with fire retardant cable coating. Conduit penetrations in walls and floors which form fire barrier compartmentation and/or pressure boundary are sealed. For the methods of sealing conduits and trays which penetrate fire barriers, refer to Figure 5.3.2 of the FSAR. Fire Protection is further discussed in Subsection 10.11.

Any exceptions to the above requirements will be documented as an exception to the appropriate design criteria.

8.9.2 Raceways 8.9.2.1 General Plant Area Conduit was sized per TVA Electrical Standards Drawing 30A809 R0, 30A810 R0, and 30A811 R1 prior to 1976. The 40-percent maximum allowable cable fill expressed previously in the FSAR was an interpretation from the maximum allowable cable diameters given in the drawings. TVA Electrical Design Standard DS-E13.1.4 has been used since issued in 1976. This standard allows a maximum cable fill of 53-percent for 1 cable, 31-percent for 2 cables, and 40-percent for 3 or more cables. When the Electrical Standards Drawings were applied for conduit sizing, the resulting conduit fill limitations were essentially equivalent to the current Design Standard DS-E13.1.4. The Electrical Standards Drawings allowed a less conservative 32-percent maximum cable fill for 2 cables, however, the 1-percent difference is not considered significant based on cable and conduit tolerances.

Conduits filled above DS-E13.1.4 levels are justified and documented as exceptions in the applicable Design Criteria.

There are five different raceway systems for voltage-level separation within a division. The are arranged as follows:

1. Medium Voltage Power (V5), Nominal Voltage 4160V AC 8.9-3

BFN-27

2. Low Voltage Power (V4), Nominal Voltage 480V AC and etc.

3. Control and Control Power (V3), Nominal Voltage 0-240V AC, 0-250V DC

4. Medium-level signal (V2), Nominal Voltage 100mV-250V AC or DC

5. Low-level signal (V1), Nominal Voltage 0-100mV AC or DC In the appropriate design criteria, there is a tabulation of these voltage levels and the controlling factors in designing for installation within them. Cables are assigned voltage levels as listed above and routed in their appropriate respective raceway, unless specifically evaluated and documented as an exception to applicable design criteria. In addition, two permissible exceptions are defined below:

a. Cables of different voltage levels may be routed together in conduit when a piece of equipment has only one conduit opening. However, cables are separated with respect to voltage levels as soon as possible.

b. For designs and installations prior to July 31, 1987, when the circuit protective device in a radial feeder is capable of interrupting both the power and control circuits for a piece of equipment, the related power and control cables may be routed together in the same conduit.

Within a standard tray arrangement, normally, the minimum standard spacing between trays stacked vertically is 9 inches, tray bottom to tray bottom. The standard spacing between trays installed side by side is 4 inches, except this is 6 inches in the Cable Spreading Room. The trays are generally constructed of galvanized steel, 12 to 24 inches wide and 4 inches deep. Cable trays are generally designed for a loading of 75 lb/ft (including the weight of the tray), and trays in tiers carrying cables of redundant divisions have Category I seismic restraints and are separated as stated in paragraph 8.9.6.1, "Cable Routing." The structural integrity of the tray system is maintained through continued review of loading as new cables are added.

ESS cables are routed in Division I or II V5, V4, or V3 trays specifically marked for these cables. Cables for the RCIC System are routed in Division I trays and the cables for the HPCI System are routed in Division II trays.

The ESS Division I or Division II tray systems are shared across units with conduit ties between units to their respective tray system. Examples of shared systems are the SGTS, EECW and RHR Service Water Systems. Cables for these redundant systems are routed in Division I or Division II trays and/or conduits.

8.9-4

BFN-27 Power cables from each diesel generator to its respective 4160-V shutdown board, bus 1 and bus 2 interties, are installed in separate conduits. The power cables from the 4160-V shutdown boards to the respective transformers for the 480-V shutdown boards and the 480-V diesel auxiliary boards are installed in raceways (conduit or cable tray) which assure adequate physical separation.

The normal DC supplies to the 4160-V shutdown board control bus are routed in raceways separate from the alternate DC supplies to these boards. The normal DC feeders to the 480-V shutdown board control bus are in separate raceways from the alternate DC feeders.

The normal and alternate supplies to the 250-V DC MOV boards are routed separately such that neither is in the same raceway. Generally, the normal or alternate supply to each MOV board is installed in conduit.

A nonsafety-related cable may be routed in a raceway with safety-related cables, but once mixed with one of the redundant divisions, it must continue in that division and not cross over and be mixed with the other redundant division.

Nonsafety-related circuits shall be considered mixed with redundant safety-related divisions if they receive power from one division and share an enclosure or raceway with a redundant division. Exceptions are allowed for nonsafety-related power cables to share a power supply and enclosure with one safety-related division and an enclosure or raceway with the other safety-related division if the circuit is provided with protection consisting of two safety-related electrical protection devices in series to prevent it from degrading safety-related circuitry. Exceptions are also allowed for nonsafety-related instrumentation and low-voltage control circuitry to mix with both safety-related divisions when analyses demonstrate the absence of adverse interactions between safety-related circuitry and associated nonsafety-related circuits. Special exceptions are also discussed in Section 8.9.4.1.

Cable trays for safety-related cables shall have a minimum horizontal separation of 3 feet between trays containing cables of different divisions. If 3-foot separation is not attainable, a fire-resistant barrier is required, extending at least 1 foot above (or to the ceiling) and 1 foot below (or to the floor) line-of-sight communication between the redundant trays.

Vertical stacking of cable trays of redundant divisions is avoided where practical.

Where vertical stacking of redundant trays is not avoidable, there is a minimum vertical separation of 5 feet. If the five feet vertical separation between vertically stacked redundant tray systems is not attainable, a fire barrier is required.

In congested areas, where one redundant tray system crosses over a tray or panel of the other system, there is a minimum vertical separation of 18 inches (tray bottom 8.9-5

BFN-27 to tray bottom) with an acceptable barrier between the redundant tray systems for a distance of 5 feet on each side of the intersection.

Trays containing nondivisional cables are routed within the 3-foot minimum horizontal space between trays of Divisions I and II. However, there are locations within the Reactor and Control Buildings where a nondivisional tray may be routed parallel first to one divisional tray and then parallel to the other divisional tray. An example of this occurs when the divisional trays are at the same elevation, but are end-to-end rather than parallel. (There is a minimum space of 3 feet between the ends of the divisional trays.) A nondivisional tray could run alongside the first divisional tray to the 3-foot space between the ends of the two divisional trays and then continue alongside the second divisional tray. Nondivisional trays are spaced a minimum of 4 inches horizontally (6 inches in the Cable Spreading Room, see FSAR Section 8.9.2.2) and a minimum of 9 inches vertically from divisional trays. The structural integrity of the tray system is maintained through continued review of loading as new cables are added.

8.9.2.2 Cable Spreading Room Where cables of different divisions of separation are run from the same or adjacent control panels with spacing less than the 3-foot minimum, both cables are run in metal (rigid or flexible) conduit to a point where a 3-foot separation exists.

A minimum horizontal separation of 3 feet is required between trays containing cables of different divisions of separation, if no physical barrier exists between trays.

If a horizontal separation of at least 3 feet cannot be attained, a fire-resistant barrier is required, extending at least 1 foot above (or to the ceiling) and 1 foot below (or to the floor) line-of-sight communication between the two tray systems. Vertical stacking of trays carrying cables of different divisions is avoided.

In the case of crossing of a tray of one separation division over a tray of the other division, there is a minimum vertical separation of 18 inches (tray bottom to tray bottom) with an acceptable barrier between the redundant tray systems for a distance of 3 feet on each side of the intersection.

Non-divisional trays are spaced a minimum of six inches horizontally and a minimum of nine inches vertically (tray bottom to tray bottom) from divisional trays.

8.9.3 Containment Penetration Cables through drywell penetrations are so grouped that failure (open circuits, shorts, or grounds) of all cabling in a single penetration cannot prevent a scram.

(This applies specifically to the neutron monitoring cables and the main steam isolation valves position switches.)

8.9-6

BFN-27 Low-voltage power and control cables for the ESS Division I and the RPS channels IA and IB are routed through three penetrations (EA, EB, and EC), with RPS channel IA in EC and RPS channel IB in EB. These three penetrations are located on the southwest side of the primary containment.

Low-voltage power and control cables for ESS Division II and RPS channels IIA and IIB are routed through two penetrations (EE & EF), with RPS channels IIA and IIB in penetration EE. These two penetrations are located on the northeast side of the primary containment.

8.9.4 Control Room and Local Panels No single control panel, local panel, or instrument rack includes wiring essential to the protective function of both redundant systems, which are backups for each other (Division I and Division II), except where, for operational reasons, locating manual control switches on separate panels is considered to be prohibitively (or unduly) restrictive to normal functioning of equipment; the switches may then be located on the same panel, provided no single event in the panel can defeat the automatic operation of the equipment. If this protection cannot be provided by circuit design (i.e., principles of fault-resistant circuit design and functional redundancy analysis to satisfy the single failure requirement), the switches for controlling different divisions of subsystems are grouped in subpanels separated by fire-resistant separation barriers without penetrations that could propagate a fire between subpanels.

8.9.4.1 Spacing of Wiring and Components in Control Boards, Panels and Relay Racks A minimum distance of 6 inches, or barriers between wiring and components in control boards, panels, and relay racks, preserves the independence of Divisions I and II circuits. Except in a few instances, the two divisions are on separate panels which themselves are separated from other panels by metal barriers or by distance.

There is no requirement to separate or use barriers between devices or wiring of the same division within the confines of a given panel.

Redundant systems for isolating the containment are divided into Division I and Division II, with separation or barriers as noted above. However, there is an exception to the use of separation or barriers between some of the redundant equipment on panels 25-7A and 25-7B. The two high-flow differential pressure transmitters that produce signals for isolating the steam lines to the RCIC turbine are mounted side-by-side on panel 25-7A and the two for the HPCI turbine are mounted similarly on panel 25-7B. This exception is acceptable because the high-temperature detectors along the steam lines provide a diverse redundant means for initiating the isolation signals. These high-temperature detectors provide coverage of the entire spectrum of sizes of steam line breaks and, thus, are the primary detectors of a break. The two divisions of high-temperature signal circuits 8.9-7

BFN-27 for the RCIC turbine are separated from each other, and those of the HPCI turbine are also separated from each other. In addition, the RCIC signal circuits are separated from those of the HPCI. This separation prevents a single credible event from effecting both high-temperature isolation signals for either turbine.

There are special cases in the control room where nonsafety- related wiring from panels containing one division of equipment is routed into a tray with wiring from panels containing the other division. This is acceptable because:

1. if the cables of interest do not leave the control bay, then the back up controls would not be effected by such a coupling and could be used in safely shutting down the plant, or

2. if the cables do leave the control bay, they have been shown to have adequate fault protection (fuse/breaker) to prevent the propagation of the fault.

Where the above separations cannot be met within the auxiliary instrument room panels, Division I cables may be run adjacent to Division II cables provided an analysis is performed and documented to show that plant safety is not jeopardized (i.e., redundant safe shutdown features/functions are not jeopardized).

8.9.5 Separation of Class 1E Electrical Equipment 4160-V Diesel Generators A, B, C, D, 3EA, 3EB, 3EC, and 3ED 4160-V diesel generators A, B, C, and D are located in Unit 1-2 Diesel Generator Building on El. 565.5 in individual rooms. Diesel generators 3EA, 3EB, 3EC, and 3ED are located in Unit 3 Diesel Generator Building on El. 565.5 in individual rooms.

The layout of these rooms is shown in Figures 1.6-26 and 1.6-27 of the FSAR.

4160-V Shutdown Boards A, B, C, D, 3EA, 3EB, 3EC, and 3ED Boards A, B, C, and D are located in separate rooms in the Reactor Building.

Boards A and C are located on El. 621.25 and boards B and D are located on El. 593. The layout of these rooms is shown in Figures 1.6-3 sheets 1 and 2 and 1.6-5 of the FSAR.

Boards 3EA, 3EB, 3EC, and 3ED are located in separate rooms in the Unit 3 Diesel Generator Building. Boards 3EB and 3ED are located on El. 565.5 and boards 3EA and 3EC are located on El. 583.5. The layout of these rooms is shown in Figure 1.6-27 of the FSAR.

8.9-8

BFN-27 4160/480-V Shutdown Board Transformers TS1A, TS1B, TS1E, TS2A, TS2B, TS2E, TS3A, TS3B, and TS3E Transformers TS1A and TS1B are located outside the 480-V shutdown board rooms 1A and 1B on El. 621.25, and TS1E is located on El. 639.0 in the Reactor Building, Unit 1. Transformers TS2A, TS2B, TS2E, TS3A, TS3B, and TS3E are located similarly in Units 2 and 3, respectively.

480-V Shutdown Boards 1A, 1B, 2A, 2B, 3A, and 3B Each of these boards is located in a separate room in the Reactor Building on El.

621.25. The layout of these rooms is shown in Figures 1.6-3 sheets 1 and 2 and 1.6-12 of the FSAR.

480-V Reactor MOV Boards 1A, 1B, 1C, 1D, 1E, 2A, 2B, 2C, 2D, 2E, 3A, 3B, 3C, 3D, and 3E All of this equipment is located in the Reactor Building. Boards 1A, 1B, 2A, and 2B are located in the rooms with the 4160-V shutdown boards. Unit 3 boards 3A and 3B are located in individual rooms on El. 621.25 and El. 593. Boards 1C, 2C, and 3C are on El. 565. The layout of these rooms is shown in Figures 1.6-3 sheets 1 and 2, 1.6-5, 1.6-6, and 1.6-13 of the FSAR.

480-V Control Bay Vent Boards A, B Boards A and B are located on El. 606 of the control bay. Board A is located in the Mechanical Equipment Room in the Unit 1 area, and board B is located in the Cable Spreading Room in the Unit 3 area. This provides two independent zones. The layout of these rooms is shown in Figures 1.6-4 and 1.6-12 of the FSAR.

4160/480-V HVAC Board Transformer THB Transformer THB is also located on El 621.25 in the Unit 3 Reactor Building. Layout of this area is shown in Figure 1.6-12 of the FSAR.

480-V HVAC Board B This board is located in the Unit 3 reactor building, elevation 593' electrical board room with 480-V reactor MOV board 3B. The layout of this room is shown in Figure 1.6-13 of the FSAR.

8.9-9

BFN-27 4160/480-V Diesel Auxiliary Board A and B Transformers TDA, TDB, and TDE Transformers TDA and TDB are located on El. 583.5 of the Units 1 and 2 Diesel Generator Building, and TDE is located on El. 565.5 of the same building. These locations are shown in Figure 1.6-6 in the FSAR.

480-V Diesel Auxiliary Boards A, B, 3EA, and 3EB Boards A and B are located in individual rooms on El. 583.5 in the Unit 1 and 2 Diesel Generator Building. The location of these boards is shown in Figure 1.6-6 of the FSAR. Boards 3EA and 3EB are located in individual rooms on El. 583.5 in the Unit 3 Diesel Generator Building. The location of these boards is shown in Figure 1.6-27 of the FSAR.

125-V Diesel Generator Batteries A, B, C, D, 3A, 3B, 3C, and 3D Batteries A, B, C, and D are located in individual rooms on El. 565.5 of the Unit 1 and 2 Diesel Generator Building in the room with the diesel generator. The layout of these rooms is shown in Figure 1.6-26 of the FSAR.

Batteries 3A, 3B, 3C, and 3D are located in individual rooms on El. 565.5 of the Unit 3 Diesel Generator Building in the room with the diesel generator. The layout of these rooms is shown in Figure 1.6-27 of the FSAR.

250-V Battery Boards 1, 2, and 3 These boards are in individual rooms on El. 593 of the control bay. The location of these rooms is shown in Figures 1.6-5 and 1.6-13 of the FSAR. The battery board room number is the same as the board it contains.

250-V DC Reactor MOV Boards 1A, 1B, 1C, 2A, 2B, 2C, 3A, 3B, and 3C All of these boards are located in separate rooms within the Reactor Building.

Boards 1A, 1B, 2A, and 2B are located in the rooms with the 4160-V shutdown boards. Unit 3 boards, 3A and 3B, are located in individual rooms on El. 621.25 and El. 593, respectively. Boards 1C, 2C, and 3C are not in individual rooms, but the boards for the other two power channels associated with each reactor are located in individual rooms providing three independent zones. Boards 1C, 2C, and 3C are on El. 565. The layout of these rooms is shown in Figures 1.6-3 sheets 1 and 2, 1.6-5, 1.6-6, 1.6-12, and 1.6-13 of the FSAR.

8.9.6 Cable Routing For 4160-V (V5), 3-phase, AC cable (greater than No. 2/0), the initial concept was to install these cables in V5 cable trays in triangular groupings with a minimum spacing 8.9-10

BFN-27 equal to the radius of the larger cable. After issuance of Design Standard DS-E12.6.3 for ampacity (September 2, 1986), the separation required was identified as 1/4 the overall effective diameter of the larger of the grouped 3-phase circuits. As a result of the May 1975 fire recovery plan, Flamemastic was placed over the cables in divisional trays; making measurement of the spacing between previously-installed cable groups no longer feasible and prohibiting free air flow between cable groupings. For installed safety-related cable, it is assumed conservatively that the cables are not uniformly spaced but are randomly laid in the tray. For installation of new V5 cables, spacing shall be maintained at 1/4 the overall effective diameter of the larger of the grouped 3-phase circuits.

For V4 cable trays, all low-voltage power cables scheduled after July 1, 1988, may be multiconductor (in order to provide a higher allowable ampacity for the respective conductor size) or single conductor (to meet any restrictions on bend radius requirements) when routed on a V4 cable tray. Previous designs with a No. 2 AWG or smaller cable were restricted to multiconductor cables only.

Cable tray fill is dictated by limits on the structural capability of the tray system and, in addition, for V4 and V5 trays ampacity considerations. Structural integrity is maintained through continued review of loading when new cables are added.

Ampacity of additional cables is reviewed to ensure depth of cable in tray does not adversely affect capability to carry its required load current.

8.9.6.1 Class 1E Cables Inside and outside the containment area, cables for the RPS outside the main protection system cabinets are installed in rigid conduit used for no other wiring.

Under vessel neutron monitoring cables are exempted from this requirement because of space limitation and the need for flexibility on the intermediate range monitoring (IRM) cables.

Cables for sensors of more than one variable in the same trip channel may be installed in the same conduit. Cables from both RPS trip system actuators to the scram solenoids for a single rod group may be installed in a single conduit.

However, a single conduit shall not contain cables to more than one group of scram solenoids. Cables for two solenoids on the same control rod may be installed in the same conduit.

Cables for the ESS are separated into redundant divisions (Division I or Division II) such that no single credible event could damage the cables of the redundant counterparts.

The routing of safety related cables through missile or hostile environmental areas is generally avoided. In rooms or compartments having rotating heavy machinery, such as the reactor recirculating pump M-G sets and the reactor feedwater pumps, 8.9-11

BFN-27 or in rooms containing high-pressure feedwater piping or high-pressure steam lines, sufficient physical distance separation or a protective barrier to prevent damage to cables in both divisions is provided between trays containing cables of different divisions of separations. Inside the primary containment area, all ESS Division II cables are installed in conduit only. The ESS Division I cables are installed in cable trays and conduits.

The routing of safety related cables through rooms or spaces where a fire hazard exists, such as the potential for accumulating large quantities of oil or other combustible materials, is generally avoided. In cases where it is impossible to provide other routing, only one division of redundant cables is allowed in any such area.

8.9.7 Fire Detection and Protection Fire Protection is further discussed in Subsection 10.11.

8.9.8 Conduit Cable and Cable Tray Markings Cables and their associated raceway are tagged to have their appropriate division of separation identified. Exceptions to these markings will be identified as appropriate.

Cable trays are identified with block letters on a colored background located on the side of the cable tray. Safety-related and non-safety cable trays are distinguishable by a different colored background.

8.9-12

BFN-16 Table 8.9-1 Deleted by Amendment 13.

BFN-16 Figure 8.9-1 Deleted by Amendment 9.

BFN-28 8.10 STATION BLACKOUT 8.10.1 Description On July 21, 1988, the Code of Federal Regulations, 10 CFR 50, was amended to include a new section 50.63, entitled, "Loss of All Alternating Current Power,"

(Station Blackout). The Station Blackout (SBO) rule requires each plant to cope with the loss of off-site power concurrent with the failure of Emergency Diesel Generators (EDGs) in excess of those required for normal redundancy. For the SBO duration, the plant must be capable of maintaining core cooling and appropriate containment integrity. SBO coping duration for BFN is four hours.

SBO is postulated as the failure of the two EDGs that normally feed a respective unit's 480-V AC shutdown boards concurrent with the loss of all offsite power.

Coping strategy is to shutdown the blacked-out unit with equipment powered from the 250-V DC battery system. Alternate AC power from diesel generators in the non-blacked-out units, will be made available to power additional required HVAC and common loads. As set forth in NUMARC 87-00, Appendix B, the Alternate AC will be available within one hour through existing cross-ties.

The 250-V unit batteries 1, 2, and 3 are adequate to supply the required Unit 1, Unit 2, and Unit 3 loads for the coping duration of four hours. SBO on Unit 2 is the loss of EDGs B and D and loss of EDGs A and C for SBO on Unit 1. SBO on Unit 3 is the loss of EDGs 3A and 3C. Considering the failure of one EDG in each of non-blacked out units (A or C for Unit 1, B or D for Unit 2, and 3A or 3C for Unit 3), and additional failure of EDG 3B or 3D, a minimum of three diesel generators remain available for SBO. These provide sufficient power to supply required HVAC and common loads.

8.10.2 Containment Cooling For the units, the containment response to a SBO was evaluated. The details of this evaluation are provided in Subsection 14.12.5.1.

The units would automatically trip when the SBO event occurs. Initial reactor vessel pressure control will be accomplished by automatic Main Steam Relief Valve (MSRV) operation. Reactor vessel water level control is maintained automatically by the operation of the RCIC/HPCI systems. The RCIC and HPCI systems take suction from the condensate storage tank. The operator would manually perform a controlled depressurization by cycling the MSRVs with reactor vessel water level being controlled by RCIC. The steam discharge from the reactor vessel would be through the MSRVs tailpipes directly to the suppression pool. During the 4-hour coping period, the suppression pool water temperature would continue to increase.

8.10-1

BFN-28 As discussed in Subsection 6.5.5.6, the Net Positive Suction Head (NPSH) analysis does not take credit for any containment pressure greater than that assumed to exist at the start of the postulated SBO event.

8.10-2