ML20198H760

Proposed Tech Specs 3.8.1 Re Extension of EDG Completion Time

ML20198H760
Person / Time
Site:	San Onofre
Issue date:	01/09/1998
From:	SOUTHERN CALIFORNIA EDISON CO.
To:
Shared Package
ML20198H713	List: ML20198H707 ML20198H744 ML20198H760
References
NUDOCS 9801130390
Download: ML20198H760 (79)

Text

.

AC Sources-Op_erating-3.8.1

'3.8'.

ELECTRICALLPOWER SYSTEMS' 3.8.~1 - AC Sources -Operating i

i LCO :3.8.1

< The following AC electrical sources shall be OPERABLE:

a.

_Two qualified circuits between the offsite _ transmission network-and the onsite Clast lE AC Electrical-Power Distribution System;.and-t b.

Two diesel generators (DGs) each capable of: supplying -

one train of the ensite Class IE AC Electrical Power Distribution-System.-

APPLICABILITY:

MODES 1, 2,_3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A.

One required offsite A.1 Perform SR 3.8.1.1 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> circuit inoperable, for required OPERABLE offsite circuit.

A@

Once per 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> thereafter 8@

A.2 Restore required

-72 hours offsite circuit to OPERABLE status.

A@-

6 days from discovery of failure to meet LC0 (coatinued) 9901130390 990109 PDR ADOCK 05000361 _

P pm SAN ONOFRE--UNIT 2 3.8-1 Amendment No. 127-

- AC Sources-Operating 3,8.1-FACTIONS- (continued)-

CONDITION REQUIRED ACTION COMPLETION TIME B._ One required DG B.1 Perforn SR'3.8.1.1 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> inoperable, for the OPERABLE required offsite AND circuits.

Once per 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> thereafter bhD B.2 Declare required 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> from feature (s) sup)orted discovery of by the inoperaale DG Condition B inoperable when its concurrent with redundant required inoperability of feature (s) is redundant inoperable, required feature (s) eHD-B.3.1 Determine OPERABLE DG 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is not inoperable due

]

to common cause-failure.

QB B.3.2 Perform SR 3.8.1.2 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for OPERABLE DG.

8HD B,4 Restore required DG 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to OPERABLE status.

AND 6 days from discovery of failure to meet.

LC0

-(continued) h g

m

' AC Sources-Operating B 3.8.1 BASES

ACTIONS M -(continued)'

systems.. In this Condition, however, the remaining OPERABLE.

-offsite circuit and DGs are adequate to supply electrical

. power to the onsite Class lE Distribution System.

The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time takes into r,ccount the capacity and capability of the remaining AC sour'ces, a reasonable.

time for repairs, and the low probability of a DBA occurring during this period.

The second Completion Time for Required Action A.2 establishes a limit on the maximum time allowed for any combination of required AC power sources to be inoperable.

during any' single' contiguous occurrence of failing to meet the LCO.

If Condition A -is entered while, for instance, a DG is inoperable, and that DG is subsequently returned OPERABLE,- the LC0 may already have been not met for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. This could lead to a total of 144 hours0.00167 days <br />0.04 hours <br />2.380952e-4 weeks <br />5.4792e-5 months <br />, since initial failure to meet the LCO, to-restore the offsite circuit. At-this time, a DG could again become inoperable, the circuit restored OPERABLE, and an additional 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> (for a total of 9 days) allowed prior to complete restoration of the LCO.

The 6 day Completion Time provides a limit on the time allowed in a specified condition after discovery of failure to meet the LCO. This-limit is considered reasonable for situations in which Conditions A and-B are entered concurrently. The "AND" connector between the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and 6 day Completion Time means that both Completion Times apply simultaneously, and the more restrictive Completion Time must be met.

As in Required Action-A.2, the Completion Time allows for an exception to the normal " time zero" for beginning the allowed outage time " clock." This will result in establishing the " time zero" at the time that the LC0 was initially not met, instead of at the time Condition A was entered.

Ikl To ensure a highly reliable power source remains when one of

-the required DGs is inoperable, it-is necessary to verify _

(continued)

SAN ON0FRE--UNIT 2 B 3.8-6 Amendment-No. 127

L AC Sources-0perating B 3.8.1 1

BASES-ACTIONS-JL1 (continued)

According to Regulatory Guide 1.93 (Ref. 6), operation may continuc in Condition B for a period that should not exceed 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

In Condition B, the remaining OPERABLE DG and offsite circuits are adequate to supply electrical power to the onsite Class lE Distribution System. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low-probability of a DBA occurring during this period.

The second Completion Time for Required Action B.4 establishes a limit on the maximum time allowed for any combination of required AC power sources to be inoperable.

during any single contiguous occurrence of failing to meet the LCO.

If Condition B is entered while, for instance, an offsite circuit-is inoperable and that circuit is subsequently returned OPERABLE, the LC0 may already have been not met for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. This could lead to a total of 144 hours0.00167 days <br />0.04 hours <br />2.380952e-4 weeks <br />5.4792e-5 months <br />, since initial failure to meet the LCO, to-restore the DG. At this time, an offsite circuit could again become inoperable, the DG restored OPERAELE, and an additional 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> (for a total of 9 days) allowed prior to complete restoration of the LCO. The 6 day Completion Time provides a limit on time allowed in a specified condition after discovery of failure to meet the LCO. This limit is considered reasonable '

situations in which Conditions A i

and B are entered concurrently. The "AND" connector between the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and 6 day Completion Times means that both-Completion Times apply simultaneously, and the more restrictive Completion Time must be met.

As in Required Action B.2, the Completion Time allows for an exception to the normal " time zero.ar beginning the allowed time " clock." This will result ir establishing tne

" time zero" at the time that the LCO was initially not met, instead of at the time Condition B was entered.

(continued)

SAN ON0FRE UNIT 2-B 3.8-9 Amendment No. 127 C'

AC Sources-Operating B 3.8.1:

1 l BASES ACTIONS-C.1 and C.2-

.(continued):

Required Action C.1, which applies when.two offsite ciccuits' are inoperable, is intended to provide assurance that aa event with a coincident single-failure will not result in a complete loss of redundant required safety functions. The.

Completion Time for this failure of redundant-required features is reduced to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> from the 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> allowed by-Regulatory-Guide 1.93 (Ref. 6) for two -inoperable required offsite circuits. The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> allowance is based upon the assumption that two complete safety trains are OPERABLE.

When a concurrent redundant required feature failure exists,

=this assumption is not the case and a shorter Completion-Time of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> is appropriate. These features are powered from redundant-AC safety trains. This includes motor driven'-

auxiliary feedwater pumps.

Single train turbine driven auxiliary-pumps, are not included in the list.

The Completion Time for Required Action C.1 is intended to-allow the operator time to evaluate end repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal " time zero" for beginning the allowed outage time " clock."

In this Required Action, the Completion Time only begins on discovery that both:

a.

All required offsite circuits are inoperable; and b.

A required feature is inoperablo.

If at any tinie during the existence of Condition C (two offsita circuits inoperable) and a required feature becomes inonarable, this Completion Time begins to be trackad.

According to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition C for a period that snould not exceed 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

This, level of degradation means that the offsite e'actrical power system does not have the capability to r " ct a safe shutdown and to mitigate the effects of an s.ddent; however, the onsite AC sources have not beer.

~ degraded. This level of degradation generally corresppnds to a total loss of the immediately-accessible of f site power sources.

(cont!nued)-

~

SAN ON0FRE--UNIT 2 B 3.8-10:

Amendment No. 127

AC Sources-0perating B;3.8.1 BASES

- ACTIONS C.1 and C.2 (continued)

Because of the normally. high availability of the of_fsite sources, this level of degradation may appear to be.more-severe than other' combinations of two AC sources inoperable that involve one or more DGs inoperable.-. However, two 4

factors tend to decrease the severity of-this level of-degradation:

a.

_The configuration of-the redundant AC electrical power

-system that remains available is not susceptible to a single bus or switching-failure; and b.

The time required to detect and restore an unavailable offsite' power source is generally much less than that required to detect and restore an unavailable onsite AC source.

With both of the required offsite circuits inoperable, sufficient onsite AC sources are available to maintain the unit in a safe' shutdown condition in the event of a DBA or transient.

In fact, a simultaneous loss of offsite AC-sources, a LOCA, and 1 worst case single failure were postult.ted as a part of the design basis-in the safety analysis.

Thus, the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Completion Time provides a period of time to effect restoration of one of the offsite circuits commensurate with the importance of maintaining an AC electrical-power system capable of meeting its design criteria.

According to Reference 6, with the availabic offsite AC sources two less than ~ required by the LCO, operation may continue for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

If two offsite sources are restored within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, unrestricted operation may continue.

If only one offsite source is restored within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, power operation continues in accordance with Condition A.

D.1 and 0.2 Pursuant to LC0 3.0.6, the Distribution System (LC0 3.8.9)

ACTIONS would not be entered even if all AC sources to it were inoperable resulting in de-energization. Therefore, the-Required Actions of Condition D are modified by a Note (continued)

- SAN ON0FRE--UNIT 2 8 3.8-11 Amendment No. 127 4

- AC Sources-Operating-B 3.8.1 BASES

= ACTIONS:

RJ_i

.2

-(con.tinued) J to irt ate that when Condition D is entered, the-Conditions and Required Actions for LCO 3.8.9, " Distribution Systems-Operating," must -be immed!ately entered.~. This allows-Condition D to provide requirements for the loss of one offsite circuit and-one'DG'without regard'to whether.a

' train is de-energize'd.

LC0 3.8.9 provides the appropriate restrictions for a de-energized train.

~

According to Regulatory Guide 1.93 (Ref. 6), operation may

-continue in-Condition D for a period that should not exceed 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

In Condition D,. individual redundancy is lost in both the offsite electrical power: system and the onsitt AC-electrical power system.

Since power system redundancy is provided by two diverse sources of power, however, the reliability of the power systems in-this Condition may appear higher than that in Condition C (loss of both' required offsite circuits). This difference in reliability is offset by the susceptibility of this power system configuration to a single bus or switching failure, The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

L1 With Train A and Train B DGs inoperable, there are no remaining standby AC sources. Thus, with an assumed loss of offsite electrical power, insufficient standby AC sources are available to power the minimum required ESF functions.

Since the offsite electrical power system is the only source of AC power for this level of degradation, the risk associated with continued operation for a short time could be less than that associated with an immediate controlled shutdown (the immediate shutdown could cause grid instability, which could result in a total loss of AC power).

Since any inadvertent generator-trip could also result in a total loss of offsite AC power, however, the time allowed for cont _inued operation is severely restricted.

n The intent here is to avoid the risk associated with an (continued)

SAN'ON0 FREI-UNIT 2 B 3.8-12 Amendment No. 127

' AC' Sources-Operating B 3.8.1 BASES-

--- ACTIONS 4 E 1.'(continued)

-immediate controlled shutdown and to minimize the risk

-associated with this. level of degradation.

According-to Reference 6, with both DGs inoperable,-

operation _may continue for a period that_should not= exceed--

2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

F.1 and F.2 If the inoperable AC electrical power sources. cannot-be restored-to OPERABLE status within the required Completion'.

Time, the unit must be brought to a MODE in which the LC0 does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 5

-within'36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience,.to reach the required unit conditions from full power conditions in an orderly manner and without chc'lenging unit systems.

L.1 Condition G corresponds to a level of degradation in which all redundancy in the AC electrical power supplies has been lost.

At.this severely degraded level, any further losses in the AC ela.trical power system will cause a loss of function. T.erefore, no additional time is justified for continued operation, lhe unit is required by LC0-3,0.3 to commence a controlled shutdown.

. SURVEILLANCE The AC ources are designed to permit inspection and REQUIREMENTS.

testing of all important areas and features, especially those that have.a standby function, in accordance-with:

10 CFR 50, Appendix A, GDC 18 (Ref. 8).

Periodic component tests are supplemented by extensive functional tests during refueling outages (under simulated accident conditions).

The SRs for_ demonstrating the OPERABILITY of the DGs are in accordance with the recommendations of Regulatory Guide 1.9 i

-(Ref. 3),- Regulatory Guide 1.108 (Ref. 9), and Regulatory Guide =1.137 (Ref. 10).

(continued)

SAN ONOFRE--UNIT 2 B.3.8-13 Amendment No. 127

_mm.-m..

m..

AC Sources-Operating B 3.8.1:

BASES SURVEILLANCE-Where the.SRs discussed herein specify voltage and frequency -

REQUIREMENTS tolerances, the following is applicable. The minimum steady (continued).

state output voltage of 3924=V-is 90% of the nominal 4360 V output voltage. This value, which is consistent with ANSI C84.1-1982 (Ref.11), allows for voltage _ drop to the terminals of 4000 V motors whose minimum operating voltage.

is specified as 90% or-3600 V.

It also allows for voltage drops to motors and other equipment down through the 120_V level where minimum operating voltage is also_-usually specified as 80% of name plate rating. The specified maximum steady state output voltage of 4796 V allows for the-maximum operating voltage specified for 4000 V motors, It ensures that for a lightly loaded distribution system, the voltage at the terminals of 4000 V motors is no more than

.the maximum rated operating voltages.

The specified minimum and maximum frequencies of the DG ars 58.8 Hz and 61.2 Hz, respectively. The.ce values are equal to i 2% of the 60 Hz nominal frequency and are derived from the recommendations given in Degulatory Guide 1.9 (Ref. 3).

SR 3.8.1.1 This SR assures proper circuit continuity for the offsite AC electrical pcwer supply to the onsite distribution network and availability of offsite AC electrical power.

The breaker alignment verifies that each breaker is in its correct position to ensure that distribution buses and loads are connected to their preferred power source, and that.

appropriate independence of offsite circuits is maintained.

The 7 day Frequency is adequate since breaker position is not likely to change Wthout the operator being aware of it and because its status is displayed in the control room.

-LR 3.8.1.2 and SR 3.8.1.7 These SRs help to ensure the availability of the standby electrical power supply to mitigate DBAs and transients and to maintain the unit in a safe shutdown condition.

To minimize the wear on moving parts that do not get lubricated when.the engine is not running, these SRs are modified by a Note (Note 2 for SR 3.8.1.2) to indicate that all DG starts for there Surveili aces may be preceded by an i

e (continued)

SAN ON0FRE--UNIT 2 B 3.8-14 Amendment No. 127 l

AC Sources-0perating B 3.8.1 BASESL zSURVEILLANCEL SR -3.8.1.2 and SR-~3.8.1.7 (continued)

REQUIREMENTS-engine prelube period and followed by a warmup period prior-to loading.

'For the purposes of SR 3.8.1.2 and SR 3.8.1.7 testing, the-DGs are started i om standby conditions.

Standby conditions for a DG mean-the diesel. engine coolant-and oil are being-continuously circulated and temperature is being maintained -

consistent with manufacturer recommendations.

In order to reduce stress and wear on diesel engines, the DG manufacturer recommen a a modified start in which the starting speed of DGs is limited, warmup is limited to this

-lower speed, and the DGs are: gradually accelerated to synchronous-speed prior to loading.

This is the-intent of Note 3.

?

SR 3.8.1.7 requires that, at a 184 day Frequency, the DG starts from standby conditions and achieves required voltage and frequency within 10 seconds.

The 10 second start requirement supports _the assumptions of the design basis LOCA analysis in the UFSAR, Chapter 15-(Ref. 5).

.The 10 second start requirement is not applicable to SR 3.8.1.2 (see Note 3) when a modified start procedure as described above is used.

Since SR 3.8.1.7 requires a 10 second start, it is more restrictive than SR 3.8.1.2 and it may be performed in lieu of-SR 3.8.1.2.

-This is the intent of Note 1 of SR 3.8.1.2.

The normal 31 day Frequency for SR 3.8.1.2.(see

-Table-3.8.1-1, " Diesel -Generator Test Schedule," in the

-accompanying LCO) and the 184 day frequency for SR 3.8.1.7 are consistent with' Regulatory Guide 1.9 (Ref. 3).

These-Frequencies provide adequate assurance of DG OPERABILITY, while minimizing-degradation resulting from testing.

SR 3.8.1;3

.This Surveillance verifies that the DGs are capable of synchronizing with the offsite electrical system and j

accepting loads greater than or equal to the equivalent of (continued)

SAN _0N0FRE--UNIT 2-B 3.8-15 Amendment No. 127 l

_a._m--.._i-.:_.

I

AC Sources-Operating 8 3.8.1 BASES SURVEILLANCE SR 3.8.1.3 (continued)

REQUIREMENTS the maximum expected accident loads listed in Reference 2.

A minimum run time of 60 minutes is required to stabilize engine temperatures, while minimizing the time that the DG is connected to the offsite source.

Although no power factor requirements are established by this SR, the DG is normally operated at a power factor between 0.8 lagging and 1.0.

The 0.8 value is the design rating of the machine, while 1.0 is an operational limitation to ensure circulating currents are minimized.

The normal 31 day Frequency for this Surveillance (Table 3.8.1-1) is consistent with Regulatory Guide 1.9 (Ref. 3).

This SR is modified by four Notes.

Note 1 indicates that diesel engine runs for this Surveillance may include gradual loading, as recommended by the manufacturer, so that mechanical stress and wear on the diesel engine are minimized.

Note 2 states that momentary transients because of changing bus loads do not invalidate this test.

Similarly, momentary power factor transients above the limit will not invalidate the test. Note 3 indicates that this Surveillance should be conducted on only one DG at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations.

Note 4 stipulates a prerequisite requirement for performance of this SR.

A successful DG start must precede this test to credit satisfactory performance.

SR 3,0.1.4 This SR provides verification that the level of fuel oil in the day tank is at or above the level selected to ensure adequate fuel oil for a minimum of I hour of DG operation at full load plus 10%.

The level is expressed as an equivalent volume in inches.

The 30 inch level corresponds to 355.1 gallons of fuel oil including instrument uncertainties.

The 31 day Frequency is adequate to assure that a sufficient supply of fuel oil is available, since low level alarms are (continued)

SAN ON0FRE--UNIT 2 B 3.8-16 Amendment No. 127

AC Fources-Operating-B 3.8.1 BASES-SURVEILLANCE SR3.8.1.4--:(continued)j

REQUIREMENTS:

provided and unit operators would be aware of any large uses

_. of fuel _ oil during this -period.

SR 3.8.1.5 Microbiological fouling is a major cause of fuel oil degradation. There'are numerous microorganisms that can grow in fuel oil-and cause fouling, but all must-have a water environment in order to survive.

Removal of water from-the fuel oil day tanks once every 31 days eliminates the necessary environment for microbial survival in the day tanks. This is the most effective means of controlling microbiological fouling.

In addition, it eliminates the potential for water entrainment in the-fuel oil during DG operation. - Water may come from any of several sources, including condensation, ground water, rain water, contaminated fuel oil,-and from breakdown of the fuel oil by microorganisms. -Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system.

The Surveillance Frequencies are established by Regulatory Guide 1.137 (Ref.10).

This SR is for preventive maintenance. The presence of water does not necessarily represent failure of this SR provided the accumulated water is removed during the performance of this Surveillance.

SR 3.8.1 di This Surveillance demonstrates that each required fuel oil transfer pump operates and transfers fuel _ oil from its associated storage tank to its associated day tank. This is required to support continuous operation of standby power sources. This Surveillance provides assurance that the fuel oil _ transfer pump is OPERABLE, the fuel oil piping system is intact, the fuel delivery piping is not obstructed, and the controls and control systems for automatic fuel transfer systems are OPERABLE.

The_ design of fuel transfer systems is such that pumps will operate automatically or must be started manually in order 1

(continued)-

SAN ONOFRE--UNIT:2 B 3.8-17 Amendment No. 127

AC Sources-Operating i

B'3.8.-l j

BASES I

SURVEILLANCE SR

3. 8. l '. 6 (continued)'

REQUIREMENTS ~

to maintain an adequate volume of fuel oil in the day tanks.

during or following DG testing.

In such a case, a 31 day Frequency is appropriate.

SR 3.' 8.1. 7 See-SR 3.8.1.2.

SR 3.8.1.8 Verification of the capabilit'y to transfer each 4.16 kV ESF bus power supply from the normal preferred power source

+

(offsite circuit) to each required alternate preferred power source (offsite circuit), via the train-aligned 4.16 kV crosstie between Unit 2 and Unit 3, demonstrates the OPERABILITY of the alternate preferred power distribution network to power the post-accident and shutdown loads.

For 2A04 the normal offsite power source is 2XR1, and the alternate offsite power source is 3XR1 or 3XVI.

For 2A06 the normal offsite power source is 2XR2, and the alternate offsite power source is 3XR2 or 3XVI.

A required alternate offsite power source is the source that is-credited as the alternate source of offsite power in LC0 3.8.1<

.Therefore, the alignment of the ESF buses-in Unit 3 determines which alternate offsite circuit 1.s the required circuit at any point in time.

For each 4.16 kV ESF bus 2A04 or 2A06) this surveillance requirement may be satisf(ied by performing both a manual transfer and an auto-transfer from the normal offsite power source to at least one of the alternate offsite power sources. The tested source may then be credited as the required alternate offsite power source per LC0 3.8.1.

This surveillance may be satisfied for the remaining power source by performing a circuit functional test in addition to the transfer test above.

This functional test shall be performed such that all components that are required to function for a successful manual or auto-transfer that were not included in the transfer tests above', are tested.

This testing may include any series of sequential, overlapping, or total steps so that the entire manual and auto-transfer capability of'the source is verified.

This is explained in a note to this SR..

(continued)

SAN ONOFRE--UNIT 2 B 3.8-18 Amendment No. 127 06/27/97

AC Sources-Operating B 3.8.1 BASES' SURVEILLANCE SR 3.8.1.8 : (continued)-

REQUIREMENTS (continued)_

The 24 month Frequency of the Surveillance is based on _

engineering judgment,-taking into consideration the unit conditions required to perform the Surveillance, and is intended to be consistent-with expected fuel cycle lengths.

y Operating experience has-shown that these components nually

. pass the SR when performed at the 24 month Frequency.

Therefore, the Frequency-was concluded to be acceptable ~ from a reliability standpoint.

This SR is modified by a Note which acknowledges that credit may be taken for unplanned events that satisfy this SR.

SR 3.8.1.9 Each DG is provided with an engine overspeed trip to prevent-damage to the engine. Recovery from the transient caused by the loss of u large-load could cause diesel engine overspeed, which, if excessive, might result in-r trip of the engine._ This Surveillance demonstrates-the OG load.

response characteristics and-capability to reject the largest single load without' exceeding predetermined voltage and frequency and while maintaining a specified margin to the overspeed trip.

For this unit, the single load for each DG is the Auxiliary Feedwater pump and its-horsepower rating is 800-HP. As required by IEEE-308 (Refs 13), the load rejection test is acceptable if the increase in diesel speed does not exceed 75% of the difference between synchronous-4 (continued)

SAN ONOFRE--UNIT 2 B 3.8-lPa Amendment No. 127 06/27/97

L AC Sources-Operating B 3.8.1-BASES SURVEILLANCE-SR 3.8.1.9-(continued)

-REQUIREMENTS speed and the overspeed trip setpoint, or 15% above l

. synchronous speed, whichever is lower.

l The time, voltage, and frequency tolerances specified in this SR are derived from Regulatory. Guide 1.9 (Ref 3) recommendations for response during load sequence inte u The 4 seconds specified is. equal to 80% of a typi_ cal 5 second load sequence interval associated W th sequencing of the largest load.

The voltage and frec,ency specified-are consistent with the design range of the equipment powered by the DG, SR 3.8.1.9.a corresponds to the maximum frequency excursion, while SR 3.8.1.9.b and SR 3.8.1.9.c are steady state voltage and frequency-values to which the system must recover following load rejection.

The 24 month frequency is consistent with the recommendation of Regulatory Guide 1.9 (Ref. 3).

In order to ensure that the DG is tested under load conditions that are as close to design basis conditions as possible, testing is performed usir.g design basis kW loading and maximum kVAR loading permitted during testing.- These loadings represent the inductive loadirg that the DG would experience to the extent practicable and is consistent with the intent of Regulatory Guide 1.9 (Ref. 3).

This SR is modified by a Note which acknowledges that credit may be taken for unplanned events that satisfy this SR.

SR 3.8.1.10

.This Surveillance demonstrates the DG capability to reject a load equal to 94.5% to 100% of its continuous rating without overspeed tripping or exceeding the predetermined voltage limits.

The DG full load rejection may occur because of a system fault or inadvertent breaker tripping. This Surveillance ensures proper engine generator load response under the simulated test conditions.

This test simulates the loss of the total connected load that the DG experiences following'a full load rejection and verifies that the DG

'will not trip upon loss of the load.

These' acceptance

' criteria provide DG damage protection. While the DG is not expected to experience this transient during an event and (continued)

SAN ON0FRE--UNIT 2-B 3.8-19 Amendment No. 127

~

a AC Sources -Operating B 3.8.1 -

l BASES-l SURVEILLANCE

-SR 3.8.1.10 (continued)-

REQUIREMENTS coatinues to be available, this response ensures =that the DG is not degraded for future application, including-reconnection to the bus if the trip initiator can be corrected or isolated.- These loads and limits are consistent with Regulatory Guide 1.9 (Ref. 3).- In order to i

ensure that the DG is tested under load conditions that are as close'to design basis conditions as possible, testing is performed using design basis kW-loading and maximum kVAR -

loading permitted during testing.

These loadings represent the_ inductive loading that the DG would experience to the extent practicable and is consistent with the intent of Regulatory Guide 1.9-(Ref. 3).

The 24 month frequency is consistent with the recommendation of Regulatory Guide 1.9 (Ref 3) and is intended to be consistent with expected fuel cycle lengths.

This SR is modified by a Note which acknowledges that credit may be taken for unplanned events that satisfy this SR.

SR 3.8.1.11 As required by Regulatory Guide 1.9 (Ref. 3), this

-Surveillance demonstrates the as designed operation of the standby power sources during loss of the offsite source.

This test verifies all actions encountered from the loss of offsite power, including shedding of the nonessential. loads and energization of the emergency buses and respective loads-from the CG, It-further demonstrates the capability of the-DG to automatically achieve the required voltage and frequency within the specified time-.

The DG auto-start time of 10 seconds is derived from requirements of the accident analysis to respond to a design basis large break LOCA. -The frequency should be restored to within 2% of-nominal following a load sequence step.

The Surveillance should be continued for a minir im of 5 minutes in order to demonstrate that all starting transients have decayed and stability has been achieved.

The requirement to verify the connection and power supply of permanent loads is intended to satisfactorily show the c.

(continued)

^ SAN ONOFRE--UNIT 2 B 3.8-20 Amendment No. 127 m

e-7

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1dl (continued)

REQUIREMENTS relationship of these loads to the DG loading logic.

In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation.

For instance, Emergency Core Cooling Systems (ECCS) injection valves are not desired to be stroked open, high pressure injection systems are not capable of being operated at full flow, or shutdown cooling (SDC) systems performing a decay heat removal function are not desired to be realigned to the ECCS mode of operation.

In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the DG system to perform these functions is acceptable.

This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The Frequency of 24 months is consistent with the recommendations of Regulatory Guide 1.9 (Ref. 3), takes into consideration unit conditions required to perform the Surveillance, and is intended to be consistent with exi,eeted fuel cycle lengths.

This SR is modified by two Notes.

The reason for Note 1 is to minimize wear and tear on the DGs during testing.

For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations.

Note 2 acknowledges that credit may be taken for unplanned events that satisfy this SR.

SR 3.8.1.12 This Surveillance demonstrates that the DG automatically starts and achieves the required voltage and frequency within the specified time (10 seconds) from the design basis actuation signal and operates for a 5 minutes.

The 5 minute period provides sufficient time to demonstrate stability.

(continued)

SAN ON0FRE--UNIT 2 B 3.8-21 Amendment No. 127

.-=

Procedures, Programs, and Manuals --

-5.5=

5.5. Procedures, Programs,andManuals~(continued)l

-5.5.2.12' lVentil'ationFilterTestingProgram'(VFTP)

(continued);

The provisions of; Technical Specification Surveillance Requirement 3.0.2 and Technical Specification Surveillance Requirement 3.0.3 are -

.1 applicable to the VFTP test frequencies.

-5.5.2.13 Diesel Fuel Oil Testing Program

. This program implements required testing of both new fuel-oil-and stored fuel oil.

The program shall include sampling and-testing requirements, and-acceptance criteria, all in accordance with -'

applicable ASTM-standards._ The purpose of the program is to establish the following:

a.

At lease once per 92 days and from new fuel oil. prior to-addition-to the storage tanks by verifying that a sample obtained in accordance with ASTM D4057-81 has a water and-sediment content of less than or equal to 0.05 volume percent,

?

'an API gravity or an absolute specific gravity within limits, and'a kinematic viscosity la 40 C of greater than or equal to 1.9-but less-than or equal to 4.1 when tested in accordance with ASTM-0975-81..

b.

At least once every 92 days ; obtaining a sample of fuel oil in accordance with ASTM-04057-81 and verifying that particulate contamination.is less than 10mg/ liter wh'en checked in accordance with ASTM-D2276-83, Method A.

't ESAN_ONOFRE--UNIT--2 ?

5;0-20 Amendment No. W,13r

=

. ~.

l r

s i

ATTACHMENT "B" EXISTING SPECIFICATIONS UNIT 3 s

)

l' AC Sources -Operating.

3.8.1

-3.8LELECTRICAL-POWER-SYSTEMS =

3.8.1 AC Sources-Operating

'LCOs3.8.1 The following AC electrical sources shall-be OPERABLE:

a.

Two qualified clicuits-between the offsite transmission network and the ensite Class 1E AC' Electrical Power Distribution System; and b.

Two diesel-generators (DGs) each capable of supplying one train of the onsite Class IE AC Electrical Power Distribution System.

APPLICABILITY:

MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A.

One required effsite A.1 Perform SR 3.8.1.1 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> circuit inoperable, for required OPERABLE offsite circuit.

A_NR N

Once per 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> thereafter aEQ A.2 Restore required 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> offsite circuit to OPERABLE status.

ANQ 6 days from discovery of failure to meet LC0 -

(continued)

SAN ONOFRE--UNIT S 3.8-1 Amendment No. 116

AC Sources-Operating 3.8.1 ACTIONS (continued)-

CONDITION REQUIRED ACTION COMPLETION TIME B.

One required DG B.1 Perform SR 3.8.1.1 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> inoperable.

for the OPERABLE required offsite AND circuits.

Once per 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> thereafter allD B.2 Declare required 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> from feature (s) supported discovery of by the inoperable DG Condition B inoperable when its concurrent with redundant required inoperability of feature (s)is redundant inoperable, required feature (s)

AND B.3.1 Determine OPERABLE DG 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is not inoperable due to common cause failure.

OE B.3.2 Perform SR 3.8.1.2 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for OPERABLE DG.

MQ B.4 Restore required DG 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to OPERABLE status.

AND 6 days from discovery of failure to meet LC0 (continued)

SAN ONOFRE--UNIT 3 3.8-2 Amendment No. 116

' AC Sources-Operating B 3.8.1 1

-BASES ACTIONS M (continued) systems.

In this Condition, however, the' remaining OPERABLE offsit; circuit and DGs are adequate to supply electrical po'..er to the onsite Class IE Distribution System.

The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time'for repairs, and the low probability of a DBA occurring during this period.

The second Completion Time for Required Action A.2 establishes a limit on the maximum time allowed for any combination of required AC power sources to be inoperable during any single contiguous occurrence of failing to meet the LCO.

If Condition A is entered while, for instance, a DG is inoperable, and that DG is-subsequently returned-i OPERABLE, the LC0 may already have been not met for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. This could lead to a total of 144 hours0.00167 days <br />0.04 hours <br />2.380952e-4 weeks <br />5.4792e-5 months <br />, since initial failure to meet the LCO, to restore the offsite circuit. At this time, a DG could again become inoperable, the circuit restored OPERABLE, and an additional 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> (for a total of 9 days) allowed prior to complete restoration of the LCO.

The 6 day Completion Time provides a limit on the time allowed in a specified condition after discovery of failure to meet the LCO.

This limit is considered reasonable for situations in which Conditions A and B-are entered concurrently. The "aMQ" connector between the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and 6 day Completion Time means that both Completion Times apply simultaneously, and the more restrictive Completion Time must be met.

As in Required Action A.2, the Completion Time allows for an exception to the normal " time zero" s'of L' ginning the allowed outage-time " clock." This will result in establishing the " time zero" at the time that the LC0 was initially not met, instead of at the time Condition A was entered.

IL1 To ensure a highly reliable power source remains when one of the required DGs is inoperable, it is necessary to verify (continued)

SAN ON0FRE--UNIT 3-B 3.8-6 Amendment No. 116 r -,

• AC; Sources -Operating

. B 3.8.1:

BASES" ACTIONS' BJ

.(continued)

- According.,to. Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition B for'a period that should-not exceed.

72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

In Condition B,lthe' remaining OPERABLE DG and offsite _

circuits are adequate to supply electrical power to the onsite Class IE Distribution System. The 72-hour Completion-Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

The second Completion Time for Required Action B.4

-establishes a limit-on the maximum time allowed for-any combination of required AC power sources to be inoperable during any single contiguous occurrence of failing to meet the LCO.

If Condition B is entered while, for instance, an offsite circuit is inoperable and that circuit is subsequently returned OPERABLE, the-LC0 may already have been not met for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

This could lead to a total of 114 hours0.00132 days <br />0.0317 hours <br />1.884921e-4 weeks <br />4.3377e-5 months <br />, since initial failure to meet the LCO, to restore the DG. At this-time, an offsite circuit could again become inoperable, the DG restored OPERABLE, and an additional 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> (for a total of 9 days) allowed prior to complete restoration of the LCO. The 6 day completion Time provides a limit on time allowed in a specified condition i

i after discovery of failure to meet the LCO.

This limit is considered reasonable for situations in which Conditions A and B are entered concurrently. -The "6HQ" connector between the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and 6 day Completion Times means that both Completion Times apply simultaneously, and the more restrictive Completion Time must be met.

1 As in Required Action B.2, the Completion Time allows for an exception to the normal " time zero" for beginning the allowed time " clock." This will result in establishing the

" time zero".at the time that the LCO was initially not met, instead of at the time Condition B was entered.

o t

e (continued)

SAN ONOFRE--UNIT 3 8 3.8-9

-Amendment No, 116

AC Sources-Operating B 3.8.1

+

BASES i

ACTIONS-C.1 and C.2 (continued)_

Required Action C.1, which applies when-two offsite circuits are inoperable, is intended to provide assuran::e that an event with a coincident single failure will not result in a complete loss of-redundant ~ required safety functions. The completion Time-for this failure of redundant required features is reduced to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> from the 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> allowed by Regulatory Guide 1.93 (Ref. 6) for two inoperable required off! P.e circuits.

The-24 hour allowance is based upon the-assumption that two complete safety trains are OPERABLE.

When a concurrent redundant required feature failure exists, this assumption is not the case and a shorter Completion Time of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> is appropriate.

These features are powered from redundant AC safety trains.

This includes motor driven auxiliary feedwater pumps.

Single train turbine driven auxiliary pumps, are not included in the list.

The Completion Time for Required Action C.1 is intended to allow the operatcr time to evaluate and repair any discovered inoperabilities.

This Completion Time also allows for an exception to the normal " time zero" for beginning the allowed outage time " clock." In this Required Action, the Completion ".e only begins on discovery that both:

a.

All required offsite circuits are inoperable; and b.

A required feature is inoperable, if at any time during the existence of Condition C (two-offsite circuits inoperable) and a required feature becomes inoperable, this Completion Time begins to be tracked.

According to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition C for a period that should not exceed 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

This level of degradation means that the offsite-electrical power system does not have the capability to effect a safe shutdown and to mitigate the effects of an accident; however, the onsite AC sources have not been degraded.

This level of degradation generally corresponds to a total loss of the immediately accessible offeite power sources.

l (continued) l l_

SAN.0N0FRE--UNIT.-3 8 3.8 10 Amendment No. 116 i.-

AC Sources-Operating =

B 3.8.1 BASES--

ACTIONS C.1 and C.2 (continued)

Because of the normally high availability of the offsite sources, this. level of degradation may appear to be more severe-than other combinations of two AC sources inoperable that involve one or more DGs inoperable. However, two.-

factors tend to decrease the suerity of this level of degradation:

a.

The configuration of the redundant AC electrical power system that' remains available is not susceptible to a i

single bus or switching failure; and J

b.

.The time required to detect and restore an unavailable offsite power source is generally much less than that required to detect and restore an unavailable onsite AC source.

With both of the required offsite circuits-inoperable, sufficient onsite AC sources are available to maintain the unit in a safe shutdown condition in the event of a DBA or transient.

In fact, a simultaneous loss of offsite AC-sources, a LOCA, and a worst case single failure were postulated as a part of the design basis in the safety analysis. Thus, the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Completion Time provides a period of time to effect restoration of one of the offsite circuits commensurate with the importance of maintaining an AC electrical power system capable of meeting its design criteria.

According to Reference 6, with the available offsite AC sources two less thar. required by the LCO, operation may continue for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

If two offsite sources are restored within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, unrestricted operation may continue, If only one offsite source is restored within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, power operation continues in accordance with Condition A.

D.1 and 0.2 Pursuant to LC0 3.0.6, the Distribution System (LC0 3.8.9)

ACTIONS would not be entered even if all AC: sources to it were inoperable resulting in de-energization. Therefore,

,the Required Actions of Condition D are modified by a Note

)

(continued)

SAN ON0FRE--UNIT 3 8 3.8-11 Amendment No. 116

AC Sources-Operating m

B 3.6.1 BASES 1

ACTIONS

_ D.1 and D.2 (continued) to indicate that when Condition D is entered, the Conditions and Required Actions for LCO 3.8.9.." Distribution Systems-Operating," must be immediately entered. This allows Condition D to provide requirements for the loss of one offsite circuit and one DG without regard to whether a i

train it, de energized.

LC0 3.8.9 provides the appropriate t

restrictions for a de energized train, s

, operation may I

AccordingtoRegulatoryGuide1.93(P,ef.6)houldnotexceed continue in-Condition D for a period that s

~

12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

In Condition D, individual redundancy is lost in both the offsite electrical power system and the onsite AC electrical power system.

Since power system redundancy is )rovided by two diverse sources of power, however, the reliasility of the power systems in this Condition may appear higher than a

that in Condition C (loss of both required offsite i

circuits).

This difference in reliability is offset by the susceptibility of this power system configuration to a single bus or switching failure.

The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Completion Time takes into account the capacity and capability of the r

i remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

+

L1 With Train A and Train B DGs ino)erable, there are no 1

remaining standby AC sources.

T1us, with an assumed loss of offsite electrical power, insufficient standby AC sources are available to power the minimum required ESF functions.

Since the offsite electrical power system is the only source of AC power for this level of degradation, the risk associated with continued operation for a short time could t

be less than that associated with an immediate controlled shutdown (the immediate shutdown could cause grid

- instability, which could result in a total _ loss of AC power).

Since any inadvertent'ger,erator tri) could also result in a total loss of offsite AC power,10 wever, the

- time allowed for continued operation is severely restricted.

-)

- Tho' intent here is to avoid the risk associated with an

+

(continued)

~

SAN ON9FRE -UNIT 31 B 3.8-It Amendment N'o. 116 -

e 3-4 w

T-ec-re.

-.w

-,.. d. %[

<e v r

..w.,,.

,-,s-,

-r c-,i o,E N.< - Y w- --

r.-

nww -, m e

->-.y

+ w

..m,,--

>%w

AC Source 3-Operating.

B 3.8.1 BASLS ACTIONS L1 (continued)

~

immediate controlled shutdown and to minimite the risk associated with this level of degradation.

According to Reference 6, with both DGs inoperable, operation may continue for a period that should not exceed 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

f.1 and F.2 If the inoperable AC electrical power sources cannot be restored to OPERABLE status within the required Com)letion Tim, the unit must be brought to a MODE in which tae LCO doss not. a ply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

The allowed Completion Times are asonable, based on operating exparlence, to reach the e

'uired unit conditions from full power conditions in an orderly manner and without challenging unit systems.

Ll Condition G corresponds to a level of degradation in which all redundancy in the AC electrical power supplles has been lost. At this severely degraded level, any further losses in the AC electrical power system will cause a loss of function.

Therefore, no additional time is justified for continued operation.

The unit is required by LC0 3.0.3 to commence a controlled shutdown.

SURVEILLANCE The AC sources are designed to permit inspection and REQUIREMENTS testhg of all important areas and features, especially those that have a standby function, in accordance with 10 CFR 50, Appendix A, GDC 18 (Ref. 8).

Periodic component tests are supplemented by extensive functional tests during refueling outages (under simulated accident conditions).

The SRs for demonstrating the OPERABILITY of the DGs are in accordance with the recommendations of Regulatory Guide 1.9 (Ref.3),RegulatoryGuide1.108(Ref.9),andRegulatory Guide 1.137(Ref.10).

(continued)

SAN ONOFRE--UNIT 3 8 3.8 13 Amendment No, 116 h

~ _,

AC Sources-Operating 8 3.8.1 BASES

. ?

-SURVEILLANCE Where the SRs dia. cussed herein specify voltage and frequency REQUIREMENTS tolerances.-the following is applicable. The minimu;r. steady (centinued state output voltage of 3924 V is 90% of the nominal 4360 V output voltage. This value, which is consistent with ANSI C84.bl982 (Rsf.11), allows for voltage drop to.the terminals of 4000 V motors whose minimum operating voltage i

is specified as 90% or 3600 V.-

It also allows for voltage drops to motors and other equipment down through the 120 V level whare minimum operating voltage is also usually specified as 80% of name plate rating.

The specified maximum steady state output voltage of 4796 V allows for the maximum operating voltage specified for 4000 V motors.

It ensures that for a lightly loaded. distribution system, the voltage at the terminals of 4000 V motors is no more than the maximum rated operating voltages.

The specified minimum and maximum frequencies of the DG are 58.8 Hz and 61.2 Hz, 1

-respectively. These values are equal to 1 2% of the 60 Hz nominal frequency and are derived from the recommendations given t tegulatory Guide 1.9 (Ref. 3).

SR 3.8.1.1 This SR assures proper circuit continuity for the offsite AC electrical power supply to the onsite distribution network and availability of offsite AC electrical power.

The breaker alignment verifies that each brehker is in its correct position to ensure that distribution buses and loads are connected to their preferred power source, and that appropriate independence of offsite circuits is maintained.

The 7 day Frequency is adequate since breaker position is not likely to change without the operator being aware of it and becaure its status is displayed in the control room.

SR

3. Q 2 and SR 3.8.1.7 These SRs help to ensure the availability of the standby electrical power supply to mitigate DBAs and transients and to maintain the unit in a safe shutdown condition.

To minimize the wear on moving parts that do not get lubricated when the engine is not running, these SRs are modified by a Note (Note 2 for SR 3.8.1.2) to indicate that all DG starts for these Surve111ances may be preceded by an (continued)

SAN ON0fRE UNIT'3.'

B 3.8-14 Amendment No, 116 r

= sf ' s e 7 g -- mese 4m.hy-g---e e=w 3

.,en

.,,a,,

\\

AC Sources-Operating i

B 3.8.1 i

I

' BASES i

SURVEILLANCE SR 3.8.1.2 and SR 3.8.1 2 (continued) f REQUIREMENTS engine-prelube period and followed by a warmup period prior l

to loading.

for the purposes of SR 3.8.1.2 and SR 3.8.1.7 testing, the DGs are started from standby conditions.

Standby conditions for a DG mean the diesel engine coolant and oil are being continuously circulated and temperature is being maintained t

consistent with manufacturer recommendations.

In order to reduce stress and wear on diesel engines. the DG manufacturer recommends a modified start in which the starting speed of DGs is limited, warmup is limited to this lower speed, and the DGs are gradually accelerated to synchronous speed prior to loading.

This is the intent of Note 3.

SR 3.8.1.7 requires that, at a 184 day frequency, the DG starts from standby conditions and achieves recuired voltage and frequency within 10 seconds. The 10 second start i

regstrhent supports the assumptions of the design basis LOCA halysi in the UFSAR, Chapter 15 (Ref 5).

The 10 second start requirement is not applicable to SR 3.8.1.2 (see Note 3) when a modified start procedure as described above is used.

Since SR 3.8.1.7 requires a 10 second start, it is more restrictive than SR 3.8.1.2 and it may be performed in lieu of SR 3.8.1.2.

This is the intent of Note 1 of SR 3.8.1.2.

The normal 31 day frequency for SR 3.8.1.2 (see Table 3.8.1-1, " Diesel Generator Test Schedule," in the accompanying LCO) and the 184 daj frequency for SR 3.8.1.7 are consistent with Regulatory Guide 1.9 (Ref. 3).

These frequencies provide adequate assurance of DG OPERABILITY, while minimizing degradation resulting from testing.

SR 3.8.1 1

'This Surveillance-verifies that the DGs are capable of synchronizing with the offsite electrical system and accepting-loads greator than or equal to the equivalent of

-(continued)

SAN ON0fRE-UNIT 3 B 3.8-15 Amendment No. 116

AC Sources-Operating i

B 3.8.1 l

i BASES i

~

SURVEltLANCE SR 3.8.1.3 (continued)

REQUIREMENTS the maximum expected accident loads listed in Reference 2.

A minimum run time of 60 minutes is required to stabilize

-engine temperatures, while minimizing the time that the DG is connected to the offsite source.

f Althouk,nopowerfactorrequiremerisareestablishedby h

this S the DG is normally oper ced at a power factor between 0.8 lagging and 1.0.

The 0.8 value is the design rating of the machine, while 1.0 is an operational l

limitation to ensure circulating currents are minimized.

The normal 31 day frequency for this Surveillance (Table 3.8.1 1) is consistent with Regulatory Guide 1.9 l

(Ref 3).

3 This SR is modified by four Notes.

Note 1 indicates that diesel engine runs for this Surveillance may include gradual t

loading, as recommended by the manufacturer, so that mechanical stress and wear on the diesel engine are minimized. Note-2 states that momentary transients because of changing bus loads do not invalidate this test.

Similarly, momentary sower factor transients above the limit will not invalidate 11e test. Note 3 indicates that this Surveillance should be conducted on only one DG at a time in order to avoid common cause failures that might result from offsite circuit or <jrid perturbations.

Note 4 stipulatos a prerequisite requirement for per_formance of this SR. A successful DG start must precede this test to credit satisfactory performance.

SR 3.8.1.4 This SR prevides verification that the level of fuel oil in the day tank is at or above the level selected to ensure adequate fuel oil for a minimum of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of DG operation at full load plus 10%.

The level is expressed as an equivalent volume in inches. The 30 inch level corresponds to 355.1 gallons of fuel oil including instrument uncertainties.

t The 31 day-frequency is adequate to assure that a sufficient supply of fuel oil is available, since low level alarms are

.h (continued) 7

. SAN'ON0FRE.-UNIT.3 B 3.8-16 Amendment No. 116 i

AC Sources-Operating l

B 3.8.1 i

BASES.

SVRVEILLANCE SR 3.8.1.4 (continued)

REQUIREMENTS provided and unit operators would be aware of any large uses of fuel oil during this period.

l SR 3. 8.1. 5, Microbiological fouling is a major cause of fuel oil degradation.

There are numerous microorganisms that can-i grow in fuel oil and cause fouling, but all must have a water environment in order to survive.

Removal of water from the fuel oil day tanks once every 31 days eliminates the necessary environment for microbial survival in.the day tanks.

This is the most effective means of controlling i

microbiological fouling.

In additicn, it eliminates the potential for water entrainment in the fuel oil during DG operation.

Water may come from any of several sources, including condensation, ground water, rain water, contaminated fuel oil, and from breakdown of the fuel oil by microorganisms.

Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system.

The Surveillance frequencies are established by Regulatory Guide 1.137(Ref.10).

This SR is for preventive maintenance.

The presence of wr..er does.not necessarily represent failure of this SR provided the accumulated water is removed during the performance of this Surveillance.

SR 3.8.1.6 This Surveillance demonstrates that each required fuel oil transfer pump operates and tians.ers fuel oil from its i

associated storage tank to its associated day tank.

This is required to support continuous operation of standby power sources.

This Surveillance provides assurance that the fuel oil transfer pump is OPERABLE, the fuel oil piping system is intact, the fuel delivery piping is not obstructed, and the controls and control :iystems for automatic fuel transfer systems are OPERABLE.

The design;of fuel transfer systems is such that pumps will

- operate automatically or must be started manually in order (continued)

SAN ON0fRE--TWIT 3-B 3.8-17 Amendment No, 116 p

y-3 9

c-r

+,->yv-w j-ygr yv y

7-gt"y-py r-v7y 5mrye v-

-9, T-yyw vve'rgri-r y-rTN-g y

q--t"-g ty---*6-er-y-

~

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.6 (continued)

REQUIREMENTS to maintain an adequato volume of fuel oil in the day tanks during or following DG testing, in such a case, a 31 day i

frequency is appropriate.

I

~

SJL3.8.1.7 i

See SR 3.8.1.2.

i SR 3.8.1.3 l

Verification of t h capability to transfer each 4.16 kV ESF

[

2 bus power supply from the normal preferred power source (offsite circuit) to each required alternate preferred power t

crosstie (offsitecircuit),viathetrainaligned4.16kV source between Unit 2 and Unit 3, demonstrates the OPERABILITY of the alternate preferred power distribution network to power the post accident and shutdown loads, for 2A04 the normal offsite power source is 2XR1, and the alternato offsite power source is 3XR1 or 3XUl.

for 2A06 tSo normal offsite power so< e is 2XR2, and the alternate offsite power source is 3XR2 or 3XUl. A raquired alternate offsite power source is the source that is credited as the alternate source of-of fsite power in LCO 3.8.1.

Therefore, the alignment of the ESF buses in Unit 3 determines which alternate offsite circuit is the required circuit at any point in time.

this surveillence for each 4.16 kV ESF bus (2A04 or 2A06)ing both a manual requirement may be satisfied by perform transfer and an auto transfer from the normal offsite power source to at least one of the alternate offsite power sources. -The tested sourc., may then be credited as the i

required alternate offsite power source per LC0 3.8.1.

This survelliance may be satisfied for the remaining power source by performing a circuit functional-test in addition to the transfer test above.

This functional test shall be performed such that all components that are required to function for a successful manual or auto transfer that were not included in the transfer tests above, are tested. This testing may include any series of sequential, overlapping, or total steps so that the entire manual and auto transfer capability of the source is verified. This is explained in a note to this SR.

(continued)

SAN ON0fRE -UNIT.3 8 3.6-18 Amendment No. 116 06/27/97 f

p ieb r-w-

, =

+

~--M

,e w,

,.m.

' - - - -r e+w-v ren,i

+-=-'s

--+ -riw-'

~-

AC Sources -Operatiig B 3.8.1 i

BASES SURVEllLANCE SR 3.8.L.9 (continued)

REQUIREMENTS (continued)

The 24 month frequency of the Surveillance is based on engineering judgment, taking into ccnsideration the unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

Operating experience has shown that these components usually pass the SR when performed at the 24 mor'.h frequency.

Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

Thu SR is modified by a Note which acknowledges that credit may be taken for unplanned events that satisfy this SR.

SR 3.8.1.9 Each DG is provided with an engine overspeed trip to prevent damage to the engine.

Recovery from the transient caused by the loss of a large load could cause diesel engine overspeed, which, if excessive, might result in a trip of the engine.

This Surveillance demonstrates the DG load response characteristics and capability to reject the largest single load without exceeding predetermined voltage and frequency and while maintaining a specifieri margin to the overspeed trip.

for this unit, the single load for each DG is the Auxiliary Feedwater pump and its horsepower rating is 800 HP. As required by IEEE-308 (Ref. 13), the load rejection test is hcceptable if the increase in diesel speed does not exceed 75% of the difference between synchronous (continued)

SAN ON0fRE-UNIT 3 8 3.8-18a Amendment No. 116 06/27/97

AC Sources-Operating B 3.8.1_

j BASES l

SURVEILLANCE SR 3.8.1.9 (continued)-

REQUMfMENTS speed and the overspee.' trip setpoint, or 15% above synchronous speed, whichever is lower.

9 The time, voltage, and frequency tolerances specified in-l this SR are derived from Regulatory Guide 1.9 _ (Ref. 3) i recommendations for response during load sequence intervals.

l The 4 seconds specified is equal-to 80% of a typical 5 second load sequence interval associated with sequencing of the largest load.

The voltage and frequency specified are consistent with the design range of the equipment powered by the DG.

SR 3.8.1.9.a corresponds to the mayimum frequency excursion, while'SR 3.8.1.9.b and SR 3.8.1.9.c are i

steady state voltage and frequency values to which the system must recover _ following load rejection.

The 24 month Frequency is consistent with the recommendation of Regulatory Guide 1.9 (Ref. 3).

In order to ensure that the DG is tested under load conditions that are as close to design basis conditions as possible, testing is performed using design basis kW loading and maximum kVAR loading permitted during testing.

These.

loadings represent the inductive loading that the DG would experience to the extent practicable and is consistent with the intent of-Regulatory Guide 1.9 (Ref. 3).

This SR is modified by a Note which acknowledges that credit may be taken for unplanned events that satisfy this SR.

SR _3 8.1.10 This Surveillance demonstrates the DG capability to reject a load equal to 94.5% to 100% of its continuous rating without overspeed tripping or exceeding the predetermined voltage-limits. The DG full load rejection may occur because of a system fault or inadvertent breaker tripping.

This Surveillance ensures proper engine generator load response under the simulated test conditions.. This test simulates the loss of the total connected load that the DG experiences following a full load rejection and verifies that the DG will not trip upon loss of the load.

These acceptance criteria provide DG damage protection, While the DG is not

- expected to experience this transient during an event and (continued)

W SAN ON0fRE--UNIT 3L B 3'.8 19:

Amendment No. 116 I

(

. f m

. - -~

AC Sources-Operating l

B 3.8.1 l

BASES-

' SURVEILLANCE SR 3.8.1.10 (continued)

REQUIREMENTS continues to be available, this response ensures that the DG is not degraded for future application, including reconnection to the bus if the trip initiator can be i

corrected or isolated.

These-loads and limits are consistent with Regulatory Guide 1.9 (Ref. 3).

In order to ensure that the DG is tested under load conditions that are as close to design basis conditions as possible.. testing is i

performed using design basis kW loading and maximum kVAR loading permitted during testing. These loadings represent the inductive loading that the DG would experience to the extent practicable and is consistent with the intent of Regulatory Guide 1.9 (Ref. 3).

The 24 month Frequency is consistent with the recommendation of Regulatory Guide 1.9 (Ref. 3 and is intended to be consistent with expected fuel cy)cle lengths.

This SR is modified by a Note which acknowledges that credit may be taken for unplanned events that satisfy this SR.

SR 3.8.1.11 As required by Regulatory Guide 1.9 (Ref. 3), this Surveillance demonstrates the as designed operation of the i

standby power sources during loss of the offsite source.

This test verifies all actions encountered from the loss of offsite power, including shedding of the nonessential loads and energization of the emergency buses and respective loads from the DG.

It further demonstrates the capability of the DG to automatically achieve the required voltage and frequency within the specified time.

The DG auto-start time of 10 seconds is-derived from requirements of the accident analysis to respond to a design basis large break LOCA.- The frequency should be restored to within 2% of nominal following a load sequence step. The Surveillance should be continued-for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability has been achieved, The requirement to verify the connection and power supply of permanent loads is intended to satisfactorily show the (continued) i

. SAN ONOFRE -UNIT 3 B 3.8-20.

Amendment No. 116 eorI.-

,.w.,.--,,r.._-,--,.E.i,-,--m.mmi

.,,..-,--hv-r..__r.,

-re,e.--,,,--.,gr.-

.~we-

- +.

,-,--,,m.

-si

.~._ - -.. -

AC Sources-Operating i

B 3.8.1 1

BASES l

SURVEILLANCE SR 3.8.1.11 (continued)

REQUIREMENTS relationship of these loa'ds to the DG loading logic, in.

certain circumstances, many of these loads cannot actually t,e connected or loaded without undue hardship or potential for undesired operation.

For instance Emergency Core Cooling Systems-(ECCS) injaction valves =are not desired to be stroked open, high.

pressure injection systems are not capable of being operated at full flow, or shutdown cooling (SDC) systems performing a decay heat removal function are not desired to be realigned to the ECCS mode of operation.. In lieu of actual demonstration of connection and loading of loads, testing that-adequately shows the capability of the DG system to perform these functions is acceptable.

This testing may include any series of sequential, overlapping, or. total steps so that the entire connection and loading sequence is.

verified.

. The frequency of 24 months is consistent with the recommendations of Regulatory Guide 1.9 (Ref. 3), takes into consideration unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

This SR is modified by two Notes.

The reason for Note 1 is to minimize wear and tear on the DGs during testing.

For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations.

Note 2 acknowledges that. credit may be taken for unplanned events that sr.tisfy this SR.

SR 3.8.1.12 This Surveillance demonstrates that the DG automatically starts and achieves the required voltage and frequency within the specified time (10 seconds) from the design basis actuation signal and operates for a 5 minutes.: The 5 minute

. period provides sufficient time to demonstrate stability.

i s

(continued)l SAN'ON0FRE--UNIT 3-B 3.3-21 Amendment No, 116 y

Y.i C._..,.%e

..'v.,.

my,..,

,,,,r,_m,,.,.e.,,.__.._m..___.mw.

,,y.

._ir..,

w

-y,

..-.y..v, y,

Procedures Programs, and Manuals 5.5 1

5.5 Proceoures, Programs, and Manuals (continued) 5.5.2.12 Ventilation filter Testing Frogram (VFTP)

(continued)

The provisions of Technical Specificatinn Surveillance Requirement 3.0.2 and T9chnical Specification Surveillance Requirement 3.0.3 are applicable to the Vf1P test frequencies.

5.5.2.13 Diesel Fuel Oil Testing Program This program implements required testing of both new fuel oil and stored fuel oil.

The program shall include sampiing and testing requirements, and acceptance criteria, all in accordince with applicable ASTM standards.

The purpose of the program is to establish the following:

a.

At lease once per 92 days and from new fuel oil prior to addition to the storage tanks by verifying that a sample obtained in accordance with ASTM D4057-81 has a water and sediment content of less than or equal to 0.05 volume percent, an API gravity or an absolute specific gravity within limits, and a kinematic viscosity 9 40 C of greater than or equal to 1.9 but less than or equal to 4.1 when tested in accordance with ASTH D975 81.

b.

At least once every 92 days by obtaining a sample of fuel oil in accordance with ASTM 04057 81 and verifying that particulate contamination is less than 10mg/ liter when checked in accordance with ASTM D2276 83, Method A.

SAN ON0fRE UNIT 3 5.0-20 Amendment No. 146,119

ATTACliMENT "C" PROPOSED SPECIFICATIONS UNIT 2 Y-

t AC Sources-Operating j

3.8.1-l 3.8 ELECTRICAL POWER SYSTEMS

-[

3.8.1. AC Sources-Operating

{

s

'LC0 3.8. l' The following AC electrical sources shall be OPERABLE:-

1 1

a.

Two qualified circuits between the offsite transmission ~

network and the onsite Class IE AC Electrical Power Distribution System; and l

b.

Two diesel generators (DGs) each capable of. supplying one train of the onsite Class lE AC Electrical Power Distribution System.

APPLICABILITY:

MODES 1, 2, 3,.and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A.- One required offsite A.1 Perform SR 3.8.1.1 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> circuit inoperable.

for required OPERABLE offsite circuit.

AND Once per 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> thcreafter AND A.2 Restore required 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> offsite circuit to OPERABLE status, a@

617 days from l Syp.1 di'scovery of

-failure to meet LC0-(continued)

'fs SAN ON0fRELUNITl2 3.8-1 Amendment No.

---,nn

.-n r

,=--,,_a--.-,

AC Sources-Operating

.3.8.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION'IINE-

8. -One required DG B.1 Perform SR 3.8.1.1

.1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> inoperable.

for the OPERABLE required offsite MQ circuits.

Once per 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> 5 Il.1 thereafter MQ B.2 Declare required 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> from feature (s)sup)orted-discovery of by the inoperaale DG Condition B inoperable when its concurrent with s

redundant required inoperability of feature (s)is redundant inoperable.

required feature (s)

MQ B.3.1 Determine OPERABLE DG 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is not inoperable due to connon cause failure.

08 B.3.2 Perform 5R'3.8.1.2 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for OPERABLE DG.

MQ B.4 Restore required DG R heuesl4 days s pt. 1 to OPERABLE status.

MD 617 days from lC,gg,1 discovery of failure to meet LC0 (continued)

SAN ON0fRE--UNIT'2' 3.8 2-Amendment No.

4

,~,

a.,-wn',-

-,---me, e.N.

w.

AC Sources-Operating B 3.8.1 BASES ACTIONS

/LZ (continued) systems.

In this Condition, however, the remaining OPERABLE offsite circuit and DGs are adequate to supply ciectrical power to the onsite Class lE Distribution System.

The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time takes into account the ca;acity and capability of the remaining AC sources, a reasonaale time for repairs, and the low probability of a DBA occurring during this period.

The second Completion Time for Required Action A.2 establishes a limit on the maximum time allowed for any combination of required AC power sources to be inoperable during any single contiguous occurrence of failing to meet the LCO.

If Condition A is entered while, for instance, a DG is inoperable, and that DG is subsequently returned OPERABLE, the LC0 may already have been not met for up to 70-houM14 days.

This could lead to a total of 444-ho m 17 days, since initial failure to meet the LCO, to restore the 9"f f' g offsite circuit. At this time, a DG could again become inoserable, the circuit restored OPERABLL, and an additional 70-30u 914 days (for a total of 931 days) day Completion allowed prior to complete restoration of the LCO. The 617 Eff 1 Time provides a limit on the time allowed in a specified condition after discovery of failure to meet the LCO.

This limit is considered reasonable for situations in which Conditions A and B are entered concurrently.

The "AllD" connector between the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and 617 day Completion Time l s qg, j, means that both Completion Times apply simult aneously, and the more restrictive Completion Time must be

't.

As in Required Action A.2, the Completion Tira.Ilows for an exception to the normal " time zero" for beginning the allowed outage time " clock." This will result in establishing the " time zero" at the time that the LCO was initially not met, instead of at the time Condition A was entered.

As required by-Section 5.5.2.14,d in the event ofa Configuration Risk Management Program is implemente 5.gg.1 Condition A.

fL1 To ensure a highly reliable power source remains when one of the required DGs is inoperable, it is necessary to verify (continued)

SAN ONOFRE UNIT 2 B 3.8-6 Amendment No.

AC Sources-Operating B 3.8.1 i

BASES ACTIONS M

(continued)

Accor44 ng-to-Regule to ry4ulde-h9Haef, 4)r-opeea t-4 on-may con t-inue-in-Condi t-4en-B-fo e+pe t4ed-tha t-should-no t-emed

??-hoursr As' the basis for this risk; informed Technical Specification action, Reference 16 provides a series of deterministic and Soff.1 probabilistic justifications for a completion time of 7. days corresponding to the periods during which Condition;B is in effect. An augmented analysis using the methodolbgy set' forth in Reference 16 maintains these-justifications and supporte continued operations in Condition B for a period that should not exceed 14 days, in Condition B, the remaining 0PERABLE DG and offsite circuits are adequate to supply electrical power to the onsite Class lE Distribution System, The 74-hsuel4 day l 5 g.1 Coinpletion Time takes into account the capacity and capability of the remaining AC sources, i reasonable time for repairs, and the low probability of a DBA occurring during this period.

The second Completion Time for Required Action B.4 establishes a limit on the maximum time allowed for any combination of required AC power sources to be inoperable during any single contiguous occurrence of failing to meet the LCO.

If Condition B is entered while, for ustance, an offsite circuit is inoperable and that circuit is subsequently returned OPERABLE, the LC0 may already have been not met for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, lhis could lead to a total of 44440uesl7 days, since initial failure to meet the LCO, lbg.1 to restore the DG. At this time, an offsite circuit could again become inoperable, the DG restored OPERABLE, and an additional 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> (for a total of 920 days) allowed prior to complete restoration of the LCO. The 617 day Completion s"f f' y Time provides a limit on time allowed in a specified condition af ter discovery of failure to meet the LCO.

This limit is considered reasonable for situations in which Conditions A and B are entered concurrently.

The "ANQ" connector between the 74-hour 14 day and 617 day Completion l5.g.1 Times means that both Completion Times apply simultaneously, and the more restrictive Completion Time must be met.

(continued)

SAN ON0fRE--UNIT 2 B 3.8-9 Amendment No.

AC Sources-Operating B 3.8.1 l

' BASES ACTIONS S.d (continued)

As in Required Action B.2, the Completion Time allows for an exception fo the normal " time zero" for beginning the allowed time " clock." This will result in establishing the

" time zero" at the time that the LC0 was initially not met, instead of at the time Condition B was entered.

At required by;Section 5.5:2;14',la Configuration ~ Risk Madagement Program is11mplemented in the event'of' ~

$qI.1

,Condi t. ion._8[

' ^

~~

~

' ~

^

C.1 and C.2

-Required Action C.1, which applies when two offsite circuits are inoperable, is intended-to provide assurance that an event with a coincident single failure will not result in a complete loss of redundant required safety functions.

The Completion Time for this failure of redundant required features is reduced to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> from the 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> allowed by Regulatory Guide 1.93 (Ref 6) for two inoperable required offsite circuits.

The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> allowance is based upon the assumption that two complete safety trains are OPERABLE.

When a concurrent redundant required feature failure exists, this assumption is not the case and a shorter Completion Time of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> is appropriate. These features are powered from redundant AC safety trains.

This includes motor driven auxiliary feedwater pumps.

Single train turbine driven auxiliary pumps, are not included in the list.

The Com)1etion Time for Required Action C.1 is intended to allow tie. operator time to evaluate and repair any discovered inoperabilities. This Completion Time also.

allows for an exception to the normal " time zero" for beginning the allowed outage time " clock."

In this Required Action, the Completion Time only begins on discovery that both:

a.

All required offsite circuit:; are inop9rable; and

b. -

A required feature is inoperable.

If at any time during the existence of Condition C (two offsite circuits inoperable) and a required feature becomes inoperable,- this Completion Time begins to be tracked.

(continued)

SAN'0N0FREaVNITL2..

B 3.8>10 Amendment No.

AC Sources-Operating B 3.8.1 BASES ACTIONS C.1 and C.2 (continued)

[

According to Regulatory Guide 1.93 (Ref. 6), operation may ccntinue in Condition C for a period that should not exceed 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

This level of degradation means that the offsite electrir.a1 power system does not have the capability to effect a safe shutdown and to mitigate the effects of an accident; however, the onsite AC sources have not been i

degraded.

This level of degradation generally corresponds to a total loss of the immediately accessible offsite power sources.

Because of the normally high availability of the offsite sources, this level of degradation may appear to be more severe than other combinations of two AC sources inoperable that involve one or more DGs inoperable.

However, two factors tend to decrease the severity of this level of degradation:

a.

The configuration of che redundant AC electrical power system that remains available is not susce,)tible to a single bus or switching failure; and b.

The time required to detect and restore an unavailable offsite power source is generally much less than that required to detect and restore an unavailable onsite AC source.

With both of the required offsite circuits inoperable, sufficient onsite AC sources are available to maintain the unit in a safe shutdown condition in the event of a DBA or transient.

In fact, a simultaneous loss of offsite AC sources, a LOCA, and a worst case single failure were postulated as a part of the design basis in the safety analysis. Thus, the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Completion Time provides a period of time to effect restoration of one of the offsite circuits commensurate with the importance of maintaining an AC electrical power system capable of meeting its design criteria.

According to Reference 6, with the available offsite AC sources two less than required by the LCO, operation may continue for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

If two offsite sources are restored within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, unrestricted operation may continue.

If only one offsite source is restored within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, power operation continues in accordance with Condition A.

(continued)

SAN ON0FRE -UNIT 2 B 3.8 11 Amendment No.

i AC Sources-Operating B 3.8.1 l

BASES ACTIONS D.1 and 0.2 PursuanttoLCO3.0.6,theDistributionSystem(LC03.8.9) i ACTIONS would not be entered even if all AC sources to it

'~

were inoperable resulting in de energization.

Therefore, i

the Required Actions of Condition D are modified by a Note t

to indicate that when Condition D is entered, the Conditions-l and Required Actions for LC0 3.8.9 " Distribution Systems-Operating," must be immediately entered. This allows Condition D to provide requirements for-the loss of one offsite circuit and one M without regard to whether a train is de energized.

LCO 3.8.9 provides.the appropriate restrictions for a de energized train.

According to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition D for a period that should not exceed 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, r

in Condition D, individual redundancy is lost in both the l

offsite electrical power system and the onsite AC electrical power system. Since power system redundancy is )rovided by two diverse sources of power, however, the reliaallity of the power systems in this Condition may appear higher than that in Condition C (loss of both required offsite

.i circuits). This difference in reliability is offset by the susceptibility of this power system configuration to a single bus or switching failure. The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Completion i

Time 'akes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

L.1 With Train A and Train B DGs ino)erable, there are no remaining standby AC sources.

11us, with an assumed loss of offsite electrical power, insufficient standby AC: sources are available to power the minimum required ESF functions.

Since the offsite electrical power system is the only source of AC power'for this level of degradation, the risk associated with continued operation for a short time could

-be less than that associated-with an immediate controlled shutdown (the inmediate shutdown could cause grid instability, which could result in a total loss of AC

' power).

Since any inadvertent generator trip could also result in a total loss of offsite AC power, however, the (continued)

SAN ON0FRE-UNIT 2 B 3.8-12 Amendment No.

,4

AC Sources-Operating h

B 3.8.1 l

4 f

BASES t

ACTIONS L1 (continued) i time allowed for continued operation is severely restricted.

The intent here is to avoid the risk associated with an immediate controlled shutdown and to minimize the risk associated with this level of degradation.

' i According to Reference 6, with both DGs inoperable, operation may continue for a period that should not exceed 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

i F.1 and F.2 If the inoperable AC electrical power sources cannot be restored to OPERABLE status within the required Com)1etion i

Time, the unit must be brought to a MODE in which t1e LC0 does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the recuired unit conditions from full power conditions in en orcerly manner and without challenging unit systems.

ftd Condition G corresponds to a level of degradation in which all redundancy in the AC electrical power supplies has been lost. At this severely degraded leve', any further losses in the AC electrical power system will cause a loss of

. function.

Therefore, no additional time is justified for continued operation.

The unit is required hy LC0 3.0.3 to commence a controlled shutdown.

SURVEILLANCE The AC sources are dest:.ed to permit 'nspection and REQUIREMENTS testing of all important areas and features, especially those that have a standby function, in accordance with '

10 CFR 50, Appendix A, GDC 18 (Ref. 8).

Periodic component tests are supplemented by extensive functional tests _during

. refueling outages (under simulated accident conditions).

+

The SRs for demonstrating the OPERABILITY of the DGs are in

-accordance with the recommendations of Regulatory Guide 1.9 (Ref 3), Regulatory-Guide 1.108 (Ref. 9), and Regulatory Guide 1.137.(Ref. 10).

(continued)

SAN;6NOFRE--UNIT 2l B 3.8-13 Amendment No, j

..v_._

y

,e.,

c..

,-_...w g,v,-

AC S:urces-Operating B 3.8.1

+

CASES SURVEILLANCE Where the SRs discussed herein specify voltage and frequency REQUIREMENTS tolerances, the following is applicable.

The minimum steady (continued) state output voltage of 3924 V is 90% of the nominal 4360 V output voltage. This value, which is consistent with ANSI C84.1-1982 (Ref, 11), allows for voltage drop to the terminals of 4000 V motors whose minimum operating voltage is specified as 90% or 3600 V.

It also allows for voltage drops to motors and other equipment down through the 120 V level where minimum operating voltage is also usually specifica as 80% of name plate rating.

The specified maximum steady state output voltage of 4796 V allows for the maximum o>erating voltage specified for 4000 V motors.

It ensures t1at for a lightly loaded distribution system, the voltage at the terminals of 4000 V motors is no more than the maximum rated operating voltages.

The specified mininum and maximum frequencies of the DG are 58.8 Hz and 61.2 lit, respectively.

These values are equal to

• 2% of the 60 Hz nominal frequency and are derived from the recommendations given in Regulatory Guide 1.9 (Ref. 3).

SR 3.8.1.1 This SR assures proper circuit cnntinuity for the offsite AC electrical power supply to the onsite distribution network and availability of of' site AC electrical power.

The breaker alignment vei hies that each breaker is in its correct position to ensure that distribution buses and loads are connected to their preferred power source, and that appropriate independence of offsite circuits is maintained.

Tho 7 day frequency is adequate since breaker position is not likely to change without the operator being aware of it and because its status is displayed in the control room.

SR 3.8.1.2 and SR 3.8.1.7 These SRs help to ensure the availability of the standby electrical power supply to mitigate DBAs and transients and to maintain the unit in a safe shutdown condition.

To minimize the wear on moving parts that do not get lubricated when the engine is not running, these SRs are modified by a Note (Note 2 for SR 3.8.1.2) to indicate that all DG starts for these Surveillances may be preceded by an (continued)

SAN ON0fRf UNIT 2 B 3.8-14 Amendment No.

AC $@urces-Operating l

B 3.8.1 i

8ASES l

SURVEILLANCE SR 3.8.1.2andSR 3.8.1.7 (continued)

REQUIREMENTS enginn prelube period and followed by a warmup period prior to loading.

for the purposes of SR 3.8.1.2 and SR 3.8.1.7 testing, the i

DGs are started from standby conditions.

Standby conditions for a DG mean the diesel engine coolant and oil are being continuously circulated and temperature is being maintained-a consistent with manufacturer recommendations.

j in order to reduce stress and wear on diesel engines, the DG manufacturer recommends a modified start in which the starting speed of DGs is limited, warmup is limited to this lower speed, and the DGs are gradually accelerated to synchronous speed prior to loading.

This is the intent of Note 3.

SR 3.8.1.7 requires that, et a 184 day frequency, the DG_

starts from standby conditions and achieves required voltage and frequency within 10 seconds.

The 10 second start requirement supports the assumptions of the design basis LOCAanalysisintheUFSAR, Chapter 15(Ref.5).

The 10 second start requirement is not applicable to SR 3.8.1.2 (see Note 3) when a modified start procedure as described above is used, i

Since SR 3.8.1,) fequires a-10 second start, it is more restrictive than >R 3.8.1.2 and it may be performed in lieu of SR 3.8.1.2.

This is the intent of Note 1 of SR 3.8.1.2.

The normal 31 day frequency for SR 3.8.1.2 (see Table 3.8.1 1, " Diesel Generator Test Schedule," in the accompanying LCO) and the 184 day frequency for SR 3.8.1.7 are consistent with Regulatory uuide 1.9 (Ref. 3). These frequencies provide adequate assurance of DG OPERABILITY,

- while minimizing degradation resulting from testing.

SR 3.8.1.3 This Surveillance-verifies that the DGs are capable of synchronizing with the offsite electrical system and accepting loads greater than or equal to the equivalent of (continued) hA DN0fRE--UNIT.21 B 3.815 Amendment No.

E t-9 m

-cy y

.r-

,-a-

=

r

-,w,r

--wwe---~,e w-w-.

-~*-<------www=

-* + - - * - -

_.m i

AC Sources-Operating B 3.8.1 BASES SURVE!LLANCE SR 3.8.1.3 (continued) i REQUIREMENTS the maximum expected accident loads listed in Reference 2.

A minimum run time of 60 minutes is required to stabilize i

engine temperatures, while minimizing the time that the D3 i

is connected to the offsite sourr.e.

i I

Although no power factor requirements are established by this SR, the DG is normally operated at a power factor i

between 0.8 lagging and 1.0.

The 0.8 value.is the design rating of the machina, while 1.0 is an operational limitation to ensure circulating currents are minimized.

i The normal 31 day Frequency for this Surveillance (Table 3.8.1-1) is consistent with Regulatory Guide 1.9 i

(Ref. 3).

This SR is modified by four Notes. Note 1 indicates that i

diesel engine runs for this Surveillance may include gradual i

loading, as recommended by'the manufacturer, so that mechanical stress and wear on the diesel engine are minimized. Note 2-states that momentary transients because of changing bus loads do not invalidate this test.

Similarly, momentary power factor transients above the limit will not invalidate the test.

Note 3 indicates that this Surveillance should be conducted en only one OG at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations.

Note 4 stipulates a prerequisite requirement for performance of this SR.

A successful DG start must precede this test to credit satisfactory performance.

SJL_1 6.1.4 This SR provides verification that the level of fuel oil in the day tank is at or above the level selected to ensure adequate fuel all for a minimum of I hour of DG operation at full load plus 10%. The level is expressed as an equivalent volume in inches. The'30 inch level corresponds to 355.1 gallons of fuel oil including instrument uncertainties.

The 31 day Frequency is adequate to assure that a sufficient supply of fuel oil-is available, since low level alarms are

?

(continued)-

SAN ON0fRE--UN!T'2 B 3.8'-16 Amendment No.

AC Sources-Operating B 3.8.1 BASES SURVEllLANCE 1R 3.8.1.4 (continued)

REQUIREMENTS -

provided and unit operators would be aware of any large uses of fuel oil during this period.

SR 3.8.1.S Microbiological fouling is a major cause of fuel oil degradation. There are numerous microorganisms that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive.

Removal of water from the fuel oil day tanks once every 31 days elirc.inates the necessary environment for microbial survival in the day tanks.

This.is the most effective means of controlling i

microbiological fouling..In addition, it eliminates the potential for water entrainment in the fuel oil during DG operation. Water may come from any of several sources, including condensation, giound water, rain water, contaminated fuel oil, and from breakdown of the fuel oil oy microorganisms.

frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil rystem.

The Surveillance frequencies are established by Regulatory Guide 1.137 (Ref. 10). This SR is for preventive maintenance. The presence of water does not necessarily represent failure of this SR provided the accumulated water is removed during the performance of this Surveillance.

SR 3.8.1.6 This Surveillance demonstrates that each required fuel oil transfer pump operates and transfers fuel oil from its associated storage tank to its associated day tank.

This is required to support continuous operation of standby power sources.

This Surveillance provides assurance that the fuel oil transfer pump'is OPERABLE, the fuel oil piping system is intact, the fuel delivery piping is not obstructed, and-the controls and control systems for automatic fuel transfer systems are OPERABLE.

.+

The design of fuel transfer systems is such that pumps will

. operate automatically or must be started manually in order (continued)

SAN ON0FRE--UNIT 2 B 3.8 17 Amendment No.

i

AC Sources-0perating B 3.8.1 4

BASES SURVEILLANCE SR 3.8.1.Q (continued)

REQUIREMENTS to maintain an adequate volume of fuel oil in the day tanks during or fcllowing DG testinj.

In such a case, a 31 day frequency is appropriate, SR 3.8.1.7 See SR 3.8.1.2.

SR 3.8.1.8 Verification of the capabilit-to transfer each 4.16 kV ESF bus power supply from the notuial preferred power source (offsite circuit) to each required alternate preferred power source (offsite circuit), via the train aligned 4.16 kV crosstic between Unit 2 and Unit 3, demcnstrates the OPERABILITY of the alternate preferred power distribution network to power the post-accident and shutdown loads, for 2A04 the normal offsite power source is 2XR1, and the alternate offsite power source is 3XRI or 3XUl.

For 2A06 the normai offsite power source is 2XR2, and the alternate offsite power source is 3XR2 or 3XUl. A required alterr. ate offsite power source is the source that is credited as the alternate source of offsite power in LCO 3.8.1.

Therefore, the alignment of the ESF buses in Unit 3 determines which alternate offaite circuit is the required circuit at any point in time, for each 4.16 kV ESF bus requircment may be satisf(ed by performing both a manual 2A04 o i

transfer and an auto-transfer from the normal offsite power source to at least one of the alternate offsite power sources.

The tested source may then be :redited as the required alternate offsite power source per LC0 3.8.1.

This surveillance may be satisfied for the remiining power source by performing a circuit functional test in addition to the transfer test above.

This functior,a1 test shall be performed such that all components that are required to function for a success.il manual or auto-transfer that were not included in the transfer tests above, are tested.

This testing may include any series of sequential, overlapping, or total steps so that the entire manual and auto-transfer capability of the source is verified.

This is explained in a note to this SR.

(continued)

SAN ON0fRE--UNIT 2 B 3.8-18 Amendment No.

y

l AC Sources-Operating B 3.8.1 i

-BASES l

SURVEllLANCE SR 3,8.1.8 (continued) i REQUIREMENTS l

.(cbntinued)

The 24 month Frequency of the Surveillance is based on

)

engineering judgment, taking into consideration the unit l

conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

i Operating experience has shown that these components usually l

pass the SR when performed at the 24 r.:onth Frequency.

l Therefore, the frecuency-was concluded to be acceptable from a reliability stancpoint.

j

~

Thi* SR is modified by a' Note which acknowledges that credit may Je taken for unplanned events that satisfy this SR.

j SR 3.8.1.9 l

Each DG is 3rovided with an engine overspeed trip to prevent Recovery from the transient caused by damage to tie engine. 'ad could cause diesel engine the loss of a large lo overspeed, which, if excessive, might-result in a trip of the engine.

This Surveillance demonstrates the DG load.

4 response characteristics and capability to reject the i

largest single load without exceeding predetermined voltage i

I and frequency and while maintaining a'specified margin to the overspeed trip.- For this unit, the single load for each DG is the Auxiliary Feedwater pump.and its horse)ower rating is 800 HP. -As= required by IEEE-308 (Ref. 13), tle load

-rejection test is acceptable if the increase in diesel speed does not exceed 75% of the difference between synchronous

{

J

.r<

i b

i.

r w

(continued)

SAN ON0fRE--UNIT 2 B 3.8-18a Amendment No.

.i-I w

~

^

+

J,,.,,,..,;

..na-,--.

,. -. ~,..

I AC Saurces-Operating l

B 3.8.1 i

i BASES SURVEILLANCE SR 3.8.1.9 (continued)

REQUIREMENTS speed and the overspeed trip setpoint, or.15% above i

. synchronous speed, whichever is lower.

~The time, voltage, and frequency tolerances specified in i

this SR are derived from Regulatory Guide 1.9 (Ref.3) recommendations for response during load sequence intervals.

j The 4 seconds specified is equal to 80% of a typical 5 second load sequence interval associated with sequencing 4

of the largest load. The voltage and-frequency specified are consistent with the design range of the equipment powered by the DG.

SR 3.8.1.9.a corresponds to the maximum i

frequency excursion, while SR 3.8.1.9.b and SR 3.8.1.9.c are j

steady state voltage and frequency values to which the-l system must recover following load rejection.

The 24 month frequency is consistent with the recommendation of RegulatoryGuide1.9(Ref.3).

In order to ensure that the DG is tested under load conditions that are as close to design basis conditions as possible, testing is performed using design basis kW loading and maximum kVAR loading permitted during testing.

These loadings represent the inductive loading that the DG would experience to the extent practicable and is consistent with r

the intent of Regulatory Guide 1.9 (Ref. 3).

This SR is modified by e Note which acknowledges that-credit may be taken for unplanned events that satisfy this SR.

SR 3.8.1.10 i

This Surveillance demonstrates the DG capability to reject a load equal to 94.5% to 100% of its continuous rating without i

.overspeed tripping or exceeding the predetermined voltage limits The DG full load rejection may occur because of a system fault or inadvertent breaker tripping.

This Surveillance ensures proper engine generator load response under the simulated test conditions.

This test simulates the loss of the total connected load that the UG ex)eriences

-following a fu11' load rejection and verifies that t1e DG will not trip upon loss of.the load.

These acceptance criteria provide DG damage protection. While the DG is-not i

expected to experience this transient during an event and 3

[

(continued)

SANON0fREhuNIT2 8 3.8-19 Amendment No.

4

-g

-e-g..e

• 4"4T-T W+

e4r--f--*'-yww-w etw +

e--*w m w v ed +-e-w h w r f

ev+wn-r-r

==-wrei-ww---w- - - *me-*

-*ww-he'

l AC Sources-Operating B 3.8.1 BASES-SURVEILLANCE SR 3.8.1.10 (continued)

REQUIREMENTS continues to be available, this response ensures that the DG is not degraded for future application, including reconnection to the bus if the trip initiator can be corrected or isolated. These loads and limits are consistent with Replatory Guide 1.9 (Ref. 3).

In order to ensure that the DG is tested under load conditions that are as c?ose to design basis conditions as possible, testing 1s performed using design basis kW loading and maximum kVAR loading permitted during testing. These loadings represent the inductive loading that the DG would experience to the extent practicable and is consistent with the intent of Regulatory Guide 1.9 (Ref. 3).

The 24 month Frequency is consistent with the recommendation of Regulatory Guide 1.9 (Ref. 3) and is intended to be consistent with expected fuel cycle lengths.

This SR is modified by a Note which acknowledges that credit may be taken for unplanned events that satisfy this SR.

SR 3.8.1.11 As required by Regulatory Guide 1.9 (Ref. 3), this

)

Surwillance demonstrates the as designed operation of the standby power sources during loss of the offsite source.

This test verifies all actions encountered from the lost of offsite power, including shedding of the nonessential loads and energization of the emergency buses and respective loads from the DG, it further demonstrates the capability of the DG to automatically achieve the required voltage and frequency within the specified time.

The DG auto-start time of 10 seconds is derived from requirements of the accident analysis to rapond to a design basis large break LOCA.

The frequency should be restored to within 2% of nominal following a load sequence step.

The Surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability has been achieved.

The requirement to verify the connection and power supply of permanent loads is-intended to satisfactorily show the (continued) s SAN ON0FRE--UNIT 2 B 3.8-20 Amendment No.

h s

AC Sources-Operating B 3.8.1 -

i BASES;

-SURVEILLANCE "SR 3.8.1.11-(continued)T REQUIREMENTS relationship _of these_ loads-to the DG loading logic.

In certain circumstances, many of these loads cannot actually =

be connected or: loaded without undue hardship or potential for undesired operation.

For instance, Emergency Core Cooling Systems'(ECCS) injection valves are not desired to be stroked open, high pressure-injection systems-are not capable ~of being operated at full flow, or shutdown cooling (SDC) systems performing a decay heat removal function are not desired to be realigned to the-ECCS-mode of operation.

In lieu-of actual demonstration of connection and loading of loads, testing that adequately shows the_ capability of_the DG system to perform these functions is acceptable.

This testing may include any series of sequential, overlapping, or total steps so that the entire connection-and loading sequence is verified.=

The Frequency of 24 months is consistent with the recommendations of Regulatory Guide 1.9 (Ref. 3), takes into consideration unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

This SR is modified by two Notes.-.The reason for Note 1 is to minimize wear and tear on the DGs.during testing.

For the purpose of this testing, the DGs must be-started from standby conditions, that is, with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations. Note 2 4

acknowledges that credit may be taken for unplanned events

~,'

that satisfy'this SR.

SR 3.8.1.12 This Surveillance demonstrates that the.DG-automatically starts and achieves the required voltage and frequency within the specified time-(10 seconds) from the design-basis actuation signal and operates for a 5 minutes. The 5 minute period provides sufficient time to demonstrate. stability.

1

.(continued) 4 l$ANONOFRE--UNIT:2 B 3.8-21

_ Amendment No.

m

=-

AC Sources-Operating

- B 3.8.1 3

t BASES i

'9EFERENCES.

5.

UFSAR, Chapter 15.

(continued)J 6.-

Regulatory _ Guide' l.93, Rev. O.

7.

Generic Letter 84-15, 3

8.

10 CFR 50, Appendix A, GDC 18.

9. ' Regulatory Guide 1.108, Rev. 1.

{

10.

Regulatory Guide 1.137, Rev.1.

i 11.

ANSI C84.1-1982.

- 12.

'ASME, Boiler and Pressure Vessel Code, Section~XI.

13.

IEEE Standard 308-1978.

14.

Draft Regulatory Guide DG-1021, April 1992, 15.

10 CFR 50.63(a)(3)(ii) as published in Federal Register Vol. 57, No. 77_page 14517, April 21, 1992, 167* ':CE NPSD-996,""CE0GTJoint' Applications? Report (for

' Emergency 7Di_eselGeneratortA0TjExtension,"May[1995!

AN.

4 Y

i e

SAN 0N0FRE--UNIT:2' -

B 3.8-29 Amendment No.

'.a a

s e

+,

e

2 Procedures, Programs, and Manuals 5.5 1

5.5 Procedures, Programs,.and Manuals (continued) 5.Si2.12 Ventilation Filter Testing Program (VFTP)

(continued)

The provisions of Technical Specification Surveillance Requirement 3.0.2 and Technical Specification Surveillance Requirement 3.0.3 are _ applicable to the VFTP test frequencies.

5.5'.2.13 Diesel Fuel-011 Testing Program This program inplements required testing of both new fuel oil and stored fuel oil. The program shall include sampling and testing -

requirements, and.accepthnce criteria, all in accordance with applicable ASTM standards.

The purpose of the program is to

' establish the following:

a.

At lease once per 92 days and from new fuel oil prior to addition to the storage tanks by verifying that a sample obtained in accordance with ASTM-04057-81 has a water and sediment content of less than or equal to 0.05 volume percent, an' API gravity or an absolute specific gravity within limits, and a kinematic viscosity 0 40 C of greater than or equal to 1.9 but less than or equal to 4.1 when tested in acccrdance with ASTM D975-81.

b.

At least once every 92 days by obtaining a sa.mple of fuel oil in accordance with ASTM-D4057-81 and verifying that particulate contamination is less than 10mg/ liter when checked in accordance with ASTM 02276-83, Method A.

5 ? S. 2 LI.4P :LCon fi gufati on 11 sk;Mariagement) Pfigram ThetConfig'uration? Risk <ManagementtProgram'(CRMP)Yprovidesta procedural i zed ! ri s k-i riformed ia s se s smenti to; manage f t he (ri s ki s s oci at ed w i th reou t pmentli noperab il i ty W The l prog ram fappl i e s ttoi techni cal speci ficati on; structures,; systems b oricomponent s -; forfwhichia' ri s_k informed Completio.njTimeihas been;gra_nted2 iThejprogarg(shalj'fincinde the'following1e.l.ements:

g

~.r

' Provision $3for theicontrolfandiimplementation' ofr ilevelil7at a

a

~' '. power 2 internal events;PRA-infortriedimethodologyESThelassessment shallsbe;capabl,ecofieyaluating thelapplicable plant (; con, figuration; b'.f }Conditiongfor; preplanned activities.

Provisions'foK performing ~a F assessment l prior?toienteringithe LCO

~'

~~

(continued)

SAN ON0FRE-UNIT 2 5.0 Amendment No.

Procedures, Programs, and Manuals 5.5.

5.5 Procedures, Programs,--and Manuals:-(continued) c "M Provisions?for/ performing anlassessment?after1 entering 1the LC0 r

~

" Con _dition.for-Lunplanned entry;into;the LC0 Condition.

dl~;i^? Provisions? for':Tassessing) the? need /forTadditi onal getion~s~1after the

~' discovery offadditional equipmentiout of service' conditions while' t

11nsth,eiLC0iCondi_ tion; ~ ~ '

~"~"

~ ~ ~ ~ ~ ^ " '

Lg.1_:

e';i

-: Provision'sifor:lconsidering ~other applicable 1riskEsignificant

' contributors 9 such' as-.- Level; 2-issues,f and externals events,.

~ ~ '

qualitativelyforl quantitative 1yj) t (continued)

SAN;0N0F,REh0 NIT 22

5;0-20ai LAmendment No; L,1 g

1 1

k i

a ATTACHMENT "D" PROPOSED-SPECIFICATIONS UNIT 3 h

-h

-1>

i AC Sources--Operating 3. 8.' l 3.8 ELECTRICAL POWER SYSTEMS 3.8.1. AC-Sources-Operating LC0 3i8 l l Theifo110 wing AC electrical sources shall be OPERABLE:

a.

Two qualified circuits between the offsite transmission

'i network and thc'onsite Class IE AC~ Electrical Power Distribution-System; a4d b.

Two diesel generators (DGs)- each capable of supplying one train of the onsite Class IE AC-Electrical Power-Distribution System.-

APPLICABILITY:

MODES 1, 2, 3, and 4.

.i-ACTIONS.

CONDITION REQUIRED ACTION COMPLETION TIME A.

One required offsite A.1 Perform SR'3.8.1.1 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> circuit inoperable, for required OPERABLE offsite circuit.

E Once per 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> thereafter AND A.E Restore required 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> offsite circuit to CPERABLE statu::.

AND 617 days from j Sug.1

.scovery of

' ailure to meet LC0 (continued)_

_ q:

l SAN ONOFRE -UNIT 3 '

3.8-L Amendment No.

1 1

9 l'

-n n

4

~,--u-u-

. ~-

AC Sources-0perating 3.8.1 0

ACTIONS--(continued)-

CONDITION, REQVIRED ACTION-COMPLETION TIME 4-B.

One required DG B.1 Perform SR-3.8.1.1 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> inoperable.

for the OPERABLE required offsite ANQ circuits.

Once per 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> thereafter<

Sq.2 a!LQ 8.2-

-Deciare requ' ired 4' hours from feature (s) supported discovery of

' by-the - inoperable DG Condition B~

inoperable when its concurrent with redundant required inoperability of feature (s) is redundant

+

inoperable, required feature (s)

AND B.3.1 Determine OPERABLE DG 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is not inoperable due to common cause failure.

98 B.3.2 Parfonn SR 3.8.1.?

24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for OPERABLE DG.

ah2-B.4 Restore required DG 72 hcur:14? days l5gg.1 to OPERABLE status.

AND 617 days from' l Sgt.1 discovery of_

~

failure to meet LC0 (continued)

. SAN ON0FRE--UNIT 3 3.8-2.

Amendment No.

) AC _ Sources--Operating n

B-3.8.1

!BASESi ACT3ONS L 1 :(continued)

. systems.

In this Condition, however, the remaining OPERABLE-offsite circuit 1and DGs are adequate to_ supply electrical power to the onsite Class IE Distribution System.

The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time takes into account the caoacity' and capability of _the remaining AC sources, a reasonable-

-time for repairs, and the low probability of_ a-DBA occurring.

during this-period.

The.second Completion Time for Required Action A.2

-establishes a ;1imit on the maximum time allowed for any-

- combination-of required AC power sources 'to be inoperable during any single contiguous occurrence of failing to meet the LC0.

If Condition A is entered while, for instance, a DG =ls. inoperable and that DG is subsequently returned OPERABLE, the LC0_may already have been not met for up to

-72 heur:14? days. This could lead to a total of 444-heueslF day.t sin'ce' initial failure to meet the LCO, to restore the g"It'1

'offsits circuit. At this time, a DG could-again become

-ino)erable,- the circuit restored OPERABLE, and an additional 72 ; cur:14? dais (for a total of 931 days) allowed prior to 5 "f f '1 complete restoration of the LCO. "The 617 day Completion Time.provides a limit on the time allowed in a specified condition after discovery of failure to meet the LCO. This

-limit is considered reasonable for situations in which Cond'tions A and B are entered concurrently. The "MQ" connector between the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and 617 day Completion Time

- l 5.pg.1

-means that bcth Completion Times apply simultaneously,.and the more rostrictive Completion Time must be met.

As in Required Action A.2, the Completion Time allows for an exception-to the normal " time zero" for beginning the allowed outage: time " clock." This will result in i

establishing the " time zero" at the time that the LC0 was initially not met, instead of at the time Condition A was entered.

As required by?Section"S~.512:14,Fa Configuration: Risk Management! Program is(implemented in the3 event of 5 et t.1 ConditiogA.-

g To ensure a highly reliable power source. remains when one of the required DGs is inoperable, it is necessary to verify-(continued)

SAN 0N0)RE-UNIT 3 83.8 Amendment No.

x

=

AC Sources-0perating B 3.8.1 BASES

-ACTIONS-M (continued)

Aecording to Re9uktery Cuide 1.03 (Ref. 5), cperation may centinue in Ccnditica S_ for c pericd tMt :heuld act exceed 72 heur.

Asithel basi s / for~ thi rri sk' informed cTechnical1 Sp'eci fication.

action, Reference 116 provfdss a series:ofideterministiband probabilistic justifications for"a completion" time of?7idays Sg.1 correspondingtotheperiods'duringwhichCondition'B>i#in-6ffect. EAn : augmented analysis'using: the. methodology) set'~ ~

l forth in Reference'16-maintains 1these justifications.and supports' continued. operations in. Condition ~.B for;a; period z

that should notiexceed.14' days.

~

In Condition B, the remaining 0PERABLE DG and offsite circuits are adequate to supply electrical power to the onsite Class 1E Distribution System.

The M-heel 4 day l bg.1 Completion Time takes into account the capacity and' capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

The second Completion Time for Required Action B.4 establishes a limit on the maximum time allowed for any combination of required AC power sources to be inoperable during any single contiguous occurrence of failing to meet the LCO.

If Condition B is entered while, for instance, an offsite circuit is inoperable and that circuit is subsequently returned OPERABLE, the LC0 may already have been not met for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. This could lead to a total l5 (1 of 144-hees17? days, since initial failure to meet the LCO, 3

to restore the DG. At this time, an offsite circuit could dgain become inoperable, the DG restored OPERABLE, and an additional 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> (for a total of 920 days) allowed prior to complete restoration of the LCO. The 617 day Completion 1fA 5

Time provides a limit on time allowed in a'specified condition after discovery of failure to meet the LCO.

This limit is considered reasonable for situations in which Conditions A and B are entered concurrently. The "AND" connector between the M-hew 14 day and 617 day Completion l59..r.

Times means that both Completion ~ Times apply simultaneously, and the more restrictive Conipletion Time must be met.

(continued)

SAN ON0FRE--UNIT 3-B 3.8-9 Amendment No.

F AC Sources-Operating _

B 3.8.1

~ ' BASES:

l ACTIONS-i[L_( (continued)

~ As in Required Action B.2, the Completion Time allows for an-exception to the normal " time zero" for beginning the

= allowed _ time " clock " _ This will result in establishing the

" time zero" at the time that the;LC0 was initially not met, 4

instead of at the time Condition B was entered.

As7requi red by' Sect i on: 5 ~.15: 2714 sT Confi gura t i on Ti s k Management Prog' ram d i s ! imp ~l emented ai n at he eventi of "~

591

' " ~ ~ ~

~ ~ ~ ^ ^ '~' ~ ~ ~

Condition:Bf"

-C.1 and C.2 Required Action-C.1, which applies when two offsite circuits are inoperable, is intended to provide assurance that an event with a coincident single failure will not result in a complete loss'of redundant required safety functions.

The Completion Time for this failure of redundant required features is reduced to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> from the 24-hours allcwed by Regulatory Guide 1.93 -(Ref. 6) for two inoperable required offsite circuits. The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> allowance is based upon the assumption that'two complete safety trains are OPERABLE, When a concurrent redundant required feature failure exists, this assumption is not the case and a shorter Completion Time of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> is appropriate. These features are powered from redundant AC safety trains. This includes motor driven auxiliary feedwater pumps.

Single train turbine driven auxiliary pumps, are not' included in the list.

The Completion Time for Required Action C.1 is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal " time zero" for beginning the allowed-outage time " clock."

In this Required

-Action, the Completion Time only begins on discovery that both:

a.

All required offsite circuits are inoperable; and g

b.

A required feature. is inoperable.

If at any time during the existence of Condition C (two

._offsite circuits inoperable) and a required feature becomes-inoperable, _this Completion Time begins to be tracked.

(continued)

SAN ON0FRE--UNIT:3 B 3.8-10' Amendment No.

a

N AC Sources-Operating g

B3j8.1-

- BASES-ACTIO1S C.1 and C.2 '(continued)

According to Regulatory Guide 1.93 (Ref. 6),- operation may' continue in Condition-C for.a period:that should not exceed 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. This level of degradation means that the offsite electrical power system does not have the capability to effect a safe shutdown and to mitigate the effects of an accident; however, the onsite AC sources have not been degraded. This level of degradation-generally corresponds to i total loss of the immediately accessible offsite power J

sources.

Because of the normally high availability of the offsite sources, this level of degradation may appear to be more severe than other combinations of-two AC sources inoperable-that involve one or mc3 e DGs inoperable. However two factors tend to decrease the severity of this level of degradation:

a.

The configuration of the redundant AC electrical power system that remains available is not susceptible to a single bus or switching failure; and b..

The time required to detect and restore an unavailable offsite power source is generally much less than that required to detect and restore an unavail&ble onsite AC source.

With acth cf the required offsite circuits inoperable, sufficient onsite AC sources are available to maintain the unit in-a safe shutdown condition in the event of a DBA or transient.

In fact, a simultaneous loss of offsite AC sources, a LOCA,:and a worst case single failure were postulated as a part of the design basis in the safety analysis.

Thus, the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Completion Time provides a period of time to effect restoration of one of the offsite circuits commensurate with the importance'of maintaining an AC electrical power system capable of meeting its design criteria.

According to Reference 6, with the available offsite AC sources two less than required by the LCO, operation may continue for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

If two offsite sources are restored within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, unrestricted operation may continue.

If only one offsite source is restored within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, power operation continues-in accordance with Condition A.

(continued)

SAN ONOFRE--UNIT 3 B 3.8-11 Amendment No.

C i__-_______i

-__a

[

AC Sources-Operating-B-3.8.1-BASES LACTI0 tis D.1 and D.2 Pursuant to LCO 3.0.6, the' Distribution System (LCO 3.8.9)

ACTI6NS would not be entered ever Lif all AC sources to it

-were inoperable resulting in de-energization. Therefore, the Required-Actians of Condition D are modified by : Note to indicate that when Condition 0 is entered,.the Conditions and Required Actions for LC0 3.8.9, "Distribation-Systems-Worating," must be-immediately entered. This-allows Condition 0 to provide requiremants for the loss of-one'offsite circuit and one^DG without regard to whether a train is da-energized.

LC0 3.8.9 provides the appropriate g

restrictions for a de-energized train.

According to Regulatory Guide 1.93-(Ref 6), operation may-continue in Condition-D for a period that should not exceed 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

in Condition D, individual redundancy is lost in both the of fsite electrical power system and the onsite AC electrical power system.

Since power system redundancy is provided by two diverse sources of-power, however, the reliability of the power systems in this Condition may appear higher than that in Condition C (loss of both required offsite f

circuits).

This difference in reliability is offset by the susceptibility of this power system configuration to a single bus or switching failure. The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Completion Time takes into account the capacity and capability of the remaining AC sources,-a reasonable time for repairs, and the low probability of a DBA occurring during this period.

u E.d With Train A and Train B OGs inoperable, there are no remaining standby AC sources. Thus, with an assumed loss of offsite electrical power, insufficient standby AC sources are available to. power the minimum required ESF functions.

Since the offsite electrical power system is the only source of AC power for_ this level of degradation, the risk associated with continued operation for a short time could be-less than that associated with an immediate controlled

-shutdown:(the immediate shutdown could cause grid instability, which could result in a total loss of AC power).

Since any inadvertent generator trip could also result in a total loss of offsite AC power, however, the (continued)

SAN ON0FRE--UNIT 3 B 3.8-12 Amendment No.

u

AC Sources-Operating 8 3.8.1 BASES ACTIONS L1 (continued) time allowed for continued operation is severely restricted.

The intent here is to avoid the risk associated with an immediate controlled shutdown and to minimize the risk associated with this level of degradation.

According to Reference 6, with both DGs inoperable, operation may continue for a period that should not. exceed 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

F.1 and F.2 If the inoperable AC electrical power sources cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LC0 does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

Ed Condition G corresponds to a level of degradation in which all redundancy in the AC electrical power supplies has been lost.

At this severely degraded level, any further losses in the AC electrical power system will cause a loss of function. Therefore, no additional time is justified for continued operation. The unit is required by LC0 3.0.3 to commence a controlled shutdown.

SURVEILLANCE The AC sources are designed to permit inspection and REQUIREMENTS testing of all important areas and features, especially those that have a standby function, in accordance with 10 CFR 50, Appendix A, GDC 18 (Ref. 8).

Periodic component tests ece supplemented by extensive functios:al tests during refueling octages (under simulated accident conditions).

The SRs for demonstrating the OPERABILITY of the DGs are in accordance with the recommendations of Regulatory Guide 1.9 (Ref. 3), Regulatory Guide 1.108 (Ref 9), and Regulatory Guide 1.137 (Ref. 10).

(continued)

SAN ON0FRE--UNIT 3 B 3.8-13 Amendment No.

o AC Sources-0perating B 3.8.1 BASES SURVE!LLANCE-Where the SRs discussed herein.specify voltage _ and frequency REQUIREMENTS tolerances,- the following is applicable. The minimum steady (continued) state output' voltage of 3924 V is 90%'of the nominal-4350 V-output voltage.

This value, which-is consistent with.

AN511084.1-1982 (Ref.11), allows for_ voltage-drop to the terminals-of 4000 V motors whose minimum operating voltage is specified as 90% or 3600 V.

_It also allows for voltage drops-to motors and other equipment down through the 120 V level where minimum operating voltage is'also'usually specified as 80% of name plate rating. :The'specified maximum steady state ' output voltage of 4796 V allows for the maximum operating voltage specified for 4000_ V motors.

It ensures that for a lightly loaded distribution system, the voltage at the terminals of 4000 V motors i: no more than the maximum rated operating voltagcs-The-specified minimum and maximum frequencies of-the DG are 58.8 Hz and 61.2 Hz, respectively. These values are equal to i 2% of the 60 Hz nominal frequency;and are derived from the recommendations given in Regulatory Guide 1.9"(Ref. 3).

SR 3.8.1.1 This SR assures proper circuit continuity for the offsite AC electrical power supply to the onsite distribution network and availability of offsite AC electrical power.

The breaker alignment verifies that each breaker is in its correct position to ensure that distribution buses and loads are connected to their preferred power source, and that appropriate independence of offsite circuits is maintained.

The 7 day Frequency is adequate since breaker position is not likely; to change without the operator being aware of it and because its status is displayed in the control room.

SR 3.8.1.2 and SR 3.8.1.7 These SRs; help to ensure the availability of the standby electrical power supply to mitigate DBAs and transients and to maintain the unit in a safe shutdown condition.

To; minimize the wear on moving parts that do not get lubricated when the engine is not running, these SRs are modified by a Note-(Note 2 for'SR 3.8.1.2) tosindicate that all DG starts for these Surve111ances may be pre'eded by an (continued)

' SAN ON0FRE--UNIT 3

-8 3.8-14 Amendment No.

- AC Sourcos--Operating;

' B 3.8.1 j

8ASES a:

iSURVEILLANCE SR 3.8.1.2 and'SR 3.8. l'.7 : - (continued)5

-REQUIREMENTS i

Lengine-'prelube period and followed by a warmup' period p_rior to. loading...

c For the purposes of SR 3.8.1.2 and SR 3.8.1.7 testing,:the DGs are started ~from standby conditions. : Standby conditions

- for a DG mean-the diesel engine coolant and oil are being -

?

continuously circulated and temperatureJis being maintained e

consistent with~ manufacturer recommendations.

't In' order to reduce stress and wear on diesel engines,-the DG--

3 manufacturer recommends a modified start-in which,the.

starting speed.of DGs is limited, warmup'is limited to this q

lower speed, and the DGs are gradually accelerated to

~

synchronous speed prior-to loading.

This.is the intent of Note 3.

SR 3.8.1.7 requires that, at a 184 day Frequency, the OG starts from standby conditions and achieves required d ?. age and frequency within 10 seconds. -The 10 second stan requirement supports the assumptions of the design W R LOCA analysis in the UFSAR, Chaptor 15 (Ref. 5).

The 10 second Start requirement is not applicable _to SR 3.8.1.2 (see Note 3) when a modified start procedure-as described above is:used.

Since SR 3.8.1.7 requires a 10 second start, it is more restrictive than SR 3,8.1.2 and it may be performed in lieu of SR 3.8.1. 2.

This is-the intent of Note 1 of SR 3.8.1.2.

The normal 31 day Frequency for SR 3.E.1.2 (see Table 3.8.1-1, " Diesel Generator Test Schedule," in the accompanying LCO)~and the 184 day Frequency for SR 3.8.1.7 are consistent with Regulatory Guide 1.9 (Ref. 3). These Frequencies provide adequate assurance of DG OPERABILITY, while minimizing degradation resulting from testing.

SR 3.8.1.3 This Surwillance verifies that the DGs are capable of synchronizing with the offsite electrical system and accepting-loads greater than or equal to the equivalent 'of (continued)

SAN ON0FRE-UNIT 3-B 3.8-15 Amendment No.

M

['

- +.

y

,..y e,

y

~_

AC. Sources -Operating -

8:3.8.1

-BASES:

SURVEILLANCE SR 3.8.1.3-(continued)-

REQUIREMENTS the maximum expected accident-loads listed-in-Reference 2.

A minimum run time of 60 minutes <is required-to stabilize-s engine temperatures; while minimizing-the time that the DG

'is connected to the offsite source.

Although no power factor requirements are established.by-

.this SR,. the DG is normally operated at a power factor between 0,8 lagging and.1.0.

The 0.8-value is the design

- rating of the machine, while 1.0-is an operational limitation to. ensure circulating currents are minimized.

The normal 31-day Frequency for this Surveillance (Table 3.6.1-1)'is consistent with Regulatory Guide 1.9 (Ref. 3).

This= SR is modified by four Notes. Note 1 indicates that diesel engine runs for this Surveillance may include gradual loading, as recommended by the manufacturer, so that mechanical stress.and wear on the diesel engine are minimized. Note 21 states that momentary transients because of changing bus loads do not invalidate this test.

Similarly, momentary power factor transients above the limit will not invalidate the test.

Note 3 indicates that this Surveillance should be conducted on only one DG at a time in-order to avoid common causo failures that might result from offsite circuit or grid perturbations.

Note 4 stipulates a prerequkite requirement for performance of this SR. A successful DG start must precede this test to credit satisfactory per4r;nr.:c.

SR 3.8.1.4 This SR provides verification _that the level of fuel oil in the day tank is at or above the level selected to ensure adequate fuel oil for a minimum of I hour of DG operation at full load plus -10%. - The level is expressed as an equivalent volume in. inches.

The 30 inch level corresponds to 355.1 gallons of fuel oil _ including instrument incertainties.

The 31 day Frequency is adequate to assure that a sufficient p

-supply of fuel oil:is available, since low level alarms are (continued)

SAN ON0FRE--UNIT 3 B 3.8-16 Amendment No.

a

AC= Sources -Operating :

B 3.8.1 i

BASES

~ SURVEILLANCE

SR 3.8.1'.4 (continued)

REQUIREMENTS provided and unit operators would be aware of any large Lses of fuel oil during this period.

f SR 3.8.1.5-Microbiological fouling is a major cause of fuel oil degradation.

There are numerous microorganisms that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive.

Removal of water from the fuel oil day tanks once every 31 days eliminates the necessary environment for microbial survival in-the day tanks. This is the most effective means of controlling microbiological fouling. -In addition, it eliminates the potencial for water.entrainment in the fuel oil during DG operation. Water may come from any of several sources, including condensation, 3round water, rain water, contaminated fuel oil, and from breakdown of the fuel oil by microorganisms.

Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system.

The Surveillance Frequencies are established by Regulatory Guide 1.137 (Ref. 10).

This SR is for preventive maintenance. The presence of water does not necessarily.

represent failure of this SR provided the accumulated water is removed during the performance of this Surveillance.

SR 3.8.1.6 This Surveillance demonstrates that each required fuel oil transfer pump cperates and transfers fuel oil-from its associated storage tank to its associ4ted day tank. This is required to support continuous operation of standby power sources. This Surveillance provides. assurance that the fuel oil: transfer pump is OPERABLE, the fuel oil piping system is intact, the fuel delivery piping is not obstructed, and the controls and' control systems for automatic fuel transfer systems are OPERABLE.

The design of fuel transfer systems is such that pumps will operate automatically or must be started manually in order (continued)

SAN ONOFRE--UNIT l3 B 3.8-17 Amendment No.

l L

AC Sources-0perating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.6-(continued)

REQUIREMENTS to maintain an adequate volume of fuel oil in the day tanks during or following DG testing, in such a case, a 31 day Frequency is appropriate.

ER 3.8.1.7 See SR 3.8.1.2.

SR 3.8.1.8 Verification of the capability to transfer each 4.16 kV ESF bus power supply from the normal preferred power source (offsite circuit) to each required alternate preferred power source (offsite circuit), via the train-aligned 4.16 kV crosstie between Unit 2 and Unit 3, demonstrates the OPERABILITY of the alternate preferred power distribution network to power the post-accident and shutdown loads.

For 2A04 the normal offsite power source is 2XR1, and the alternate offsite power source is 3XR1 or 3XVI.

For 2A06 the normal offsite power source is 2XR2, and the alternate offsite power source is 3XR2 or 3XVI. A required alternate offsite power source is the source that is credited as the alternate source of offsite power in LC0 3.8.1.

Therefore, the alignment of the ESF buses in Unit 3 determines which alternate offsite circuit is the required circuit at any point in time.

For each 4.16 kV ESF bus (2A04 or 2A06) this surveillance requirement may be satisfied by performing both a manual transfer and an auto-transfer from the normal offsite power source to at least one of the alternate offsite power c

sources. The tested source may then be credited as the required alternate offsite power source per LC0 3.8.1.

This surveillance may be satisfied for the remaining power source by performing a circuit functional test in addition to the transfer test above. This functional test shall be performed such that all components that are required to function for a successful manual or auto-transfer that were not included in the transfer tests above, are tested.

This s

testing may include any series of sequential, overlapping, or total steps so that the entire manual and auto-transfer capability of the source is verified. This is explained in a note to this SR.

(continued)

SAN-ON0FRE--UNIT 3 B 3.8-18 Amendment No.

+

AC Sources--Operating 9 3.8.1

BASES SVRVEILLANCE SR 3.8.1 8 (continued) 2 REQUIREMENTS.

(continutd)

The 24 month Frequency of the Surveillance is based on engineering judgment, taking into consideration the unit-conditions required to perform the Surveillance, and is-intended to be consistent with expected fuel cycle lengths.

Operating experience has shown that these components usually pass the SR when performed:at the 24 month Frequency.

Therefore, the Frecuency was concluded to be acceptable-from a reliability stancpoint.-

This SR is modified by a Note which acknowledges that credit may be taken for unplanned events that satisfy this SR.

SR 3.8.1.9 Each DG is provided with an engine overspeed trip to-prevent damage to the engine.

Recovery from the transient caused by the loss of a large load could cause diesel engine overspeed, which, if excessive, might result in a trip of the engine. This Surveillance demonstrates the DG load response characteristics and capability to reject the largest single load without exceeding predetermined voltage.

and frequency and while maintaining a specified margin to the overspeed trip.

For this unit, the single load for each DG is the Auxiliary Feedwater pump and its horsepower rating is 800 HP. As required by IEEE-308 (Ref.13), the load rejection test is acceptable if the increase in diesel speed does not exceed 75% of the difference between synchronous 1

i (continued)

SAN ONOFRE--UNIT 3 B 3.8-18a Amendment No.

AC Sources-Operating B 3.8.1 2

BASES SURVEILLANCE SR 3.8.1.9 (continued)

REQUIREMENTS speed and the overspeed trip setpoint, or 15% above synchronous speed, whichever is lower.

The time, voltage, and frequency tolerances specified in this SR are derived from Regulatory Guide 1.9 (Ref. 3) recommendations for response during load sequence intervals.

The 4 seconds specified is equal to 80% of a typical 5 second load sequence interval associated with sequencing of the largest load.

The voltage and frequency specified are consistent with the design range of the equipment powered by the DG.

SR 3.8.1.9.a corresponds to the maximum frequency excursion, while SR 3.8.1.9.b and 'SR 3.8.1.9.c are steady state voltage and frequency values to which the system must recover following load rejection.

The 24 month frequency is consistent with the recommendation of Regulatory Guide 1.9 (Ref. 3).

In order to ensure that the DG is tested under load conditions that are as close to design basis conditions as possible, testing is performed using design basis kW loading and maximum kVAR loading permitted during testing.

These loadings represent the inductive 1cading that the DG would experience to the extent, practicable and is consistent with the intent of Regulatory Guide 1.9 (Ref 3).

This SR is modified by a Note which acknowledges that credit may be taken for unplanned events that satisfy this SR.

SR 3.8.1.10 This Surveillance demonstrates the DG capability to reject a load equal to 94.5% to 100% of its continuous rating without overspeed tripping or exceeding the predetermined voltage limits.

The DG full load rejection may occur because of a system fault or inadvertent breaker tripping. This Surveillance ensures proper engine generator load response under the simulated test conditions.

This test simulates the loss of the total connected load that the DG experiences following a full load rejection and verifies that the DG will not trip upon loss of the load.

These acceptance criteria provide DG damage protection. While the DG is not expected to experience this transient during an event and (continued)

. - =

SAN ON0FRE--UNIT 3 B 3.8-19 Amendment m.

-~

' AC Sources-Operating B ' 3.8.1' m

BASES' r

' SURVEILLANCE-

~SR ~3.8.L lQ (continued)L REQUIREMENTS i

continue"s-to be.available, this response ensures that the'DG is not degraded for future application --including reconnection_to_the bus if the trip _ initiator can be corrected _or isolated. - These loads and limits are-

~

consistent with'Regu.latory Guide 1.9 (Ref. 3)'.

In order to ensure that the DG-is tested under load conditions that are a.; close to design basis conditior.s as possible, testing is performed using design basis-kW loading and maximum kVAR loading permitted during testing. These loadings represent

~

the ir.ductive loading that the DG would experience to the-extent practicable and is consistent with the intent of Regulatory Guide 1.9 (Ref. 3).

The-24 month Frequency is consistent with the recommendation of Regulatory Guide 1.9 (Ref. 3) and is-intended to be t

consistent with expected fuel cycle lengths.

e This SR is modified by a Note which acknowledges that credit may be taken for unplanned events that satisfy this SR.

SR 3,8.1.11 As required by Regulatory Guide 1.9 (Ref.-3), this W

Surveillance-demonstrates the as designed operation of the standby power sources during loss of the offsite source.

This test verifies all actions encountered from the loss of offsite power, including shedding of the nonessential loads and energization of the emergency buses and respective loadsL fro.. the DG.

It further demonstrates the capability of the DG to_ automatically achieve the required voltage and-frequency within the specified time.

The DG auto-start time of 10 seconds is derived from requirements of the accident analysis to respond to a design 1

basis-large break LOCA. The frequency should be restored to with.in 2% of nominal following a load sequence step. The Surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability has been achieved.

The-requirement to verify the connection and power supply of permanent loads'is intended to satisfactorily show the i

4 (continued)

. SAN'ONOFRE--UNIT 31 B 3.8-20 Amendment No.

J AC Sources-Operating;

?

B-3.8.1 BASES

~ SURVEILLANCE

,SR 3.8.1.11'~(continued)

REQUIREMENTS relationship of these loads-to the DG loading logic.- In-certain-circumstances, many of these loads cannot actually-be~ connected or loaded without undue hardship or potential for undesired operation.

For instance, Emergency Core Cooling Systems (ECCS).

injection' valves are not desired to be stroked open, high pressure injection ' systems are not capable of. being operated-at-full flow, or. shutdown cooling (SDC) systems performing a

-decay heat removal function are not desired to be realigned to the ECCS mode of operation.

In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the DG system to perform these functions is acceptable.

This-testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The Frequency of 24 months is consistent with the recommendations of Regulatory Guide 1.9 (Ref. 3), takes into consideration unit conditions required to perform the Surveillance, and is interded to be consistent with expected fuel cycle longths.

This SR is. modified by two Notes.

The reason for Note 1 is to minimize wear and tear on the DGs during testing.

For

~

the-purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations.

Note 2 acknowledges that credit may be taken for unplanned events that satisfy this SR.

SR 3.8.1.12 This Surveillance demonstrates that the DG automatically starts and achieves the required voltage and frequency within the specified time (10 seconds) from the design basis

, actuation signal and operates-for t 5 minutes.

The 5 minute

. period provides sufficient time to demonstrate stability.

(continued)

SAN ONOFRE--UNIT 3 8 3.8 21 Amendment No.

P

.,,--r.

y

,e

AC Sources.-Operating B 3.8.1~

_ BASES REFERENCES 5.

UFSAR, Chapter 15._

(continued) 6.

l Regulatory Guide 1.93, Rev. 0._

7.

Generic letter 84-15.

'8.

_10 CFR'50, Appendix A, GDC 18.-

l 9.

-Regulatory Guide 1.108, Rev. l.-

10.

Regulatory Guide 1;137, Rev.1.

11. - -ANSI C84.1-1982.

12.

ASME, Boiler and Pressure Vessel Code,Section XI.

13.

-lEEE Standard 308-1978.

14.

' Draft Regulatory Guide DG-1021, April 1992, 15.

10CFR50.63(a)(3)(ii)aspublishedinFederal Register Vo!. 57, No. 77 page 14517, April 21, 1992.

16n J CE NPSD-9967f"CE0G.:Jointi Applications: ReportY for

- " Emergency Dies 3 Generator,A0T: Extension.] Mayfl995j 1

' SAN ON0FRE--UNIT 3-B 3.8-29

-Amendment No.

Procedures, Programs, and Manuels.-

5.5-T 5.5 Procedures, Programs, and Manuals (continued) 5.5.2.12 Ventilation Filter Testing Program (VFTP)

(continued).

.The provisions of-Technical Specification Surveillance Requirement

= 3.0.2_ and Technical Specification Surveillance Requirement 3.0.3 are applicable to the VFTP test frequencies.

5.5.2.13 Diesel Fuel Oil Testing Program This program implements required testing of'both' new fuel oil and stored fuel oil.. The program shall include sampling and testi.ng-requirements,'and acceptance criteria, all in accordance with applicable ASTM standards.

The purpose of the program is to establish the following:

a.

At lease once per 92 days and from new fue'i oil prior to addition to the stcrage tanks by verifying that a sample obtained in accordance with ASTH-D4057-81 has a water and sediment content of less than or equal to 0.05 volume percent, an API gravity or an absolute specific gravity within limits, and a kinematic viscosity 0-40 C of greater than or equal to 1.9 but less than or equal to 4.1 when tested in accordance with ASTM 0975-81.

b.

At least once every 92 days by obtaining a sample of fuel oil in accordance with ASTM 04057-81 and verifying that particulate contamination 1 less than 10mg/ liter when checked in accordance with ASTM-D2276-83, Method A.

sis (2[l[QConfigjirat.ioni Ri sk MahigementiPropfam Th'e[ Con fi gu ra t i bh7 Ri~s k? Ma n ayemeh tlPfopriiili(CRMP)i p r6v i de STa proceduralized risk-informediassessmentito manageitheirisklassociated withiequipmentsinoperability N Thefprogram appl.iesitostechnical specificationstruci.ures,; systems,iorLcomponentsiforwhichiatrisk?

informed 1 Compl etion LTime l hasi beenigranted GThe prpgr'am -:shalli incl ude

'"~

' ' ~ ~

~

-thelfollowing; elements:

sun.1 a.t ? Provisions for'theYc'6ntrolTand?implementationTofiailevelWat

~ ' power;internalievents1.PRAvinformed methodology? XThelassessment shallibe(capable;of evaluatingithe[ applicable; plant configuration.

by"7Provisionstfor7 performing ; ant assessnientyprioRtoTenteringithellCO Conditiontforpreplannedacttvi_ ties.

~

(continued)

SAN ONCFRE--UNIT 3 5.0-20 Amendment No.

5 r,

_y w

s

4, t

Procedurese Programs ( and Manuals 3

5.5-

?S.5:Procedurts,: Programs,and. Manuals.(conti_nued) cit r ProvisionF for?performingianiassessment':after?enteringithe;I.00.

'"~~~ Condition;foQnplannedientrylinjo thell.00 Conditjon, t

d.%g(discovery >ofsadditionahequipment;outfofcservicejcondyionsj"w~hile?

Provisions forJasse~ssini the:eeed!forladditionan actionFafter'the s' qI,1

'~

indhe1LC01 Conditions '" ~

e".V. O W ovision'sifor7 cons'idering70theC appl i cabl e ' ri sE s i gn i fi cant.

~ "contributorsEsuch-ai levelL2?issuespfand.externalieventsj ""

~

qdalita)1velyf onquant,it_htivelyj

~~ ~'

' ~' " ' ~ ' ~~

. ()

e s'

l (continued).

i

~ j:0NOFREG UNIT.?3-"

SAN n'4 l 5.0-20af.

" ", ~., ' Amen.dme.nt1No s "

%.It.1 1

~

~

.. :, e

- - - _ - _ - _ _ - _ _ _ _ _ - _ _ _ _ - _.