Text

Requests NRC Approval to Perform Preoperational Test & Make Final Turnover of an inter-unit 4.16 Kv Bus cross-tie Which Is Being Installed in SONGS Units 2 & 3.W/54 Oversize Drawings
	ML20133C126
Person / Time
Site:	San Onofre
Issue date:	12/31/1996
From:	Rainsberry J; SOUTHERN CALIFORNIA EDISON CO.
To:	; NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
	GL-88-20, NUDOCS 9701070043
	Download: ML20133C126 (103)
	v • d • e

i jpg s_m ou,-

,b_:1 EDISON II An LDISON 1%TTRV47/ON4L Company December 31, 1996 U. S. Nuclear Regulatory Commission Attention: Document Control Desk Washington, D.C. 20555 i Gentlemen:

Subject:

Docket Nos. 50-361 and 50-362 Inter-Unit 4.16 kV Bus Cross-Tie )

San Onofre Nuclear Generating Station '

Units 2 and 3 J

Reference:

December 15, 1995 Letter from Walter C. Marsh (Edison) to the Document Control Desk (NRC),

Subject:

Response to Generic Letter 88-20, Supplement 4, "Inrtividual Plant Examination of External l Events (IPEEE)," San Onofre Nuclear Generating Station, Units 2 and 3 The purpose of this letter is to request NRC approval to perform the preoperational test and make the final turnover of an inter-unit 4.16 kV bus cross-tie which is being installed in the San Onofre Nuclear Generating Station (SONGS) Units 2 and 3 during their respective Cycle 9 refueling outages.

As a result of beyond design basis scenarios during Emergency Planning Drills, l an instruction to cross connect 4.16 kV safety-related busses has been in use !

since 1990. This cross connect would only be implemented if no action I consistent with license conditions or technical specifications was immediately apparent that provided adequate or equivalent protection to public health and safety, as allowed by 10CFR50.54x. This instruction, which was developed for issuance from the Technical Support Center during a declared emergency, requires the lifting of leads and installation of jumpers to bypass the necessary interlocks. The SONGS Units 2 and 3 Individual Plant Examination of External Events (IPEEE)(reference) examined events that were within the design basis as well as outside the design basis of Units 2 and 3. One event which was outside the design basis of the plant was the loss of all AC power (unit blackout). The IPEEE identified a significant safet experiencing unit blackout if diesel generator (DG) powery from benefit the to theunit other unit i could be supplied within 55 minutes to one of the two deenergized 4.16 kV safety-related busses. In our refers aced letter, Southern California Edison ,

(Edison) committed to install switches and modify control circuitry to replace I this instruction with an engineered cross connect capability prior to Unit 3 i Cycle 9 operation. f l 9701070043 961231 DR ADOCK 050003 i O[ f /

f.

sNi$ b,cA 92674.ot2s Orcm4 5o LaRck i C E

Document Coru ol Desk 1 The final design of this modification has been completed. The design i modification and post installation test guidelines were reviewed against the criteria of 10CFR50.59 and do not constitute an unreviewed safety question.

During an Edison self-assessment'of the engineering process, the original 10CFR50.59 for this modification was found to be incomplete with respect to the use of the cross-tie. The self-assessment determined that, although the installation and testing of the modification was allowed by 10CFR50.59, the 10CFR50.59 was not clear that the use of the modification was not evaluated under 10CFR50.59. Because the use of this modification in a beyond design basis event is not allowed by 10CFR50.59, Edison is requesting NRC approval to perform the preoperational test and make the final turnover of the inter-unit 4.16 kV bus cross-tie.

During a recent NRC review of Edison's self-assessment process, the inspectors questioned the conclusions of Edison's 50.59 evaluation for the design modification, with respect to changes in the probability of a malfunction of equipment im)ortant to safety. The bases for our conclusion are explained further in tie enclosure to this letter. The 10CFR50.59 evaluations for the modification and the test guidelines as well as relevant portions of the Design Change Package are also enclosed. In order to make the final ,

connections and perfois the preoperational test of these modifications, the units will make use of the eight hour technical specification allowed outage time for 4.16 kV safety related busses.

Although the installation of this modification and post installation testing i do not constitute an unreviewed safety question, the use of this modification )

in the beyond design basis scenario of a unit blackout may present an unreviewed safety question for the non-blacked out unit if an operable 4.16 kV safety-related bus is cross connected to a deenergized bus on the blacked out unit. Because of the unique nature of this situation, where the installation and testing of a modification is allowed by regulations, but the intended use of the modification may not be allowed, Edison is requesting NRC approval to perform the preoperational test and make the final turnover. Edison will install jumpers and lift leads, as applicable, to the cross-tie permissive switches to prevent unacceptable DG system effects until NRC approval is ,

received.

This design modification is only intended for use in a beyond design basis conjition where one unit has experienced a loss of all AC power and the other unit has an operable DG. In that situation it is anticipated that a 10CFR50.54x condition will be declared to " protect the public health and safety."

This modification will make the SONGS Units 2 and 3 electrical system more robust and better able to mitigate a loss of all AC power in a unit. Edison may, in conjunction with the Combustion Engineering Owner's Group effort, pursue separate licensing action crediting this cross-tie to extend the DG technical specification allowed outage time to 14 days. Your approval for the preoperational test and final turnover of this modification by May 15, 1997 will allow installation and testing during the Unit 3 cycle 9 refueling outage, thereby fulfilling the commitment made in the SONGS Units 2 and 3 IPEEE (reference).

Document Control Desk If you have any questions, please feel free to contact me. ;

1 Sincerely, l I)

A d j

J. L. Rainsberry l Manager, Plant Licensi !

Enclosure I cc: L. J. Callan, Regional Administrator, NRC Region IV K. E. Perkins, Jr., Director, Walnut Creek Field Office, NRC Region IV J. A. Sloan, NRC Senior Resident Inspector, San Onofre Units 2 & 3 M. B. Fields, NRC Project Manager, San Onofre Units 2 and 3 l

1 j

1 1

l l

l 1

I i

1 ENCLOSURE l

'i ENCLOSURE TABLE OF CO'NTENTS 10CFR50.59 Discussion Section I Pre-Operational Test 10CFR50.59 Section II Edison Internal UFSAR Change Request Section III Selected Portions of Design Change Section IV Package 7048.00SE, Rev.0 (A3C #2)

Selected Elementary Diagrams Section V

I Section I 10CFR50.59 Discussion 4

The 10CFR50.59 evaluation for the inter-unit 4.16kV bus cross-tic modification concluded that the design modification did not involve an increase in the probability of malfunction of equipment important to safety. The explicit basis stated was that of maintaining the existing failure modes and effects analysis conclusions of the UFSAR for the DG system. Additional bases were implicit from Section 1 (Engineering Evaluation) of the modification package, and the context of the UFSAR design and licensing bases, as follows:

1. No increase based on NRC Inspection Manual, Part 9900 criteria:

Within the SONGS 2/3 licensing bases, as described in the UFSAR, the probability of a malfunction of equipment important to safety (e.g., a Diesel Generator train) is not based on the number of devices, such as switches, that are in the circuits. This is also true for the plant-specific PRA for SONGS 2/3 (Individual Plant Examination). In the UFSAR, the probability of malfunction is based only on qualitative criteria such as quality assurance per 10CFR50 Appendix B, redundancy (single failure criteria) per IEEE-279, and separation per Regulatory Guide 1.75. This is the basis for the SONGS 2/3 review and license. These criteria are referenced by the design modification.

Therefore, in accordance with the NRC Inspection Manual, Part 9900, Section E, the modification cannot be considered to increase the probability of a malfunction previously evaluated in the UFSAR. l l

2. No increase based on meeting single failure within each train: !

Additionally, the physical configuration of the modification and administrative controls -

prevent the malfunction of a DG train due to inadvertent operation of cross-tie ;

permissive switches. All the switches are located in a vital area on the respective unit's train's fire isolation switch panel. The cross-tie switches are uniquely identified from the fire isolation switches. Two cross-tie switches are provided for each DO (a total of 4 per unit); for a particular train, both switches in both units need to be manipulated to

" activate" the DG cross connect capability. Repositioning either of the 2 switches per DG (e.g., due to single failure or operator error) will alarm in the control room but have no effect on any automatic or manual functions of the electrical train. With l redundant, alarmed switches, repositioning of more than one switch is outside the single j failure design basis defined in the UFSAR. As discussed above, the single failure criterion (10CFR50 Appendix A, and IEEE 279) is part of the environment in which SONGS 2/3 were originally reviewed and licensed.

Therefore, in accordance with NRC Inspection Manual, Part 9900, Section E and 10CFR50 Appendix A (single failure criterion), the modification cannot be considered to increase the probability of a malfunction previously evaluated in the UFSAR.

3. No increase based on NSAC-125:

NSAC 125, " Guidelines for 10CFR50.59 Safety Evaluations," says that "a change that does either of the following is a change that increases the probability of occurrence of a malfunction of equipment important to safety:

Degrades below the design basis the performance of a safety system assumed to function in the accident analysis.

Increases challenges to safety systems assumed to function in the accident analysis such that safety system performance is degraded below the design basis without compensating effects."

The performance of the electrical distribution system is unaffected by the installation of these switches because the 10CFR50 Appendix A single failure criterion is met within 2

each train. Furthermore, these switches do not increase challenges to any safety systems for the same reason.

Therefore, in accordance with NSAC-125, the modification cannot be considered to 3 increase the probability of a malfunction of equipment important to safety previously i evaluated in the UFSAR.

4. Adequate compensatory measures even were an increase to occur:

Any postulated risk of inadvertent system activation is negated by the compensatory measures provided by the design, location, and administrative controls. The compensatory measures inherent in the design are that system activation requires the manipulation of two switches for each DG, Additionally, repositioning either of the two )

switches per DG will alarm in the control room but have no effect on any automatic or manual functions of the electrical train. The location of the switches provides another sayer of defense to prevent inadvertent system actuation. All the switches are located in a vital area on the respective unit's train's fire isolation switch panel. Access to vital areas is positively controlled by security key card. The cross-tie switches are also !

- located in a cabinet and are uniquely identified from the fire isolation switches which are also located in the same cabinet. Finally, administrative controls will be in place prohibiting switch manipulation except as allowed by the Technical Specifications or ,

10CFR50.54x. !

n 1

l i

e 1

8 I

j i l

i k

i Section II 4

Pre-Operational Test 10CFR50.59 l d

1 6 {

l i

\i f

1 0

i 4

. *(a i

?

f 4

s t

i t

i

^ 10CFR50.59 SAFETY EVALUATION FOR 10CFR50.54(x)

EMERGENCY DIESEL GENERATOR UNIT-TO-UNIT CROSS-TIE PRE-OPERATIONAL TEST SAN ONOFRE NUCLEAR GENERATING STATION UNITS 2 AND 3 REVISION 0 I. TEST PROCEDURE OBJECTIVES DCP 2&3-7048.00SE installs the hardware to provide the capability of performing an Emergency Diesel Generator (EDG) Unit-to-Unit Cross-Tie at San Onofre Nuclear Generating Station (SONGS) Units 2 and 3 in the event of a Loss of Offsite Power (LOOP) where one of the two Units experiences a Station Blackout (SBO) event. The performance of such a Unit-to-Unit Cross-Tie requires entry into 10CFR50.54(x) where action is being taken that is deemed necessary to mitigate an eccident or event where the Unit is operated outside the boundaries of its Technical Specifications (TS), hence, DCP 2&3-7048.00SE is known as the 10CFR50.54(x) EDG Unit-to-Unit Cross-Tie design change. DCP 2&3-7048.00SE requires verification of the satisfactory operation of the 10CFR50.54(x) EDGUnit-to-Unit Cross-Tie installation. Verification of proper opemtion will be accomplished by perfonnance of a Pre-Operational Test of the Class 1E 4.16 kV Electrical Distribution System at SONGS Units 2 and 3. The Pre-Operational Test will include Component Tests, Equipment Functional Tests, and an Integrated Functional Test.

The Integrated Functional Test portion of the Pre-Operational Test will affect both SONGS Unit 2 and Unit 3 because it requires simultaneous use of Class 1E 4.16 kV Engineered Safety Features (ESF) buses on both units with one train being tested at a ;

time. Table 1 provides the Modes of Operation assumed by the Integrated Functional Test l Guidelines and provides the " Simulated Unit Conditions and Unit Designations" for Unit 2 and Unit 3.

Table 1 Integrated Functional Test (IFT) Unit Modes and Designations UNIT 2 UNIT 3 Normal Modes of Operation Modes 1,2,3, or 4 Modes 5,6, or l Analyzed forIFT Defueled Alternate Modes of Operation Modes 5,6, or Modes 5,6, or Analyzed for IFT Defueled Defueled Expected Unit Mode of MODE 1 MODE 5 Operation During IFT Simulated Unit Condition and Operating Unit Station Blackout Unit Unit Designation During IFT l

Page 1 of 31

l 1

- The Integrated Functional Test will prove the integrated design operates as intended. The Integrated Functional Test will not verify all possible combinations of supplying power to and/or receiving power from the Class lE 4.16 kV ESF buses. AB individual circuit 4

interlock combinations will be tested during the static circuit testing of the Component Tests and the Equipment Functional Tests described in Section I.A., below. The objectives of the operational test are as follows:

A. Individual Component Tests and Equipment Functional Tests The following Individual Component Tests and the Equipment Functionel Tests L should be performed on each Unit when the Unit is in Mode 5, Mode 6, or

! Defueled. 'Ihe tests must be peformed on one ESF train at a time.

l 1. Verify that handswitches at the Exposure Fire Isolation Panels used for the 1

10CFR50.54(x) EDG Unit-to-Unit Cross-Tie modification provide proper contact form and function and verify the switch contact configuration changes as designed when operated from " Normal" position to "50.54X" position and from "50.54X" position to "Nonnal" position.

]

2. Verify EDG Output Breaker Control, including alarm circuits, and i modified breaker auxiliary position switches for all fourEDG Output j

, Breakers by simulating desired breaker positions for the appropriate !

breakers when 50.54X switches are selected to " Normal" and selected to

, "50.54X."

l

3. Verify all Standby Power System Inoperable Annunciators, Bus Paralleled Annunciators, and ESF System Bypassed / Inoperable Status Indications affected by this DCP function as designed.

4. Verify Unit Auxiliary Breaker's modified breaker auxiliary position switch -

for each of the four Unit Auxiliary Breakers (one Train A breaker and one Train B breaker for each Unit) functions as designed.

5. Verify Reserve Auxiliary Breaker's modified breaker auxilia:y position switches for each of the four Reserve A exiliary Breakers (one Train A breaker and one Train B breaker for each Unit) function as designed.

6. Verify Cross-Tie Breaker Control and modified breaker auxiliary position switches for each of the four IE Bus Cross-Tie Breakers (one Train A breaker and one Train B breaker for each Unit) function as designed.

l l

l Page 2 of 31 1

e - - --

7. Verify EDG Govemor Control and Automatic Voltage Regulator (AVR)

Control for each EDG function as designed.

The Individual Component Tests required to be perfonned prior to performance of

. the Integrated Functional Test will be completed under Constmetion Work Orders (CWOs). The Equipment Functional Tests required to be performed prior to performance of the Integated Functional Test will be prerequisites performed within the Pre-Operational Procedure. He Individual Component Tests and the Equipment Functional Tests are not required to be performed in accordance with SO123-IT-1," Infrequently Performed Tests and Evolutions Controls Program."

' B. Integrated FunctionalTest ne Integrated Functional Test is required to be performed after all the modifications in accordance with DCP 2&3-7048.00SE have been completed on both Unit 2 and Unit 3. The Integrated Functional Test will be performed in accordance with the requirements of SO123-IT-1, " Infrequently Performed Tests j and Evolutions Controls Program" procedure. During the Integrated Functional i Test, the same tmin Class 1E 4.16 kV ESF buses in Unit 2 and Unit 3 will be cross !

l connected with the " Operating Unit," Unit 2, EDG picking up the load from an

" initially dead bus" on the " Station Blackout Unit," Unit 3. During this test, the ;

autosequencing feature will be INOPERABLE for the Class 1E 4.16 kV ESF buses on each Unit for the train being tested. This preoperationalIntegrated i Functional Test requires simultaneous use of Class 1E 4.16 kV ESF buses in each unit, therefore, the testing will be limited to one train at a time. This ensures at least one train of the Class 1E Electrical Distribution System on each Unit remains OPERABLE during performance of th: Integated Functional Test. The most likely alignment will be of the "Operaung Unit," Unit 2 operating in Mode 1 and of the " Station Blackout Unit," Unit 3 operating in Mode 5.

NOTE: De prerequisites for performing the Integrated Functional Test are 1 provided in Section II. The test procedure stop criteria are provided in Section III. The summary of applicable accidents and events related to the operation of the Class IE Electrical Distribution System are provided in Section IV. The 10CFR50.59 Safety Evaluation justifying performance of the Integrated Functional Test is provided in Section V.

If, during the test, both units are operating in either Mode 5, Mode 6, or in Defueled Mode, then entry into a Technical Specification (TS) Limiting Condition for Operation (LCO) is not required. If, during the test, one unit is operating in either Mode 1, Mode 2, Mode 3, or Mode 4 and the other unit is operating in either Mode 5, Mode 6, or Defueled Mode, then planned entry into TS 3.8.1, "AC Page 3 of 31

t Sources - Operating," LCO 3.8.1 A,"One required offsite circuit INOPERABLE"

-l (a 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months shutdown action statement) and LCO 3.8.lD,"One required offsite ;

circuit INOPERABLE AND One required DG (EDG) INOPERABLE" (a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months l shutdown action statement), and TS 3.8.9, " Distribution Systems - Operating," j LCO 3.8.9A, "One AC electrical power distribution subsystem INOPERABLE" i (an 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months shutdown action) will occur for the unit operating in either Mode 1, Mode 2, Mode 3, or Mode 4. The most limiting shutdown action statement is the TS LCO 3.8.9A 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months shutdown action statement. Therefore, completion of the Integrated Functional Test for a given train must be completed within the 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months time frame to avoid having to perform a TS shutdown on the Operating Unit. For simplicity, the unit operating in either Mode 1, Mode 2, Mode 3, or Mode 4 (in this case Unit 2 is expected to be operating in Mode 1) will be designated as the

" Operating Unit." and the unit operating in either Mode 5, Mode 6, or in Defueled Mode (in this case Unit 3 is expected to be operating in Mode 5) will be i designated as the " Station Blackout Unit." During the Integrated Functional Test, i the Class IE 4.16kV ESF bus associated with the Operating Unit being tested 1 must remain energized to avoid entry into TS LCO 3.0.3. If the Operating Unit 1E I 4.16kV ESF bus should deenergize, two of four Battery Chargers on the j Operating Unit are rendered INOPERABLE, then TS LCO 3.0.3 is entered !

because there is no other TS action statement provided for such a condition. The l Operating Unit must initiate a TS shutdown within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . Entry into TS LCO i 3.0.3 is an event reportable to the United States Nuclear Regulatory Commission l (USNRC).

Dunng perfonnance of the Integrated Functional Test, the automatic sequencing feature of the ESF loads onto the Class IE 4.16kV ESF buses being tested will be

- disabled when the 50.54X handswitches at the applicable train Exposure Fire Isolation Panels for Unit 2 and Unit 3 are selected from the " Normal" position to the "50.54X" position. Automatic sequencing of ESF loads on the Operating Unit, therefore, will not occur if a Safety Injection Actuation Signal (SIAS) occurs. )

Removing automatic sequencing from service on one train Class IE 4.16kV ESF j bus of the Operating Unit renders one electrical power distribution subsystem ,

INOPERABLE, hence, the Operating Unit will enter TS LCO 3.8.9A action l statement. Based upon present planned schedule, DCP 2&3-7048.00SE will be l completely installed during the latter part of Unit 3 Cycle 9 Refueling Outage. The Integrated Functional Test is scheduled to be performed when Unit 2 is in Mode 1 and Unit 3 is in Mode 5. The Integrated Functional Test Methodology assumes l one unit is the " Operating Unit" operating in either either Mode 1, Mode 2, Mode !

3, or Mode 4 and one unit is the " Station Blackout Unit" operating in either Mode i 5, Mode 6, or in Defueled Mode. Therefore, Unit 2 is expected to be the

" Operating Unit" and Unit 3 is expected to be the " Station Blackout Unit."

l Page 4 of 31

i l

r The Integrated Functional Test will demonstrate the following functions to verify l~ proper operation of the Class IE Electrical Distribution System when the 5054X l handswitches at the Exposure Fire Isolation Panels for Unit 2 and Unit 3 are selected to "50.54X." The objectives of the Integrated FunctionalTest are pmvided below:

l

1. Verify closum of the associated tie breaker on a Class 1E 4.16kV ESF bus

]

will not trip its EDO breaker with the 5054X handswitches in the 50.54X position.

2. Verify a Class IE 4.16kV bus tie breaker can be closed onto a dead bus with the 5054X hand switches in the 50.54X position.

3. Verify alarm and indications function as per design.

4. Verify that an EDG or, the Operating Unit can provide power to the same train Class IE 4.16kV ESF bus on the Station Blackout Unit by performing the followng:

a. Cross connect the Operating Unit running EDG to the same train of the Station Blackout Unit dead bus,

b. Acknowledgebus parallelalarm.

c. Observe EDG Govemor contub are in Isochronous Mode, NOT l in Droop Mode. )

d. Align ESF loads on the Station Blackout Unit without exceeding l the EDG load limit on the Operating Unit. j

5. Verify both units can be restored to a normal lineup by restoring Offsite Power to the respective Class IE 4.16 kV ESF buses and/or restore the Station Blackout Unit without dmpping loads on either the Operating Unit's or the Station Blackout Unit's Class IE 4.16 kV ESF bus by performing the following:

a. Recover the Station Blackout Unit by restoring Offsite Power via the Openting Unit's Reserve Auxiliary Transformer (RAT),

OR Page 5 of 31

b. Recover the Station Blackout Unit by restoring Offsite Power to the Station Blackout Unit's RAT or Unit Auxiliary Transformer (UAT),if applicable,

-. OR

c. Recover the Station Blackout Unit by restoring power from the unit's own EDG.

6. Verify the Class IE 4.16kV Electrical Distribution System can be restored to its normal required configuration for the Operating Unit and Station Blackout Unit actual Operating Modes.

The Integrated Functional Test will be performed using the following methodology which assumes that Unit 2 is the Operating Unit and Unit 3 is the Station Blackout Unit based upon the present Unit 2 Cycle 9 and Unit 3 Cycle 9 Refueling Outage schedules:

Align the Train A Class 1E 4.16kV ESF buses at Unit 2 and Unit 3 such that ESF buses 2A04 and 3A04 are in parallel and EDG 20002 is supplying power to both buses.

1. Ensure the Class 1E 4.16kV ESF buses are initially aligned such that bus 2A04 is powered fmm the Unit 2 RAT via breaker 2A0418 and bus 3A04

is either powered from the Unit 3 RAT via breaker 3A0418 or powered from the Unit 3 UAT via breaker 3A0419 (if Unit 3 loads are being backfed from Offsite Power via the UAT).

2. Start, or verify running, a Component Cooling Water (CCW) Pump, a Saltwater Cooling (SWC) Pump, and either an Auxiliary Feedwater (AFW)

Pump or a IAw Pressure Safety Injection (LPSI) Pump powered from bus 2A04.

3. Declare Alternate PreferTed Power Supply of Unit 2 INOPERABLEt enter Unit 2 TS LCO 3.8.1 A,72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months shutdown action statement.

4. Place Train A Class 1E 4.16kV ESF Cross-Tie Breakers 2A0417 and 3A0416 in " MANUAL."

5. Place Unit 3 EDG 3G002 in Maintenance Lockout.

1 i

Page 6 of 31

I l

6. Perform Slow Start on Unit 2 EDG 20002.

7. Synchronize Unit 2 EDG 20002 with ESF bus 2A04 and close EDG 20002 Output Breaker,2A0413. Verify EDG 2G002 Govemor Control is operating in Droop Mode. Pick up ESF Bus 2A04 loads with EDG 20002.

8. Open breaker 2A0418, Unit 2 RAT supply breaker to ESF bus 2A04. ESF Bus 2A04 is powered from Unit 2 EDG 20002. Verify Unit 2 EDG ,

20002 Govemor Control switches from Droop Mode to Isochronous l Mode.

9. Declare Unit 2 and Unit 3 Train A AC Disribution Systems INOPERABLE; enter Unit 2 TS LCO 3.8.9A 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months shutdown action statement.

10. Open breaker 3A0418, Unit 3 RAT supply breaker (or 3A0419, Unit 3 UAT supply breaker,if applicable) to ESF bus 3A04. ESF bus 3A04 is now deenergized.

i

, 11. Place 5054X handswitches 2HS-5054XA1 and 2HS-5054XB1 at the l Unit 2 Train A Exposure Fi:e Isolation Panel and 3HS-5054XA1 and !

3HS-5054XB1 at the Unit 3 Train A Exposure Fire Isolation Panel from the " Normal" position to the "50.54X" position.

12. Acknowledge Control Room Alarm and Indication for Standby Power Bypassed.

13. Verify VR Relays are energized on both units.

NOTE: Auto Load Sequencing is now blocked on Train A in both units.

14. Close Train A ESF Bus Cmss-Tie Breakers 2A0417 and 3A0416. ESF Bus 3A04 is now being powered from Unit 2 EDG 20002.

15. Acknowledge Control Room Bus 2A04/3A04 Parallel Alarm.

16. Verify Unit 2 EDG 2G002 Govemor Control continues to operate in Isochmnous Mode (it does not switch to Dmop Mode).

i Page 7 of 31

l

17. Start a CCW Pump, SWC Pump, and an AFW Pump or LPSI Pump on ESF bus 3A04. Ensure Unit 2 EDG 20002 load does not exceed load limit of 4,700 kW. Unit 2 EDG 20002 is providing power to Unit 3 Train A ESF bus 3A04 loads.

Realign Unit 3 Train A ESF bus 3A04 and Unit 2 ESF bus 2A04 to be powered from Unit 3 Offsite Power:

1. Ensure that Class IE 4.16kV ESF buses 2A04 and 3A04 are initially in pamllel and are powemd fmm Unit 2 EDG 20002 (this is the electrical alignment that Unit 2 and Unit 3 should be in after Step 17, aligning Units 2&3 ESF buses 2A04 & 3A04 to EDG 20002, above).

2. Synchronize and Close breaker 3A0418, Unit 3 RAT supply bmaker (or 3A0419, Unit 3 UAT supply breaker, if applicable) to ESF bus 3A04.

Unit 2 EDG 20002 is paralleled with Unit 3 Offsite Power.

3. Verify Unit 2 EDG 20002 Govemor Contml switches imm Isochronous !

Mode to Droop Mode. Reduce load on Unit 2 EDG 20002.

4. Open EDG 2G002 Output Breaker 2A0413. Unit 2 ESF bus 2A04 and Unit 3 ESF bus 3A04 are in parallel being powered fmm Unit 3 Offsite Power. Verify Unit 2 EDG 2G002 Govemor Control switches from Droop :

Mode to Isochronous Mode. l l

Realign Unit 3 Train A ESF bus 3A04 and Unit 2 Train A ESF bus 2A04 to be powered from Unit 2 EDG 2G002:

1. Ensure that Class 1E 4.16kV ESF buses 2A04 and 3A04 are powered from Unit 3 Offsite Power (this is the electrical alignment that Unit 2 and Unit 3 l should be in after completing Step 4 under Realigning Units 2&3 ESF buses 2A04 & 3A04 to Unit 3 Offsite Power, above).

2. Synchronize and Close Unit 2 EDG 2G002 Output Breaker,2A0413.

Verify Unit 2 EDG 2G002 Govemor Control switches from Isochronous Mode to Droop Mode. Pick up load on Unit 2 EDG 20002.

3. Open 3 A0418, Unit 3 RAT supply breaker to (or 3A0419, Unit 3 UAT supply breaker, if applicable) to ESF bus 3A04. ESF buses 2A04 and 3A04 are in parallel being powered from Unit 2 EDG 2G002.

Page 8 of 31

4. Verify Unit 2 EDG 2G002 Govemor Control switches fmm Droop Mode toIsochronous Mode.

i

. Realign Unit 3 Train A ESF bus 3A04 and Unit 2 Train A ESF bus 2A04 to be l powered from Unit 3 EDG 30002:

1. Ensure that Class lE 4.16kV ESF buses 2A04 and 3A04 are initially in parallel and are powered from Unit 2 EDG 2G002 (this is the electrical alignment that Unit 2 and Unit 3 should be in after completing S'.ep 4 under Realigning Units 2&3 ESP buses 2A04 & 3A04 to Unit 2 EDO 20002, above).

2. Remove Unit 3 EDG 3G002 from Maintenance Lockout.

3. Perform Slow Start on Unit 3 EDG 3G002.

4. Synchronize and Close Unit 3 EDG 3G002 Output Breaker,3A0413.

4

5. Verify Unit 2 EDG 20002 and Unit 3 EDG "1002 Govemor Controls ;

each switch from Isochronous Mode to Da u Mode. Unit 2 EDG 2G002 l and Unit 3 EDG 3G002 are in parallel opeucan.

l 1

6. Open Unit 2 EDG 20002 Output Breaker,2A0413. ESF buses 2A04 and 3A04 are in parallel being powered from Unit 3 EDG 3G002.

NOTE 1: 'Ihe frequency of the EDGs when paralleled could drop as much as 1.5 Hertz. When the EDGs are separated, they operate in Isochronous Mode at 60 Hertz. When the EDGs are paralleled, i they both switch to Droop Mode and frequency may drop to i 58.5 Hertz. l

. NOTE 2: The EDGs can be operated in parallel indermitely with no adverse 4

consequences. However, to ensure that the plant is quickly restored to a normal operating configuration, it is recommended that the time EDGs are operated in parallel be limited to 51 minute,if practical j 7. Verify Unit 2 EDG 20002 and Unit 3 EDG 3G002 Govemor Controls

, each switch from Droop Mode to Isochronous Mode. Unit 2 ESF bus 2A04 and Unit 3 ESF bus 3A04 are in parallel being powered from Unit 3 EDG 3G002.

Page 9 of 31

t

8. Shutdown Unit 2 EDG 2G002.

Realign Unit 2 Train A ESF bus 2A04 to be powered from Unit 2 Offsite Power and Unit 3 ESF bus 3A04 to be powered fmm EDG 3G002: ,

i l

1. Ensure that Class 1E 4.16kV ESF buses 2A04 and 3A04 are initially in j parallel and are powered from Unit 3 EDG 3G002 (this is the electrical )

alignment that Unit 2 and Unit 3 should be in after completing Step 8 under ;

Realigning Units 2&3 ESF buses 2A04 & 3A04 to Unit 3 EDG 3G002, I above). i l l

2. Synchronize and Close breaker 2A0418, Unit 2 RAT supply breaker to ESF bus 2A04. Unit 3 EDG 30002 is in parallel with Unit 2 Offsite i Power.

3. Verify Unit 3 EDG 3G002 Govemor Control switches from Isochronous ,

Mode to Droop Mode. Adjust the load on Unit 3 EDO 3G002 so that it is j roughly carrying only the load on IE 4.16 kV ESF bus 3A04.

4. Open Train A ESF Bus Cross-Tie Breakers 3A0416 and 2A0417. ESF Bus 2A04 is being powered fmm Unit 2 Offsite Power and ESF Bus 3A04 is being powered from Unit 3 EDG 30002. ESF buses 2A04 and 3A04 are no longer operating in parallel. Verify Unit 3 EDG 3G002 Govemor Control switches from Droop Mode to Isochronous Mode.

5. Place 5054X handswitches 2HS-5054XA1 and 2HS-5054XB1 at the Unit 2 Train A Exposure Fire Isolation Panel and 3HS-5054XA1 and 3HS-5054XB1 at the Unit 3 Train A Exposure Fire Isolation Panel from the "50.54X" position to the " Normal" position. l I

6. Verify Control Room Alarm and Indication for Standby Power Bypassed cleats.

7. Verify VR Relays remain de<nergized (reset) on both units (ESF Buses 2A04 and 3A04 remain energized). Auto Load Sequencing is restored

8. Declare Train A AC distribution subsystems at Unit 2 OPERABLE. Exit TS LCO 3.8.9A 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months action statement.

NOTE: Unit 2 TS LCO 3.8.1 A 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months action statement is still in effect.

Page 10of 31

e Realign Unit 3 Train A ESF bus 3A04 to Unit 3 Offsite Power:

1. Ensure that ESF bus 2A04 is powered by Unit 2 Offsite Power, ESF bus 3A04 is powered by Unit 3 EDO 30002, and ESF buses 2A04 and 3A04 4

are separated from each other (this is the electrical alignment that Unit 2 arid Unit 3 should be in after completing Step 8 under Realigning Unit 2 ESF bus 2A04 to Offsite Power and ESF bus 3A04 to Unit 3 EDG 3G002, above).

2. Synchronize and Close breaker 3A0418, Unit 3 RAT supply breaker (or breaker 3A0419, Unit 3 UAT supply breaker, if applicable) to ESF bus 3A04. Unit 3 EDG 30002 is in parallel with Unit 3 Offsite Power.

3. Verify Unit 3 EDG 3G002 Govemor Control switches from Isochronous Mode to Droop Mode. Reduce load on Unit 3 EDG 30002.

' 4. Open breaker 3A0413, Unit 3 EDG 3G002 Output Breaker.

5. Verify Unit 3 EDG 3G002 Governor Control switches from Droop Mode toIsochronous Mode.

6. Shutdown Unit 3 EDG 3G002.

Restoring AC Electrical Distribution System to Normal Configuration:

1. Place Train A 1E 4.16kV ESF Bus Cross-Tie breakers 2A0417 and 3A0416 in"AUTC."

2. Verify Train A Class IE 4.16kV ESF buses aligned such that ESF bus 2A04 is powered from the Unit 2 RAT via supply breaker 2A0418 and ESF bus 3A04 is powered from the Unit 3 RAT via supply breaker 3A0418 (or from the Unit 3 UAT via supply breaker 3A0419 if Offsite Power wasd originally being provided to Unit 3 by backfeeding the Unit 3 UAT).

3. Exit Unit 2 TS LCO 3.8.l A 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Action Statement.

Testing of the Train B ClasslE 4.16kV buses 2A06 for Unit 2 and 3A06 for Unit 3 will be performed using a similar methodology. The procedure guideline used for testing Train B ESF buses would be to follow the above methodology and substitute the equivalent Train B component for each unit (i.e., breaker, switch, pump, etc.) to that of the given Train A component for each unit.

Page 11 of 31

i' II. PREREQUISITES FOR PERFORMING THE INTEGRATED FUNCTIONAL TEST '

As noted previously, for purposes of this evaluation, the " Operating Unit" refers to the i Unit operating in either Mode 1, Mode 2, Mode 3, or Mode 4; the " Station Blackout l

Unit" refers to the Unit operating in either Mode 5, Mode 6, or Defueled Mode; and the

" Station Blackout Unit" refers to that unit that has one train Class IE 4.16kV ESF bus being powered from the opposite unit's same train EDG. j l

NOTE: The possibility exists (although slim) that Unit 2 and Unit 3 could each be !

operating in either Mode 5, Mode 6 or, or in Defueled Mode at the time this test is performed. In that case, only, the prerequisites for the " Station Blackout Unit" need only be met.

As a minimum, the following prerequisites must be met prior to performance of any portions of the 10CFR50.54(x) Diesel Generator Unit-to-Unit Cross-Tie Operation VerificationTest (10CFR50.54(x) Test) to mimimize the probability of a Main Turbine and/or Reactor trip on the Operating Unit and to ensure that a failure of any equipment important to safety will not result in an unfavorable safety condition during alignment prior to test performance, during test performance, or realignment to normal operating lineup: l A. Test Procedure Prerequisites which apply to both the Operating Unit or the Station Blackout Unit: 1

1. All modifications required by DCP 2&3-7048.00SE to equipment and circuits have been satisfactorily completed on both Unit 2 and Unit 3 to l support performance of the required tests. l

2. Energy Control Center (ECC) has been notified regarding performance of the 10CFR50.54(x) Integrated Functional Test at SONGS Unit 2 and Unit 1 3 and that Unit 2 will be entering an 8-hour shutdown action statement in support of the test. ;

3. Both EDGs at SONGS Unit 2 and both EDGs at SONGS Unit 3 are OPERABLE prior to the test. When one train of Class IE 4.16 kV ESF l buses on each Unit is rendered INOPERABLE for performance of the 10CFR50.54(x) test, the two EDGs affected by the test at that time will remain functional during that portion of the test.

4. No surveillance testing shall be performed during performance of the 10CFR50.54(x) verification tests with the exception of those surveillances required by TS Limiting Condition for Operation (LCO) Action Page 12 of 31

i Requirements associated with INOPERABLE AC Electrical Power l

Distribution subsystems and/orINOPERABLE AC Sources. This '

pmrequisite does not preclude performing required " Channel Checks" (qualitative assessment, by observation, of channel behavior during operation) to verify equipment OPERABLE during the time interval when the Class IE 4.16 kV ESF bus at the Operating Unit to be used for supplying power to the opposite Unit's " dead bus" is declared INOPERABLE.

5. No Electrical Distribution System bus ground alarms are present prior to or during the test.

6. . All annunciaton in alarm prior to the test should be noted. An evaluation of all alarming annunciaton shall be performed to determine the applicability or impact to the test and determine what coune of action should be taken.

B. Test Procedure Prerequisites which apply to the Operating Unit, only:

1. Two trains of Component Cooling Water (CCW) System are OPERABLE.

2. Two trains of Saltwater Cooling (SWC) System are OPERABLE.

3. Two trains of Containment Emergency Ming Units (ECUS) and two trains of Dome Air Circulaton are OPERABLE.

4. If Operating Unit is in either Mode 1, Mode 2, or Mode 3, then two trains of Containment Spray System are OPERABLE

5. If Operating Unit is in either Mode 1, Mode 2, or Mode 3, then both Atmospheric Dump Valves (ADVs) are OPERABLE.

6. If the Operating Unit is in Mode 4 and a Steam Generator (S/G) is required i for Secondary Heat Removal, at least one ADV train, associated with an l OPERABLE S/G,is OPERABLE. I

7. Two Trains of Emergency Core Cooling System (ECCS) are OPERABLE if Operating Unit is in either Mode 1, Mode 2, or Mode 3.

8. One train of High Pressure Safety Injection (HPSI), powered from the OPERABLE Class 1E 4.16 kV ESF bus, is OPERABLE if the Operating Unit is in Mode 4.

Page 13 of 31

9. Two trains of Emergency Chiller Systems and all associated support systems (Contml Room Ventilation, Emergency Chill Water, etc.) are initially OPERABG and may be aligned to either Unit 2 or Unit 3. j

. NOTE: The Chillers will most likely be aligned to Unit 3 in support of the l ESF Integrated Test. When one train Unit 3 IE 4.16 kV ESF bus is being tested by this Integrated Functional Test, the associated !

- Control Room Emergency Air Cleanup System, Emergency Chiller, l 4

and the Emergency Chilled Water System are rendered

INOPERABLE. !

10. All trains of Auxiliary Feedwater (AFW) System shall be OPERABLE if i the Operating Unit is in Mode 1, Mode 2, or Mode 3. j

11. If the Operating Unit is in Mode 4 and a S/G is required for Secondary j Heat Removal, at least one train of AI Y, associated with the OPERABLE l S/G and powered from the OPERABLE Class IE 4.16 kV ESF bus,is !

OPERABLE.

i !

12. If the Operating Unit is in either Mode 1, Mode 2, or Mode 3, the Pressurizer Level Control System is in automatic control. i

13. If the Operating Unit is in either Mode 1, Mode 2, or Mode 3, the :

Pressurizer Pressure Control System is in automatic control.

14. All " Third-of-a-Kind" pumps (HPSI Pump 2(3)P018, CCW Pump l 2(3)P025, Charging Pump 2(3)P191) on the Operating Unit should be aligned to the train powered by the OPERABLE Class IE 4.16 kV ESF j bus, if practical (i.e., OPERABLE, available, and not required to meet l OPERABILITY requirements for the opposite tmin), to provide ;

availability of backup Safety Related equipment for event mitigation. ;

15. Common IE Motor Control Centers, Train A MCC BQ and Train B MCC BS, will be aligned to the same unit their associated train Emergency Chilleris aligned.

C. Test Procedure Prerequisites which apply to the Operating Unit, only, if the Operating Unit is operating in Mode 1:

1. The Main Turbine-Generator is either:

a. Synchronized to the grid with both Turbine-Generator output 220 kV Circuit Breakers (CBs) closed 4 Page 14 of 31

4

1) If Unit 2 is the Operating Unit, then CBs 4062 and 6062 are closed l

2) If Unit 3 is the Operating Unit, then CBs 4152 and 6152 are j

..- closed l l

OR 1

b. Offline with the Turbine-Generator output breakers open.

1

2. The Steam Bypass Control System (SBCS) master contmller and individual valve controllers are in automatic with at least three SBCS l valves and associated Condenser Waterboxes in service. I

3. Main Feedwater (MFW) System is in automatic operation with at least one MFW Pump in operation. All associated support equipment, including standby equipment associated with the operating MFW Pump (s) (Lube Oil, Turbine Plant Cooling Water (TPCW), etc.) is functional and operational.

4. Reactor Power, Stear 2 Demand, and Turbine Generator load (if on line) are in a steady state condition (i.e., no plant power changes are in progress, Reactor Power, Steam Demand, and Turbine-Generator load are constant).

D. Test Procedure Prerequisites which apply to the Operating Unit, only,if the Operating Unit Main Turbine-Genemtoris on line (paralleled to the grid):

1. There are no fault or trouble conditions with the AVR/ Exciter / Generator system.

2. Main Turbine-Generator Control Valve Open Limit (CVOL) is set at g 5%

above the Nanow Range Govemor.

3. All Main Turbine Generator associated support equipment, including, standby equipment (Turbine Plant Cooling Water, Stator Water Cooling, Main Lube Oil, Generator Seal Oil, etc..) is functional and operational.

E. Test Proceduie Prerequisites which apply to the Station Blackout Unit, only:

1. If Shutdown Cooling is required for decay heat removal at the Station i Blackout Unit, the Integrated Functional Test may c...y be performed if, and only if, only one train of SDC is requir.1 to be OPERABLE and operating. The OPERABLE SDC train ar.d all support systems (CCW, Page 15 of 31 i .

- - - _ - = . - . - - - - . . - - -. -~ -- .. - - - . - - . - - _ - -

SWC, etc.) must be aligned to the OPERABG Class 1E 4.16 kV ESF bus with an OPERABLE EDO.

)

, 2. Ensure the following Class 1E 4.16 kV ESF bus loads associated with the

{

, ESF bus being tested on the Station Blackout Unit are functional and !

available to operate to verify the Operating Unit's EDG is able to pick up l I

the load associated with the " dead bus" on the Station Blackout Unit. 1 4

a. CCWPump i

b. SWC Pump ;

I

c. AFW P: imp orLPSIPump 3

i l

3. If the Station Blackout Unit requires a Reactor Coolant System (RCS)

loop with its associated S/G be OPERABLE for Secondary Heat Removal,

then the train of AFW, associated with the OPERABG S/G and powered j

! from the OPERABG Class 1E 4.16 kV ESF bus, is OPERABG or {

functional. I 1

4. . If the Station Blackout Unit requires a RCS loop with its associated S/G be i

, OPERABG for Secondary Heat Removal, then the ADV associated with l

) the OPERABG S/G, is OPERABLE or functional. l t

i III. INTEGRATED FUNCTIONAL TEST STOP CRITERIA

) A.- If, during the Integrated Functional Test, any of the following openting limits are j exceeded, the testing is to be stopped:

I 1. For the OPERABLE 1E 4.16 kV and 480 V ESF Buses (i.e., the IE buses 3

not being tested):

a. IE 4.16 kV Bus Voltage: 4,2% V$ Bus Voltages 4,576 V

b. IE 480 V Bus Voltage: 428 Vs Bus Voltages 520 V

2. Switchyard Frequency: 59.9 Hz s Switchyard Frequency s 60.1 Hz.

i NOTE: Verification of IE 4.16 kV and 480 V bus voltage and Switchyard

Frequency ensures that the Grid Voltage and Frequency are in their 4- normal operating ranges. Offsite Power is capable of providing the

proper voltage to maintain the " OPERABLE" train of IE 4.16 kV i ,

I i

{ Page 16 of 31 ;

i

and 480 V ESF buses (buses not being tested) in an OPERABLE status.

3. If Main Turbine-Generator is on line, then Generator power changes not to

. exceed 50MW.

4. If Main Turbine-Generator is on line, Generator reactive power changes not to exceed 25 MVAR.

5. EDG operating in accordance with precautions and limitation of Operating Instruction SO23-2-13," Diesel Generator Operation," and applicable referenced Operating Instructions with the exception of the precaution which prevents operating EDGs in parallel (this Integrated Functional Test -

will allow parallel operation of same train EDGs on opposite units).

a. The EDGs should not be operated unloaded at 900 RPM for more than 10 minutes.

b. Both EDGs from the same unit should not be paralleled with the same Offsite AC Power Source at the same time.

c. EDG loading to bes 4,700 kW.

d. To prevent inadvertent automatic trip of an EDG on " Anti-Motoring" (reverse power), an EDG should be loaded and unloaded as follows:

1) When loading the EDG after paralleling and closing its output breaker, load EDG to k 100 kW.

2) When unloading the EDG prior to taking it off line, do not reduce load below 100 kW.

e. If the EDG is operated at < 30% generator load (1,410 kW) for 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months cumulative, then the EDG should be operated at > 50% l generator load (2,350 kW) for at least 30 minutes to clean out l exhaust stacks and remove possible glanng from the piston heads.

f. SDG Turbocharger Lube Oil pressure 210 psig and temperature 2 95*F.

I

g. EDG frequency: 58.0 Hzs EDG frequency 5 61.2 Hz Page 17 of 31

-_ . . - _ _ . . _ _ _ - _ _ _ . . . _ _ _m_- _ . _ _ - _ . . _ . _ . . _.. _ _

h. EDG voltage: 4,360 V s EDG voltages 4,550 V B. If, during the Integrated Functional Test, any of the following events occur, the i testing is to be stopped and the Class IE 4.16 kV AC Electrical Distribution

. subsystem shall be restored to its normal or pretest alignment:

1. A Main Turbine-Generator Trip (if Unit was on line).

i

2. A Reactor Trip and/or an Engineered Safety Features Actuation System l (ESFAS) actuation. !

3. A Loss of Main Feed Pump or other Plant Component that potentially :

impacts steady state power operation.

4. Loss of RCS Heat Removal, such as a Loss of Shutdown Cooling, if operating.

5. An EDG trips on an automatic trip function or for any unexplained reason.

6. Any other significant plant transient potentially impacting steady state !

power operations.

C. If an unexpected alarm of an annenciator occurs during the test, the test shall be t temporarily halted until the cause of the alarm is understood and the condition is corrected,if necessary.

D. If while one unit's EDG is operating in parallel with the oppnsite unit's EDG and an EDG on one unit trips, then perform the following:

1. Verify the associated Class IE 4.16kV ESF buses on each unit remain energized by the EDG remaining on line (this lineup is the expected configuation after one EDG trips).

2. Restore the Class 1E 4.16kV AC Electrical Distribution subsystem to its normal alignment or its pretest alignment.

3. Determine the cause of the loss of power to the affected ESF bus (es).

NOTE: If the Class lE 4.16 kV bus on the " Operating Unit" deenergized, then the Operating Unit entered TS 3.0.3 because two battery l chargers became INOPERABLE. The Operating Unit will Exit TS !

3.0.3 as soon as the ESF bus is reenergized. !

l Page 18 of 31 i

b.. - .- - - - ,. ,. -

IV. ACCIDENT / EVENT

SUMMARY

The Following Accidents / Events Analyzed in the Updated Final Safety Analysis Report (UFSAR) Are Related to/Affected by the 10 CFR 50.54(x) Unit-to-Unit ESF Bus Cross-Tie Design Change and Integrated Functional Test:

A. UFSAR Section 15.1: Increase in Heat Removal by the Samdary System (Turbine Plant)

1. UFSAR Section 15.1.3.1," Steam System Piping Failures" The steam line break is classified as a limiting fault and is dermed as a pipe break in the Main Steam (MS) System. I.oss of All Normal AC Power (Loss of Offsite Power) is assumed to occur at the time the Reactor trips !

on Low Pressurizer (PZR) Pressure. The EDGs will start up and provide power to the Class 1E 4.16 kV and 480 V ESF buses. A Main Steam Line ,

Rupture between one of the Main Steam Isolation Valves (MSIVs) and its !

associated Steam Generator (SG) will result in that SG blowing down to a dry out condition.- A Main Steam Line Rupture inside Containment will result in Containment pressurization during the associated SG blowdown to dry out. Worst case single failure is assumed in the analysis. For Containment pressurization, failure of one EDG to start provides the wont case single failure because only one train of Containment Cooling and Containment Spray would be available to mitigate Containment pressurization. From an aspect of potentially over pressurizing the RCS with the Emergency Core Cooling System (ECCS), two trains of ECCS will add more inventory to the Reactor Coolant System (RCS) than one train, alone.

B. UFSAR Section 15.2: Decrease in Heat Removal by the Secondary System (Turbine Plant)-

1. UFSAR Section 15.2.1.4," Loss of All Normal AC Pos.u !

The Loss of All Normal AC Power is classified as a Moderate-Frequency i Incident. The loss of all normal AC power event assumes a reduction in l Auxiliary Feedwater (AFW) flow from 700 gpm to 500 gpm and assumes I the upper tolerance limits on the Pressurizer Safety Valves (PSVs) increase i from +1% to +2% and the Main Steam Safety Valves (MSSVs) increase from +1% to +3%. The loss of all normal AC power event conservatively assumes the Turbine Driven AFW Pump fails to start in order to delay ,

Auxiliary Feedwater System flow to any SG until the availability of EDG Page 19 of 31

. _ , , . , , , _ - . , _ . ,r -

.,m. .,-, ., ,.,-..y --.. . __ ,,- y,. .- -_.., r., w e., .,

, power to one of the Motor Driven AFW Pumps after Emergency l Feedwater Actuation Signal (EFAS) initiation.

i i

2. UFSAR Section 15.2.2.4," Loss of All Normal AC Power wth a I

{

. ~. Concurrent Single Failure of an Active Component" The Loss of All Normal AC Power with a Concurrent Single Failure of an Active Component is classified as an Infrequent Incident. The scenario is

! identical for the Loss of All Normal AC Power event above, but includes j the assumption of failure of one of the EDGs to ctart resulting in a loss of

AC power to the respective train Class IE 4.16 kV and 480 V ESF buses.

A

3. UFSAR Section 15.2.3.1,"Feedwater System Pipe Breaks"

l. Feedwater System Pipe Breaks are classified as limiting fault incidents. A l feedwater system pipe break may occur due to a pipe failure in the Main

! Feedwater System (MFW). A Feedwater System Pipe Break may produce a total loss of normal feedwater and a blowdown of one SG. The Feedwater System Pi;m Break event is more severe with a Loss of Normal

AC Power (Loss of Offsite Power) because of the loss of forced primary coolant flow, turbine laad, Pressurizer (PZR) level and pressure control, and steam bypass control. 'Ihe culmination of these events is a rapid decrease in the heat tansfer capability of both SGs and eventual

elimination of one SG's heat transfer capability. The result is a RCS heat l~ up and pressurization.

C. - UFSAR Section 15.6: Decrease in Reactor Coolant Inventory 4

i 1. UFSAR Section 15.6.3.2.2," Steam GeneratorTube Rupture with a i Concurrent Loss of Normal AC Power" The Steam Generator Tube Rupture (SGTR) with a Concurrent Loss of

Normal AC Power accident is classified as a limiting fault based upon the l estimated frequency of this accident. The most advene radiological release i conditions are established during a SGTR event where the Loss of Normal AC Power (Loss of Offsite Power) occurs concunently to the Reactor Trip on Low Pressurizer Pressure. In addition, single failure is assumed to occur such that the Motor Driven AFW Pump associated with the unaffected SG is unavailable. Under this condition; the Turbine Driven AFW Pump must be used to feed the unaffected SG which will contribute to additional release of radioactivity from the Turbine Driven AFW Pump exhaust steam to atmosphere. The most conservative single failure to Page 20 of 31 w

establish such a condition would be failure of the EDG associated with the train that supplies power to the Motor Driven AFW Pump associated with the unaffected SG. With this single failure assumption, one train of Emergency Core Cooling System (ECCS) would be unavailable for RCS

.. makeup.

2. UFSAR Section 15.6.3.3," Loss of Coolant Accident" A Loss of Coolant Accident (LOCA) is considered a limiting fault based upon the expected frequency of occunence of a LOCA. This UFSAR section coven the spectrum of LOCAs fmm Small Break to Large Break LOCAs. A failed open PSV is also included in this UFSAR section. De Design Basis LOCA assumes a Loss of Normal AC Power (Loss of Offsite Power) concunent with the most limiting single failure which is the failure of one DG to stan on the loss of Voltage Signal (LOVS). The loss of that i

EDG results in the loss of one train of ECCS, Containment Cooling, Containment Spray, and the associated suppon systems for that train.

With only one train of ECCS, Containment Cooling, Containment Spray, etc., available for mitigation of the LOCA, the most limiting radiological releases to the public result.

D. Class 1E AC Electrical Distribution Impact of Accidents / Events For each of the above accidents / events described above, at least one EDG is required to operate to provide power to its associated Class lE 4.16 kV ESF bus and Class 1E 480 V ESF bus in support of operation of at least one train of ESF equipment required for accident / event mitigation. He capability of the EDGs to power their respective Class lE 4.16 kV ESF buses is only altered during the actual testing of the 10CFR50.54(x) Unit-to-Unit IE Bus Cross-Tie by verifying j the capability of one Unit's EDG to provide power to the opposite Unit's same :

tmin Class lE 4.16 kV ESF bus. l l

Only one train can be tested at a time. The affected Class IE 4.16 kV ESF bus on the Operating Unit will be INOPERABLE during the testing because the auto l sequencing of the IE loads on that ESF bus will be disabled when any of the ;

associated train 5054X handswitches at either the Unit 2 or Unit 3 Exposure Fire Isolation Panel is placed in the "50.54X" position. This lineup renders one AC electrical power distribution subsystem INOPERABLE per TS 3.8.9," Distribution Systems - Operating" LCO Action Statement "A" which states, if"one AC electrical power distribution subsystem is inoperable ," then " restore AC electrical power distribution subsystem to OPERABLE status" within "8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ." Testing of Page 21 of 31

J I

g the 10CFR50.54(x) lineup for a given train and Unit must be completed and the system must be restored to OPERABLE status within the 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months window in order to allow for continued operation of the Operating Unit. The maximum 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months i i

completion time limit before requiring a Unit Shutdown in this condition is j

. acceptable because of the following bases for the TS LCO Action Statement:

\

1

!- 1. Here is little potential for the Unit Operator's uttention to be diverted

from the evaluadons and actions necessary to restore power to the affected ,

train ;

I i

l a. He prerequisites and limitations pmvided by the Test Guidelines ensure the Operating Unit and the Station Blackout Unit is in a steady state condition with no other evolutions taking place during

the Integrated Functional Test for the 10CFR50.54(x) EDG Cross-Tie design change.

l l b. The Integrated Functional Test will be performed in accordance with the requirements of SO123-IT-1," Infrequently Performed Tests and Evolutions Contmls Program" procedure which provides ;

specific requirements for performance of infrequent evolutions.

c. De Integrated Functional Test will be a planned, procedurahzed test. Entry into the LCO Action Statement is a preplanned !

evolution rather than the result of an unplanned event or failure of equipment.

2. There is little potential for a Design Basis Accident or event concurrent )

with a single failure of a redundant component in the train with AC power l during the 8 hourtime interval.

NOTE: If one of the two units is an " Operating Unit" during the I performu ce of this Integrated Functional Test, the Operating Unit's Cu as 1E 4.16 kV ESF bus must remain energized througho'at the test to maintain all four of its Class IE Battery Chargers OPERABLE and prevent entry into TS LCO 3.0.3.

Should the ESF bus on the Operating Unit become deenergized at any time, then two of the four Class 1E Battery Chargers associated with the Operating Unit are renderJ- INOPERABLE and TS LCO 3.0.3 is entered. A 30-Day Licensee Event Report (LER) to the NRC will be required for entering TS LCO 3.0.3.

1 i

Page 22 of 31 E

--r

V. 10 CFR 5039 SAFETY EVALUATION FOR INTEGRATED FUNCTIONAL TEST

, Engineering Evaluation The Integrated Functional Test IE of the AC Electrical Distribution System after completion of modifications in accordance with DCP 2&3-7048.00SE,"10CFR50.54(x)

Unit-to-Unit Diesel Generator Cross-Tie," will verify proper operation of the capability to parallel like train Class IE 4.16 kV ESF buses between units where one EDG is supplying

power to one Unit and the other Unit is in a " Station Blackout" (SBO) event. The ~

! . alignment for the "10CFR50.54(x) Cross-Tie Integrated Functional Test will be performed

on one train at a time. The affected Class IE 4.16 kV ESF bus on the Operating Unit will be declared INOPERABLE during the testing because the auto sequencing of the IE loads i on that ESF bus will be disabled when any of the associated train 5054X handswitches at

either the Unit 2 or Unit 3 Exposure Fire Isolation Panel is placed in the "50.54X" position. This lineup renders one AC electrical power distnbution subsystem

INOPERABLE per TS 3.8.9 LCO Action Statement A is entered and that train "AC i electrical power distribution subsystem" is declared INOPERABLE. The 5054X switches

! associated with the train to be tested will have to be placed in the "50.54X" position to i support the Integrated Functional Test. TS LCO 3.8.9 Action Statement A allows 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months

to restore the AC electrical power distribution to OPERABLE status before a Unit Shutdown must be initiated. 'Ihe maximum 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months completion time limit before requiring

a Unit Shutdown in this condition is acceptable because of the following bases for the TS f LCO Action Statement

i i 1. There is little potential for the Unit Operator's attention to be diverted l from the evaluations and actions necessary to restore power to the affected j nm

a. 'Ihe prerequisites and limitations provided by the Test Guidelines ensure the Operating Unit and the Station Blackout Unit is in a steady state condition with no other evolutions taking place during the Integrated Functional Test for the 10CFR50.54(x) EDG Cross-Tie design change.

b. The Integrated Functional Test will be performed in accordance with the requirements of SO123-IT-1," Infrequently Perfonned Tests and Evolutions Controls Program" procedure which - Jes specific requirements for performance of infrequent evolutie ,

c. The Integrated Functional Test will be a planned, proceduralized test. Entry into the LCO Action Statement is a preplanned I

Page 23 of 31 {

t i

evolution rather than the result of an unplanned event or failure of equipment, i I

2. There is little potential for a Design Basis Accident or event concurrent J with a single failure of a redundant component in the train with AC power j during the 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months time interval.

l 1

l

1. May the proposed activity increase the probability of occurrence of an accident evaluated previously in the UFSAR?

Response: No.

During the period of time the one train Class 1E 4.16 kV ESF bus being tested is INOPERABLE, the other train Class 1E 4.16 kV ESF bus and associated EDG will remain OPERABLE. The Integrated Functional Test will be performed in compliance with TS 3.8.9 Action Statement A associated with the INOPERABLE AC Electrical Distribution Subsystems.

Failuru of the Class 1E 4.16 kV distribution system or failure of Main Control Board equipment associated with operation of the Class IE 4.16 kV and 480 V buses are not precursors to any of the accidents or events analyzed in UFSAR Chapter 15 accident analyses. Interactions between OPERABLE equipment important to safety are not affected by performance of the equipment involved in theIntegrated FunctionalTest.

'Iherefore, the proposed activity will not increase the probability of occunence of an accident previously evaluated in the UFSAR.

i

2. May the proposed activity '.ncrease the consequences of an accident j evaluated previouslyin theUFSAR?

Response: No.

During the period of time the one train Class 1E 4.16 kV ESF bus being tested is INOPERABLE, the other train Class IE 4.16 kV ESF bus and associated EDG will remain OPERABLE. The Integrated Functional Test will be performed in compliance with TS 3.8.9 Action Statement A associated with INOPERABLE AC Electrical Distribution Subsystems. Interactions between OPERABLE equipment important to safety are not affected by performance of the Integrated Functional Test. All UFSAR analyzed accidents and events that include a Loss of Offsite Power (LOOP) assume only one train of the AC Electrical Distribution Subsystem Page 24 of 31

i

[' 1 4

-is available for mitigation of those accidents and events. Only ene train of the AC j Electrical Distribution Subsystem is OPERABW during performance of the i

Integrated Functional Test. A single failure rendering the OPERABG AC l Electrical Distribution Subsystem or any equipment important to safety powered '

) from that AC Electrical Distribution System is not considered to be a credible event concunent with the UFSAR analyzed accidents arxi events during the 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months

time interval allowed by TS 3.8.9 LCO Action Statement A.

i.

i

'Iherefore, the proposed activity will not increase the consequences of an accident

previously evaluated in the UFSAR.

e l 3. May the proposed activity increase the probability of occurrence of a

malfhnetion of equipment important to safety evaluated previously in the

! UFSAR?

l, Response: No.

l During the period of time the one train Class IE 4.16 kV ESF bus being tested is INOPERABM, the other train Class IE 4.16 kV ESF bus and associated EDG

!. will remain OPERABG. The Integrated Functional Test will be performed in l l compliance with TS 3.8.9 Action Statement A associated with Inoperable l

! Electrical Distribution Subsystems. Interactions between OPERABG equipment

' l important to safety are not affected by perfonnance of the Integrated Functional 1 i Test because of the inherent design of separation of opposite trains of equipment j l at each Unit. Hence, the AC Electrical Distribution Subsystem taken out of l j- service in support of the Integmted Functional Test cannot be a precursor to or j initiate failures of equipment important to safety required to be OPERABG l during this test. !

Therefore, the proposed modification will not increase the probability of occurrence of a malfunction of equipment important to safety previously evaluated :

in the UFSAR.

4. May the proposed activity increase the consequences of a malfunction of

. equipment important to safety evaluated previously in the UFSAR?

Response: No.

During the period of time the one train Class IE 4.16 kV ESF bus being tested is INOPERABE, the other train Class IE 4.16 kV ESF bus and associated EDG will remain OPERABW. The Integrated Functional Test will be performed in Page 25 of 31

.; 1 compliance with TS 3.8.9 Acuon Statement A associated with Inoperable Electrical Distribution Subsystems. Interactions between OPERABLE equipment

important to safety are not affected by performance of the Integrated Functional Test because of the inherent design of separation of opposite trains of equipment

, at each Unit. Hence, the AC Electrical Distribution Subsystem taken out of service in support of the Integrated Functional Test cannot contribute to the ,

, consequences of failures of equipment important to safety required to be l OPERABLE during this test. l Therefore, the proposed modification will not increase the consequences of a malfunction of equipment important to safety previously evaluated in the UFSAR.

1

5. May the proposed activity crmte the possibility of an accident of a different !

type than any evaluated previi usly in the UFSAR?

l Response: No. l 1

'Ihe Integrated Functional Test to verify proper operation of the HS5054X switches and capability to align an EDG and its associated Class lE 4.16 kV ESF bus with a dead "same train" bus on the opposite unit will be performed under a special test procedure per the requirements of Station Procedure SO123-IT-1,

" Infrequently Performed Tests and Evolutions Controls Program." The testing l will be performed in compliance with TS 3.8.9 Action Statement A associated with l Inoperable Electrical Distribution System Equipment. Interactions between OPERABLE equipment important to safety are not affected by performance of the 4

Integrated FunctionalTest.

The accidents and events related to and potentially affected by performance of the Integrated Functional Test are provided in Section IV," Accident / Event Summary," pmvided above. There are no reasonable or credible accident or event scenarios potentially associated with the Class lE Electrical Distribution System or the Main Control Board Switches affected by this design change that are different fmm any of those previously evaluated in the UFSAR. 1 Therefore, this proposed change will not create the possibility of an accident of a different type than previously evaluated in the UFSAR.

Page 26 of 31

__ _ _ _ . _ _ _ _ _ . _ _ . _ __ -- - __.~---

- - -- q i

- l l \

4 3

i '

6. May the proposed activity create the possibility of a malfunction of equipment important to safety of a different type than any evaluated previuslyin the UFSAR?

Response: No.

The Integrated Functional Test to verify proper operation of the HS5054X switches and capability to align an EDG and its associated Class 1E 4.16 kV ESF bus with a dead "same tmin" bus on the opposite unit will be performed under a special test procedure per the requirements of Station Procedure SO123-IT-1,

" Infrequently Performed Tests and Evolutions Controls Program." The testing will be performed in compliance with TS 3.8.9 Action Statement A associated with Inoperable Electrical Distribution System Equipment. Interactions between OPERABLE equipment important to safety are not affected by performance of the Integrated FunctionalTest.

There are no reasonable or credible failure modes potentially associated with the Class 1E Electrical Distribution System or the Main Control Board Switches affected by this design change that could result in a malfunction of couipment ,

important to safety different from any previously analyzed in the UFSnR. l Therefore, this proposed change will not create the possibility of a malfunction of equipment important to safety of a different type than any previously evaluated in the UFSAR.

7. Does the proposed activity reduce the margin of safety as denned in the bads !

for any TechnicalSpeclReation? j Response: No.

The following TS are associated with the Class IE Electrical Distribution System ;

and the Main Control Boani Switches affected by the Integrated Functional Test 4 for DCP 2&3-7048.00SE design modification implementation verification.

TS 3.8.1: AC Sources, Operating (Modes 1,2,3, and 4)

TS 3.8.2: AC Sources, Shutdown (Modes 5 and 6)

TS 3.8.9: Distribution System - Operating (Modes 1,2, 3, and 4)

The OPERABILITY of the AC Power Sources and associated AC Electrical Distribution Subsystems during operation ensures that sufficient power will be available to supply the safety related equipment required for;

1) The safe shutdown of the facility Page 27 of 31

i 1

l l

2) he mitigation and control of accident conditions within the facility.

The minimum specified independent and redundant AC Power Sources and AC j Electrical Distribution Subsystems satisfy the requirements of General Design i , Criterion 17 of Appendix A to 10CFR 50.

The ACTION requirements specified for the levels of degradation of the power sources pmvide restriction upon continued facility operation commensurate with the level of degmdation. De OPERABILITY of the AC Power Sources and the !

l AC Electrical Distribution Subsystems are consistent with the initial condition l assumptions of the safety analyses and are based upon maintaining at least one i redundant onsite AC Power Source and ssociated AC Electrical Distribution Subsystem OPERABLE during accident conditions coincident with an assumed j loss of offsite power and single failure of the other AC onsite source. De AC l

i Power Sources and AC Electrical Distribution Subsystem allowable out-of-service '

, times are 'oased on Regulatory Guide 1.93," Availability of Electrical Power i Souxtes," December 1974. When one EDG is inoperable, there is an additional

ACTION requirement to verify that all required systems, subsystems, trains, l components and devices, that depend on the remaining OPERABLE EDG as a source of emergency power, are also OPERABLE. His requirement is intended j to provide a,surance that a loss of offsite power event will not result in a complete i

loss of safety function of critical systems during the period of time that one of the

EDGs is inoperable. The term verify as used in this context means to

- administratively check by examining logs or other information to determine if j certain components are out-of-service for maintenance or other reasons. It does i not mean to perform the surveillance requirements needed to demonstrate the OPERABILITY of the component. l The Integrated Functional Test IE AC Electrical Distribution System after i completion of modifications in accordance with DCP 2&3-7048.00SE, ;

"10CFR50.54(x) Unit-to-Unit Diesel Generator. Cross-Tie," will verify proper operation of the capability to parallel like train Class 1E 4.16 kV ESF buses between units where one EDG is supplying power to one Unit and the other Unit is in a SBO event. The alignment for the "10CFR50.54(x) Cross-Tie Integrated Functional Test will be performed on one train at a time. The affected Class 1E 4.16 kV ESF bus on the Operating Unit will be declared INOPERABLE during the testing because the auto sequencing of the IE loads on that ESF bus will be disabled when any of the associated train 5054X handswitches at either the Unit 2 or Unit 3 Exposure Fire Isolation Panel is placed in the "50.54X" position. This lineup renders one AC electrical power distribution subsystem, the Altemate Preferred Power Supply for Unit 2, INOPERABLE per TS 3.3.9 LCO Action Statement A. The 5054X switches associated with the train to be tested will have to be placed in the "50.54X" position to support the Integrated Functional Test.

Page 28 of 31

~

TS LCO 3.8.9 Action Statement A allows 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months to restore the AC electrical power distribution to OPERABLE status before a Unit Shutdown must be initiated. The maximum 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months completion time limit before requiring a Unit i Shutdown in this condition is acceptable because of the following bases for the TS l

,, LCO Action Statement: l

1. There is little potential for the Unit Operator's attention to be diverted from the evaluations and actions necessary to restore power to the affected !

train:

a. The prerequisites and limitations provided by the Test Guidelines ensure the Operating Unit and the Station Blackout Unit is in a steady state condition with no other evolutions taking place during the Integrated Functional Test for the 10CFR50.54(x) EDG Cross-Tie design change.

b. The Integrated Functional Test will be performed in accordance with the requirements of SO123-IT-1," Infrequently Performed Tests and Evolutions Controls Pmgram" procedure which provides specific requirements for performance ofinfrequent evolutions.

l

c. He Integrated Functional Test will be a planned, proceduralized test. Entry into the LCO Action Statement is a preplanned evolution rather than the result of an unplanned event or failure of equipment.

2. Here is little potential for a Design Basis Accident or event concurrent with a single failure of a rMandant component in the train with AC power during the 8 hourtime interval.

During the period of time the one train Class 1E 4.16 kV ESF bus being tested is INOPERABLE, the other train Class IE 4.16 kV ESF bus and associated EDG will remain OPERABLE. The Integrated Functional Test will be performed in compliance with TS 3.8.9 Action Statement A associated with Inoperable Electrical Distribution Subsystems. Interactions between OPERABLE equipment important to safety are not affected by performance of the Integrated Furrtional Test. All UFSAR analyzed accidents and events that include a loss of Offsite Power (LOOP) assume only one train of the AC Electrical Distribution Subsystem is available for mitigation of those accidents and events. Only one train of the AC Electrical Distribution Subsystem is OPERABLE during performance of the Integrated Functional Test. A single failure rendering the OPERABLE AC Electrical Distribution Subsystem or any equipment important to safety powered from that AC Electrical Distribution System is not considered to be a credible Page 29 of 31

,aw -- +

j-l event concurrent with the UFSAR anclyzed accidents and events during the 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months l time interval allowed by TS 3.8.9 LCO Action Statement A.

The OPERABILITY of the minimum specified AC Power Sources and associated AC Electrical Distribution Subsystems during Shutdown and Refueling ensures that:

1) The facility can be maintained in the shutdown or refueling condition for extended time periods.

2) Sufficient instmmentation and control capability is available for monitoring and maintaining the unit status.

Testing to verify proper operation of the HS5054X switches and capability to align an EDG and its associated Class IE 4.16 kV ESF bus with the same train " dead"

^

ESF bus on the opposite unit will be performed under a special test pmcedure per the requirements of Station Procedure SO123-IT-1," Infrequently Performed Tests and Evolutions Controls Program." The testing will14 performed in compliance with the applicable Action Statements of TS 3.8.1 and 3.8.9 associated with an INOPERABLE train of AC Sources - Operating and an INOPERABLE train of l the AC Electrical Distribution Subsystem. 'Ihe methodology of testing will ensure that voluntary entry into TS LCO 3.0.3 does not occur. If the Class IE 4.16 kV ESF bus on the Operating Unit should become deenergized, then two of four trains j of Class IE Battery Chargers will be rendered INOPERABG and the Operating i Unit will enter TS LCO 3.0.3. TS 3.8.9 only allows one Battery Charger to be j inoperable at a time on the Operating Unit. The Station Blackout Unit must be operated in compliance with TS 3.8.2, "AC Sources - Shutdown" and TS 3.8.10, l

" Distribution Systems Shutdown." TS 3.8.2 only requires one qualified offsite source and one EDG OPERABW. TS 3.8.10 only requires one OPERABLE train of Class IE AC Electrical Distribution subsystem. Compliance with both TS will be maintained without entry into a TS LCO Action Statement. 'Iherefore, deenergizing one Class IE 4.16 kV ESF bus on the Station Blackout Unit is acceptable for performance of the Integrated Functional Test.

For performance of the Integrated Functional Test, the Station Blackout Unit will be in either Mode 5 with Reactor Coolant System (RCS) Loops filled, Mode 6 with at least 23 feet of water above the Reactor Vessel Flange, or defueled with no fuel movement in progress. Since one of the two Class 1E 4.16 kV ESF buses will be deenergized at a time for circuit testing, the specific operating conditions for Mode 5 or 6 must be established to ensure only one train of Shutdown Cooling is required to be OPERABLE. A dead Class IE 4.16 kV ESF bus renders one train of Shutdown Cooling INOPERABLE. No TS LCOs will be Entered for the Station Blackout Unit if operated in either Mode 5 with RCS loops filled, Mode 6 Page 30 of 31

l l

with 23 feet of water above the Reactor Vessel Flange, or defueled with no fuel movement in progress.

Themfore, this proposed change will not reduce the margin of safety as defined in the basis for any technical specification.

1 i

l Prepamd by: -.,c. Most( 15, jpS6 l K.F. Wrigh[

KFW.7048S7SE.W61 1

l Page 31 of 31

i l

l Section III i

Edison Internal UFSAR Change Request j i

1

, y-DCP # 2 & 5 - 7046.06 El REV O m%

JJFSAR/UFHA CHANGE REQUEST e

( A. IDENTIFICATION Page 1 of 7 Unit 2&3 Change Request No.:SAR23 450 (provided by Nuclear Regulatory Affairs)

Title:

10CFR50.54(x) Unit to Unit DG X-Tie Date Prepared: 05/08/96 Document Affected: UFSAR Section: 8.1.4 and 8.3.1 Orig. Organization: NEDO/ Control-Elec originator. Bikash Basu Originating Design Document (s) or Other DCP 2&3 - 7048.00SE, Rev. O Operating License /TS affected? @ No O yes Section:

B. DESCRIPTION Summary of Change (Attach additional pages and/or marked up pages as required):

DCP 2&3 - 7048.00SE, Rev. O will provide the capability to manually cross-connect one unit's DG to the same train of the other unit's 4.16 KV Class 1E AC bus in the event of:

1. A loss of all preferred power sources to both San Onofre units, and p

2. A station blackout in one of the San Onofre units =Nr r,; 4.10 ';'/ 0:;~ : L.; :; d;;d, and

3. Either one or both of the other San Onofre unit's DGs are available and supplying power to their 4.16 KV Class 1E buses.

( Describe Why Change is Necessary (Attach additional pages as required):

This DCP will eliminate the physical changes to the plant that are required presently by the " Desperate Operating Instruction 1E 4160 X-Tie", Rev. O that cannot be completed within the 55 minutes requirement of the IPEEE evaluation.

C. EVALUATION 50.59 Evaluation Covered by DCP/FCN Reference Attached N/A - No impact on Nuclear Safety (see Attachrnert 5 guidelines)

D. APPROVALS (Optional for DCP)

Prepred by: Approved by:

Bikash Basu 5/8/96 Rice Berkshire 5/8/96 Printed Name Date Printed Name Date W G h /922.94 *T l t G, f =t g;, R .E.- /f*FV6 7//8/f(f e Signature / PAX Date Signature / PAX Date E. FORWARD TO MANAGER, PLANT LICENSING sCE 26449 REV. 210/95 (REFERENCE 30128-XXX4 2]

NY1SINf$oNoYk$.N!$N

4

.. . . a;'

ge,, 215 fo+t.cose e o sur 47 _

i sen Onofr 2.e , -

Updated i

INTRODUCTION i

I l of the same unit. Offsite power is then available at the EsF buses of i

the monoperating unit through the main step-up and unit auxiliary j transformer. 'this source of offsite power is in addition to the j preferred sources referred to in paragraph 8.3.1.1.1.

j 8.1.4.2 Onsite Power System i

l A. No portion of the onsite standby ac power system is shared between l imitat. The 4.16 kV EsF buses are shared between units only when i

operating in the backup mode, using offsite sources, as described in q paragraph 8.1.4.1, listing B.

~.

l **! 3. The class 1E power systems are designed to satisfy the single-failure

$ criterion.

i .9 l l C. For each protection channel (A, B, C, or D) one independent 125V-dc k ,I -

and one 120-volt vital ac power source are provided. Subsystems A and B batteries are sized for 1-1/2 hours of operation without the support

] of a battery charger. Subsystems C and D batteries are sized for 8

C hours without support of a battery charger to provide for shutdown

~

h cooling (sDC) valve operation, which is required to operate any time

, ]' within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months following an accident (refer to paragraph 6.3.3.4.1 and a Table 15.6-25).

(~ 8 l

3 D. A separate non-Class 1E 125V-de and 250V-dc system is provided for l "E non-Class 1E instrumentation, controls and other 125V-de and 250V-dc 8 loads.

E

{ E. Raceways are not shared by Class 1E and non-Class 1E cables. Refer to y paragraph 8.1.4.3, Regulatory Guide 1.75, for detailed discussion.

E g F. Special identification criteria apply for Class 1E equipment, cabling

.g and raceways, and associated circuits (refer to paragraph 8.3.1.3).

.E

- c. separation criteria apply which establish requirements for preserving D the independence of redundant Class 1E systems (refer to Paragraph

} 8.3.1.4).

R. Class 1E equipment is designed with the capability of being tested g periodically.

J I. Non-class 12 uninterruptible power supplies are provided for the

] onsite technical support center computer and the Dose Assessment computer (refer to paragraph 8.3.1.1.6).

8.1.4.3 Damian criteria. Reaulatory cuides, and TFFT standards f Codes and standards applicable to the onsite power system are listed in

( Appendiz 3.2A. Generally, the system is designed in accordance with IEEE standards 308-1974, 317-1972, 323-1971 or 1974, 334-1971, 279-1972, 382-1972, 383-1974, 420-1973, and 450-1S72.

PAGE 2 O P ~7 3/96 4.1-4 Revision 11

1; -

' ~ ' 'l 3

M 2L'5404t.00SE e O w 48 f( San Onofre 263 FSAR Updated i(

INTRODUCTION i

j' compliance with General Design Criteria 17 and 18 of 10CFR50, Appendix A, is l discussed in paragraph 8.3.1 2 and 8.3.2.2. Consistency of the design with the

. recommendations of Regulatory Guides 1.6, 1.9, 1.22, 1.29, 1.30, 1.32, 1.40,

! 1.41, 1.47, 1.53, 1.62, 1.63, 1.73, 1.75, 1.81, 1.89, 1.93, and IEEE Standards

338-1971, 344-1971 or 1975 and 387-1972 is discussed below. l 1

{ 8.1.4.3.1 Regulatory Guide 1.6. Independence Between Redundant standby j (Onsite) Power Sources and Between Their Distribution Systems l The Class 1E system is divided into redundant load groups so that loss of j any one group will not prevent the minimum safety functions from being j performed. Figure 8.3-1 shows this arrangement.

): Each ac load group of either unit has connections to two preferred (offsite)

power sources, provided that the 4.16 kV switchgear of the other unit is

! energized, and to a single diesel generator. Each diesel generator is j exclusively connected to a single Class 1E, 4.16 kV, load group d 1

Each de load group is energized by one battery and one battery charger. The batteries are exclusively associated with a single 125V-dc bus, and each l battery charger is supplied from the associated ac load group. The diesel

generator of one load group cannot be paralleled, either manually or 9 automatically, with the diesel generator of the redundant load group. ?

w i(- No provisions exist for . automatic transfer of loads between redundant onsite c

{ power supplies. The third-of-a-kind equipment that serves as maintenance 1S l

3 spare equipment is manually connected to a load group through a manual transfer switch and two separate interlocked devices on the redundant load la

! Eroups. ~j i

3fc

8.1.4.3.2 Regulatory Guide 1.9 Selection, Design, and Qualification h l of Diesel-Generator Units Used as Standby (Onsite) Electric ]e

Power Systems at Nuclear Power Plants i c j

The sum of the conservatively estimated loads needed to be supplied 3

following any design basis event is less than: j i

8 l

The continuous 8760-hour rating of each diesel generator y

.5 The ses11er of the 2000-hour rating, or 90% of the 30-minute c

_-a rating of the set

E l Imad requirements are listed in table 8.3-1.

t j The diesel generators have the following capabilities: .)

A. Starting and accelerating all engineered safety features and

forced shutdown loads to rated speed in the time and sequence n t shown in table 8.3-1. E, 4

( 3. Maintaining, during the loading sequence, the frequency and 8

U!

1

] voltage above a level which degrades the performance of any of I the loads below their minimum requirements. d PAGET 3 of: 7 6/94 , 8.1-5 Revision 10

}. .

OCP # 2.S"b-7048.00SE m_ O m 49 -

l San Onofre 2&3 ISAR j Updated INTRODUCTION

, B. Preoperational system tests are performed with all components )

i installed in accordance with the procedures described in chapter 14. These tests demonstrate that the equipment ope m es

! within design limits, and that the system is operational ati j meets performance specifications. These tests also demonstr.te i that: m.

i n

i 1. The Class IE loads can operate on the preferred power supply. od

! E i 2. The loss of the preferred power supply can be detected.

j 3. The standby power supply can be started and can accept .E j design loads in the sequence and time duration shown in i i

table 8.3-1. }

.c i 4. The standby power supply is independent of the preferred b i o power supply. 3 4

E 4

C. Periodic equipment tests are performed at scheduled intervals to .9 e detect deterioration of the system toward an unacceptable condition ' :E ;

! and to demonstrate that the standby power equipment and other com- 8 !

l( ponents that are not running during normal operation of the station 3 l are operable. ,]

I C-j D. Surveillance system tests referred to in item C above are per- ]w I

formed at scheduled intervals to demonstrate the operational I readiness of the system. I With regard to Section 7 of IEEE 308 and Regulatory Guide 1.93, the .!

j Technical Specifications discuss operating alternatives under degraded t; Class IE ac system conditions. !

'E E

Compliance with Section 8 of IEEE 308 is described as follows:

i' ' ff !

N A. The standby ac power supplies are not shared by the units

l i

B. The de power supplies are not shared by the units.

] C. The total preferred power supply capacity must be sufficient to i operate the engineered safety features for a design basis acci, dent on one unit and those systems required for concurrent safe shut-

down on the remaining units.

8.1.4.3.7 Regulatory Guide 1.40, Qualification Tests of Continuous-Duty

, Motors Installed Inside the Containment of Water-Cooled i

Nuclear Power Plants Comparison of the design with the recommendations of Regulatory Guide 1.40 is discussed in subsection 3.11.2.

$4E 4 0F 7

' ~~

~ .

DCP# 2.k3 ~/04t.00SE m O sg 50 San Onoire 263 F3AR

. Updated ,

l

j INTRODUCTION

. I l The qdantity of Tlassable material in these low-energy circuit l devices is so small that the hazard is ne5 118ible. l G.

Reference:

Section 5.6.5 of IEEE 384-1974. See item A.2 above.

I H.

Reference:

Section 5.6.6 of IEEE 384-1974. Where it is necessary i

that cables of different separation groups enter the control board enclosure with physical separation ~1ess than that indicated in j

paragraph 8.3.3.3.1, listings A, B, and C, the cables of all but one

of the separation Sroups are installed in rigid metallic conduit, i

flexible metallic conduit, metallic wireways, or solid bottom or top cable trays.

l l I.

Reference:

Section 5.7 or IEEE 384-1974. See listing A.2 above.

1 l 8.1.4.3.15 Regulatory Guide 1.81, Shared Emergency and shutdown Electric

Systems for Multiunit Nuclear Power Plants a

The design is consistent with the recommendations of Regulatory Guide 1.81. Each ,

unit is provided with separate and independent onsite ac electric systems capable '

i of supplying minimum ESF loads and the loads required'for attaining a safe and orderly cold shutdown of the unit assu=ing a_ single failure and loss of offsite j power. The standby ac power supplies are not shared by thMs except aunng the abnonnal plant conditions desengsection 8.3.1.5. __ ., )

8.1.4.3.16 Regulatory Guide 1.89, Qualification of Class 1E Equipment for

Nuclear Power Plants 1

Regulatory Guide 1.89 endorses IEEE 323-1974, Standard for Qualifying Class 1E

Equipment for Nuclear Power Generating Stations.

1 a

Comparison of the design with the recommendations of Regulatory Guide 1.89 is

discussed in appendix 3A.

A 8.1.4.3.17 Regulatory Guide 1.93 Availability of Electric Power Sources Comparison of the design with the recommendations of Regulatory Guide 1.93 is l discussed in appendix 3A.

l 8.1.4.3.18 IEEE 338-1971, Criteria for the Periodic Testing of Nuclear Power Generating Station Class 1E Power and Protection Systems Refer to sections 7.1, 7.2, and 7.3 for discussion of this standard.

i PA&E 5 oF 7 6/94 ,

. 8.1-16 Revision 10

l< l

)( .

\

' ~

^--

DCP 2&3 - 7048.00SE, Rev.0 Sht 5 l I

I l . 8.3.1.5 Cro==*ia to the onaani+* Uni += &" r=-wor

' l The Individual Plant Examination of External Events (IPEEE) for SONGS Units i !

l 2&3 document, dated December 15,1995, submitted to the NRC in response to g Generic Letter 88-20, Supplement 4, takes probabilistic credit for the capability of

a Diesel Generator (DG) crosstie to the opposite unit in the event the opposite unit

has a station blackout. The crosstie must be established prior to the Steam Generator dryout and before the core is uncovered.

f i The purpose of the crosstie is to provide the capability to manually cross-connect -ADD

. one San Onofre unit's DG to the same train of the other San Onofre unit's 4.16 ;

kV Class 1E AC bus in the event of: '

i l j 1. A loss of all preferred power sources to both San Onofre units, and .

t l 2. A station blackout in one of the San Onofre units, and k l

3. Either one or both of the other San Onofre unit's DGs are available and l supplying power to their 4.16 kV Class 1E buses. !

k Operation of the crosstie is permitted under the provisions of 10 CFR 50.54(x),

which states, "A licensee may take reasonable action that departs from a license condition or a technical specification (contained in a license issued under this part) !

, in an emergency when this action is immediately needed to protect the public health l l 3 and safety and no action consistent with license conditions and technical !

. specifications that can provide adequate or equivalent protection is immediately l L apparent." During operation of the cross-tie under 10 CFR 50.54(x), the plant is i operating outside the license condition or technical speci6 cations and the reporting requirements of 10 CFR 50.72 and 10 CFR 50.73 are applicable. )

k The 4.16 kV Class 1E bus DG crosstie is designed to perform the intended

functions in the followmg manner

l I

Two dedicated Hand Switches per 4.16 kV Class 1E train (8 total in the plant), i I

l. each with ." Normal" and "50.54X" maintained positions are provided at the i Exposure Fire Isolation Panels in the Class 1E switchgear rooms. An ESF System Bypass / Inoperable status alarm and indication will be received in the respective f unit's control room if any of these switches is not in the " Normal" position.

t i With all Hand Switches in the " Normal" position, the Onsite AC Power Systems

j. ,

will function as described in paragraphs 8.3.1.1 through 8.3.1.4.

- PA 6g' 6 0F 7 I

i

-p. e. u ._~g a3 .,..n,--__ -c. - ._ ym.p .,, , --. e ,#. m ,.-- ----.,.,w.#

a e e +

DCP 2&3 - 7048.00SE, Rev.0 Sht B2.

~ -

f To establish the crosstic connection between the same train 4.16 kV ESF buses of T

L' Unit 2 and Unit 3, the operator must manually select the associated 5054X hand switches at the Exposure Fire Isolation Panels to the "50.54X" position.

- After the crosstie connection is established, the required ESF loads must then be manually loaded from the control room without exceeding the DG load limits.

The preferred power can be restored by paralleling the DG to the SONGS 230 kV Switchyard using any one of the four preferred power sources (Unit 2 Reserve .

Auxiliary Transformer, Unit 2 Unit Auxiliary Transformer, Unit 3 Reserve Auxiliary 1 Transformer, or Unit 3 Unit Auxiliary Transformer) in the normal manner. After closing one of the preferred power supply breakers, the DG can be shutdown and be returned to the standby mode The DGs may be paralleled for the duration required for the transfer of the bus to the incoming DG and then tripping the tie breakers. Each DG will then carry its own Unit's loads.

A

( .

PAGE 7 0F '7

. ,w_.,.. + . . -w~ - ---

l I

9 I

i i

Section IV

! Selected Portions of Design Change Package j 7048.00SE, Rev.0 (ASC #2) 4 i ,

) i i

l l

4 l 4 l

2 l

i

DCP 2&3 - 7048.00SE, Rev. O ASC # 2, Rev. O, Sht / OF 53 Page cf 1 2 CONCEPTUAL ENelNEERING PACKAGE (CEP)/ DESIGN CHANGE PACKAGE (DCP) COVER SHEET

1. DCp No./Rev 2&3-7048.00SE /0 @ Affected Section Change; ASC No.:[ Whole 2_ Documert Revision neie.10 CFR 50.54(x) UNIT TO UNIT D/G CROSSTIE i Onginator BALDEV RANDHAWA _Onginating Org.:NEDO/ELEenit:2&3 System:PBA/Pglity Class:li Seisme Category:l

2. CEP Approvals (SigtvDate, As ApplicAle):

SDE '

Heath Physics /

Originator / Secunty /

Responsible FLS / Chemistry /

Discipline SLS / Maintenance /

Plant Engineenng / Operations /

Electncal/ Controls ' Nuclear Const. I Nuclear / Mechanical / EP nFn 9 0 M% /

IPRE I Environmental . . . o. L mov i POG du b i uses ver' =

/ Other /

Manager, Technical / Other /

3. DCP Approvals (sigtvDate, As Applicable):

SOE $ 4 MMf A6 Nuclear / Mechanical Th /

Onginator [DM d b/13Am 5 to f

-IPRE b /\ %

v' Responsible FLS MAAN / /J/2,,o/p6 / uclearRegulatory N Affairs

Yl ei%

A)iscipline SLS N / /M8 le /POG =.:s A u.> -- /#2[to/96 Plant Engineenng O / Other ( TT~ee, /'- / / L /r/96 I Alectrical/ Controls M / G/Jo/ib Other !

Restrictions / Mode Restraints:

4. DCP Effective Date: Nuclear Safety Group Approval (SigrvDate) /

5. DCP Closure: (signed by irstinting organizatusn, i.e., NEDO or Station)

A. Installation and required testing are complete with the following exceptions:

/

TEST OPERATIONS SUPERVISOR or STATION COGNIZANT ENGINEER DATE B. Required testing is complete and addtional engineering changes generated against this package dunng implementation and testing are listed on Form 26 503.

/

Originator DATE

6. Final Review / Acceptance: Work completion and test results have been reviend and are accepted for operation and maintenance.

/ /

COGNt2 ANT STATION ENGINEER DATE SUPERVISING ENGINEER DATE

7. Conaguranon Review: (Signed / Dated by the Supervisor of Configuration Control)

Affected design document and procedures restraining operability reflect this modification. /

SCF 26.1781 REv. s a#96 (REFERENCE SO1234uov.1016}

P 1&2 7 urtenevemovemrmo r:rvoo . ae we ye.;;;;;;3;;3g CVE'DAT AiASC7548A DAT*CisviD .10000 Preted 12/23/96 r

. DCP 2&3 - 7048.00SE, Rev. 0 ASC # 2, Rev. O, Shi 2 page 2 or 2 i

CONCEPTUAL ENGINEERING PACKAGE (CEPl/ DESIGN CHANGE PACKAGE (DCP

$ 8. Package Contents 1

included in Package ((/N) PeGe No.

A. Form 261761 CEP/DCP Cover Sheet A Y /

B. Form 26403 Design Change Cordrustion Sheet B N C. Section 1 Desedption of Change 1 Y 3 1A Reason for the Change 1A Y 5 1B Fmotional OtWive forthe Change 1B Y //

1C impact of the Change on Site Programs 1C Y

^ - ^ - " ^ ^ - /2 1D 10 Y gg 1E Functional OtyctiveM. the Change Osaty CrHe ris,

1E N 1F impact of the Change on Sao Programs IF .jf,,,

D. Section 2 10CFR50.50 Safety Evaluation 1 E. Section 3 2

3 1 24 Ucensing and Design Document impact / Design Crtterte Y ,,,3E,,,

3A Operating Uoonse or uoense Amendments 36 3A 1 1 O uFSAR O uFsA O SP Er $8 L 3C Design Criteda, Form 26182 3C N 3D System Desenption Changes

) 3E Ucensee Cortrolled Specifications Changes 30 i

1 3F General Design Cdtede Changes 3E i

i 3F N F. Section 4 Drawing Changes 4 .h[,,,_

, G. Section 5 Site Computer Softare Change Request 5 W i H. Section 6 Calculet ns N 6

i I. Section 7 Test kS.Seceptance Cnteria 7 Y Md-J. Section 6 Meterials 8

K. Section 9 Construction Safety Assessment /Special Construction Requirements I

{ L. Section 10 Site Programs impact Desenption, AR no. 10

, M. Section 11 Vendor Documents / Technical Manuel References 11 N. Section 12 Cost Estimates 12 O. Section 13 Schedules '

9. Refe,.caiRemerus cPorinformation Onty):

I LMr PAGE #58 i

i j

a i

i

^

scE 2s.17s-1 REv. s eine[ REFERENCE. So123-Xxiv.1016]

page 2 o' 2 t

1

DCP 2&3 - 7048.00SE, Rev. O ASC # 2, Rev. O, Sht. 3 1

SECTION 1 DESCRIPTION OF CHANGE 4

l DCP 2&3 - 7048.00SE, Rev. 0 )

ASC # 2, Rev. O, Sht. 4 DESIGN CHANGE TITLE: 10 CFR 50.54(x) UNIT-TO-UNIT DIESEL GENERATOR CROSSTIE

1. DESCRIPTION OF CHANGE The purpose of Affected Section Change (ASC) #2 is; E) Add a prerequisite in the test Guidelines (section 7.D) prior to performing the pre-operational Integrated Functional Test.

F) The physical changes per this DCP revision 0, ASC#1 will be completely installed and tested for unit 2 and unit 3 during the respective cycle 9 outage. The letter to the NRC (revised draft of the NRC letter is included in section 3.A of the ASC #2) requests NRC approval to perform the pre-operational test in addition to final turnover of the DCP.

G) In the fire protection and engineering self assessment exit interview held at 0830 ASC#Z on 12/13/96, Mr. Bill Ang of the NRC stated that the 10CFR50.59 Safety Evaluation for this DCP "may" be invalid. ARs 96120998 (Unit 2 Train B) and 961201400 (Unit 2 Train A) were written and processed. The end state of these two ARs isolates the safety related portions of the DCP that "could" potentially negatively affect plant performance.

FIDCNs will be issued in the future for similar U3 Train A and Train B jumpers and lifted leads if NRC approval is not obtained prior to starting the associated circuit affecting construction of this DCP.

Upon receipt of NRC approval, FIDCNs (to be issued in the future) will be implemented to remove the jumpers and restore the lifted wires to the original DCP configuration (ASC#1 configuration) prior to performing the integrated pre-operational test.

IfNRC approval is not obtained in time to complete the DCP prior to Unit 3 Cycle 9 operation, licensing action will be needed to revise the SONGS NRC IPEEE completion commitment, j l

The purpose of Affected Section Change (ASC) #1 is; j A) To add a description of the " scope of the safety evaluation" at the beginning of the Section 2,10CFR50.59 Safety Evaluation. The Engineering / Fire Protection l Self-Assessment team in their exit meeting on September 20,1996 (CPR #

l l

-l DCP 2&3 - 7048.00SE, Rev. O ASC # 2, Rev. O, Sht. 5 960900875) noted that the 10CFR50.59 Safety Evaluation does not clearly support conclusions by failing to address operation issues associated with the use of this design. This preamble to the safety evaluation will clarify that the

10CFR50.59 safety evaluations analyzed the impact of the additional hardware and control circuit changes which will be a permanent part of the plant. The 10CFR50.59 safety evaluations did not attempt to analyze safety concerns during crosstie operation as the crosstie operation facilitated by this DCP is beyond the plant design basis.

B) To add a means to connect, only during crosstie operation, the newly added Diesel Generator droop circuit interlocks. This will allow continued maintenance on 4160VAC Class IE breakers (Unit Aux, Reserve Aux, DG, Tie) without affecting l the other Unit's DG (ref. CPR# 960701200). The FIDCNs for this design change !

were issued separately from ASC#1.

C) To add in the Emergency Diesel Generator System Description (SD-S023-750) that this DCP adds the ability to crosstie diesel (s) to the opposite unit's same train safety bus during a 10CFR50.54(x) condition. I D) To add that the final turnover of this DCP will require NRC approval. m 4g l

1.A REASON FOR THE CHANGE The December 15,1995, Individual Plant Examination of External Events (IPEEE) report for SONGS Units 2&3, which was submitted to NRC in response to Generic Letter 88-20, 1 Supplement 4, takes probabilistic credit for the capability of a Diesel Generator (DG) ,

crosstie to the opposite unit and requires that in approximately 55 minutes (available l mission time equal to steam generator dry out time plus core uncovery time) the crosstie is established to restore power to the unit experiencing a station blackout.

The purpose of the crosstie is to provide the capability to manually cross-connect one unit's DG to the same train of the other unit's 4.16 kV Class IE bus in the event of:

1. A loss of all preferred (offsite) power sources to both San Onofre units, and

2. A station blackout in one of the units ( both DGs are unavailable) , and

3. Either one or both of the other San Onofre unit's DGs (standby power) are available and supplying power to their 4.16 kV Class IE buses.

- . ~ - - - _ - . - . - . - . . - . . . - ~ . - - . - - - - - . ~ . - - . - -.

l DCP 2&3 - 7048.00SE, Rev. O i ASC # 2, Rev. O, Sht. 6 i i Operation of the crosstie is pennitted under the provisions of 10 CFR 50.54(x), which ,

! states, "A licensee may take reasonable action that departs from a license condition or a technical specification (con'ained in a license issued under this part) in an emergency when

. this action is immediately needed to protect the public health and safety and no action ,

consistent with license conditions and technical speci6 cations that can provide adequate or j equivalent protection is immediately apparent".

i g

I l The present " DESPERATE OPERATING INSTRUCTION lE 4160 X-TIE, REV.0" for yg '

! 10 CFR 50.54 (x) condition requires plant physical work (applying jumpers, lifting leads,

and opening knife switches) that cannot be completed within the 55 minute requirement of theIPEEE evaluation.

l d

The DG crosstic capability can be utilized to supply power to the dead bus of the other unit for any emergency situation when it is immediately needed to protect the public health j and safety and no action consistent with license conditions and technical specifications that

can provide adequate or equivalent protection is immediately apparent.

i l The crosstied DG can supply Shutdown Loads for both units in the 10 CFR50.54(x) AsC 42

, scenario. Since this is a beyond design basis condition n-) design calculation for DG j loading is required. The DG loading will be manually controlled by plant procedures.

The 10 CFR 50.59 Safety Evaluation in section 2 evaluates the permanent plant -

configuration changes by this DCP and its impact during the plant operations for normal i and design basis accident conditions within the bounds of the Technical Specifications and

UFSAR.

l l

NOTE:

i Separate from this DCP, Proposed Change Number (PCN) - 453 to the Operating Licence is issued requesting NRC to approve revisions to Technical Specification (TS) 3.8.1, "AC Sources- Operating," to 1) extend the offsite circuit Allowed Outage Time (AOT) from "72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months M 6 days from discovery of failure to meet LCO" to "72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months M 10 days from discovery of failure to meet LCO" and 2) extend the Emergency Dies:1 Generator (EDG) AOT from "72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months M 6 days from discovery of failure to meet l LCO" to "7 days M 10 days from discovery of failure to meet LCO". j An effort is in process to extend the Emergency Diesel Generator (EDG) AOT from "7 days AND 10 days from discovery of failure to meet LCO" as requested in PCN 453 to a ;

14 day AOT. As part of the effort a calculation will be performed to show that one DG l can accommodate the safe shutdown loads for one train of both units (excluding design ;

basis accident loads). Should this TS PCN be submitted to NRC for approval, an Affected i Section Change (ASC) will be initiated if appropriate to update any affected design basis ;

documents and capture required changes to site programs and procedures. !

i DCP 2&3 - 7048.00SE, Rev. 0 ASC # 2, Rev. O, Sht. ?

4 l DEFINITION: Station Blackout (SBO)

The complete loss of alternating current (AC) electric power to the essential and non-a essential switchgear buses in a nuclear power plant (i.e, loss of offsite electric power

system concurrent with turbine trip and unavailability of the onsite emergency se power i system). It does not include the loss of available ac power to buses fed by stat 6r: Latteries :

through inverters, or by alternate ac sources, nor does it assume a concurrent single failure i or design basis accident.(10CFR50.2) i i 1. A.I. Existina Desian (Normal Ooerations. Modes 1-6) 2

1. Closure of the bus tie breaker will trip the associated DG breaker.

2. The tie breaker of the bus experiencing loss of voltage and receiving power l l from the opposite unit's 4.16 kV Class IE bus will be losed in the auto j mode,if and only if: ,

a. The opposite unit's 4.16 kV Class IE bus tie breaker is closed.

AND i

l b. The Unit Auxiliary Transformer (UAT) supply breaker of the bus !

j expenencmg loss ofvoltage is open.

AND

c. The Reserve Auxiliary Transformer (RAT) supply breaker of the bus experiencing loss of voltage is open. i AND

d. 2/4 residual voltage permissive signal from the bus experiencing loss ofvoltageis present.

AND

e. The DG supply breaker of the bus experiencing loss of voltage is open. ,

AND

f. 2/4 LOVS or SDVS condition does not exists on the opposite unit's 4.16 kV Class lE bus.

l l

l l DCP 2&3 - 7048.00SE, Rev. 0 l ASC # 2, Rev. O, Sht. E l l l AND l g. AUTO / MANUAL push-button for the tie breaker of the bus experiencing the loss of voltage is in auto.

l (SIAS transfers the tie breaker of the bus experiencing the loss of voltage control circuit to manual in order to preclude automatically i seeking power supply from the opposite unit if a loss of voltage or l degraded voltage condition exists.)

]

1 AND

h. Lockout relays of the tie breaker of the bus experiencing the loss i of voltage and associated RAT and UAT breakers are not actuated l (reset position). !

3. The tie bree.ker of the bus supplying power to the opposite unit's 4.16 kV Class IE bus experiencing loss of voltage will close in auto mode only if:

I

a. The tie breaker of the opposite unit experiencing loss of voltage is open. ;

\

l I

b. 2/4 LOVS or SDVS condition does not exists on the bus supplying j power to the opposite unit's 4.16 kV Class IE bus.

i 1

AND !

l

c. The RAT supply breaker of the bus supplying power to the opposhe unit's 4.16 kV Class IE bus is closed.

OR.

d. The UAT supply breaker of the bt.s supplying power to the opposite unit's 4.16 kV Class IE bt:s is closed. l AND l

e. 2/4 LOVS or SDVS present at the opposite unit's 4.16 kV Class j IE bus. j i

AhD l

DCP 2&3 - 7048.00SE, Rev. O ASC # 2, Rev. O, Sht. di

f. AUTO / MANUAL push-button for the tie breaker is in auto, (SIAS transfer the tie breaker control circuit in manual to preclude automatically seeking power supply from the opposite unit if a loss ofvoltage or degraded voltage condition exists.)

AND

g. Lockout relays of the tie breaker and associated RAT and UAT breakers are not actuated (reset position).

4. The 4.16 kV Class IE bus U2/U3 paralleled alarm annunciates at the Control Room (CR) , annunciator window (s) 63B55 (63C55) if:

a. The 4.16 kV Class IE bus is receiving power from its own UAT and RAT.

OR

b. The 4.16 kV Class IE bus is receiving power via tie breaker from the opposite unit's RAT m UAT and from its own RAT.

OR l

c. The 4.16 kV Class IE bus is receiving power via tie breaker from the opposite unit's RAT g UAT and from its own UAT.

(The DG cannot be connected to the opposite unit's 4.16 kV Class IE bus as closing a tie breaker will r.utomatically trip the associated DG breaker. As such, a DG cannot be paralleled with any of the opposite unit's 4.16 kV Class IE bus power supplies.)

5. Alarm for auto transfer of the tie breaker to manual operation mode during 1 a SIAS or if a manual mode of operation is selected.

6. Alarm at CR for Standby Power System inoperable status, multiple inputs '

l (M1, M2, M3) annunciator window 57A55 (57B55), for any one of the following conditions:

I

a. The DG breaker Loss of DC Control Power or Out of Operation (M2). j

b. The Non-lE UPS tran:former normal supply breaker Loss of DC Control Power if breaker is racked in and closed (M2).

l

DCP 2&3 - 7048.00SE, Rev. O ASC # 2, Rev. O, Sht. 10

c. The tie breaker Loss of DC Control Power or Out of Operation i

(M2).

l d. The RAT breaker Loss of DC Control Power or Out of Operation ,

(M2).'

i e. The Load Center Transformer feeder Loss of DC Control Power or Out of Operation (M2). ,

f. ESF Inoperable Manual Actuation, HS-0065 (M1). ,

4 g. HS1767-1 in maintenance position (M3). i

h. Loss of 125VDC power to DG L160 panel (M3). )

l i. DG exciter field ground or Exciter in off position (M3) )

1

7. Indication for ESF system Bypass / Inoperable status at HS-0065, ESF :

system bypassed / Inoperable Status Module, for any one of the following . l conditions (partiallist )if:

a. The DG breaker loss of DC Control Power or Out of Operation i (SPS Lamp #4).

4

b. The tie breaker loss of DC Control Power or Out of Operation

(SPS Lamp #2).

! c. The RAT breaker loss of DC Control Power or Out of Operation

, (SPS Lamp #1). 1

d. The Load Center Transformer feeder loss of DC Control Power or

Out ofOperation (SPS Lamp #3).

, 8. The DG Governor will be in DROOP mode when the associated RAT -

i breaker, m the UAT breaker, g the tie breaker is closed and the associated DG breaker is closed.

)

) i I

i

-f b

)

i

. . . ___~ _ . . . . _ _ . - . . _ . _ _ . _ . - . _ _ _ . _ _ _ _ - __ __..___.s . _ _ _ _ . _ .

l DCP 2&3 - 7048.00SE, Rev. 0 f

l i ASC # 2, Rev. O, Sht. II :

l l 1.B FUNCTIONAL OBJECTIVE OF THE CHANGE

]

!' The objective of this modification is to allow, subsequent to satisfying 10 CFR 50.54(x) i . requirements, manual cross-connect of a unit's DG to the same train of the opposite unit's !

! 4.16 KVAC Engineered Safety Features (ESF) bus in the event ofloss of normal preferred l powei, alternate preferred power, and standby power to the opposite unit's 4.16 kV Class

IE bus. After switching at each units fire isolation panel in the El. 50' Class IE switchgear l room, all subsequent operations are completed in the main control room.

l Two dedicated Hand Switches (HS-5054XAl and HS-5054XB1 for TRAIN A, HS-j 5054XA2 and HS-5054XB2 for TRAIN B), with " Normal" and "50.54X" maintained positions, will be used per ESF train per unit for 10 CFR 50.54(x) operation. The hand ASd 2 switches will be located at the train A and Train B Exposure Fire Isolation Panels of both units. Installed spare switches, various breaker position contacts and spare wires will be lAsC#2 utilized to avoid adding new raceway for implementation of this design change. This design change also determinates and removes the 183X relay in the 4KV breaker which is not being used, l.B.1 Normal Operations. Modes 1-6 During the normal operation mode (modes 1-6) all 50.54X hand switches must be placed in the " Normal" position for the DG and 4.16 kV Class IE bus to be

" OPERABLE". In the " Normal" position, all existing design functions will be unaffected. The bypass INOP Status panel will annunciete (as described below) if one or both of the switches are NQIin the Normal position.

lAsc42.

The DG breaker auxiliary contact 152b is permanently tied into the Unit to Unit 4.16 kV Class IE bus paralleled alarm, annunciator window 63B55 (63C55).

1.B.2 10 CFR Sn.54(x) Operation l

The hand switches on the affected train in hath units (4 total per train / 2 per bus in each unit) must be selected manually in the El. 50' 1E switchgear rooms to the .

"50.54X" position prior to cross connection of the DG to the opposite unit at Ase d 7, l panel CR63 in the main control room.

The following are achieved upon placmg the four affected train hand switches to !

the "50.54X" position: i

1. Removes the 2 out of 4,4 sec, delayed LOVS/SDVS or DGVSS trip signal to the tie breaker in order to permit the tie breaker to be closed on to a dead bus from CR63.

l

, DCP 2&3 - 7048.00SE, Rev. O I ASC # 2, P.ev. O, Sht. 12. 1 NOTE: Jumpers are installed to prevent this function prior to A5c d2. )

NRC approval. !

2. Allows the tie breaker to close without initiating an associated DG breaker trip. l NOTE: Jumpers are installed to prevent this function prior to MC#1 NRC approval.

3. Disables the 4.16 kV Class IE bus voltage reset relay circuit to stop automatic load sequencing g_n_both n units. This will prevent a SIAS N signal from overloading the DG in a cross tied configuration. Manual operator action in the control room will manually start the sequenced ESF loads that are needed while maintaining the DG within allowable load limits.

NOTE: Wires are lifted to prevent this function prior to NRC ASC 4L approval. !

4. Initiates a diesel generator ESF system bypass / inoperable alarm and status indication. The DG breaker Loss of DC Control Power or Out of Operation 127DC relay, see item 6.a of section 1.A.1, will deenergize if ASC4y either or both of the two hand switches is not in the " Normal" position. i

5. Forces the DG to operate in the droop mode when it is connected to the offsite power system through either unit or when it is running in parallel with the opposite unit's DG.

1.C IMPACT OF THE CHANGE ON SITE PROGRAM 1.C.1 Operations 1moact The purpose of the crosstie is to provide the capability to manually cross-connect one San Onofre unit's DG to the same train of the other San Onofre unit's 4.16 kV Class 1E AC bus in the event of:

1. A loss of all preferred (offsite) power sources to both units, and

2. A station blackout in one of the units ( both DGs are unavailable) , and

3. Either one or both of the other unit's DGs (standby power) are available

_- .- - - -. . . - . - - - . .-~ -- -

4 4

DCP 2&3 - 7048.00SE, Rev. O ASC # 2, Rev. O, Sht. G and supplying power to their 4.16 kV Class IE buses.

Operation of the crosstie in this or other similar situations is permitted under the

' provisions of 10 CFR 50.54(x), which states, "A licensee may take reasonable action that departs from a license condition or a technical specification (contained in j a license issued under this part) in an emergency when this action is immediately needed to protect the public health and safety and no action conristent with license

conditions and technical specifications that can provide adequate or equivalent protection is immediately apparent." During operation of the crosstie under q j

10CFR 50.54(x), both units would be operated outside the license condition or l-technical specifications and the reporting requirements of 10 CFR 50.72 and 10CFR50.73 would apply.

The actual alignment for 10 CFR 50.54(x) operation will only be performed under a i Shift Superintendent / Emergency Coordinator decision to deviate from the

!. Technical Specifications (TS) to provide IE power to the unit in the SBO condition.

1 The 4.16 kV Class IE bus DG crosstie is designed to perform the intended i functions in the following manner:

1

Two dedicated Hand Switches per 4.16 kV Class IE train (8 total in the plant),

l cach with " Normal" and "50.54X" maintained positions are provided at the Exposure Fire Isolation Panels in the Class IE switchgear rooms. An ESF System -

Bypass / Inoperable status alarm and indication will be received in the respective l

4 unit's control room if any of these switches is not in the " Normal" position.

The DG breaker ruxiliary contact 152b is permanently tied into the Unit to Unit 4.16 kV Class lEbus paralleled alarm, annunciator window 63B55 (63C55).

A detailed description of the manual crosstie capability in the 10 CFR 50.54(x)

{. operating mode is discussed below:

I

! This discussion covers only the crosstic capability for bus 2A04 to bus 3A04. !I

! Similar crosstie capabilities exist for bus 3 A04 to bus 2A04, bus 2A06 to bus 3 A06, and bus 3A06 to bus 2A06.

f Fo. this discussion, the initial conditions are, a 10 CFR 50.54(x) is invoked for the plant condition in which; l 4 l' Unit 3 has a station blackout, and

) 1.

b J

1

i l

f DCP 2&3 - 7048.00SE, Rev. 0 -

ASC # 2, Rev. O, Sht. IA

2. Offsite oower to Unit 2 buses 2A04 and 2A06 are lost, and l 3. 2G003 is inoperable, and

4. Only 20002 is running (isochronous operation) and supplying power to bus 2A04.

l In this condition, to establish the crosstic connection between bus 2A04 and bus ,

3 A04 an operator must manually select 2HS-5054XAl and 2HS-5054XB1 at Exposure Fire Isolation Panel 2L412 in the Unit 2 Class lE switchgear room at EL.

50' to the "50.54X" position. In the Unit 3 Class IE switchgear room, the operator must also manually select 3HS-5054XA1 and 3HS-5054XB1 at Exposure Fire Isolation Panel 3L412 to the "50.54X" position.

The following functions are achieved upon placing the 2HS-5054XA1,2HS-5054XB1,3HS-5054XA1, and 3HS-5054XB1 in the "50.54X" position:

1. 2HS-5054XAl and 2HS -5054XB1 will bypass the 2 out of 4 LOVS or .

DGVSS or SDVS signal to the " Voltage Reset" relays (VR1,VR2) geJg blocking the automatic sequencing of the Unit 2 ESF loads to the 2A04/2B04 buses.

3HS-5054XAl and 3HS -5054XB1 will bypass the 2 out of 4 LOVS or DGVSS or SDVS signal to the " Voltage Reset" relays (VR1, VR2) thus blocking the automatic sequencing of the Unit 3 ESF loads to the Asc +2 3A04/3B04 buses.

2. 2HS-5054XAl and 2HS-5054XB1 remove tie breaker 2A0417 close initiated trip signal to Diesel Generator 2G002 breaker 2A0413 so that tie breaker 2A0417 can be manually closed without tripping Diesel Generator )

breaker 2A0413. i i

3HS 5054XA1 and 3HS -5054XB1 remove tie breaker 3A0416 close !

initiated trip signal to Diesel Generator 3G002 breaker 3A0413 so that tie A5C42 breaker 3 A0416 can be manually closed without tripping Diesel Generator breaker 3A0413,

3. 2HS-5054XA1 and 2HS-5054XB1 remove the 2 out of 4,4 sec. delayed LOVS/SDVS or DGVSS trip signal to tie breaker 2A0417. This permits AS C42 ;

tie breaker 2A0417 to be manually closed onto dead bus 2A04.

3HS-5054XAl and 3HS-5054XB1 remove the 2 out of 4,4 sec. delayed

. . =-. - - - . . . -___ .

DCP 2&3 - 7048.00SE, Rev. O ASC # 2, Rev. O, Sht. 15 LOVS/SDVS or DGVSS trip signal to tie breaker 3 A0416. This permits tie breaker 3A0416 to be manually closed onto dead bus 3 A04.

1

4. Placing 2HS-5054XAl and 2HS-5054XB1,3HS-5054XA'. and 3HS-5054XB1 in "50.54X" position forces the associated DG 1 o operate in the

, droop mode when it is connected to the offsite power syr.em through either unit or when it is running in parallel with the opposite unit's DG.

As described in section 1.A, no loading calculations were performed due to 1 10CFR50.54(x) being a "beyond design basis" condition. To assure that the l running diesel could accept the block loads applied when the tie breaker to the j deenergized bus is closed, the ESF system dynamic computer model was run. The 1 results of these runs (included in section 6) show that the DG with shutdown loads can accept the block load from the deenergized unit including SIAS loads without i l any HPSI pump. In order to limit the size of the block load applied from the (

i deenergized unit and to assure that the DG block loads in other possible 50.54(x) l

! scenarios are within the DG capabilities following restrictions will be required: l

1) If the running DG load is s 3400KW, open or verify open both HPSI

]

breakers on the deenergized bus prior to closing the tie breakers. <

2) If running DG load is ) 3400KW, reduce running load tos 3400KW if l possible and then proceed as described in "l)" above. If not successful in l reducing running load to ( 3400KW, open or verify open on the train to be 1

crosstied in the deenergezied unit: A) both HPSI breakers; B) both charging pump breakers; C) both containment Emergency fan breakers; and D) the pressurizer heater breaker, prior to closing the tie breakers.

After the crosstie connection is established, the needed Unit 3 ESF loads that are j designed to automatically sequence onto the 4.16 kV and 480V buses must be A s c.4 2.

manually started. Once the Unit 2 crosstie enable switches are placed in the "50.54X" position, additional Unit 2 ESF loads that are designed to automatically sequence onto the 4.16 kV and 480V buses must be manually started. The i Operator will use control room instrumentation and administrative controls to avoid I overloading of the DG when it is supplying both units ESF buses. The total loading on each DG should not exceed the existing load limits of 5170 kW for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months in a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period or 4700kW for continuous operation (ref. calc E4C-088, Emergency Diesel Generator Loading, Rev.1).

With the two train A 4.16 kV Class IE buses tied together, offsite power can be restored by paralleling the DG to the grid using any one of the four sources (Unit 2 Reserve Auxiliary Transformer, Unit 2 Unit Auxiliary Transformer, Unit 3 Reserve l

- - . . - - - = . _ . - - _

i DCP 2&3 - 7048.00SE, Rev. 0 I ASC # 2, Rev. O, Sht. _g,__

Auxiliary Transformer, or Unit 3 Unit Auxiliary Transformer) in the normal mameu

~

. After closing one of the offsite power supply breakers, the DG automatically switches to droop mode operation. The loa.is then can be transferred to the offshe power source and the DG can be shutdown and retumed to the standby mode.

With the two train A 4.16 kV class IE buses tied together, the U3 DG may be paralleled to the Class lE 4.16 kV buses and the loads can be transferred to the U3 DG or the tie breakers can be opened with each DG carrying its own Unit's loads.

Both DGs will switch to droop operation when the incoming DG breaker is closed.

Open the tie breakers or one of the DG breakers. When one of the tie breakers or DG breakers is opened, both or remaining DGs will switch back to isochronous operation respectively. The DGs should not be left running in parallel with each other. The DG parallel operation should be minimized for the duration required for the transfer of the bus to the incoming DG and then tripping the tie breakers.

The Simulator requires revision / modification to allow DG crosstic operator training.

l 1.C.2 Operation Procedures Imoact During operation of the crosstie under 10CFR 50.54(x), both units would be Ascd2 operated outside the license condition or technical specifications.

In order to limit the size of the block load applied from the deenergized unit and to assure that the DG block loads in all possible 50.54(x) scenarios are within the DG capabilities, the following restrictions will be required:

1) If the running DG load is s 3400KW, open or verify open both HPSI breakers on the deenergized bus prior to closing the tie breakers.

2) If running DG load is ) 3400KW, reduce mnning load tos 3400KW if possible and then proceed as described in "l)" above. If not successful in reducing mnning load to ( 3400KW, open or verify open on the train to be crosstied in the deenergized unit: A) both HPSI breakers; B)both charging pump breakers; C) both containment Emergency fan breakers; and D) the pressurizer heater breaker, prior to closing the tie breakers.

After the crosstie connection is established, the needed Unit 3 ESF loads that are designed to automatically sequence onto the 4.16 kV and 480V buses must be ASC4%

manually started. Once the Unit 2 crosstie enable switches are placed in the "50.54X" position, additional Unit 2 ESF loads that are designed to automatically

DCP 2&3 - 7048.00SE, Rev. O I ASC # 2, Rev. O, Sht. I7 sequence onto the 4.16 kV and 480V buses must be manually started. The ASCd2.

Operator will use control room instrumentation and administrative controls to avoid overloading of the DG when it is supplying both units ESF buses. The total loading ,

i on each DG should not exceed the existing load limits of 5170 kW for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months in a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period or 4700kW for continuous operation (ref. calc E4C-088, i Emergency Diesel Generator Loading, Rev.1).

4

, Operations will be required to issue / revise an Operating Procedure for the DG l crosstie operations. Existing " DESPERATE OPERATING INSTRUCTION lE 50 4160 X-TIE" should then be voided.

i With the proposed modification as a minimum the following operating procedures

may be impacted

9 4

1. SO23-2-13 Diesel Generator Operation l l 2. SO23-3-3.19 4KV Emergency Bus Transfer Test

! 3. SO23-3-3.27.2 Weekly Electrical Bus Surveillance

\

4. SO23-6-2 Transferring of 4160 Volt Buses !

1 i i

5. SO2-15-63.B Annunciator Panel 63B, Train "A" Switchgear )

6. SO2-15-63.C Annunciator Panel 63C, Train "B" i Switchgear/ Transformer l

7. SO3-15-63.B Annunciator Panel 63B, Train "A" Switchgear i 8. SO3-15-63.C Annunciator Panel 63C, Train "B"

! Switchgear/ Transformer

9. SO23-15-57.A Annunciator Panel 57A, Train "A" Safety Injection

10. SO23-15-57.B Annunciator Panel 57B, Train "B" Safety Injection i

j 11. SO23-3-3.45 Control Room Indication Status Check

1.C.3 Maintenance Imnact This modification will allow, subsequent to satisfying 10 CFR 50.54(x)

J requirements, manual cross-connect of a unit's DG to the same train of the opposite f

O

DCP 2&3 - 7048.00SE, Rev. O ASC # 2, Rev. O, Sht. Isk unit's 4.16 kV Class IE bus.

Spare hand switches located in the Exposure Fire Isolation Panel, Train A and B, in El. 50' Class lE switchgear room, and spare breaker position contacts will be

~

used for this 10 CFR 50.54 (x) operation. Component level surveillance testing and

. maintenance will be performed at the same frequency of the existing 4kV circuitry Asce2 4

which is currently performed every other refueling outage. No overall functional

., testing will be required except the preoperational one time integrated testing as outlined in section 7 of this DCP.

i i

)

I 4

A 3

i I

i 4

+

4 1

1 1

2 1

4

DCP 2&3 - 7048.00SE, Rev. O ASC # 2, Rev. O, Sht. 19 1.D. DESIGN CRITERIA 1.D.1 Codes and Standards All the changes will comply with the technical requirements of sections 8.1.4.3 and l

8.3 of the SONGS 2 & 3 UFSAR, Revision 9. The 10 CFR 50.54 (x) Unit to Unit Diesel Generator Crosstie modification will use the following codes and standards:

1. IEEE 323-1974 Standard for Qualifying Class IE Equipment for Nuclear Power Generating Stations

2. IEEE 344-1975 Recommended Practices for Seismic Qualification of Class IE Equipment for the Nuclear Power Generating Station

3. IEEE 379-1972 Application of Single Failure Criterion to Nuclear Power Generating Station Class lE Systems

4. IEEE 384-1974 Criteria for Independence of Class-lE Equipment and Circuits

5. UFHA Updated Fire hazard Analyses 1.D.2 Reculatorv Reauirements

1. 10 CFR 50 Appendix A, General Design Criteria for Nuclear Power Plants j i

2. 10 CFR 50.54 Conditions ofLicenses

3. RG 1.6 Independence Between Redundant Standby (onsite) ,

Power Sources and Between their Distribution Systems, Rev. 0

4. RG 1.75 Physical Independence of Electrical Systems, Rev.1

5. RG 1.10 Seismic Qualification of Electrical and Mechanical Equipment for Nuclear Power Plants, Rev. I 1.D.3 Jnout Parameters Input parameters regarding equipment classification, seismic category, quality class, 1

1

4 l

1

DCP 2&3 - 7048.00SE, Rev. O

ASC # 2, Rev. O, Sht. '2 d l and environmental classification are as specified in SONGS 2 & 3 UFSAR, j Revision 9, Appendix 3.2A.

1.D.4 Interface Reauirements The proposed modi 6catim for Unit to Unit Diesel Generator crossstie will be mostly confined to Class IE switchgear rooms at Control Building El. 50'. Unit to !

Unit wiring will utilize spare wires of existing cables to avoid adding new raceway and new cable. Cubicle to cubicle wiring will use new cable routed through existing trays to avoid affecting other safety related loads except for two internal wires require for the alarm circuit for each Class IE switchgear. Spare hand switches located in the Exposure Fire Isolation Panels also in the Class 1E switchgear room and spare breaker position contacts will be used for this modification.

Operating Procedures for the alarm response to alarm 57A55 (57BSS) ' Standby Power System Inoperable' will be revised to reflect that one or both of the 10CFR 50.54(x) switches in the "50.54X" position will also initiate the alarm through the A3cyg DG breaker loss of DC control power relay. Indication for ESF system Bypass /

Inoperable status at HS-0065 for DG breaker loss of DC Control Power will also indicate one or both 10CFR 50.54(x) switches not in the " Normal" position.

I i

The Operator will use control room instrumentation and administrative controls to avoid overloading of the DG using the crosstie under the provisions of 10 CFR 50.54(x).

1.D.5 Material Reauirements -

Material required for this modification shall be Safety Related, Quality Class II.

The modification for each unit (Trains A & B) will require terminal blocks and l cables. Spare switches, spare breaker auxiliary position contacts and spare wires of existing cables will also be used to avoid adding new raceway.

1.D.6 Plant Layout and Arrangement Requirements l Spare switches in existing Exposure Fire Isolation panels will be used for this design change. Additional terminal blocks will be mounted in existing cubicles as indicated in the IDCNs attached in Section 4. Cable installation in the cable tray are minimal. Spare wires of existing cables are used to avoid adding raceway.

This modification will therefore not affect plant layouts and arrangements.

1.D.7 Environmental Condition 4

w, --- ,-

4 4

DCP 2&3 - 7048.00SE, Rev. 0 .!

'- ASC # 2, Rev. O, Sht. fI l i

4 1.D.7 Environmental Condition

Current plant environmental parameters are unaffected by this modification. Spare ,

switches, breaker auxiliary position contact, terminal blocks, wire, and cables are all i 3

in panel and switchgear cubicles inside the Class IE switchgear room. The j

~

i switchgear room is located in the Control Building El. 50', where the environmental I conditions is mild. Therefore,10 CFR 50.49, Environmental Qualification of l l Electric Equipment Important to Safety for Nuclear Power Plants, does not apply.

i 1.D.8 Safety Reauirements ,

i l

Since this modification will be performed in the Control Building El. 50', no special

. Radiological Safety Requirements are required for the installation of these terminal j blocks and cables. This installation will involve working near energized equipment, therefore, appropriate caution shall be taken when working inside the energized switchgear. Standard Construction Safety Procedures shall be followed to prevent undue risk to the health and safety of the construction and the operation personnel.

1.D.9 Ouality Class and Seismic Catenorv i

, Per Appendix 3.2A of the UFSAR, the Switchgear is Seismic Category I, Quality ,

' Class II (SONGS 2 & 3, Q-list document #90034). Exposure Fire Isolation Panels

are classified as Seismic I, Quality Class II, (reference CCDB document #90010A).

The additional terminal blocks for switchgear installation are speci6ed for Seismic Category I, Quality Class II application. !

1.D.10 Other Related Criteria i Fire Protection:

i

} The Appendix R analysis postulates fires to the plant under normal operating conditions. Impact of the additional new cables for this DCP within each Class IE switchgear room is bounded by the existing analysis. New cables added , which impact combustible loading, are documented in UFHA changes included in the DCP. Therefore, the design changes performed will not impact Appendix R i

compliance.

Appendix R documents are revised and included section 4 of this DCP. Other fire protection issues are addressed in form 26-292, " Fire Protection Checklist".

Security Criteria:

Security criteria are not affected by this modification.

i

DCP 2&3 - 7048.00SE, Rev. O ASC # 2, Rev. O, Sht. 2.1 Environmental Oualification:

All devices installed by this modification will not affect the existing harsh area environmental qualification criteria as defined by 10 CFR 50.49, or any environmentally qualified equipment or function covered by the SONGS harsh area j EQ program. l I

1.D.11 Environmental Renulatorv 'Reauirements This modification will not create or add any new air pollution control, hazardous waste and National Pollutant Discharge Elimination System (NPDES) to the existing environmental condition. Therefore, it does not require any non-radiological environmental permits.

1.D.12 Radioactive Waste Treatment Systems This modification does not change any radioactive waste treatment systems (liquid, gaseous and/or solid). Nor does it change any release quantities and personnel exposure from those previously identified.

1.D.13 Electrical Loads ICCNs to Calculation E4C-017,125 Volt Battery and DC System Sizing ( ICCN #

C-43 for Unit 2 and ICCN # C-44 for Unit 3) were issued to reflect the reduction of Class IE DC loads due to removal of relays 183X-1 and 183X-2. The net Class IE DC load reduction will be 0.066 amperes from Unit 2 Train A 1E Battery Bank 2B007, and 0.088 amperes from each of the following battery banks:, Unit 2 Train ;

B Class IE Battery Bank 2B008, Unit 3 Train A Class IE Battery Bank 3B007, and Unit 3 Train B Class IE Battery Bank 3B008. Accordingly, the results of the existing analyses in the base calculation are bounding and no change to the service test profile is required.

1 BATTERY SOURCE LOAD ADDED LOAD DELETED 2B007 2D1P101 0 0.066A (0.00825KW)

AX42' 2B008 2D2P101 0 0.088A (0.01IKW) 3B007 3 DIP 101 0 0.088A (0.01IKW) ,

3B008 3D2P101 0 0.088A (0.01IKW)

! DCP 2&3 - 7048.00SE, Rev. 0 '

ASC # 2, Rev. O, Sht. 23 This proposed modification does not add or delete any loads to/from either Train A or Train B 4.16 kV or the 480V Class IE AC buses for Unit 2 or Unit 3. The Emergency Diesel Generator loads are not affected by this design modification for normal operation, safe shutdown and mitigation of the accident conditions as considered in the design bases. For the DG crosstie operation during 10CFR50.54(x), the DG loading will be administratively controlled to avoid overloading of the DG. The total loading on each DG should not exceed the existing load limits of 5170 kW for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months in a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period or 4700 kW for continuous operation (ref. cale E4C-088, Emergency Diesel Generator Loading,

Rev.1).

1.D.14 Control Room Desian Standard for Human Factors This modification will not change the existing design of the Control Room. Alarm Response Instructions SO23-15-57.A and SO23-15-57.B, Annunciator Panel 57A, Train "A" Safety Injection and Annunciator Panel 57B, Train "B" Safety Injection,

, will be revised to reflect that 10 CFR 50.54(x) condition will also initiate these alarms through the 127DC contact of the Diesel Generator Breaker.

l 4SCWL The 10 CFR 50.54(x) switches located at the Fire Isolation Panel will have a

colored rectangular line surrounding both switches for human factors. The color j will be the associated train color code. Even though this design is outside the human factors DBD boundary, the control room design standard for human factors

, has been followed.

1.D 15 Regulatory Guide 1.97 Requirement i

This design will not change any Regulatory Guide 1.97 Instrumentation on the Instrument Report contained within the Nuclear Consolidated Data Base (NCDB)

, 90010A.

3 a

4 i DCP 2&3 - 7048.00SE, Rev. O i ASC # 2, Rev. O, Sht 24 I

i

)

i SECTION 2 10 CFR 50.59 SAFETY EVALUATION

DCP 2&3 - 7048.00SE, Rev. 0 l

. ASC # 2, Rev. O, Sht 25 l l

l 2. 10 CFR 50.59 SAFETY EVALUATION 5

Thepurpose of this Safety Evaluation is to evaluate thepermanentplant confguration changes by this DCP and its impact during normalplant operations and design basis l

, accident conditions within the bounds of the Technical Specifcations and UFSAR.. This i Safety Evaluation does not analyze the use of this crosstie which is beyond the plant i i design basis and can only be performed after invoking'10CFR 50.54(x). l The Following Accidents / Events Are Related to/Affected by the 10 CFR 50.54(x) Unit-to-Unit Crosstie Design Change: !

I I UFSAR j Section 15.1 Increase in Heat Removal by the Secondary System (Turbine Plant)

UFSAR !

l Section 15.1.3.1 Steam System Piping Failures The steam line break is classified as a limiting fault and is defined as a pipe break in the Main Steam (MS) System. Loss of All Normal AC Power (Loss of Offsite Power) is

- assumed to occur at the time the Reactor trips on Low Pressurizer (PZR) Pressure. The DGs will stan up and provide power to the Class IE 4.16 kV and 480 V buses. A Main Steam Line Rupture between one of the Main Steam Isolation Valves (MSIVs) and its 4

l associated Steam Generator (SG) will result in that SG blowing down to a dry out l condition. A Main Steam Line Rupture inside Containment will result in Containment )

pressurization during the associated SG blowdown to dry out. Worst case single failure is !

assumed in the analysis. For Containment pressurization, failure of one DG to start !

q provides the worst case single failure because only one train of Containment Cooling and Containment Spray would be available to mitigate Containment pressurization. From an aspect of potentially over pressurizing the RCS with the Emergency Core Cooling System (ECCS), two trains of ECCS will add more inventory to the Reactor Coolant System (RCS) than one train, alone.

]

UFSAR ,

Section 15.2 Decrease in Heat Removal by the Secondary System (Turbine Plant)

UFSAR Section 15.2.1.4 Loss of All Normal AC Power The Loss of All Normal AC Power is classified as a Moderate-Frequency Incident. The loss of all normal AC power event assumes a reduction in Auxiliary Feedwater (AFW) flow from 700 gpm to 500 gpm and assumes the upper tolerance limits on the Pressurizer Safety Valves (PSVs) increase from +1% to +2% and the Main Steam Safety Valves (MSSVs) increase from +1% to +3%. The loss of all normal AC power event conservatively assumes the Turbine Driven AFW Pump fails to start in order to delay Auxiliary Feedwater System flow to any SG until the availability of DG power to one of

l DCP 2&3 - 7048.00SE, Rev. O ASC # 2, Rev. O, Sht z.G

- the Motor Driven AFW Pumps after Emergency Feedwater Actuation Signal (EFAS) initiation.

UFSAR Section 15.2.2.4 Loss of All Normal AC Power with a Concurrent Single Failure of an Active Component The Loss of All Normal AC Power with a Concurrent Single Failure of an Active Component is classified as an Infrequent Incident. The scenario is identical for the Loss of All Normal AC Power event above, but includes the assumption of failure of one of the DGs to stant resulting in a loss of AC power to the respective train Class IE 4.16 kV and 480 V Buses.,

UFSAR Section 15.2.3.1 Feedwater System Pipe Breaks Feedwater System Pipe Breaks are classified as limiting fault incidents. A feedwater system pipe break may occur due to a pipe failure in the Main Feedwater System (MFW)

A Feedwater System Pipe Break may produce a total loss of normal feedwater and a blowdown of one SG. The Feedwater System Pipe Break event is more severe with a Loss of Normal AC Power (Loss of Offsite Power) because of the loss of forced primary coolant flow, turbine load, Pressurizer (PZR) level and pressure control, and steam bypass control. The admination of these events is a rapid decrease in the heat transfer capability of both SGs and eventual elimination of one SG's heat transfer capability. The result is a RCS heat up and pressurization.

UFSAR Section 15.6 Decrease in Reactor Coolant Inventory 1 1

UFSAR Section 15,6.3.2.2 Steam Generator Tube Rupture with a Concurrent Loss of Normal AC l Power l

The Steam Generator Tube Rupture (SGTR) with a Concurrent Loss ofNormal AC Power accident is classified as a limiting fault based upon the estimated frequency of this !

accident. The most adverse radiological release conditions are established during a SGTR event where the Loss ofNormal AC Power (Loss of Offsite Power) occurs concurrently to the Reactor Trip on Low Pressurizer Pressure. In addition, single failure is assumed to occur such that the Motor Driven AFW Pump associated with the unaffected SG is unavailable. Under this condition, the Turbine Driven AFW Pump must be used to feed i the unaffected SG which will contribute to additional release of radioactivity from the Turbine Driven AFW Pump exhaust steam to atmosphere. The most conservative single failure to establish such a condition would be failure of the DG associated with the train that supplies power to the Motor Driven AFW Pump associated with the unaffected SG.

With this single failure assumption, one train ofEmergency Core Cooling System (ECCS)

DCP 2&3 - 7048.00SE, Rev. O ASC # 2, Rev. O, Sht '27 would be unavailable for RCS makeup.

UFSAR Section 15.6.3.3 Loss of Coolant Accident A Loss of Coolant Accident (LOCA) is considered a limiting fault based upon the expected frequency of occurrence of a LOCA. This UFSAR section covers the spectrum of LOCAs from Small Break to Large Break LOCAs. A failed open PSV is also included in this UFSAR section. The Design Basis LOCA assumes a Loss of Normal AC Power (Loss of Offsite Power) concurrent with the most limiting single failure which is the failure of one DG to start on the Loss of Voltage Signal (LOVS). The loss of that EDG results in the loss ofone train ofECCS, Containment Cooling, Containment Spray, and the associated support systems for that train. With only one train of ECCS, Containment Cooling, Containment Spray, c:c., tvailable for mitigation of the LOCA, the most limiting !

radiological releases to the public result.

For each of the above accidents / events described above, at least one EDG is required to operate to provide power to its associated Class 1E 4.16 kV and 480 V buses in wpport of operation of at least one train of ESF equipment required for accident / event mitigation. The capability of the DGs to power their respective Class 1E 4.16 kV buses is not altered by this design modification which provides the 10 CFR 50.54(x) Unit-to-Unit 1E Bus Crosstie. In addition, the sequencing of ESF equipment is not affected by this design modification. The responses to the Seven Questions for the 10 CFR 50.59 Safety Evaluation required to justify this design change are provided below:

1. May the proposed activity increase the probability of occurrence of an accident evaluated previously in the safety analysis report?

Response: No.

This design change (refer to Section 1 of the DCP for detail design changes) will allow for paralleling like train Class IE 4.16 kV buses between units where one DG is supplying power to one unit and the other unit is in Station Blackout (SBO). The actual alignment for 10 CFR 50.54(x) operation will only be performed under a Shift Superintendent /

Emergency Coordinator decision to deviate from the Technical Specifications (TS) to provide IE power to the unit in the SBO condition. This evolution is outside the design basis. The unit-to-unit tie breakers control circuits will be modified to allow them to be manually closed during 10 CFR 50.54(x) operation when the respective Class IE 4.16 kV ESF bus is powered from the DG without tripping the respective DG breaker or if they are manually closed to a dead bus. Two dedicated hand switches, HS 5054XAl(2) and HS 5054XBl(2), are used for each train to avoid inadvertent switch operation and switch failure. These hand switches must be kept in the normal position for plant operation in Mode 1 through Mode 6, when the associated bus is required to be operable. Malfunction

DCP 2&3 - 7048.00SE, Rev. O ASC # 2, Rev,0, Sht 2.1L or misoperation of a switch will be alarmed. The Train of Class IE electrical distribution ;

! is declared inoperable as long as any of that Train's 5054X switches are positioned in other than the normal position.

)

i i )

Failure of the Class IE 4.16 kV distribution system or failure ofMain Control Board j equipment associated with operation of the Class IE 4.16 kV and 480 V buses are not l precursors to any of the accidents or events analyzed in UFSAR Chapter 15 accident

analyses with the exception of a possible Reactor Trip with associated Turbine Trip. This i

event is analyzed and bounded by the UFSAR. This design modiScation will not increase the probability of failure of the electrical distribution system, hence, the probability of a l

Reactor Trip with Turbine Trip will not increase.

3- ;

} Placing any of the Class IE 4.16 kV tie breakers in manual position or in test condition

will place either one or both units in a TS Limiting Condition for Operation (LCO) Action Statement. For a unit operating in Mode 1,2,3, or 4, two separate and redundant Class IE Electrical Distribution Systems are required to be OPERABLE. Ifone is taken out of i service, as a minimum, that unit is in a TS LCO Action Statement (the opposite unit, if !

operating in Mode 1,2,3, or 4 may be in a TS LCO Action Statement also). For a unit j operating in Mode 5 or 6, one IE Electrical Distribution System is required to be OPERABLE (it should be noted that the other IE Electrical Distribution System that is

! inoperable may place the other unit in a TS LCO Action Statement if that unit was in l Mode 1,2,3, or 4). Placing the breaker control switches in the manual position on the !

Main Control Board would prevent automatic operation of the Electrical Distribution !

system. Entry into TS LCO Action Statements where one of the two ESF trains is taken

out of service is allowed as long as the system is restored to OPERABLE status within the 2-TS LCO Action Statement time limits. The inoperable train must be returned to service within the TS LCO Action Statement time limit or the unit must be shut down and cooled ;

l down per the requirements of the applicable TS. It is highly improbable for someone to I lI place any 5054X hand switches in 50.54X position and have such an event go unnoticed.

Annunciators on the Control Room Main Control Board will alarm when any of the :

HS5054X switches are placed in 50.54X position, alerting the operators of the abnormal l lineup. l This design modification will not use any additional wires in the Control Room, therefore, - i there will be no change to the fire loading details. This design modification will not affect the wiring between components associated with SONGS Unit 2 and Unit 3 on the Main Control Board. Therefore, the probability of a failure in one unit propagating to the other unit will not be increased by this design modification.

Testing to verify proper operation of the HS5054X switches and capability to aiign an DG and its associated Class IE 4.16 kV bus with a dead "same Train" bus on the opposite unit will be performed under a special test procedure per the requirements of Station Procedure SO123-IT-1," Infrequently Performed Tests and Evolutions Controls 1 Program." The testing will be performed in compliance with the applicable Technical Specification Action Statements associated with Inoperable Electrical Distribution System Equipment. For details, see 10 CFR 50.59 Question 7 Response.

e 1 DCP 2&3 - 7048.00SE, Rev. 0 ASC # 2, Rev. O, Sht. 2 9 i

j ASC #2 of this DCP added the prerequisite (see section 7.D .2) that NRC approval has been obtained prior to performing the Integrated Functional Test. Final turnover of the j' DCP also requires prior NRC approval. l 4

After installation of the DCP, rev. O and ASC #1, jumpers and lifted leads were/will be

, installed in order to restore SONGS Units 2 and 3 to a configuration electrically ,

i equivalent to the pre DCP rev. O configuration (see section 1.B.2.1, l.B.2.2, and 1.B.2.3) I

! prior to partial turnover.-

! The lifting of the leads and adding of thejumpers will prevent any alignment of the EDG Unit-j to-Unit Cross-Tie equipment installed by DCP rev. O and ASC #1, accidental or intentional, from placing Unit 2 and/or Unit 3 in a configuration not permitted by the plant design prior i to installation of the DCP. With the jumpers installed and leads lifted, the ESF system

! Bypass / Inoperable status at HS-0065 for DG breaku loss of DC Control Power will indicate Asc#2 one or both 5054X switches not in the " Normal" position and the EDG droop ci cuit j interlocks with 5054X switches to allow continued maintenance without affecting the other Unit's EDG will not be affected byjumpers and lifted leads.

I i

i Thejumpers installed by this moddication at the respective terminal boards are being installed '

l in accordance with Maintenance Procedure, SO123-I-4.49, Attachment 9 " Control and

Instmment Cable Termination and Repair Guide". The wires being determinated will be taped off and secured in accordance with this procedure to prevent them from making any l j electrical contact with the terminal boards. The IE Electrical Distribution System will remain -

~

operational and functional after a Design Basis Earthquake and under all other analyzed i conditions. The accident analyses discussed in DCP rev. O and ASC # 1 above will not be altered by this change.

. i 4 Therefore, the proposed actmty will not increase the probability of occurrence of an accident i previously evaluated in the UFSAR.

2. May the proposed activity increase the consequences of an accident evaluated j previously in the safety analysis report?

j Response: No.

This design change will not adversely affect the capability of the Class IE Electrical l Distribution system to perform its support safety functions in the mitigation of the accidents

! and events evaluated in UFSAR Chapter 15. The installed 5054X switches will remain in their normal position during operation in Mode 1 through Mode 6, when the associated bus

! is required to be operable. The installed 5054X switches will only be placed in the 50.54X position ifjust cause for deviating from the Technical Specifications is determinec appropriate for mitigating a Station Blackout at one of the two units or a special test approved to verify j switch OPERABILITY is required. When the 5054X switches are aligned to their normal j positions, the electrical distribution system control remains in the same configuration as the ,

i i

1 a

- . - . - --- . . - - .. -~- - - - - - ._ .- - -- -

r 2

DCP 2&3 - 7048.00SE, Rev. O ASC # 2, Rev. O, Sht _30 I electrical distribution system prior to this design change. The 5054X switches are passive,

! manual switches that will be installed to Seismic Category I requirements. The switches cannot change position from the normal to the 50.54X position by themselves and will remain in their selected position throughout a Design Basis Earthquake, other Natural Disaster, or j during any postulated accident or event evaluated in the UFSAR.

, Testing to verify proper operation of the 5054X switches and capability to align an DG and

its associated Class IE 4.16 kV bus with a dead "same Train" bus on the opposite unit will j be performed under a special test procedure per the requirements of Station Procedure SO123-IT-1, " Infrequently Performed Tests and Evolutions Controls Program." The testing will be performed in compliance with the applicable Technical Specification Action Statements associated with Inoperable Electrical Distribution System Equipment. For details, 4

see 10 CFR 50.59 Question 7 Response.

! The activities with thejumpers and lifted leads will retain pre DCP functionality as described Ay_W 2.

in detail in section 2.1.

Therefore, the proposed activity will not increase the conseqdences of an accident previously evaluated in the UFSAR.

3. May the proposed activity increase the probability of occurrence of a malfunction of equipment important to safety evaluated previously in' the safety analysis report?

Response: No.

The 5054X switches are passive, manual switches that will be installed to Seismic Category

I requirements. The switches cannot change position from the normal to the 50.54X position by themselves and will remain in their selected position throughout a Design Basis Earthquake, other Natural Disaster, or during any postulated accident or event evaluated in the UFSAR. The configuration of the Class IE Electrical Distribution System and the configuration of the Main Control Board switches will not change when in Mode 1 through Mode 6 of operation. Failure modes will not be changed by this design modification. The configuration of the Class IE Electrical Distribution System and the configuration of the Ma n Control Board switches will not change when in Mode I through Mode 6 of operation.

Failure modes will not be changed by this design modification.

Testing to verify proper operation of the 5054X switches and capability to align an DG and ASCM2 its associated Class IE 4.16 kV bus with a dead "same Train" bus c,n the opposite unit will be performed under a special test procedure per the requirements of Station Procedure SO123-IT-1,"Infrequemly Performed Tests and Evolutions Controls Program." The testing will be performed in compliance with the applicable Technical Speedication Action Statements associated with Irspwable Electrical Distribution System Equipment. For details, see 10 CFR 50.59 Question 7 Response.

The activities with thejumpers and lifted leads will retain pre DCP functionality as described Asc# 2,

DCT' is 3 - 7048.00SE, Rev. O t

[ AM # ?, Rev. O, Sht _ 21 in detailin section 2.1. lAS:U-l

Therefore, the proposed modification will not increase the probability of occurrence of a )

, malfunction of equipment imponant to safety previously evaluated in the UFSAR.

i

4. May the proposed activity increase the consequences of a malfunction of equipment important to safety evaluated previously in the safety analysis report?

i Response: No.

The 5054X switches are passive, manual switches that will be inst .11ed to Seismic Category I requirements The switches cannot change position from the normal to the 50.54X position by themselves and will remain in their selected position throughout a Design Basis Earthquake, other Natural Disaster, or during any postulated accident or event evaluated in the UFSAR. The configuration of the Class IE Electrical Distr'.oution System and the

configuration of the Main Control Board switches will net char ge when in Mode I through Mode 6 of operation. Failure modes will not be changea by this design modification.

Testing to verify proper operation of the 5054X switches and capability to align an DG and A3c,4 g its associated Class IE 4.16 kV bus with a dead "same Train" bus on the opposite unit will ,

j be performed under a special test procedure per the requirements of Station Procedure l SO123-IT-1," Infrequently Performed Tests and Evolutions Controls Program." The testing

]

will be performed in compliance with the arr.eable Technical Specification Action l

Statements associated with Inoperable Electrical Dutribution System Equipment. For details, see 10 CFR 50 59 Question 7 Response.

The activities with thejumpers and lifted leads will retain pre DCP functionality as described Asc4 2, in detailin section 2.1.

l Therefore, the proposed modification will not increase the consequences of a malfunction of equipment important to safety previously evaluated in the UFSAR.

5. May the proposed activity create the possibility of an accident of a different type than any evaluated previously in the safety analysis report?

l Response: No.

This design modiScation will not affect the operation of the IE Electrical distribution system.

All breakers that respond to a LOVS or SIAS with LOVS will operate as presently designed.

This design modification will not affect the sequencing ofloads onto the Class IE 4.16 kV buses.

This design modification will not use any additional wires in the Control Room, therefore, 1 there will be no change to the fire loading details. This design modification will not affect the

) wiring between components associated with SONGS Unit 2 and Unit 3 on the Main Control

a-DCP 2&3 - 7048.00SE, Rev. O ASC # 2, Rev. O, Sht 3 r_

Board. Therefore, the probability of a failure in one unit propagating to the other unit will not be increased by this design modification. t The 5054X switches are passive, manual switches that will be installed to Seismic Category I roquirements The switches cannot change position from the normal to the 50.54X position by themselves and will remain in their selected position throughout a Design Basis Earthquake, other Natural Disaster, or during any postulated accident or event evaluated in the UFSAR. The configuration of the Class 1E Electrical Distribution System and the configuration of the Main Control Board switches will not change when in Mode 1 through Mode 6 of operation. Failure modes will not be changed by this design modification.

Testing to verify proper operation of the 5054X switches and capability to align an DG and ASC d 2.

its associated Class 1E 4.16 kV bus with a dead "same Train" bus on the opposite unit will ,

be performed under a special test procedure per the requirements of Station Procedure l SO123-IT-1," Infrequently Performed Tests and Evolutions Controls Program." The testing will be performed in compliance with the applicable Technical Specification Action '

l Statements associated with Inogr.ble Electrical Distnbution System Equipment. For details, see 10 CFR 50.59 Question 7 Response.

There are no reasonable or credible accident or event scenarios potentially associated with the Class 1E Electrical Distribution System or the Main Control Board Switches affected by this design change that are different from any of those previously evaluated in the UFSAR.

The activities with thejumpers and lifted leads will retain pre DCP functionality as described AsC #2.

in detailin section 2.1.

Therefore, this proposed change will not create the possibility of an accident of a different type than previously evalaated in the UFSAR.

I l

l i

l DCP 2&3 - 7048.00SE, Rev. O ASC # 2, Rev. O, Sht 23

6. May the proposed activity create the possibility of a malfunction of equipment i important to safety of a different type than any evaluated previously in the safety l analysis report?

i i

~ Response: No.

l This design moddication will not affect the normal operation of the 1E Electrical distribution system. All breakers that respond to an LOVS or SIAS with LOVS will operate as presently I Ai==l This design moddication will not affect the sequencing ofloads onto the Class IE 4.16 kV buses.

. This design modification will not use any additional wires in the Control Room, therefore, there will be no change to the fire loadmg details. This design modification will not affect the wiring between components associated with SONGS Unit 2 and Unit 3 on the Main Control Board. Therefore, the probability of a failure in one unit propagating to the other unit will not be increased by this design modification.

The 5054X switches are passive, manual switches that will be installed to Seismic Category I requirements. The switches cannot change position from the normal to the 50.54X position -

by themselves and will remain in their selected position throughout a Design Basis Earthquake, other Natural Disaster, or during any postulated accident or event evaluated in the UFSAR. The configuration of the Class IE Electrical Distribution System and the configuration of the Main Control Board switches and wiring will not change during modes 1 through 6 operations. Failure modes will not be changed by this design modification.

Testing to verify proper operation of the 5054X switches and capability to ali,s;n an DG and Asc42 its associated Class IE 4.16 kV bus with a dead "same Train" bus on the opposite unit will be performed under a special test procedure per the requirements of Station Procedure SO123-IT-1," Infrequently Performed Tests and Evolutions Controls Program." The testing will be performed in compliance with the applicable Technical Specification Action Statements associated with Inoperable Electrical Distribution System Equipment. For details, see 10 CFR 50.59 Question 7 Response.

There are no reasonable or credible failure modes potentially associated with the Class IE Electrical Distribution Systera or the Main Control Board Switches affected by this design change that could result in a malfunction of equipment important to safety different from any previously analyzed in the UFSAR.

The activities with thejumpers and lifted leads will retain pre DCP functionality as described ASC#2.

in detail in section 2.1.

Therefore, this proposed change will not create the possibility of a malfunction of equipment important to safety of a difDrent type than any previously evaluated in the UFSAR.

. - - =- - . , _ - .- . _ - -

4 DCP 2&3 - 7048.00SE, Rev. O ASC # 2, Rev. O, Sht 3i'4 i

l 7.. Does the proposed activity reduce the margin of safety as defined in the basis for any 1

technical specification?

Response: No.

The following TS are associated with the Class IE Electrical Distribution System and the Main Control Board Switches affected by this design modification:

TS 3.8.1: AC Sources, Operating (Modes 1,2,3, and 4) .

TS 3.8.2: AC Sources, Shutdown (Modes 5 and 6) l TS 3.8.9: Distribution System - Operating (Modes 1, 2, 3, and 4) i 7

The OPERABILITY of the AC power sources and associated distribution systems during operation ensures that sufficient power will be avadable to supply the safety related equipment

l. required for;

. i

1) The safe shutdown of the facility

2) The mitigation and control of accident conditions within the facility.

The minimum specified independent and redundant AC power sources and distribution systems satisfy the requirements of General Design Criterion 17 of Appendix A to 10CFR 50.

The ACTION requirements specified for the levels of degradation of the power sources provide restriction upon continued facility operation commensurate with the level of degradation. The OPERABILITY of the power sources are consistent with the initial condition assumptions of the safety analyses and are based upon maintaining at least one redundant onsite AC power source and associated distribution system OPERABLE during accident conditions coincident with an assumed loss of offsite power and single failure of the other AC onsite source. The AC source allowable out-of-service times are based on Regulatory Guide 1.93, " Availability of Electrical Power Sources," December 1974. When one DG is inoperable, there is an additional ACTION requirement to verify that all required -

systems, subsystems, trains, components and devices, that depend on the remaining OPERABLE DG as a source of emergency power, are also OPERABLE. This requirement is intended to provide assurance that a loss of offsite power event will not result in a complete loss of safety function of critical systems during the period of time that one of the DGs is !

inoperable. The term verify as used in this context means to administratively check by examining logs or other information to determine if certain components are out-of-service for maintenance or other reasons. It does not mean to perform the surveillance requirements needed to demonstrate the OPERABILITY of the component. 1 The OPERABILITY of the minimum specified AC power sources and associated distribution ,

systems during shutdown and refueling ensures that:

I l

DCP 2&3 - 7048.00SE, Rev. O ASC # 2, Rev. O, Sht 35

1) The facility can be maintained in the shutdown or refueling condition for extended ;

time periods.

i

' 2) Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status.

I ,

i' This design change (refer to Section 1 of the DCP for detail design changes) will allow for i paralleling like train Class IE 4.16 kV buss between units where one DG is supplying power to one unit and the other unit is in Station Blackout (SBO). The actual alignment for 10 CFR

I 50.54(x) operation will only be performed under a Shift Superintendent / Emergency Coordinator decision to deviate from the Technical Specifications (TS) to provide Class IE

}' power to the unit in the SBO condition. This evolution is outside the design basis. The unit- t to-unit tie breakers control circuits will be modified to allow them to be manually closed

during 10 CFR 50.54(x) operation when the respective Class 1E 4.16 kV ESF bus is powered from the DG without tripping the respective DG breaker or if they are manually closed to a ,

dead bus. Two dedicated hand switches,5054XA and 5054XB, are used for each train to Asc4Z j avoid inadvertent switch operation and switch failure. Wse hand switches must be kept ir

the normal position for plant operation in Mode I throus Mode 6, when the associated bus i

is required to be operable. Malfunction or misoperation of a sv h will be alarmed. The j Train of Class 1E electrical distribution is declared inoperable ar kng as any of that Train's

{ 5054X switches are positioned in other than the normal position.

~

The 5054X switches are passive, manual switches that will be installed to Seismic Category I requirements. The switches cannot change position from the normal to the 50.54X position

' by themselves and will remain in their selected position throughout a Design Basis Earthquake, other Natural Disaster, or during any postulated accident or event evaluated in I the UFSAR. The configuration of the Class 1E Electrical Distribution System and the i configuration of the Main Control Board switches will not change when in Mode I through

Mode 6 of operation. Failure modes will not be changed by this design modification.

I' This design modification will not affect the normal automatic operation of the Class IE Electrical distribution system. All breakers that respond to a LOVS or SIAS with LOVS will operate as presently designed. This design modification will not affect the sequencing of

loads onto the Class 1E 4.16 kV buses.

1 j The configuration ofthe Class IE Electrical Distribution System and the configuration of the l Main Control Board switches and wiring will not change when in automatic mode of j operation. Failure modes will not be changed by this design modi 6 cation.

i

! Calculation E4C-017,125 Volt Battery and DC System Sizing, ICCN # C-43 for Unit 2 and l ICCN # C-44 for Unit 3 were issued to reflect the reduction of Class IE DC loads due to i removal of relays 183X-1 and 183X-2. The net Class IE DC load reduction will be 0.066 l amperes from Unit 2 Train A lE Battery Bank 2B007 and 0.088 amperes from each of the 3 following battery banks., Unit 2 Train B Class IE Battery Bank 2B008, Unit 3 Train A Class j IE Battery Bank 3B007, and Unit 3 Train B Class lE Battery Bank 3B008. Accordingly, the j results of the existing analyses in the base calculation are bounding and no change to the 1

I a

3 DCP 2&3 - 7048.00SE, Rev. O ASC # 2, Rev. O, Sht %

i service profileis required.

This proposed modification does not add or delete any loads to/from either Train A or Train B 4.16 kV or the 480V Class IE AC buses for Unit 2 or Unit 3. The Tech Spec and UFSAR design basis DG load pro 61es are not affected by this design modification. For the DG crosstie operation during 10CFR50.54(x), the DG loading will be administratively controlled to avoid overloading of the DG.' The Operator will use control room instrumentation and .

admin'strative controls (refer to section 1.C of this DCP) to avoid overloading of the DG when it is supplying both units ESF buses. The total loading on each DG should not exceed

the existing load limits of 5170 kW for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months in a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period or 4700kW for continuous

] operation (ref. calc E4C-088, Emergency Diesel Generator Loading, Rev.1).

Testing to verify proper operation of the 5054X switches and capability to align an DG and ASCO l its associated 4.16 kV Class IE bus with a dead "same Train" bus on the opposite unit will i be performed under a special test procedure per the requirements of Station Procedure

! SO123-IT-1," Infrequently Performed Tests and Evolutions Controls Program." The testing will be performed in compliance with the applicable Technical Specification Action j Statements associated with Inoperable Electrical Distribution System Equipment. The methodology of testing will ensure that voluntary entry into TS 3.0.3 does not occur. If a unit is in Mode 1,2,3, or 4, the 4.16 kV Class IE Buses must emain energized. Deenergizing 1 a 4.16 kV Class 1E Bus resuhs in the loss of two of four trains of Class IE Battery Chargers

, which would place a unit in Mode 1,2,3, or 4 in TS 3.0.3. TS 3.8.9 only allows one Battery g Charger to be inoperable at any time. In Mode 5 or 6, only two of the four Battery Chargers

are required to be operable, therefore, deenergizing a 4.16 kV Class IE bus is acceptable for

j. testing During testing automatic sequencing of the ESF loads onto the bus beingtested will j not occur if a SIAS occurs. This will render one electrical power distribution subsystem i inoperable which will require entry into theTS LCO 3.8.9 A for the unit in Mode 1,2,3, or

4. During testing, the following Technical Speci6 cation Action Statements will apply to the unit in Mode 1,2,3, or 4. For a unit in Mode 1, 2, 3 or 4, its Diesel Generata (DGs) will be used, one train at a time, to power the opposite units like 4.16 kV Class IE bus via the bus tie breakers. The unit with the " dead bus" will be in either Mode 5 with Reactor Coolant System (RCS) Loops filled, Mode 6 with at least 23 feet ofwater above the Reactor Vessel Flange, or defueled with no fuel movement in progress. Since one of the two 4.16 kV Class IE buses will be deenergized at a time for circuit testing, the specific operating conditions for Mode 5 or 6 must be established to ensure only one train of Shutdown Cooling is required to be operable. A dead 4.16 kV Class IE bus renders one train of Shutdown Cooling inoperable. As indicated in TS 3.8.1 LCO, Safety Related Equipment such as one train of Emergency Core Cooling System will be rendered inoperable for the unit in Mode 1,2, 3, or 4 when an DG is inoperable or if the DG and one offsite source is inoperable. No TS LCOs will be entered for the unit in Mode 5 with RCS loops filled, Mode 6 with 23 feet of water above the Reactor Vessel Flange, or defueled with no fuel movement in progress. Although during the test, single failure criterion will not be met, performance of the testing will be acceptable as long as the TS LCO Action Statement Completion times are not violated. The Action Statement completion times are based upon the very low acceptable probability of occurrence of events concurrent with assumed single failure during those time intervals where

l DCP 2&3 - 7048.00SE, Rev. 0 ASC # 2, Rev. O, Sht 37 equipment is out of service. In addition, recovery from the testing mode can be accomplished

rapidly, if warranted, to restore oper: bility to Safety Related Equipment.

]

The activities with thejumpers and lifted leads will retain pre DCP functionality as described AdC#7 in detail in section 2.1.

! Therefore, this proposed change will not reduce the margin of safety as defined in the basis I for any technical specification.

l J

l

'l 4

a 4

e i

f l

I I

1

I DCP 2&3 - 7048.00SE, Rev. O ASC 0 2, Rev. O, Sht. 35 t

4 l

1

I SECTION 3 9

LICENSE AND DESIGN DOCUMENT IMPACT / DESIGN CRITERIA I 2

l

I 4

1 3

4 l

DCP 2&3 - 7048.00SE, Rev. O ASC # 2, Rev. O, Sht. 39

3. LICENSE AND DESIGN DOCUMENTIMPACT/ DESIGN CRITERIA 6

3.A LICENSE / TECHNICAL SPECIFICATIONS The Operating License / Technical Specifications have been reviewed and no change is required.

The NRC is being requested to approve performance of the preoperational test and make

the final turnover of the inter-unit 4.16kV bus cross-tie which is being installed by this Mcd2

DCP ( The Draft of the NRC letter is enclosed).

i 4

a

l DCP 2&3 - 7048.00SE, Rev. 0 :

l ASC # 2, Rev. O, Sht. 40 i i

[ DRAFT

U. S. Nuclear Regulatory Commission Attention: Document ControlDesk Washington, D.C. 20555 i Gentlemen, l

Subject:

Docket Nos. 50-361 and 50-362 Inter-Unit 4.16kV Bus Cross-Tie San Onofre i Nuclear Generating Station Units 2 and 3

Reference:

December 15,1995 Letter from Walter C. Marsh (Edison) to the Document i Control Desk (NRC),

Subject:

Response to Generic Letter 88-20, Supplement 4,

" Individual Plant Examination of External Events (IPEEE)," San Onofre Nuclear ,

Generating Station, Units 2 and 3 j l

The purpose of this letter is to request NRC approval to perform the preoperational test and make

! the final turnover of an inter-unit 4.16kV bus crosede which is being installed in the San Onofre

Nuclear Generating Station (SONGS) Units 2 and 3 during their respective Cycle 9 refueling i 4

outages. I hSC42

As a result of beyond design basis scenarios during Emergency Planning Drills, an instruction to cross connect 4.16 kV safety-related busses has been in use since 1990. This cross connect would

only be implemented if no action consistent with license conditions or technical specifications was immediately apparent that provided adequate or equivalent protection to public health and safety, .

! as allowed by 10CFR50.54x. This instmetion, which was developed for issuance from the j Technical Support Center during a declared emergency, requires the lifting ofleads and j installation ofjumpers to bypass the necessary interlocks. The SONGS Units 2 and 3 Individual i i

Plant Examination of External Events (IPEEE)(reference) examined events that were within the i design basis as well as outside the design basis of Units 2 and 3. One event which was outside the

. design basis of the plant was the loss of all AC power (unit blackout). The IPEEE identified a ;

I significant safety benefit to the unit experiencing unit blackout if diesel generator (DG) power

from the other unit could be supplied within 55 minutes to one of the two deenergized 4.16 kV safety-related busses. In our referenced letter, Southern California Edison (Edison) committed to install switches and modify control circuitry to replace this instruction with an engineered cross connect capability prior to Unit 3 Cycle 9 operation.

The final design of this modification has been completed. The design modification and post installation test guidelines were reviewed against the criteria of 10CFR50.59 and do not constitute an unreviewed safety question. During an Edison self-assessment of the engineering process, the original 10CFR50.59 for this modification was found to be incomplete with respect to use of the cross tie. The self-assessment determined that, although the installation and testing of the modification was allowed by 10CFR50.59, the 10CFR50.59 was not clear that the use of the modification was not evaluated under 10CFR50.59. Because the use of this modification in a l

i i DCP 2&3 - 7048.00SE, Rev. O I

ASC # 2, Rev. O, Sht. 4I l beyond design basis event is not allowed by 10CFR50.59, Edison is requesting NRC permission i to perform the preoperational test and make the fmal turnover of the inter-unit 4.16kV bus j cross-tie.

) During a recent NP.C review ofEdison's self-assessment process, the inspectors questioned the conclusions ofEdison's 50.59 evaluation for the design modification, with respect to changes in the probability of a malfunction of equipment important to safety. The bases for our conclusion are explained further in the enclosure to this letter. The 10CFR50.59 evaluations for the

, modification and the test guidelines as well as relevant portions of the Design Change Package are

} also enclosed. In order to make the final connections and perform the preoperational test of these modifications, the units will make use of the eight hour technical mecification allowed mitage

!- time for 4.16 kV safety related busses.

Although the installation of this modification and post installation testing do not constitute an unreviewed safety question, the use of this modification in the beyond design basis scenario of a i unit blackout may present an unreviewed safety question for the non-blacked out unit if an

! operable 4.16 kV safety-related bus is cross connected to a deenergized bus on the blacked out I unit. Because of the unique nature of this situation, where the installation and testing of a modification is allowed by regulations, but the intended use of the modification may not be

! allowed, Edison is requesting NRC approval to perform the preoperational test and make the l final turnover. Edison will installjumpers and lift leads, as applicable, to the cross-tie permissive A.5CU- !

i switches to prevent unacceptable DG system effects until NRC approval is received.

4 This design modification is only intended for use in a beyond design basis condition where one l unit has experienced a loss of all AC power and the other unit has an operable DG. In that

} situation it is anticipated that a 10CFR50.54x condition will be declared to " protect the public

! health and safety."

1 This modification will make the SONGS Units 2 and 3 electrical system more robust and better able to mitigate a loss of all AC power in a unit. Edison may, in conjunction with the Combustion Engineering Owner's Group effort, pursue separate licensing action crediting this cross-tie to extend the DG technical specification allowed outage time to 14 days. ,Your approval for the preoperational test and final turnover of this modification by May 15,1997 will allow installation and testing during the Unit 3 cycle 9 refueling outage, thereby fulfilling the commitment made in the SONGS 2 and 3 IPEEE (reference).

Ifyou have any questions, please feel free to contact me.

Sincerely, J. L. Rainsberry Manager, Plant Licensing

DCP 2&3 - 7048.00SE, Rev. 0 ASC # 2, Rev. O, Sht. 42 ATTACHMENT The 10CFR50.59 evaluation for the inter-unit 4.16kV bus cross-tie modification concluded that the design modification did not involve an increase in the probability of malfunction of equipment important to safety. The explicit basis stated was that of maintaining the existing failure modes and effects analysis conclusions of the UFSAR for the DG system. Additional bases were implicit from Section 1 (Engineering Evaluation) of the modification package, and the context of the UFSAR design and licensing bases, as follows

1. No increase based on NRC Inspection Manual, Part 9900 criteria:

Within the SONGS 2/3 licensing bases, as described in the UFSAR, the probability of a malfunction of equipment important to a fety (e.g., a Diesel Generator train) is not based on the number of devices, such as switches, that f.re in the drcuits. This is also true for the plant-specific PRA for SONGS 2/3 (Individual Plant Examination). In the UFSAR, the probability of malfunction is based only on qualitative criteria such as quality assurance per 10CFR50 Appendix B, redundancy (single failure criteria) per IEEE-279, and separation per Regulatory Guide 1.75.

This is the basis for the SONGS 2/3 review and license. These criteria are referenced by the design modification.

A5GO Therefore, in accordance with the NRC Inspection Manual, Part 9900, Section E, the modification canr.ot be considered to increase the probability of a malfunction previously evaluated in the UFSAR.

2. No increase based on meeting single failure within each train:

Additionally, the physical configuration of the modification and administrative controls prevent '

the malfunction of a DG train due to inadvertent operation of cross-tie permissive switches. All the switches are located in a vital area on the respective unit's train's fire isolation switch panel.

The cross-tie switches are uniquely identified from the fire isolation switches. Two cross-tie switches are provided for each DG (a total of 4 per unit); both switches in both units need to be manipulated to " activate" the DG cross connect capability. Repositioning either of the 2 switches per DG (e.g., due to single failure or operator error) will alarm in the control room but have no effect on any automatic or manual functions of the electrical train. With redundant, alarmed switches, repositioning of more than one switch is outside the single failure design basis defined in the UFSAR. As discussed above, the single failure criterion (10CFR50 Appendix A, and IEEE 279) is part of the environment in which SONGS 2/3 were originally reviewed and licensed.

Therefore, in accordance with NRC Inspection Manual, Part 9900, Section E and 10CFR50 Appendix A (single failure criterion), the modification cannot be considered to increase the probsbility of a malfunction previously evaluated in the UFSAR.

3. No increase based on NSAC-125:

i DCP 2&3 - 7048.00SE, Rev. O i ASC # 2, Rev. O, Sht. 43

NSAC 125, " Guidelines for 10CFR50.59 Safety Evaluations," says that "a change that does either !

l of the following is a change that increases the probability of occurrence of a malfunction of i

equipment important to safety: 1 Degrades below the design basis the performance of a safety system assumed to function in the accident analysis.

i Increases challenges to safety systems assumed to function in the accident analysis such that safety system performance is degraded below the design basis without compensating effects."

The performance of the electrical distribution system is unaffected by the installation of these switches because the 10CFR50 Appendix A single failure criterion is met within each train.-

j Furthermore, these switches do not increase challenges to any safety systems for the same reason.

J j' Therefore, in accordance with NSAC-125, the modification cannot be considered to increase the t probability of a malfunction of equipment important to safety previously evaluated in the UFSAR.

/rSch2.

4. Adequate compensatory measures even were an increase to occur:

. Any postulated risk ofinadvertent system activation is negated by the compensatory measures

~

provided by the design, location, and administrative controls. The compensatory measures inherent in the design are that system activation requires the manipulation of two switches for

each DG. Additionally, repositioning either of the 2 switches per DG will alarm in the control ;

j room but have no effect on any automatic or manual functions of the electrical train. The location of the switches provides another layer of defense to prevent inadvertent system actuation. All the switches are located in a vital area on the respective unit's train's fire isolation switch panel.

{ Access to vital areas is positively controlled by security key card. The cross-tie switches are also j located in a cabinet and are uniquely identified from the fire isolation switches which are also located in the same cabinet. Finally, administrative controls will be in place prohibiting switch i manipulation except as allowed by the Technical Specifications or 10CFR50.54x.

4 i

DCP 2&3 - 7048.00SE, Rev. 0 '

ASC # 2, Rev. O, Sht. 44 i

i I 1 j 1

A i

i SECTION 7 I 1

l '

j TEST GUIDELINES / ACCEPTANCE CRITERIA 1

4 i

i i

i 4

s i

)

1 k

i t

W

DCP 2&3 - 7048.00SE, Rev. O

ASC # 2, Rev. O, Sht. J5

7. TEST GUIDELINES AND ACCEPTANCE CRITERIA In addition to the standard construction testing, the following test guidelines are provided to verify the proper installation of 10 CFR 50.54(x) Unit to Unit Diesel Generator l Crosstie.

l 7.A BACKGROUND The purpose of the crosstie is to provide the capability to manually cross-connect one San l Onofre unit's Diesel Generator (DG) to the same train of the other San Onofre unit's 4.16 l kV Class IE AC busin the event of:

1. A loss of all preferred (offsite) power sources to both San Onofre units, and

2. A station blackout (loss of all offsite and standby power) in one of the San Onofre units, and

3. Either one or both of the other San Onofre unit's DGs (standby power) are available and supplying power to their 4.16 kV Class IE buses.

Operation of the crosstie is permitted under the provisions of 10 CFR 50.54(x).

7.B SCOPE The scope of this section is to provide the required test guidelines in addition to the standard post construction testing and acceptance criteria associated with the DG Crosstie modification to the 4.16 kV ESF buses to both units.

7.C OBJECTIVE The objective of Section 7 is to delineate test and acceptance criteria to ensure that the DG crosstie will function as designed by this modification. Existing components disturbed while doing this test and modification shall be retested and restored to their original designed form and function.

The Inagrated Functiont.1 Test will prove the integrated design operates as intended. The Integrated Functional Test will not verify all possible combinations of supplying power to and/or receiving power from the Class IE 4.16kV ESF buses. All individual circuit interlock combinations will be tested during the static circuit testing.

7.D PREREOUISITES

1) Ensure that all modifications to equipment and circuits have been cortpleted as ASC42.

necessary to support performance of the required tests.

)

i j DCP 2&3 - 7048.00SE, Rev. 0 :

j ASC 0 2, Rev. O, Sht. 44 j l 2) NRC approval (see section 3.A, Draft NRC letter) has been obtained prior to ge,g l performing the Integrated Functional Test (see section 7.F.2).

! 7.E GENERAL METHODS

!- l i l All component level tests to be performed per the applicable sections of the following j procedures:

SO23-II-l1.152 Circuit Device Tests & Overall Function.

{

j SO23-XXVI-6.14 Generic Test Procedure for Circuit and Calibration Test.

i 7.F ACCEPTANCE CRITERIA 1

7.F.1 Component Tests l

(Thefollowing testspreferably should beperformed during modes 5 or 6. The Tests must beperformed on one ESF train at a time. Thefollowingprovides Y basisfor detailed testing procedures and its contents will be superseded by the i issuance ofan approved testprocedure.)

1. All hand switches already installed at the Exposure Fire Isolation Panels shall be tested for proper contact form and function. Verify that the

! contact configuration changes according to the intent of the design when j the hand switches are operated from " Normal" to "50.54X" position and j Ma vern.

t :

2

2. Demonstrate Diesel Generator Breaker Control (including alarm circuits) l

and modified breaker auxiliary position switches function as designed. This I i may be done by simulating desired breaker positions for the appropriate

! breakers and actuating the appropriate 5054X hand switches. Overlapping

, tests may be credited for acceptance. During this DG breaker test, the

associated ESF train will be declared inoperable and the Unit will be operating under TS LCO 3.8.9, Action A, if the Unit is in modes 1,2,3, or

4. The companion Unit will be operating under TS LCO 3.8.1, Action A, if the companion Unit is in modes 1, 2, 3, or 4.

i j Verify that Standby Power Sys Inoperable Annunciators, Bus Paralleled

Annunciators, and ESF System Bypassed / Inoperable Status Indications l affected by this DCP perform intended functions after this modification. ,

i

3. Demonstrate Unit Aux. Breaker's modified breaker auxiliary position s

,e c, -

DCP 2&3 - 7048.00SE, Rev. O ASC # 2, Rev. O, Sht. 47 switch functions as designed.

! 4. Demonstrate Reserve Aux Breaker's modified breaker auxiliary position switches function as designed. During this breaker test, the associated ESF train will be declared inoperable and the Unit will be operating under TS LCO 3.8.1, Action A, if the Unit is in modes 1,2,3, or 4. The companion

. Unit will also be operating under TS LCO 3.8.1, Action A, if the

compamon Unit is in modes 1,2,3, or 4.

i

5. Demonstrate Tie Breaker Control and modified breaker auxiliary position 4

switches function as designed. Modified trip function can be verified by actuating the appropriate 5054X hand switches. During this Crosstie test, l the associate ESF train will be declared inoperable and the Unit will be l operating under TS LCO 3.8.9, Action A, if the Unit is in modes 1,2,3, or

4. The companion Unit will be operating under TS LCO 3.8.1, Action A,

. if the companion Unit is in modes 1,2,3, or 4.

i 4

6. Demonstrate Diesel Generator Governor Control function as designed.

. This can be done by simulating desired breaker positions for the appropriate breaker position switches. Overlapping tests may be credited for acceptance. During this DG test, the associated ESF train will be declared inoperable and the Unit will be operating under TS LCO 3.8.1, l l Action B, if the Unit is in modes 1, 2, 3, or 4.

j 7.F.2 Integrated Functional Test i

a 1

(Required to beperformed after completion ofall modsficationsfor both units.

The integrated tests will beperformed as an IT-1 test. The 10 CFR 50.59 Safety 1

< Evaluationfor this test will be included with the approvedpre operational test procedure. The approvedpre-operational testprocedure shall also include i necessaryprerequisites and testprocedure stop criteria.) W2 ;

During this integrated functional test the same train of both Unit 2 and Unit 3 will be cross connected and the test will be performed on both trains. The test shall be performed on one train at a time, during the test if both units are in mode 5 or 6, an 3

entry to TS LCO is not required. During mode 5 or 6 both units are operating under TS LCO 3.8.2. The most likely scenario for performing this test is that one

f. unit is in mode 1,2,3, or 4 and other unit is in mode 5 or 6. If one unit is mode 1, 2,3, or 4 then the test must be completed within the 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months based on TS LCO 3.8.9A. During this test automatic sequencing of the ESF loads onto the bus being tested will not occur if a SIAS occurs. This will render one electrical power

distribution subsystem inoperable which will require entry into the TS LCO 3.8.9A.

During this test 4 KV ClasslE bus of the Unit in modes 1,2, 3, or 4 must be

DCP 2&3 - 7048.00SE, Rev. O ASC # 2, Rev. O, Sht. 45, energized all the time.

Demonstrate the following:

1. Closure of the associated tie breaker on a Class 1E 4KV bus will not trip its DG breaker with the 5054X hand switches in the 50.54X position.

2. A Class IE 4KV bus tie breaker can be closed onto a dead bus with the 5054X hand switches in the 50.54X position.

3. Alarm and indicaticns function as per design. j

4. Perform the following on one train at a time for both units (U2 in modes 1, 2,3, or 4 and U3 in modes 5, or 6)

Cross connect the running DG to the same train of the opposite unit's dead bus.

Acknowledge bus parallel alarm.

Observe DG Governor controls are aplin droop mode.

Connect some loads without exceeding the DG load limit to the opposite unit.

Recover using offsite power supplies (U3 cffsite power via its own RAT supply breaker, U2 offsite power via its own RAT supply breaker) and the opposite unit's DG without dropping loads.

d

5. Return to the normal configuration. ;

t The following are suggested steps that may be followed for performing the integrated test on Train A, bus 2A04 and bus 3 A04. Steps for Train B intergrated test are similar to Train A tests.

(Refer to the attached Sketch A).

INTEGRATED TEST:

INITIALBUS ALLIGNMENT: Both Buses 2A04 and 3 A04 are powered from RAT (UAT) breakers 2A0418, and 3 A0418 ( or 3 A0419) respectively.

+ START OR VERIFY RUNNING SWC, CCW, AND AFW OR LPSI ON 2A04

+ DECLARE ALTERNATE PREFERRED POWER SUPPLY OF UNIT 2 INOPERABLE; enter Unit 2 TS LCO 3.8.l A,72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months shutdown action statement.

+ SELECT 2A0417 and 3A0416 TO MANUAL

+ PUT 3G002 IN MAINTENANCE LOCKOUT

DCP 2&3 - 7048.00SE, Rev. O ASC d 2, Rev. O, Sht. 49

+ SLOW START 2G002

+ SYNC 2G002 WITH 2A04 & CLOSE 2A0413

+ OPEN 2A0418 (bus 2A04 is powered from 2G002)

+ DECLARE UNIT 2 AND UNIT 3 TRAIN A AC DISRIBUTION SYSTEMS INOPERABLE; enter Unit 2 TS LCO 3.8.9A 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months shutdown action statement.

+ OPEN 3A0418 (or 3A0419), (3A04 is deenergized) l

+ SELECT 2HS5054XA1, XB1 AND 3HS505dXA1, XB1 TO 50.54X POS l

+ ACKNOWLEDGE CR ALARM /IND FOR STDBY BYP l 1

+ VERIFY VR RELAYS ARE ENERGIZED ON BOTH UNITS (auto sequencing is i blocked)

+ CLOSE 2A0417, 3 A0416 (bus 3A04 powered from 2G002)

, + ACKNOWLEDGE CR BUS 2A04/3A04 PARALLEL ALARM i

+ OBSERVE 2G002 GOVERNOR CONTROL F_QT IN DROOP

+ START CCW, SWC, AFW (OR LPSI) ON BUS 3 A04 (DO NOT EXCEED DG LOAD LIMIT) i RECOVER USING U3 OFFSITE POWER INITIALBUS ALIGNMENT: Buses 2A04 and 3A04 are powered from 2G002

+ SYNC AND CLOSE 3A0418 (or 3 A0419), (20002 is paralled with U3 offsite power)

+ OBSERVE 2G002 IN DROOP

+ OPEN 2A0413

+ SYNC AND CLOSE 2A0413

+ OPEN 3 A0418 (or 3A0419), (buses 2A04 and 3A04 are powered from 2G002)

+ OBSERVE 2G002 NOT IN DROOP 1

4 DCP 2&3 - 7048.00SE, Rev. 0 l ASC # 2, Rev. O, Sht. So '

RECOVER USING 3G002 INITIALBUS ALIGNMENT. Buses 2A04 and 3 A04 are powered from 2G002

+ REMOVE 3G007 FROM MAINTENANCE LOCKOUT l

+ SLOW START 3G002

+ SYNC AND CLOSE 3A0413 (20002 and 3G002 are in parallel)

+ OBSERVE 2G002 & 3G002 IN DROOP l

+ OPEN 2A0413 (buses 2A04 and 3A04 are powered from 3G002)

+ OBSERVE 2G002,3G002 GOVERNOR CONTROL N_QIIN DROOP

+ SHUTDOWN 2G002 RECOVER USING U2 OFFSITE POWER INITIALBUS ALIGNMENT: Buses 2A04 and 3 A04 are powered from 3G002

+ SYNC AND CLOSE 2A0418 (3G002 is paralled with U2 offsite power)

+ OBSERVE 3G002INDROOP

+ OPEN 2A0417 & 3A0416 (tie breakers are open, bus 2A04 is powered from its own RAT)

+ PLACE 2HS5054XA1, XB1 and 3HS5054XA1, XB1 IN NORMAL

+ VERIFY VR RELAYS REMAIN DE-ENERGIZED (RESET) ON BOTH UNITS (ESF Buses 2A04 and 3 A04 remain energized). Auto Load Sequencing is restored

+ VERIFY CR ALARM /IND FOR STDBY BYP CLEARED

+ EXIT TS LCO 3.8.9.A (8 HR) ON U2 RECOVER USING U3 OFFSITE POWER INITIALBUS ALIGNMENT: Bus 2A04 is powered from its own RAT and bus 3A04 is powered from 3G002

+ SYNC AND CLOSE 3 A0418 (or 3A0419), (3G002 is paralled with U3 offsite power)

+ OBSERVE 3G002 IN DROOP

, DCP 2&3 - 7048.00SE, Rev. 0 l ASC # 2, Rev. O, Sht. si !

l l +- OPEN 3A0413, bus 3 A04 is powered from its own RAT (or UAT) 1

+ SHUTDOWN 3G002

+ VERIFY CR ALARM /IND FOR STDBY BYP CLEARED RETURN TO NORMAL CONFIGURATION

+ RETURN 2A0417 & 3A0416 IN AUTO

+ EXIT U2 TS LCO 3.8.1.A (72 HR) ACTION STATEMENT

+ EXIT U3 ACTION STATEMENT (IF APPLICABLE) 4 END OF TEST BUS ALIGNMENT: Buses 2A04 and 3A04 are powered from RAT (or UAT, for U3 only) breakers 2A0418, and 3 A0418 (or 3A0419) respectively.

TEST 2A06/3 A06 CROSSTIE IN A SIMILAR MANNER.

I J

i l I 4

N I

J

}

DCP 2&3 - 7048.00SE, Rev. O ASC # 2, Rev. O, Sht. 5 2.

7.G REFERENCES

1. DCP 2&3 7048.00SE; Diesel Generator 4160V Crosstie.

2. SO123-XXVI-2.4; Preparation, Review and Approval of Component Test Procedure.

3. SO123-XXIX-2.31; Component Testing.

4. SONGS Unit 2 Operating License (OL) & Technical Specifications, Amendant No.

127.

5. SONGS Unit 3 Operating License (OL) & Technical Specifications, Amendant No.

I16.

6. SO123- IT-1, Infrequently Performed Test Guidelines.

I i

l l

DG CROSS TIE TRAIN A !

2A84 - 3A94 !

(SIMPLIFIED) N'f1047 oose, AxX. O w_sa -!

l OFFSITE POWER l .

i f i f i f RES. AUX UlliT AUX RES. AUX Uffli AUX .

XFMR 2XRI XFMR 2XUt XFMR 3XRI XFMR 3XUt !

O b i 3A0419 2AS419 O)3AS418 O)

O 2AS414 O O O i

095 2AS4 OUS 3AS4 o U t 0)2AS413 U)1A0417 0 0) 3AS418 U)3A0413 0

2L412 }

3L412

m 2. 1

=j =99j 2 3 22 m

=1

.. :l 2

l99l1

=

i

= E E llm m '

Cl 55 EEl -

LM M lC i

i SKETCH A l

i I

I l

J l

J f

4 i i t

?

i l

}

I Section V i

Selected Elementary Diagrams -

(

'e 4

i U

5 t

t i

l' 1

s a

4 1

4 4

1 4

4

4 e

4 Section V Selected Elementary Diagrams

OLOVERSIZE i

DOCUMENT :

l e

PAGE(S) PULLED \

m a m aur e m m aur e m me m aur m as e m anr ar amr aur am amr ame m m aar SEE APERTURE CARD FILES l

l APERTURE CARD / PAPER COPY AVAILABLE THROUGH NRC FI j *NUMBER

* * *OF*OVERSIZE

* *

PAGES

*

FILMED

* * *ON* APERTURE

* * * *CARD * * ***************

l ACCESSION NUMBERS OF OVERSIZE PAGES:

?

l 9 90/69noq3-o!- SV ;

l l

4

!.. .

ML20133C126

Text

Subject:

Reference:

Subject:

SUMMARY

Title:

Reference:

Reference:

Reference:

Subject:

Reference:

Subject:

=

Navigation menu

Search