Text

License Amendment Request OL-1228 Revision to Technical Specification Surveillance Requirements 3.8.1 and 3.8.4
	ML031681411
Person / Time
Site:	Callaway
Issue date:	06/06/2003
From:	Shafer D; AmerenUE
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	ULNRC-04837
	Download: ML031681411 (64)
	v • d • e

nommemommomm- - -

Union Electric One Ameren Plaza 1901 Chouteau Avenue PO Box 66149 St. Louis, MO 63166-6149 314.521.M June 6, 2003 U. S. Nuclear Regulatory Commission Attn: Document Control Desk Mail Stop P1-137 Washington, DC 20555-0001 Ladies and Gentlemen: ULNRC-04837 WAmeren DOCKET NO. 50-483 UF UNION ELECTRIC COMPANY CALLAWAY PLANT LICENSE AMENDMENT REQUEST OL-1228 REVISION TO TECHNICAL SPECIFICATION SURVEILLANCE REOUIREMENTS 3.8.1 AND 3.8.4 Union Electric Company (AmerenUE) hereby transmits an application for amendment to Facility Operating License No. NPF-30 for the Callaway Plant. Per this License Amendment Request (LAR) AmerenUE requests revision of Technical Specification (TS) 3.8.1, "AC Sources - Operating," to allow surveillance testing of the onsite standby emergency diesel generators (DGs) during MODES in which it is currently prohibited. In particular, AmerenUE proposes removing the MODE restrictions for Surveillance Requirement SR 3.8.1 .10 (full-load rejection test), SR 3.8.1.13 (protective-trip bypass test), and SR 3.8.1.14 (endurance and margin test) so that these SRs can be performed during plant operation.

AmerenUE also requests incorporation of the changes included in NRC-approved Industry/Technical Specification Task Force (TSTF) Standard Technical Specification (STS) change TSTF-283, Revision 3, which is applicable to SRs for the diesel generators as well as the station batteries under TS 3.8.4, "DC Sources-Operating." These changes would modify the Notes in SR 3.8.1.11 (loss-of-offsite-power test), SR 3.8.1.12 (safety injection actuation signal test), SR 3.8.1.16 (synchronizing test), SR 3.8.1.17 (test mode change-over test), SR 3.8.1.18 (load sequencing test), SR 3.8.1.19 (combined safety injection actuation signal and loss-of-offsite-power test), SR 3.8.4.7 (battery service test), and SR 3.8.4.8 (battery discharge test) to allow performance (or partial performance) of these surveillances during prohibited MODES in order to re-establish OPERABILITY following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns during plant operation.

P (

a subsidiaryofAmeran Corporation

ULNRC-04837 June 6, 2003 Page 2 Essential information is provided in the attachments to this letter. Attachment 1 contains a description of the proposed changes, the supporting technical analyses, and the significant hazards determination. Attachments 2 and 3 contain marked-up and revised TS pages, respectively. Attachment 4 contains proposed changes to the TS Bases (in marked-up form) to assist the staff in its review of the proposed changes.

These Bases changes are provided for information only, and will be implemented pursuant to the TS Bases Control Program, TS 5.5.14, upon approval of this license amendment.

AmerenUE is submitting this LAR in conjunction with an industry consortium of six plants as a result of a mutual agreement known as Strategic Teaming and Resource Sharing (STARS). The STARS group consists of the six plants operated by TXU Generation Company LP, Union Electric Company, Wolf Creek Nuclear Operating Corporation, Pacific Gas and Electric Company, STP Nuclear Operating Company, and Arizona Public Service Company. The other members of the group (except STP Nuclear Operating Company) are expected to submit license amendment requests similar to this one. Pacific Gas and Electric Company's Diablo Canyon plant is the lead plant for this proposed license amendment. Due to design differences between the STARS plants, there may be some differences in the plant LARs, particularly for the information provided in Attachment 1.

As indicated in Attachment 1, the proposed TS changes have been evaluated pursuant to CFR 50.92, and it has been determined that this amendment application does not involve a significant hazard consideration. In addition, evaluation of the proposed changes against the requirements of 10CFR51.22(b) has determined that no environmental impact statement or environmental assessment needs to be prepared in connection with the issuance of a license amendment for the proposed changes.

Finally, it may be noted that this amendment application was reviewed by the Callaway Onsite Review Committee and the Nuclear Safety Review Board for Callaway, and that in accordance with 10 CFR 50.91, a copy of this amendment application is being provided to the designated Missouri State official.

With regard to NRC approval of this LAR, and as previously indicated, the changes proposed in this LAR would permit the rescheduling certain DG surveillances such that they could be done during plant operation instead of only during shutdown conditions. The changes could therefore affect the scheduling of surveillance activities for the next refueling outage (RF-13) for Callaway, which is scheduled for Spring of 2004. On that basis, AmerenUE respectfully requests approval of the proposed changes before the end of this year (2003). It is anticipated that the license amendment, as approved, will be effective upon issuance, to be implemented within 60 days from the date of issuance.

ULNRC-04837 June 6, 2003 Page 3 Please contact us for any questions you may have regarding this application.

Very truly yours, David Shafer Acting Manager, Regulatory Affairs TBE/mlo Attachments: 1. Evaluation of Proposed Amendment to Technical Specification Surveillance Requirements 3.8.1 & 3.8.4

2. Marked-Up Technical Specifications

3. Proposed/Revised Technical Specifications

4. TS Bases Changes (For Information Only)

ULNRC-04837 June 6, 2003 Page 4 cc: U. S. Nuclear Regulatory Commission (Original and 1 copy)

Attn: Document Control Desk Mail Stop P1-137 Washington, DC 20555-0001 Dr. Bruce S. Mallet Regional Administrator U.S. Nuclear Regulatory Commission Region IV 611 Ryan Plaza Drive, Suite 400 Arlington, TX 76011-4005 Senior Resident Inspector Callaway Resident Office U.S. Nuclear Regulatory Commission 8201 NRC Road Steedman, MO 65077 Mr. Jack N. Donohew (2 copies)

Licensing Project Manager, Callaway Plant Office of Nuclear Reactor Regulation U. S. Nuclear Regulatory Commission Mail Stop 7E1 Washington, DC 20555-2738 Manager, Electric Department Missouri Public Service Commission PO Box 360 Jefferson City, MO 65102

STATE OF MISSOURI )

) SS CITY OF ST. LOUIS )

David Shafer, of lawful age, being first duly sworn upon oath says that he is Superintendent Licensing, Regulatory Affairs, for Union Electric Company; that he has read the foregoing document and knows the content thereof, that he has executed the same for and on behalf of said company with full power and authority to do so; and that the facts therein stated are true and correct to the best of his knowledge, information and belief.

By David Shafer Acting Manager, Regulatory Affairs SUBSCRIBED and sworn to before me this 6 day of _________2003.

MELUSSA L. ORR Notary Pubic - Notary S2aI STATE OFSt. SS2 City of Lou:

My Commission Expires: June k.i, tO3

Attachment 1 ULNRC-04837 Page 1 of 26 EVALUATION OUTLINE

Subject:

Revision to Technical Specifications 3.8.1, "AC Sources - Operating," and 3.8.4, "DC Sources - Operating"

1. DESCRIPTION

2. PROPOSED CHANGES

3. BACKGROUND

3.1 DESCRIPTION

OF CLASS E ALTERNATING CURRENT (AC)

POWER SYSTEM 3.2 DIESEL GENERATORS: DESIGN FEATURES, OPERATION AND TESTING 3.3 OVERVIEW OF CLASS E DC POWER SOURCES (STATION BATTERIES)

4. TECHNICAL ANALYSIS 4.1 MODE RESTRICTION ELIMINATION 4.1.1 SR 3.8.1.10 - FULL-LOAD REJECTION TEST 4.1.2 SR 3.8.1.13 - NON-EMERGENCY PROTECTIVE TRIP BYPASS TEST 4.1.3 SR 3.8.1.14 - ENDURANCE AND MARGIN TEST 4.1.4 ADDITIONAL ANALYSES: EFFECTS OF EVENTS OCCURRING WHILE A DG IS PARALLELED TO OFFSITE POWER DURING TESTING 4.2 TSTF-283 REVISION 3 CHANGES

5. REGULATORY ANALYSES 5.1 NO SIGNIFICANT HAZARDS CONSIDERATION 5.2 APPLICABLE REGULATORY REQUIREMENTS

6. ENVIRONMENTAL CONSIDERATION

7. REFERENCES

8. PRECEDENTS

Attachment 1 ULNRC-04837 Page 2 of 26 EVALUATION OF PROPOSED AMENDMENT TO TECHNICAL SPECIFICATION SURVEILLANCE REQUIREMENTS 3.8.1 & 3.8.4

1.0 DESCRIPTION

The Technical Specifications (Appendix A of the Operating License) include Surveillance Requirements (SRs) that require the performance of testing to confirm OPERABILITY of the station emergency/standby diesel generators (DGs) and batteries. Testing, monitoring and inspection per these SRs are required to be performed on a periodic basis, but in some cases such activities may also be performed to verify or re-establish OPERABILITY following repairs or other unanticipated corrective maintenance. Testing per some of the applicable SRs can be performed during any plant MODE. However, many of these SRs contain the provision, in the form of a Note included in each SR, that the surveillance is not to be performed during certain plant MODES. The proposed changes would modify such Mode restrictions by revising the Note associated with each applicable SR to either completely remove the MODE restrictions for the affected surveillance, or conditionally allow the surveillance to be performed (or partially performed) during currently prohibited MODES following corrective maintenance.

Specifically, the MODE 1 and 2 restrictions currently specified for the following DG SRs would be removed: SR 3.8.1.10 (full load rejection test), SR 3.8.1.13 (protective-trip bypass test), and SR 3.8.1.14 (endurance and margin test). The changes would allow these DG surveillances to be performed periodically and/or following planned or unplanned maintenance, during plant operation.

In addition, the proposed changes would modify SR 3.8.1.11 (loss-of-offsite-power test), SR 3.8.1.12 (safety injection actuation signal test), SR 3.8.1.16 (synchronizing test), SR 3.8.1.17 (test mode change-over test), SR 3.8.1.18 (load sequencing test), SR 3.8.1.19 (combined safety injection actuation signal and loss-of-offsite-power test), SR 3.8.4.7 (battery service test), and SR 3.8.4.8 (battery discharge test) to allow performance or partial performance of these surveillances in order to re-establish OPERABILITY following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns during plant operation. These changes are consistent with NRC approved Industry/Technical Specification Task Force (TSTF) Standard Technical Specification (STS) change TSTF-283, Revision 3.

The exact changes to be made to the Technical Specifications are described as follows.

Attachment I ULNRC-04837 Page 3 of 26

2.0 PROPOSED CHANGE

S MODE Restriction Elimination The following changes are proposed in order to eliminate the MODE 1 and 2 surveillance testing restrictions for SRs 3.8.1.10, 3.8.1.13 and 3.8.1.14, as noted above. The changes would be effected by deleting the applicable Note for each surveillance, as foliows:

SR 3.8.1.10 currently contains the following Note:

"This Surveillance shall not be performed in MODE 1 or 2."

For the proposed change to this SR, this Note would be completely removed.

SR 3.8.1.13 currently contains the following Note:

"This Surveillance shall not be performed in MODE 1 or 2."

For the proposed change to this SR, this Note would be completely removed.

SR 3.8.1.14 currently contains Note 2 which states the following:

"This Surveillance shall not be performed in MODE 1 or 2."

For the proposed change to this SR, this Note would be completely removed (so that current Note 3 would become Note 2).

The above changes, if approved, will allow the testing required by these SRs to be performed during all MODES of operation such that the testing will no longer be required to be performed only during plant outages. This will help to reduce the complexity of coordinating work and testing activities during refueling outages and could potentially reduce outage critical path time.

In addition, this change will potentially avoid a plant shutdown if maintenance (planned or unplanned) performed during power operation results in the need to perform any of the above surveillances to demonstrate OPERABILITY. The change will also maximize flexibility in responding to an event during shutdown when other engineered safety feature (ESF) equipment may be out of service.

TSTF-283 Revision 3 Changes The following proposed changes modify the existing TS to allow more flexibility for DG and battery testing, when required to reestablish OPERABILITY following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns during plant operation, in accordance with TSTF-283, Revision 3.

The changes would be effected by revising the applicable Note associated with each affected surveillance.

Attachment 1 ULNRC-04837 Page 4 of 26

SR 3.8.1.11 currently contains Note 2 which states:

"This Surveillance shall not be performed in MODE 1 or 2."

For the proposed change to this SR, this Note would be replaced with the following Note 2:

"This Surveillance shall not normally be performed in MODE 1 or 2. However, portions of the Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced."

SR 3.8.1.12 currently contains Note 2 which states:

"This Surveillance shall not be performed in MODE 1 or 2."

For the proposed change to this SR, this Note would be replaced with the following Note 2:

"This Surveillance shall not normally be performed in MODE 1 or 2. However, portions of the Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced."

SR 3.8.1.16 currently contains the following Note:

"This Surveillance shall not be performed in MODE 1, 2, 3, or 4."

For the proposed change to this SR, this Note would be replaced with the following Note:

"This Surveillance shall not normally be performed in MODE 1, 2, 3 or 4. However, this Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced."

SR 3.8.1.17 currently contains the following Note:

"This Surveillance shall not be performed in MODE 1 or 2."

For the proposed change to this SR, this Note would be replaced with the following Note:

"This Surveillance shall not normally be performed in MODE 1 or 2. However, portions of the Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced."

SR 3.8.1.18 currently contains the following Note:

"This Surveillance shall not be performed in MODE 1 or 2."

Attachment 1 ULNRC-04837 Page 5 of 26 For the proposed change to this SR, this Note would be replaced with the following Note:

"This Surveillance shall not normally be performed in MODE 1 or 2. However, this Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced."

SR 3.8.1.19 currently contains Note 2 which states:

"This Surveillance shall not be performed in MODE 1 or 2."

For the proposed change to this SR, this Note would be replaced with the following Note 2:

"This Surveillance shall not normally be performed in MODE 1 or 2. However, portions of the Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced."

SR 3.8.4.7 currently contains Note 2 which states:

"This Surveillance shall not be performed in MODE 1, 2, 3, or 4."

For the proposed change to this SR, this Note would be replaced with the following Note 2:

"This Surveillance shall not normally be performed in MODE 1,2, 3, or 4. However, portions of the Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced."

SR 3.8.4.8 currently contains a Note which states:

"This Surveillance shall not be performed in MODE 1, 2, 3, or 4."

For the proposed change to this SR, this Note would be replaced with the following Note:

"This Surveillance shall not normally be performed in MODE 1, 2, 3, or 4. However, portions of the Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced."

Incorporating TSTF-283 for the affected SRs will give the flexibility to perform (or partially perform) these Surveillances online for the purpose of reestablishing OPERABILITY without having to shut down the plant. This can eliminate any transients potentially involved with a plant shutdown.

The marked-up and revised TS pages reflecting the above changes are provided in Attachments 2 and 3, respectively. In addition, the associated TS Bases will be revised to reflect the changes to these TS. A marked-up copy of the proposed TS Bases changes is provided in Attachment 4 for information only. The TS Bases changes will be implemented in accordance with TS 5.5.14,

Attachment 1 ULNRC-04837 Page 6 of 26 "Technical Specifications (TS) Bases Control Program," as part of the implementation of this amendment after NRC approval.

3.0 BACKGROUND

3.1 Description of Class E Alternating Current (AC) Power System The onsite power system for Callaway is provided with preferred power from the offsite system through two independent and redundant sources of power in accordance with 10 CFR 50, Appendix A, General Design Criterion (GDC) 17. With respect to the safety-related (Class E) power supply configuration, one preferred circuit from the switchyard supplies power to a multi-winding startup transformer, one winding of which feeds a 13.8/4.16-kV ESF transformer (equipped with an automatic load tap changer (LTC) and its associated capacitor bank). The second preferred (offsite) circuit supplies power from the switchyard via a safeguards transformer to the second 13.8/4.16-kV ESF transformer (also equipped with an automatic load tap changer (LTC) and its associated capacitor bank).* Each ESF transformer supplies power to an associated Class E 4.16-kV bus. For each safety-related bus normally fed by its associated ESF transformer, the capability exists for either bus to be ultimately supplied via the other preferred source connection.

The onsite power system is generally divided into two load groups. Each load group consists of an arrangement of buses, transformers, switching equipment, and loads fed from a common power supply. Power is supplied to loads at 13.8 kV, 4.16 kV, 480 V, 480/277 V, 208/120 V, 120 VAC, 250 VDC, and 125 VDC. The class E AC system loads are accordingly separated into two load groups which, as noted above, are powered from separate ESF transformers.

Each load group has power distributed by a 4.16-kV bus (NBO1 or NB02), 480-V load centers, and 480-V motor control centers. Each load group is independently capable of safely bringing the plant to a cold shutdown condition, as the Class E electrical power distribution system is designed to satisfy the single-failure criterion.

The onsite standby power system includes Class E AC and DC power supply capability for equipment used to achieve and maintain a cold shutdown of the plant and to mitigate the consequences of a design basis accident (DBA). With respect to Class E AC power, each of the two Class E load groups, at the 4.16-kV bus level, is capable of being powered from an independent diesel generator (one per load group) which functions to provide power in the event of a loss of the preferred power source. Undervoltage relays are provided for each 4.16-kV bus The switchyard, it should be noted, is supplied by two transmission line rights-of-way which approach the plant from different locations, pursuant to GDC 17.

The startup and ESF "A" transformers are each sized to carry both load groups if required. Flexibility in connection capability is provided such that each Class E 4.16-kV bus can be supplied via the other's normal offsite source connection. This requires manual action, however, since there is no automatic connection between redundant load groups, i.e. between the Class E 4.16-kV buses.

Attachment 1 ULNRC-04837 Page 7 of 26 to detect an undervoltage condition and automatically start the diesel generator in response to such a condition.*

The Class E DC system includes four separate 125-VDC battery supplies for Class E controls, instrumentation, power, and control inverters. This system is discussed further in Section 3.3 of this attachment.

A simplified one-line diagram of the electrical power distribution system described above is provided on Figure 1 on the next page (i.e., page 8). As can be seen from the figure, and as described above, each of the two 4.16-kV Class 1E buses is normally supplied by its preferred (offsite) power source (via its respective ESF transformer) and is capable of being exclusively supplied by its associated diesel generator (as there is no automatic connection between the redundant load groups.)

In the event of a loss-of-coolant accident (LOCA) and/or loss of offsite power (LOOP), the starting (or shedding and restarting) of Class E electrical loads is controlled by the load shedder emergency load sequencers (LSELS) (one for each 4.16 kV bus). In the event of a LOCA with preferred (offsite) power available to the 4.16-kV Class E bus(es), Class E loads are started in programmed time increments by the load sequencer(s). The associated DG(s) will be automatically started but not connected to the bus. However, in the event that preferred (offsite) power is lost, the load sequencer will function to shed selected loads and automatically start the associated standby diesel generator (via the DG control circuitry). The load sequencer(s) will function to start the required Class E loads in programmed time increments.

Diesel Generators: Design Features Operation and Testing As noted above, the onsite standby electrical power source for each of the two Class E AC (4.16-kV) buses at Callaway is a dedicated DG. The DGs are automatically started on the following:

Receipt of a safety injection signal (SIS) (indicative of a LOCA)

Loss of voltage to the respective 4.16-kV bus.

Manual initiation capability is also provided, both locally (at the DG local control panel in each diesel generator room) and from the main control room.

Automatic protection for the following conditions is provided for each DG:

Start failure

Engine overspeed

High jacket coolant temperature

Low lube oil pressure Operability requirements for the undervoltage relays are specified in TS 3.3.5, "Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation." Loss-of-voltage and degraded-voltage protection functions are provided for each bus.

Attachment 1 ULNRC-04837 Page 8 of 26 TO BLAND TO MONTGOMERY

(~~~~~~

Figure 1

Attachment 1 ULNRC-04837 Page 9 of 26

High crankcase pressure

Generator differential These protective functions (to shut down the diesel or trip the DG breaker) are retained during receipt of an SIS.

In addition to the above, DG protection is also provided for the following conditions:

Reverse power

Loss of field

Generator over-excitation (Volts/Hertz)

Generator overcurrent

Generator voltage-restrained overcurrent

Generator ground overcurrent

. Underfrequency These protection functions are only in effect during tests when the diesel generator is operating in parallel with the preferred power system. However, they are automatically bypassed upon receipt of an SIS. This is based on the design consideration that DG availability to mitigate a DBA is more critical than protecting the engine against minor problems that are not immediately detrimental to emergency operation of the DG.

The following interlocks and/or permissives are relevant to DG operation:

Circuit breaker electrical interlocks are provided to prevent automatic closing of a DG breaker to an energized or faulted bus.

If preferred (offsite) power is lost, undervoltage relays on the incoming (offsite) side of the 4.16-kV feeder breakers prevent closure of these breakers.

The two 4.16-kV circuit breakers that control the incoming preferred source power to a 4.16-kV Class E bus are so interlocked that only one breaker can be closed at one time, thus preventing parallel operation of the preferred sources.

When operating from the DG supply (after a loss of offsite power), redundant load groups cannot be manually connected together since the 4.16-kV circuit breakers controlling the incoming preferred power supplies to the Class E buses are interlocked to prevent paralleling of the DGs.

During normal operation (with offsite power available), synchronizing check relays prevent an operator error that would parallel the standby source (DG) with the offsite source when the two sources are not synchronized.

A single, annunciated key-operated switch in the DG room is provided for each DG to block automatic start signals when the DG is out for maintenance.

A local handswitch is provided to allow a modified diesel engine start in which the speed of the diesel engine is limited in order to reduce stress and wear on the engine. An emergency start signal (SIS, loss of voltage, or emergency manual start) overrides the local modified start handswitch.

Attachment 1 ULNRC-04837 Page 10 of 26 During periodic DG tests, subsequent to DG start and synchronization to the preferred system, a switch in the control room allows parallel operation with the preferred system (offsite source) and actuates an interlocking freeze signal to the associated capacitor bank.

This freeze signal causes the capacitor bank to stop automatic operation and to hold in its present state during DG testing, thus preventing system interactions. The freeze signal is removed automatically when DG parallel operation is terminated.

As noted previously, each DG starts automatically in response to an SIS (i.e., low pressurizer pressure, steam line pressure, high containment pressure signal, or manual) or an ESF bus undervoltage signal. After the DG has started, it will automatically tie to its respective bus after offsite power is tripped as a consequence of ESF bus undervoltage or degraded voltage, independent of or coincident with an SIS. The DGs will also start and operate in the standby (ready-to-load) mode without tying to the ESF bus on an SIS alone. Following the trip of offsite power, the LSELS strips nonpermanent loads from the ESF bus. When the DG is tied to the ESF bus, loads are then sequentially connected to its respective ESF bus by the LSELS. The sequencing logic controls the permissive and starting signals to motor breakers to prevent overloading the DG by automatic load application. At the same time, the LSELS assures that ESF electrical loads are automatically connected to the DGs in sufficient time to provide for safe reactor shutdown and to mitigate the consequences of a design basis accident such as a LOCA.

OPERABILITY requirements for the onsite and offsite AC sources during plant operation, i.e.,

for MODES 1, 2, 3 and 4, are specified in TS 3.8.1, "AC Sources - Operating." TS 3.8.1 includes SRs for monitoring of the offsite sources and testing of the DGs. Some of the DG SRs involve tests in which the DG is paralleled to the offsite source (i.e., connected to its associated bus while that bus is being supplied by its preferred/offsite source). The length of time that the DG is paralleled to the offsite circuit can be on the order of minutes, depending on what test is being performed, up to a minimum time of 24 continuous hours such as required for the endurance and margin test per SR 3.8.1.14. SR 3.8.1.3, for example, requires synchronizing the DG to the bus while the bus is being supplied with offsite power and running the machine loaded to a minimum required load for at least 60 minutes.

Testing per SR 3.8.1.3 can and is allowed to be performed during any plant MODE as it is required to be done monthly, including during plant operation. The other SRs that involve paralleling the DG to offsite power, however, have MODE restrictions such that they are not permitted to be performed during plant operation. These include SR 3.8.1.10 and SR 3.8.1.14, for which AmerenUE is proposing to eliminate the currently specified MODE restrictions. The basis for the MODE restrictions is given in the TS Bases for these SRs. The concern expressed for each of these surveillances is that "during operation with the reactor critical, performance of this Surveillance could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, unit safety systems." In the Technical Analysis section of this attachment (i.e., Section 4.0), this and other concerns are more closely examined. The qualitative analysis provided therein explains that such perturbations are highly unlikely and that the associated risk (as evaluated qualitatively) is quite low. It includes consideration of how the DG and electrical system may respond to a LOOP or

Attachment 1 ULNRC-04837 Page 11 of 26 fault condition while the DG is connected to its associated bus and thereby paralleled to the offsite circuit.

The SRs to be changed per TSTF-283 involve surveillance tests of a more complex or intrusive nature (compared to the above SRs) for which only a conditional relaxation of the MODE restrictions is requested. Due to the nature of these surveillances, they would continue to be normally performed only during shutdown conditions. However, it is possible to perform (or partially perform) these SRs under certain circumstances or conditions during plant operation, and their performance could be needed to verify DG OPERABILITY following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, or other unanticipated OPERABILITY concerns during plant operation. Under such circumstances, and as explained further in Section 4.2, it may be preferable and justifiable to perform the required testing during plant operation in lieu of shutting down the plant in order to perform the testing in an unrestricted MODE.

3.2 Overview of Class IE DC Power Sources (Station Batteries)

The Class E DC electrical power system provides the AC emergency power system with control power. It also provides both motive and control power to selected safety-related equipment and preferred AC vital bus power (via inverters). As required by 10 CFR 50, Appendix A, GDC 17, the DC electrical power system is designed to have sufficient independence, redundancy, and testability to perform its safety functions, assuming a single failure.

Consistent with the dual, redundant load group configuration described previously for safety-related equipment and the AC electrical power system, the 125 VDC electrical power system consists of two independent and redundant Class E 125 VDC electrical power subsystems (Train A and Train B). Each DC electrical subsystem consists of two 125 VDC batteries, two battery chargers, one swing battery charger and all the associated control equipment and interconnecting cabling. (While the DC buses within each subsystem share a swing battery charger, there is no sharing between redundant Class E subsystems, including batteries, battery chargers, and distribution panels.) This configuration is also depicted on the one-line diagram of Figure 1 (page 7).

The Train A and Train B DC electrical power subsystems provide control power for the associated Class E AC power load groups, including the 4.16-kV switchgear and the 480-V load centers. The DC electrical power subsystems also provide DC electrical power to the inverters (two per subsystem, one associated with each battery/charger combination), which in turn power the AC vital buses (one associated with each inverter).

During normal operation, the 125-VDC load is powered from the battery chargers with the batteries "floating" on the system. In case of a loss of normal power to the battery chargers, the DC load is automatically powered by the station batteries.

Attachment 1 ULNRC-04837 Page 12 of 26 OPERABILITY requirements for the DC sources during plant operation (i.e., MODES 1, 2, 3 and 4) are specified in TS 3.8.4, "DC Sources - Operating." TS 3.8.4 includes SRs for verifying battery performance and OPERABILITY. In particular, a battery service test per SR 3.8.4.7 and a battery performance discharge test per SR 3.8.4.8 are required to be periodically performed at a frequency of at least once per 18 months. The test interval of 18 months is based on a typical fuel cycle, as these tests are only allowed to be performed during plant shutdown conditions and are thus typically performed during each refueling outage. This is enforced by the Note attached to each of these SRs which states that the surveillance shall not be performed in MODE 1, 2, 3, or 4.

As stated in the Bases for these SRs, "The reason for the Note is that performing the Surveillance would perturb the electrical distribution system and challenge safety systems." As explained further in Section 4.2, it may be possible under certain circumstances to perform at least a portion of these tests during prohibited MODES if, for instance, a need to perform corrective maintenance on the batteries arose such that testing to confirm OPERABILITY would be required. Performance of a partial test per either of these SRs during plant operation might be possible, for example, with the battery temporarily isolated from the system, though battery inoperability would require entry into the Required Action under TS 3.8.4 (which has a Completion Time of only two hours). Nevertheless, this could be judged to be preferable to, and have less impact than, shutting down the plant in order to perform such testing during an unrestricted MODE per the current Note.

4.0 TECHNICAL ANALYSES 4.1 MODE Restriction Elimination Per the current Technical Specifications, and as noted previously, the surveillance tests required per SRs 3.8.1.10 (full-load rejection test), 3.8.1.13 (protective-trip bypass test), and 3.8.1.14 (endurance and margin test) must be performed while the plant is in a shutdown condition, i.e.

MODE 5 or 6, as enforced through the associated Notes that are to be revised per this LAR.

With the plant in MODE 5 or 6, the Technical Specifications (TS 3.8.2) only require one of the two DGs to be OPERABLE. Therefore, per the current testing process, the DG being tested is typically not the DG that is being maintained or credited as the OPERABLE DG for satisfying TS 3.8.2.

The proposed changes, however (if approved), would allow DG testing to be done during MODE 1, 2, 3 or 4 - when both DGs are required to be OPERABLE per TS 3.8.1 - so that the DG under test would also be required to be OPERABLE. Any condition associated with the testing that would not make the DG OPERABLE would therefore require declaring the DG inoperable and entering Required Actions for the inoperable DG. Performance of the testing required per SR 3.8.1.13, for example, would require entering the Required Action under TS 3.8.1 because, as further discussed below, it requires isolating the DG breaker and portions of the control logic for a short period of time.

Attachment 1 ULNRC-04837 Page 13 of 26 For SRs 3.8.1.10 and 3.8.1.14, however, no such entry would be required. In light of the electrical system design at Callaway, paralleling a DG with the offsite source for testing does not make the DG inoperable. This is due, in part, to the fact that an SIS will "override" the test mode to automatically return the DG to a standby/ready-to-load condition. This capability is a design feature of the DGs and the electrical power system, and parallel operation therefore does not adversely affect the capability of the DG to respond to an SIS. While it could be surmised that there is increased risk associated with the longer periods of time that a DG is paralleled to the offsite source for testing, such operation does not require the DG or bus loads to be considered inoperable. Therefore, it is not expected that performance of the tests required per SRs 3.8.1.10 and 3.8.1.14 would require entry into any Condition or Required Action under the TS/LCO 3.8.1 (unless an unsatisfactory test result were obtained), just as no such entry is currently required when performing SR 3.8.1.3 during plant operation.

Notwithstanding the above, the current TS Bases for SR 3.8.1.10 and SR 3.8.1.14 state that the reason for not permitting these surveillances to be performed in MODES 1 and 2 is to prevent unnecessary perturbations to the electrical distribution systems which could challenge steady state operation and thus plant safety systems. The current TS Bases for SR 3.8.1.13 state that the reason for not permitting this surveillance to be performed in MODES 1 and 2 is that performance of the SR would remove a required DG from service during those Modes. With regard to these concerns, testing experience has shown that the potential for any significant perturbation to bus voltage or plant loads is quite low, and that with regard to SR 3.8.1.13, DG unavailability is acceptably small. Further evaluation is provided for each SR (i.e., for SR 3.8.1.10, SR 3.8.1.13 and SR 3.8.1.14), as follows.

4.1.1 SR 3.8.1.10 - Full-Load Rejection Test The historical approach for performing the full-load rejection test per SR 3.8.1.10 has been to parallel the DG under test with the offsite power source (while the offsite source is supplying the bus), load the DG to the required load, and then open the DG output breaker, while the plant is in MODE 5 or 6. Opening of the DG output breaker separates the DG from its associated emergency bus and allows the offsite circuit to continue to supply that bus.

As previously noted above, the concern associated with performing the full-load rejection test in MODE 1, 2, 3, or 4 is that disconnecting the DG while it supplying power to the vital buses could cause undesirable electrical perturbations on the bus and thus to plant loads. In addition, the DG being tested is susceptible to grid disturbances while it is paralleled to the offsite source, and it is potentially more susceptible to tripping due to the extra protection trip relays that are cut in during the test.

Grid Disturbances The potential for occurrence of a compounding grid disturbance during the time that a DG is under test per this SR is remote. The occurrence of a grid disturbance is independent of testing performed pursuant to this SR, and since the DG is only paralleled with the offsite source for a limited period of time before tripping the DG breaker, the probability of a grid disturbance

Attachment 1 ULNRC-04837 Page 14 of 26 occurring while a DG is paralleled to the offsite system is small. This conclusion is supported by the fact that normal practices of risk management ensure that SRs of this type are not scheduled during periods in which the potential for grid or bus disturbances exists (such as during severe weather or maintenance activities in the switchyard). Further, it may be noted that the amount of time the DG is required to be paralleled to the offsite source for performance of this surveillance by itself is less than the time it is paralleled when performing the monthly test required per SR 3.8.1.3 (done in conjunction with SR 3.8.1.2 or SR 3.8.1.7) for which there is no MODE restriction.

In the event of a grid disturbance occurring while the DG is paralleled to offsite power, protective relaying and instrumentation exists to mitigate the effects of such disturbances. For example, the protective DG trips/relaying mentioned previously would be available to protect the DG while it is connected to the grid, if protective relaying associated with the offsite system or station transformers did not already effect a separation from the offsite system in response to the disturbance. (The latter is not required by the TS but it is maintained to protect plant assets and preclude costly effects and repairs.) With regard to plant loads connected to the associated safety bus and a grid disturbance involving a sustained low grid-voltage condition, the protection instrumentation required by TS 3.3.5, "Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation," would be available to respond to such a condition for protection of the plant loads.

Electrical Perturbations As noted above, opening of the DG breaker during the performance of this surveillance separates the DG from the associated safety bus and allows the offsite circuit to continue supplying the bus. This evolution has little impact on plant loads. The power system loading during the testing is already well within the rating of all transformers, switchgear, and breakers before and after the load rejection. Further, experience with this test has shown that the voltage "perturbation" seen on the bus during and just after the load rejection is not significant, i.e.

within 5 percent step change. Data recorded from past performances of this test show that bus voltage during the "transient" remains well above the minimum required voltage for bus loads and typically recovers within one second. Therefore, performing load reject tests in accordance with SR 3.8.1.10 during plant operation would not be expected to cause any a significant voltage perturbation that could adversely affect the plant electrical system or plant loads.

4.1.2 SR 3.8.1.13 - Non-Emergengy Protective Trip Bypass Test SR 3.8.1.13 requires verification that the non-emergency automatic protective trip functions (as described previously in Section 3.2) for each DG are bypassed on a loss-of-voltage signal concurrent with a safety injection signal.

This test is currently performed apart from testing of the DG itself because it does not require paralleling or even running the DG. It is performed under a separate procedure dedicated to testing of the DG output breaker tripping and control circuitry, which includes testing to demonstrate bypassing of the non-emergency automatic trips. Although the proposed change

Attachment 1 ULNRC-04837 Page 15 of 26 would allow this test to be done during MODE 1 or 2 (from which it is currently prohibited), it is anticipated that the test would not be done much differently than the way it is currently performed during allowed MODES (typically during MODE 5 or 6).

The test procedure requires opening and racking out the output breaker of the associated DG, and involves simulating conditions such that the use of jumpers and blocking devices is required.

The affected DG is therefore considered to be unavailable during performance of the test.

As identified previously, the TS Bases for SR 3.8.1.13 note that the surveillance is currently prohibited from being performed during MODES 1 and 2 because its performance requires removing a required DG from service. This concern may be put into perspective, however, when the actual amount of time that a DG is rendered unavailable for the performance of this surveillance is considered. A review of the surveillance history for this test shows that the average time to complete the test is less than 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months . This is significantly less than the allowed out-of-service time (72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ) currently specified in the TS for an inoperable DG. An average unavailability time of 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months per DG per operating cycle, attributed to this test, is considered to be quite small relative to the total time the DGs are available throughout the operating cycle.

Also, it should be remembered that availability of the other DG is maintained during such testing since risk-management practices require the redundant, unaffected train (associated with the DG not under test) to be maintained in a protected status during such activities.

Based on the above, the concern currently identified in the TS Bases for SR 3.8.1.13 is not significant such that performance of the SR should be restricted to shutdown conditions.

4.1.3 SR 3.8.1.14 - Endurance and Margin Test Performance of the endurance and margin test per SR 3.8.1.14 requires synchronizing, paralleling and loading the DG with the offsite source (via the associated 4.16 kV safety bus) and then running it continuously while loaded to its full-load capability for not less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . (Per the Callaway TS, during the 24-hour run the machine must be loaded and run at 110% of its continuous duty rating for at least 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months if it has been determined that the auto-connected design loads have increased above the continuous duty rating of the machine.) As for the previously discussed SRs, the proposed change would allow this surveillance test to be performed during plant operation when both DGs are required to be OPERABLE, as opposed to being performed only during shutdown conditions when only one DG is required to be OPERABLE.

Similar to the concem expressed in the TS Bases for the full-load rejection test of SR 3.8.1.10 (as previously discussed in Section 4.1.1), the concem associated with performing the 24-hour endurance test in MODE 1, 2, 3, or 4 is that while a DG is paralleled to the offsite source, the DG is not independent of disturbances on the offsite power system, and the associated safety bus and train of equipment is not independent of any potential interaction between the DG and the offsite system. Further, the DG is potentially more susceptible to tripping due to the extra protection trip relays that are cut in during such testing.

Attachment 1 ULNRC-04837 Page 16 of 26 These concerns are addressed in the following evaluation which shows, through qualitative arguments, that the risk associated with paralleling a DG to offsite power for surveillance testing during plant operation is acceptably small.

Grid Disturbances The amount of time that a DG is paralleled to offsite power for performance of the 24-hour endurance test is considerably longer than the time a DG is required to be paralleled for the performance of other SRs (such as SR 3.8.1.3 and SR 3.8.1.10), when each test is separately considered. Nevertheless, the additional time is only on the order of hours such that the total time is still small compared to the thousands of hours (per year) that the DG(s) is required to be OPERABLE. The potential for occurrence of a compounding grid disturbance during the time that a DG is under test per this SR may therefore still be considered remote. Further, since there is certainly less than a 100% probability that a grid disturbance will lead to DG unavailability, the probability of a DG being rendered unavailable as a result of a grid disturbance during testing is even more remote.

As already noted, the normal practices of risk management exercised at Callaway ensure that SRs of this type are not scheduled during periods in which the potential for grid or bus disturbances exists (such as during severe weather or maintenance activities in the switchyard).

These practices also require only one DG to be tested at a time based on the established practice of "protecting" the other train when a component (or components) of one train is being tested or declared inoperable. This provides for sufficient independence of the onsite source for the other train from offsite power while still enabling testing to demonstrate DG OPERABILITY for the affected train.

As also noted previously, in the event of a grid disturbance occurring while the DG is paralleled to offsite power, protective relaying and instrumentation (including the aforementioned LOP instrumentation) exists to respond to certain types of disturbances. Further, if a DG protective trip were to occur in response to a disturbance in the offsite power system, operator action can be taken to manually reset the lockout relay of the DG under test (assuming that the condition which caused the trip was promptly cleared or isolated) so that the DG can be restarted and loads properly sequenced, if required.

Electrical Perturbations After the DG is synchronized and loaded, the test performed per SR 3.8.1.14 is essentially a continuous run involving little or no dynamic effects. Bus voltage and power factor, including the effects of any changes in offsite power (such as the typical change in grid load that occurs in the course of a day) are monitored closely during the test because SR 3.8.1.14 requires the power factor to be maintained within a certain range. Electrical perturbations are thus minimized to the extent that they are monitored and can be controlied.

The potential effects of a grid disturbance that could cause an electrical perturbation have already been discussed in part. The following section discusses the potential effects of events

Attachment 1 ULNRC-04837 Page 17 of 26 such as a loss of offsite power or a LOCA (or a combination of the two) occurring while a DG is under test.

4.1.4 Additional Analyses: Effects of Events Occurring While a DG is Paralleled to Offsite Power During Testing The following are separate analyses of events that may be postulated to occur concurrent with DG testing. Specifically, a LOOP, LOCA and a combination of a LOOP and LOCA are each postulated to occur while a DG is under test, i.e., while it is running and connected to its associated bus and thereby paralleled to offsite power. Such scenarios are unlikely as they involve the simultaneous occurrence of several conditions or events. Nevertheless, evaluations of these scenarios are provided based on NRC requests for additional information that have been previously received by other licensees requesting the same or similar changes to the Technical Specifications.

The discussion that follows is applicable to SR 3.8.1 .10 and SR 3.8.1.14, though the latter may be most applicable since it involves the longest period of time that a DG is paralleled to offsite power.

Loss of Offsite Power (LOOP)

In the event of a LOOP occurring while a DG is running and paralleled to offsite power for testing (via the associated safety bus), the DG would continue supplying power to the loads on the safety bus as well as to the offsite system if no separation of the offsite source occurred. (In this scenario, the bus undervoltage relays might not immediately trip if bus voltage is being adequately supported by the DG. On the other hand, relays in the switchyard or associated with the site transformers could trip to separate the offsite system. The latter, however, are not safety-related and therefore not credited in any accident/event analyses.) At some point, however, because loading would exceed the DG's capability, the DG would be unable to match load and either the bus undervoltage relays would trip (after timing out) or the DG overcurrent or underfrequency relays would trip. The former would cause the feeder breakers in the offsite source connection to trip (but not the DG output breaker); whereas the latter would cause the DG output breaker to trip open.*

In lieu of a complete LOOP (a rare or unlikely event), a more likely scenario would be a degraded grid/grid loading condition while the plant is operating. In such a scenario, it is possible or likely that the plant's main generator would support system voltage in the vicinity of the plant/switchyard so that the plant buses or DG under test would not see the conditions (voltage) that would otherwise exist if the plant were offline or tripped. The worst-case impact to the plant buses or DG (including a change in the power demand on the DG) would therefore not be seen until after the plant tripped in response to the grid condition (if a trip were to occur). However, degraded voltage protection would still be effective for protecting plant loads if bus voltage were degraded after the plant trip, and protective relaying would also still be be effective for protecting the DG. Also, and notwithstanding the protective trip capability, such a grid condition would be identified via the contingency analysis computer at Ameren's Energy Supply Operations center, which is in continuous use to monitor such conditions and to evaluate offsite source OPERABILrIY on an ongoing basis, based on previous experience with this kind of condition. With respect to this scenario, therefore, there is no significant concern or impact with having a diesel generator paralleled to offsite power for testing during plant operation.

Attachment 1 ULNRC-04837 Page 18 of 26 If the bus undervoltage relays i.e., the (LOP instrumentation required by TS 3.3.5) tripped in response to an undervoltage condition (after the relays timed out), the feeder breakers would trip to separate the offsite source. At the same time, the LOP signal would initiate the LSELS which in tum would cause all but the permanently connected bus loads to be shed. Sequenced loads would then be loaded onto the bus via the blackout sequencer. Since the DG would already be running and connected, the DG start signal from the LOP instruments would have no effect in that regard. From this point on, the plant would respond as it would in response to a LOOP condition.

If the overcurrent or underfrequency relays tripped (i.e., before the degraded voltage relays tripped), the DG output breaker would trip open. Immediately after the overcurrent or underfrequency relays opened the DG output breaker, the resultant dead-bus condition would cause the LOP instrumentation to trip which would then trip the feeder breakers open to fully isolate the offsite system from the bus. The DG output breaker would then re-close, re-energizing the bus. From this point on, the plant would respond as it would in response to a LOOP condition.

For the discussed scenario, the overcurrent or underfrequency trips are the features intended to open the DG output breaker without lockout. There are, however, several non-essential DG trip functions (listed in Section 3.2) enabled when the DG is in the test mode, i.e., paralleled with the offsite source, which are bypassed when the DG is in the emergency mode. In the event that one of these functions is caused to trip, the DG output breaker will open and lock out.

Depending on the type of trip, the DG may also trip and lock out. If one of these DG protective trips were to occur in response to a disturbance in the offsite power system, operator action can be taken to manually reset the lockout relay of the DG under test (assuming that the condition which caused the trip was promptly cleared or isolated) so that the DG can be restarted and loads properly sequenced.

For the above, the worst-case effect of having a DG under test when a LOOP occurs is potentially delaying the plant response to the LOOP (by several minutes), as operator action may be required to reset the DG lockout relay. In general, however, the time response to a LOOP is not critical, as there is no concurrent accident condition and the affected bus can be restored wel in time to effect safe shutdown. (The response to a LOOP-LOCA condition is evaluated separately below.) It should be remembered that the other train would not be affected by the DG under test so that its response to a LOOP would be unaffected.

Loss of Coolant Accident (LOCA)

For a LOCA (SIS) while a DG is under test (paralleled to offsite power via the associated safety bus), the DG response is as designed. That is, the SIS "overrides" the test mode as follows: The LOCA signal will cause the DG start circuitry to reset and trip the DG output breaker. LSELS will initiate the LOCA sequence for required bus loads as the bus continues to be powered from the offsite source. The DG will shift to the emergency mode and remain in a standby ready-to-load condition. This sequence is in accordance with the design basis, and therefore, for this scenario there is no impact to the analyzed plant response to the LOCA.

Attachment 1 ULNRC-04837 Page 19 of 26 It may be noted that this test mode override capability is periodically verified by test pursuant to TS SR 3.8.1.17. Also, it should be noted that there is no impact to the other bus/DG/load group since only the DG under test is affected.

LOOP with LOCA In the accident analyses of the FSAR, a LOCA is postulated to occur concurrently with a LOOP for the purposes of providing a bounding analysis that challenges required safety features.

Consideration of a LOOP occurring with a LOCA while a DG is under test involves a highly improbable combination of events or conditions. Notwithstanding, given such an unlikely scenario, the response of a DG to a LOOP and LOCA while the DG is being tested is dependent on which (LOOP or LOCA) occurs first (or whether the two events occur simultaneously), as described further below.

If a DG were under test, and a LOCA occurred such that it occurred simultaneously with - or immediately before - a LOOP, the foliowing would occur. For the simultaneous occurrence, the DG output breaker would immediately open while the DG would continue to run from the test (with its governor and voltage regulatory reset). Non-essential loads would be shed from the bus via LSELS. (Meanwhile, in response to the LOOP condition, the bus feeder breakers would open to isolate the offsite power system from the bus.) After a short time delay, the DG output breaker would re-close onto the de-energized bus, and LSELS would sequence required loads onto the bus via the LOCA sequencer which, by design, takes precedence over the blackout sequencer.

For the case when the LOOP occurs just after a LOCA, the LOCA sequencer would still control bus loading. Initially, however, with offsite power available, the LOCA signal would open the DG output breaker while (like the above case) the DG would continue to run (with its governor and voltage regulator reset). LSELS would begin to shed and sequence loads onto the bus. If a LOOP then occurred, the bus feeder breakers would open (to separate the offsite power system) and the LOCA sequencer would reset. (Any loads that had been sequenced onto the bus would be shed.) After a short time delay, the DG output breaker would close onto the bus and the LOCA sequencer would again initiate the sequencing of required loads onto the bus.

For the case where a LOOP occurs before a LOCA (with the DG in a test mode), the following sequence could be expected to occur. Initially, when the LOOP occurs, the sequence would be as described previously for a LOOP (only) condition. That is, the degraded voltage, overcurrent or underfrequency relays would actuate, or possibly one of the non-essential relays would actuate. Then either of the aforementioned sequences would occur or begin to occur based on which of the noted trip functions occurred first (or in lieu of the other). The occurrence of a LOCA at this point would cause a SIS to be generated, but the subsequent response is dependent on which trip function was actuated in response to the LOOP.

1. If the degraded voltage relays had effected a separation of the offsite source in response to the LOOP, the SIS would cause the LOCA sequencer to go into effect.

Attachment 1 ULNRC-04837 Page 20 of 26

2. If a non-essential relay had responded before the degraded voltage relays during the LOOP, a DG lockout would be in effect. (Although the non-essential trips are designed to be bypassed by a SIS, the SIS cannot reset a lockout that is already in effect.)

Operator action may thus be required to reset the lockout before the DG is restarted in response to the LOOP-LOCA condition. The LOCA sequencer would then reload the bus with all required sequenced loads.

In summary, the worst-case effect for some of the above scenarios is to thus delay but not preclude system responses to the LOCA (SIS) for the affected bus. There would be no impact to the other bus (i.e., for the DG that was not in test).

4.2 TSTF-283 Revision 3 Changes As described previously, the changes proposed per TSTF-283 (Revision 3) modify SRs 3.8.1.11 (loss of offsite power test), 3.8.1.12 (safety injection actuation signal test), 3.8.1.16 (synchronizing test), 3.8.1.17 (test mode change-over test), 3.8.1.18 (load sequencing test),

3.8.1.19 (combined safety injection actuation signal and loss-of-offsite-power test), 3.8.4.7 (battery service test), and 3.8.4.8 (battery discharge test) to allow performance or partial performance of these surveillances in the prohibited MODES in order to reestablish OPERABILITY following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns).

Specifically, the TS changes will incorporate a Note in each affected SR to permit testing during restricted (currently prohibited) MODES to reestablish OPERABILITY, if required, provided an assessment is performed to assure that plant safety is maintained or enhanced. The TS Bases will be updated consistent with TSTF-283 to provide the following guidance relative to this assessment: "This assessment shall consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when the Surveillance is performed in these normally restricted MODES. Risk insights or deterministic methods may be used for this assessment."

As noted previously, some SRs are more complicated or intrusive than others, and would involve too great an impact or potential perturbation to the plant to be done in their entirety during plant operation. For these, the Note incorporated per TSTF-283 only permits a partial performance of the applicable SR In each of these cases, the text proposed for the Note (and for the associated Bases changes) refers to the "partial Surveillance" or "portions of the Surveillance" rather than referring wholly to "the Surveillance."

Attachment 1 ULNRC-04837 Page 21 of 26 The intent is that performing (or partially performing) an SR should not be precluded iftesting per that SR is needed to verify OPERABILITY following, for example, corrective maintenance on a DG or battery, and if a safety assessment supports performance of the SR (or a portion of the SR) during the restricted MODE. The type and degree of post-maintenance testing required depends on what was done to the DG or battery during the maintenance activity, such that only a particular SR(s) or a particular portion(s) of an SR may be required to adequately verify OPERABILITY. The required safety assessment will dictate, on case-by-case basis whether it is appropriate to perform the SRs or portions of SRs needed to confirm OPERABILITY during a restricted MODE. Otherwise, the plant will have to be brought into a non-restricted MODE or condition (shutdown) for performance of the SR(s).

Conclusion/Summarv The proposed changes will provide the flexibility necessary to optimize both outage schedules and the utilization of resources, while still protecting the health and safety of the public and station personnel.

The following is a summary of the bases and justification for the requested changes:

MODE Restriction Elimination SR 3.8.1 .10 (Full-Load Rejection Test) a) The testing is within the rating of all transformers, switchgear, and breakers, both before and after the load rejection.

b) Based on experience this test generally has had little impact on the plant electrical distribution system. Results from tests at Callaway show that voltage changes during a fill-load rejection test are not significant.

c) The likelihood of a grid disturbance occurring that would cause the tested DG to become unavailable, while the DG is under test, may be assumed to be quite remote.

d) The other DG (not under test) will remain OPERABLE to supply its bus and all of its associated loads for safe shutdown of the facility in the event of an accident.

SR 3.8.1.13 (Non-Emergency Protective Trip Bypass Test) a) Average DG unavailability for the performance of this test can be expected to be less than 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months per DG per operating cycle.

b) The other DG (not under test) will remain OPERABLE to supply its bus and all of its associated loads for safe shutdown of the facility in the event of an accident.

Attachment 1 ULNRC-04837 Page 22 of 26 SR 3.8.1.14 (Endurance and Margin Test) a) The electrical alignment for this test is similar to the existing monthly run of the DG, (SR 3.8.1.3) for which there is no MODE restriction.

b) The likelihood of a grid disturbance occurring that would cause the tested DG to become unavailable, while the DG is under test, may be assumed to be quite remote.

c) The tested DG remains OPERABLE throughout performance of this surveillance.

d) The other DG (not under test) will remain OPERABLE to supply its bus and all of its associated loads for safe shutdown of the facility in the event of an accident.

TSTF-283 Changes a) The proposed changes are identical to those in NRC-approved TSTF-283.

b) Performance (or partial performance) of the SRs during restricted MODES will require an assessment to assure plant safety is maintained or enhanced.

c) Performance (or partial performance) of the applicable SRs during restricted MODES will only be performed for the purpose of establishing OPERABILITY.

5.0 REGULATORY ANALYSIS

5.1 No Significant Hazards Consideration AmerenUE has evaluated whether or not a significant hazards consideration is involved with the proposed amendments by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of Amendment," as discussed below:

1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The design of plant equipment is not being modified by the proposed changes. In addition, the DGs and their associated emergency loads are accident mitigating features. As such, testing of the DGs themselves is not associated with any potential accident-initiating mechanism.

Therefore, there will be no significant impact on any accident probabilities by the approval of the requested changes.

The changes include an increase in the online time that a DG under test wilH be paralleled to the grid (for SRs 3.8.1.10 and 3.8.1.14) or unavailable due to testing (per SR 3.8.1.13). As such, the ability of the tested DG to respond to a design basis accident could be adversely impacted by

Attachment 1 ULNRC-04837 Page 23 of 26 the proposed changes. However, the impacts are not considered significant based, in part, on the ability of the remaining DG to mitigate a DBA or provide safe shutdown. With regard to SR 3.8.1.10 and SR 3.8.1.14, experience shows that testing per these SRs typically does not perturb the electrical distribution system. In addition, operating experience and qualitative evaluation of the probability of the DG or bus loads being adversely affected concurrent with or due to a significant grid disturbance, while the DG is being tested, support the conclusion that the proposed changes do not involve any significant increase in the likelihood of a safety-related bus blackout or damage to plant loads.

The SR changes that are consistent with TSTF-283 have been approved by the NRC for submittal by licensees. The on-line tests allowed by the TSTF are only to be performed for the purpose of establishing OPERABILITY. Performance of these SRs during restricted MODES will require an assessment to assure plant safety is maintained or enhanced.

Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed change create the possibility of a new or different accident from any accident previously evaluated?

Response: No.

The capability to synchronize a DG to the offsite source (via the associated plant bus) and test the DG in such a configuration is a design feature of the DGs, including the test mode override in response to a safety injection signal. Paralleling the DG for longer periods of time during plant operation may slightly increase the probability of incurring an adverse effect from the offsite source, but this increase in probability is judged to be still quite small and such a possibility is not a new or previously unrecognized consideration.

The proposed changes would not require any new or different accidents to be postulated since no changes are being made to the plant that would introduce any new accident causal mechanisms. This license amendment request does not impact any plant systems that are potential accident initiators; nor does it have any significantly adverse impact on any accident mitigating systems.

Therefore, the proposed change does not create the possibility of a new or different accident from any accident previously evaluated.

3. Does the proposed change involve a significant reduction in a margin of safety?

Response: No.

The proposed changes do not involve a significant reduction in the margin of safety. The margin of safety is related to the confidence in the ability of the fission product barriers to perform their design functions during and following an accident situation. These barriers include the fuel

Attachment 1 ULNRC-04837 Page 24 of 26 cladding, the reactor coolant system, and the containment system. The proposed changes do not directly affect these barriers, nor do they involve any significantly adverse impact on the DGs which serve to support these barriers in the event of an accident concurrent with a loss of offsite power. The proposed changes to the testing requirements for the plant DGs do not affect the OPERABILITY requirements for the DGs, as verification of such OPERABILITY will continue to be performed as required (except during different allowed MODES). The changes have an insignificant impact on DG availability, as continued verification of OPERABILITY supports the capability of the DGs to perform their required function of providing emergency power to plant equipment that supports or constitutes the fission product barriers. Only one DG is to be tested at a time, so that the remaining DG will be available to safely shut down the plant if required.

Consequently, performance of the fission product barriers will not be impacted by implementation of the proposed amendment.

In addition, the proposed changes involve no changes to setpoints or limits established or assumed by the accident analysis. On this and the above basis, no safety margins will be impacted.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Based on the above evaluation, AmerenUE concludes that the proposed amendment involves no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and accordingly, a finding of "no significant hazards consideration" is justified.

5.2 Applicable Regulatory Requirements The requirements of 10 CFR 50, Appendix A, GDC 17, "Electric Power Systems," and GDC 18, "Inspection and Testing of Electric Power Systems," are summarized below:

GDC 17 Onsite electricpower system andan offsite electricpower system shall be provided to permit functioning of structures, systems, and components importantto safety. The safety functionfor each system shall be to provide sufficient capacityandcapabilityto assure that (1) specified acceptablefuel design limits anddesign conditionsof the reactorcoolantpressure boundary are not exceeded as a result of anticipatedoperationaloccurrencesand(2) the core is cooled andcontainment integrity and other vitalfunctions are maintainedin the event ofpostulated accidents.

The onsite electricpower supplies, including the batteries, and the onsite electric distribution system, shall have sufficient independence, redundancy, and testabilityto perform their safety functions assuming a singlefailure.

Provisionsshall be included to minimize the probabilityof losing electricpowerfrom any of the remainingsupplies as a result of or coincidentwith, the loss ofpower generatedby the

Attachment 1 ULNRC-04837 Page 25 of 26 nuclearpower unit, the loss ofpowerfrom the transmissionnetwork, or the loss ofpowerfrom the onsite electricpower supplies. "

GDC 18 Electricpower systems importantto safety shall be designed to permit appropriateperiodic inspection and testing of importantareasandfeatures, such as wiring, insulation, connections, andswitchboards to assess the continuity of the systems and the condition of their components.

The systems shall be designedwith a capability to testperiodically(1) the operabilityand functionalperformance of the components of the systems, such as onsitepower sources, relays, switches, and buses, and (2) the operabilityof the systems as a whole and, under conditions as close to design as practical, thefull operation sequence that brings the systems into operati8on, including operation of applicableportions of the protectionsystem, and the transfer ofpower among the nuclearpower unit, the offsite power system, andthe onsitepower system.

As described previously, and in accordance with GDC 17, the design of the AC electrical power system provides independence and redundancy to ensure an available source of power to the Engineered Safety Feature (ESF) systems. The onsite Class E AC Distribution System for Callaway is divided into two load groups. A 4.16-kV ESF bus is associated with each load group. The two load groups are 100% redundant and are electrically and physically separated such that the loss of either group does not prevent the minimum safety functions from being performed. Each load group has connections to either of two offsite power sources from the switchyard, and a single DG. Offsite power is supplied to the switchyard from the transmission network via two rights of way approaching the site from two different directions.

Further, the power systems are designed to be testable and subject to inspection pursuant to GDC 18. The testability of Class E equipment is, in fact, identified as a Safety Design Basis in the Callaway FSAR. The testability of the DGs, in particular, is an enabling feature for performance of surveillance tests required by the Technical Specifications.

The most significant changes being proposed would modify test requirements for the DGs which provide emergency power to the 4.16-kV ESF buses in the event of a loss of offsite power pursuant to GDC 17. The test requirements are intended to verify and/or ensure continued OPERABILITY of the DGs. The proposed changes involve no changes to the required tests themselves except to allow certain tests to be performed during MODES for which performance of the affected tests is currently prohibited. Deterministic evaluation of the proposed changes has determined that DG availability is not significantly affected by the proposed changes (including testing per SR 3.8.1.13), that the potential for significantly adverse electrical perturbations during tests such as SR 3.8.1.10 (full-load rejection test) is acceptably low, and that the potential for a grid disturbance causing DG unavailability while a DG is in test is quite low. Further, only one DG will be tested at a time such that OPERABILITY of the other DG and its associated bus and bus loads will be unaffected. Testing will thus continue in a manner that supports DG OPERABILITY so that the DGs will be available to perform their intended safety function consistent with regulatory requirements.

Attachment 1 ULNRC-04837 Page 26 of 26 In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

6.0 ENVIRONMENTAL CONSIDERATION

AmerenUE has evaluated the proposed amendment for environmental considerations. The review has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, and would change an inspection or surveillance requirement. However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluent that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure.

Accordingly, the proposed amendments meet the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment needs to be prepared in connection with the proposed amendments.

7.0 REFERENCES

1. 10 CFR 50.90, "Application for Amendment of License or Construction Permit"

2. TSTF-283, Revision 3, "Modify Section 3.8 Mode restriction Notes"

3. 10 CFR 50.36(a), "Technical Specifications"

4. 10 CFR 50, Appendix A, GDC 17, "General Design Criteria for Nuclear Power Plants -

Electric Power Systems"

5. 10 CFR 50, Appendix A, GDC 18, "Inspection and Testing of Electric Power Systems" 8.0 PRECEDENTS

Amendment 173 to Columbia Generating Station Operating License (

Subject:

Columbia Generating Station Operating License NPF-21 Request for Technical Specifications Amendment to Remove Operating Mode Restrictions for Emergency Diesel Generator Surveillance Testing, dated May 18, 2001)

Attachment 2 ULNRC-04837 MARKED-UP TECHNICAL SPECIFICATIONS

AC Sources - Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.7 NOTE All DG starts may be preceded by an engine prelube period.

Verify each DG starts from standby condition and 184 days achieves in 12 seconds, voltage 2 3740 V and s 4320 V, and frequency 2 58.8 Hz and 61.2 Hz.

SR 3.8.1.8 Not used.

SR 3.8.1.9 Not used.

SR 3.8. 1.1I0 OTF --

_ This Surveillance shall not be performed n MODE 4 Verify each DG operating at a power factor< 0.9 and 18 months 2 0.8 does not trip and voltage is maintained s 4784 V and frequency is maintained

65.4 Hz during and following a load rejection of Ž 5580 kW and

6201 kW.

(continued)

CALLAWAY PLANT 3.8-8 Amendmert No. 133

AC Sources - Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.11 -NOTES

1. All DG starts may be preceded by an engine prelube period. ' normally

2. This Surveian -

-MODE 1oraL2. .b it4SERT I Verify on an actual or simulated loss of offste power 18 months signal:

a. De-energization of emergency buses;

b. Load shedding from emergency buses;

c. DG auto-starts from standby condition and:

1. energizes permanently connected loads in s 12 seconds,

2. energizes auto-connected shutdown loads through the shutdown load sequencer,

3. maintains steady state voftage2 3740 V and s 4320 V,

4. maintains steady state frequency 2 58.8 Hz and < 61.2 Hz, and

5. suppies permanently connected and auto-connected shutdown loads for 2 5 minutes.

(conunuea CALLAWAY PLANT 3.8-9 Amendment No. 133

AC Sources - Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

I.

SURVEILLANCE FREQUENCY 4.

SR 3.8.1.12 NOTES

1. All DG starts may be preceded by prelube period.

Iiu[ UrIS 57'

2. This TISERT I Verify on an actual or simulated safety injection signal 18 months each DG auto-starts from standby condition and:

a. In s 12 seconds after auto-start and during tests, achieves voltage > 3740 V and s 4320 V;

b. In s 12 seconds after auto-start and during tests, achieves frequency > 58.8 Hz and s 61.2 Hz;

c. Operates for > 5 minutes;

d. Permanently connected loads remain energized from the offsite power system; and

e. Emergency loads are auto-connected and energized through the LOCA load sequencer from the offste power system.

S- - - e.-

tonunueau CALLAWAY PANT 3.8-10 Amnendment No. 133

AC Sources - Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8A..13 1X This Surveillance shall not be performed in MODE 1J Verify each DG's automatic trips are bypassed on 18 months actual or simulated loss of voltage signal on the emergency bus concurrent with an actual or simulated safety Injection signal except:

a. Engine overspeed;

b. Generator differential current;

c. Low lube oil pressure;

d. High crankcase pressure;

e. Start failure relay; and

f. High jacket coolant temperature.

(continued)

CALLAWAY PLANT 3.8-11 Amendment No. 133

AC Sources - Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.14 NOTES

1. Momentary transients outside the load and power factor ranges do not invalidate this test.

2 The DG may be loaded to2 5580 kW and

6201 kW for the entire test period if auto-connected design loads are less than 6201 kW.

Verify each DG operating at a power factors 0.9 and 18 months 2 0.8 operates for 2 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months s:

a. For 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months loaded Ž 6600 KW and

< 6821 kW; and

b. For the remaining hours of the test loaded

> 5580 kW and < 6201 kW.

SR 3.8.1.15 --- NOTES

1. This Surveillance shall be performed within 5 minutes of shutting down the DG after the DG has operated 2 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months loaded Ž 5580 kW and < 6201 kW. Momentary transients outside of load range do not invalidate this test.

2. All DG starts may be preceded by an engine prelube period.

Verify each DG starts and achieves, ing 12 seconds, 18 months voltage 2 3740 V, and s 4320 V and frequency 2 58.8 Hz and s 61.2 Hz.

(continued)

CALLAWAY PLANT 3.8-12 Amendment No. 133

AC Sources - Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.16 - NOTE This Survel no performed in MODE 1,

~~~~~ ,3 r 4. J > normally, INSERT Verify each DG: 18 months

a. Synchronizes with offsite power source while loaded with emergency loads upon a simulated restoration of offsite power,

b. Transfers loads to offsite power source; and

c. Retums to ready-to-load operation.

4 SR 3.8.1.17 NOTE This I s lbe performed in MODE I or 2.e _nral INSERTI Verify, with a DG operating in test mode and 18 months connected to its bus, an actual or simulated Safety Injection signal overrides the test mode by:

a. Retuming DG to ready-to-load operation; and

b. Automatically energizing the emergency load from offsite power.

iconunueau CALLAWAY PLANT 3.8-13 Amendment No. 133

AC Sources - Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.18 NOTE This eanotbe performed In MODE I

.N0.er~noma INSERT 2 Verify interval between each sequenced load block is 18 months within +/- 10% of design interval for each LOCA and shutdown load sequencer.

SR 3.8.1.19 NOTES

1. Af DG starts may be preceded by an engine prelube period. noriii;IIy

2. This Surveillance shal o o n INSERT 1 Verify on an actual or simulated loss of offslte power 18 months signal in conjunction with an actual or simulated Safety Injection signal:

a. De-energization of emergency buses;

b. Load shedding from emergency buses; and

c. DG auto-starts from standby condition and:

1. energizes permanently connected loads In 12 seconds,

2. energizes auto-connected emergency loads through LOCA load sequencer,

3. achieves steady state voltage 2 3740 V and s 4320 V,

4. achieves steady state frequency Z 58.8 Hz andg s61.2 Hz, and (continued)

CALLAWAY PLANT 3.8-14 Amendment No. 133

DC Sources - Operating 3.8.4 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY I-SR 3.8.4.7 NOTES

1. The modified performance discharge test in SR 3.8.4.8 may be performed in lieu of the service test in SR 3 8 4 7 r vu1t;ly

2. This Surveiflance shall n performed in INSERT I MODE 1, 2, 3,or4 Verify battery capacity Is adequate to supply, and 18 months maintain In OPERABLE status, the required emergency loads for the design duty cycle when subjected to a battery service test.

4 SR 3.8.4.8 a 9_e MtUI I -

This Surveillance shall not be performed in MODE 1, INSERT I 2, 3, r.. normally Verify battery capacity is 2 80% of the manufacturees 60 months rating when subjected to a performance discharge test or a modified performance discharge test. AND 18 months when battery shows degradation or has reached 85% of expected life i

CALLAWAY PANT 3.8-24 Amendment No. 133

Text Inserts for Technical Specification Chancies Insert 1 However, portions of the Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

Insert 2 However, this Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant Is maintained or enhanced.

Attachment 3 ULNRC-04837 PROPOSED/REVISED TECHNICAL SPECIFICATIONS

AC Sources - Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.7 ------ NOTE--

All DG starts may be preceded by an engine prelube period.

Verify each DG starts from standby condition and 184 days achieves in s 12 seconds, voltage Ž 3740 V and

4320 V, and frequency Ž 58.8 Hz and s 61.2 Hz.

SR 3.8.1.8 Not used.

SR 3.8.1.9 Not used.

SR 3.8.1.10 I Verify each DG operating at a power factor

0.9 and 18 months

Ž 0.8 does not trip and voltage is maintained

4784 V and frequency is maintained

65.4 Hz during and following a load rejection of Ž 5580 kW and

6201 kW.

(continued)

CALLAWAY PLANT 3.8-8 Amendment No. XXX

AC Sources - Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.11 ---- NOTES

1. All DG starts may be preceded by an engine prelube period.

2. This Surveillance shall not normally be performed in MODE 1 or 2. However, portions of the Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

Verify on an actual or simulated loss of offsite power 18 months signal:

a. De-energization of emergency buses;

b. Load shedding from emergency buses;

c. DG auto-starts from standby condition and:

1. energizes permanently connected loads in

12 seconds,

2. energizes auto-connected shutdown loads through the shutdown load sequencer,

3. maintains steady state voltage Ž 3740 V and s 4320 V,

4. maintains steady state frequency

Ž 58.8 Hz and

61.2 Hz, and

5. supplies permanently connected and auto-connected shutdown loads for 5 minutes.

(continued)

CALLAWAY PLANT 3.8-9 Amendment No. XXX

AC Sources - Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.12 -- - -NOTES -

1. All DG starts may be preceded by prelube period.

2. This Surveillance shall not normally be performed in MODE 1 or 2. However, portions of the Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

Verify on an actual or simulated safety injection signal 18 months each DG auto-starts from standby condition and:

a. In

12 seconds after auto-start and during tests, achieves voltage Ž 3740 V and

4320 V;

b. In s 12 seconds after auto-start and during tests, achieves frequency Ž 58.8 Hz and

61.2 Hz;

c. Operates for 5 minutes;

d. Permanently connected loads remain energized from the offsite power system; and

e. Emergency loads are auto-connected and energized through the LOCA load sequencer from the offsite power system.

(continued)

CALLAWAY PLANT 3.8-10 Amendment No. XXX

AC Sources - Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.13 I Verify each DG's automatic trips are bypassed on 18 months actual or simulated loss of voltage signal on the emergency bus concurrent with an actual or simulated safety injection signal except:

a. Engine overspeed;

b. Generator differential current;

c. Low lube oil pressure;

d. High crankcase pressure;

e. Start failure relay; and

f. High jacket coolant temperature.

(continued)

CALLAWAY PLANT 3.8-11 Amendment No. XXX

AC Sources - Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.14 ---

K rsec

-J NU--- I tE ___ _

1. Momentary transients outside the load and power factor ranges do not invalidate this test.

2. The DG may be loaded to Ž 5580 kW and

6201 kW for the entire test period if auto-connected design loads are less than 6201 kW.

Verify each DG operating at a power factor

0.9 and 18 months

Ž 0.8 operates for Ž 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months s:

a. For 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months loaded Ž 6600 kW and

6821 kW; and

b. For the remaining hours of the test loaded

Ž 5580 kW and* 6201 kW.

SR 3.8.1.15 -- ------ NOTES -----

1. This Surveillance shall be performed within 5 minutes of shutting down the DG after the DG has operated 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months loaded Ž 5580 kW and 6201 kW. Momentary transients outside of load range do not invalidate this test.

2. All DG starts may be preceded by an engine prelube period.

Verify each DG starts and achieves, in s 12 seconds, 18 months voltage Ž 3740 V, and

4320 V and frequency

Ž 58.8 Hz and

61.2 Hz.

(continued)

,1 CALLAWAY PLANT 3.8-12 Amendment No. XXX

AC Sources - Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued) -

SURVEILLANCE FREQUENCY SR 3.8.1.16 - ~-----NOTE-- --

This Surveillance shall not normally be performed in MODE 1, 2, 3, or 4. However, this Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

Verify each DG: 18 months

a. Synchronizes with offsite power source while loaded with emergency loads upon a simulated restoration of offsite power;

b. Transfers loads to offsite power source; and

c. Retums to ready-to-load operation.

LnIo-% I E SR 3.8.1.17 ------ -z U~~~~~~~ l r- -----

This Surveillance shall not normally be performed in MODE 1 or 2. However, portions of the Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

Verify, with a DG operating in test mode and 18 months connected to its bus, an actual or simulated Safety Injection signal overrides the test mode by:

a. Retuming DG to ready-to-load operation; and

b. Automatically energizing the emergency load from offsite power.

(continued)

CALLAWAY PLANT 3.8-13 Amendment No. XXX

AC Sources - Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued) Y SURVEILLANCE FREQUENCY 4

SR 3.8.1.18 ----- NOTE This Surveillance shall not normally be performed in MODE 1 or 2. However, this Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

Verify interval between each sequenced load block is 18 months within +/- 10% of design interval for each LOCA and shutdown load sequencer.

SR 3.8.1.19 --------- N- OTES-- --

1. All DG starts may be preceded by an engine prelube period.

2. This Surveillance shall not be performed in MODE 1 or 2. However, portions of the Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

Verify on an actual or simulated loss of offsite power 18 months signal in conjunction with an actual or simulated Safety Injection signal:

a. De-energization of emergency buses;

b. Load shedding from emergency buses; and

c. DG auto-starts from standby condition and:

1. energizes permanently connected loads in 5 12 seconds,

2. energizes auto-connected emergency loads through LOCA load sequencer,

3. achieves steady state voltage Ž 3740 V and

4320 V,

4. achieves steady state frequency 2 58.8 Hz and:5 61.2 Hz, and (continued)

CALLAWAY PLANT 3.8-14 Amendment No. XXX

DC Sources - Operating 3.8.4 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.4.7 --- NOTES _ ___

1. The modified performance discharge test in SR 3.8.4.8 may be performed in lieu of the service test in SR 3.8.4.7.

2. This Surveillance shall not normally be performed in MODE 1, 2, 3, or 4. However, portions of the Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

Verify battery capacity is adequate to supply, and 18 months maintain in OPERABLE status, the required emergency loads for the design duty cycle when subjected to a battery service test.

4.

SR 3.8.4.8 ---- ---- NOTE -----

This Surveillance shall not normally be performed in MODE 1, 2, 3, or 4. However, portions of the Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

Verify battery capacity is Ž 80% of the manufacturees 60 months rating when subjected to a performance discharge test or a modified performance discharge test. AND 18 months when battery shows degradation or has reached 85% of expected life CALLAWAY PLANT 3.8-24 Amendment No. XXX

Attachment 4 ULNRC-04837 TS BASES CHANGES (For Information Only)

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.6 (continued)

REQUIREMENTS The Frequency for this SR is 31 days.

SR 3.8.1.7 See SR 3.8.1.2.

SR 3.8.1.8 Not Used SR 3.8.1.9 Not Used SR 3.8.1.10 This Surveillance demonstrates the DG capability to reject a full load without overspeed tripping or exceeding the predetermined voltage limits.

The DG full load rejection may occur because of a system fault or inadvertent breaker tripping. This Surveillance ensures proper engine generator load response under the simulated test conditions. This test simulates the loss of the total connected load that the DG experiences folowing a full load rejection and verifies that the DG does not trip upon loss of the load. These acceptance cnteria provide for DG damage protection. While the DG Is not expected to experience this transient during an event and continues to be available, this response ensures that the DG is not degraded for future application, including reconnection to the bus if the trip initiator can be corrected or isolated.

In order to ensure that the DG is tested under load conditions that are as dose to design basis conditions as possible, testing must be performed using a power factor 2 0.8 and < 0 9. This power factor Is chosen to be representative of the actual design basis inductive loading that the DG would experience.

The 18 month Frequency Is consistent with the recommendation of Regulatory Guide 1.108 (Ref. 9) and Is Intended to be consistert with expected fuel cycle lengths.

Tjhis SR has been modified by a Note. The reason forthe Note is that during operation with the reactor critical, performance of this SR could cause perturbation to the electrical distnbution systems that could challenge continued steady state operation and, as a resul, unit safety (continued)0~~~~~~~~

B 3.8.1-18 RevisIon PLANT CALLAWAY CALLAWAY PLANT B 3.8.1-18 Revision

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.10 (continued)

REQUIREMENTS The requirements of the "Single-Load RejecUon Tesr and the "Full-Load Rejection Test" as described In Regulatory Guide 1.9, Revision 3 have been combined. The "Full-Load Rejection Test" is a demonstration of the emergency diesel generators capabirdy to reject a load equal to 90 to 100 percent of its continuous rating (5580-6201 kilowatts)while operating at a es+o power factor between 0.8 and 0.9 and that the voltage does not exceed 4784 volts and that the frequency does not exceed 65.4 Hertz following a load rejection of 5580 to 6201 kilowatts. The frequency criteria Is from the "Single-Load Rejection Test and Is based on nominal engine speed plus 75 percent of the difference between nominal speed andthe over-speed t/c.cr4inuly.) trip setpoint (Refs. 13 and 15).

The ESW pump, starting transient during the LOCA sequencing test, in1l be demonstrated to be within a minimurn voltage of 3120 Vac and to recover to 3680 Vac within 3 seconds and to be within a maximum voltage of 4784 Vac and recover to 4320 Vac within 2 seconds. This is based on Regulatory Guide 1.9 Revision 3 Section 1.4 and past trending of ESW pump starting transient performance (Refs. 14 and 15).

SR 3.8.1.11 As required by Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(1), this Surveillance demonstrates the as designed operation of the standby power sources during loss of the offsite source. This test verifies all actions encountered from the loss of offste power, including shedding of the nonessential loads and energization of the emergency buses and respective loads from the DG It further demonstrates the capability of the DG to automatically achieve the required voltage and frequency within the specified time.

The DG autostart time of 12 seconds Is derived from requirements of the accident analysis to respond to a design basis large break LOCA. The Surveillance should be continued for a minimum of 5 minutes In order to demonstrate that all starting transients have decayed and stability Is achieved.

The requirement to verify the connection and power supply of permanent and autoconnected loads Is Intended to satisfactorily show the relationship of these loads to the DG loading logic. In certain circumstances, many of these loads cannot actualy be connected or loaded wthout undue hardship or potenUal for undesired operation. For Instance, Emergency Core Cooling Systems (ECCS) Injection valves are (continued)

Revision 0 PLANT B 3.8.1-19 CALLAWAY PLANT B 3.8.1-19 Revrision 0

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.11 (continued)

REQUIREMENTS not desired to be stroked open, or high pressure injection systems are not capable of being operated at full flow, or residual heat removal (RHR) systems performing a decay heat removal function are not desired to be realigned to the ECCS mode of operation. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capabilty of the DG systems to perform these functions Is acceptable.

This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The Frequency of 18 months is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(1), takes Into consideration unit conditions required to perform the Surveillance, and Is intended to be consistent with expected fuel cycle lengths.

This SR is modified by two Notes. The reason for Note I is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standbyconditions, that is, with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations. The reason for Note2 s that performing the Surveillance would remove a required offsite circult from service, perturb the electrical distribution system, and challenge safety systems.

INSERT I This Surveillance demonstrates that the DG automatically starts and achieves the required voltage and frequency within the specified time (12 seconds) from the design basis actuation signal (SI signal and operates for 2 5 minutes. The 5 minute period provides sufficient time to demonstrate stability. SR 3.8.1.12.d and SR 3.8.1.12.e ensure that permanently connected loads and emergency loads are energized from the offsite electrical power system on a safety Injection signat without loss of offsite power.

The requirement to verify the connection of permanent and autoconnected loads Is Intended to satisfactorily show the relationship of these loads to the DG loading logic. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potenUal for undesired operation. For Instance, ECCS injection valves are not desired to be stroked open, or high pressure injection systems are not capable of being operated at full flow, or RHR systems performing a decay heat removal function are not desired to be (continued)

CALLAWAY PLANT B 3.8.1-20 Revision

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.12 (continued)

REQUIREMENTS realigned to the ECCS mode of operation. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the DG system to perform these functions is acceptable.

This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The Frequency of 18 months takes into consideration unit conditions required to perform the Surveillance and Is Intended to be consistent with the expected fuel cycle lengths. Operating experience has shown that these components usually pass the SR when performed at the 8morth Frequenry. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

This SR s modified by two Notes. The reason for Note I Is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standbyconditions, that is, with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations. The reason for Note2 Is that during operation wlth the reactor critical, performance of this Surveillance could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, unit safety systems.

INSERTi SR 3.8.1.13 This Surveillance demonstrates that DG noncritical protective functions are bypassed oh a loss of voltage signal concurrent with safety injection signal. The noncritical trips are bypassed during DBAs and provide an alarm on an abnormal engine condition. This alarm provides the operator with suffcient time to react approprately. The DG availability to mitigate the DBA Is more critical than protecting the engine against minor problems that are not inmediately detrimental to emergency operation of the DG ThelmonthF ung Is based orerIneering m t kn It consideratio untcniions reuired to rform e urvei lance an is intended o e consewi expected fuel cce lenperating experience has shown that these components usually pass the SR when performed at the 18 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

The SR is modified by a Noe. The reason for the Note Is that performing (continued)

Revision 0 (continued)

B 3.8.1-21 CALLAWAY PLANT PLANT B 3.8.1-21 Revision 0

AC Sources - OperaUng B 3.8.1 BASES SURVEILLANC :E SR 3.8.1.14 REQUIREMEN TS (continued) Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(3), requires demonstration once per 18 months that the DGs can start and run continuously at full load capability for an interval of not less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

Ifthe auto-connected design loads have increased above the continuous duty rating the load shall be increased to 110% of the continuous duty rating for;, 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and the remainder of the time at a load equivalent to the continuous duty rating of the DG The DG starts for this Surveillance can be performed either from standby or hot conditions. The provisions for prelubricating and warmup, discussed in SR 3.8.1.2, and for gradual loading, discussed In SR 3.8.1.3, are applicable to this SR.

In order to ensure that the DG is tested under load conditions thatare as close to design conditions as possible, testing must be performed using a power factor of - 0.8 and < 0.9. This power factor Is chosen to be representative of the actual design basis Inductive loading that the DG would experience. The load band is provided to avoid routine overloading of the DGL Routine overloading may result in more frequentteardown inspections In accordance with vendor recommendations in order to maintain DG OPERABILITY The generator voftage and frequency Is maintained within 4160 + 160 - 420 volts and 60 +/- 1.2 Hz during this test.

The 18 month Frequency is consistent with the recommendations of

] ReglaKGide 1108 Ref.-) a9 gr alas,nt Xcosi reraionlinit conition required to rform theSurveillance,and is This Surveillance Is modified bySIweeYNotes. Note I states that momentary transients due to changing bus loads do not invalidate this oabve test. Similarly, momentary powjfqctor_raqsnts ct2enpwr factor tIn,t thect3rffOA performance of this Surveillance could

,cause perturbations to the electrical distnbution systems that could c h ng co iu s d ra n ndas , t it ft ste sJ The reason for oe7 a opera ig eD for greater an ors in the overloaded cond&tio'leed not be performed, provided the auto-connected loads remain belo 6201 KW continuous rating of the DGS SR 3.8.1.15 This Surveillance demonstrates that the diesel engine can restart from a hot condition, such as subsequent to shutdown from normal (continued)

CALLAWAY PANT B 3.8.1-22 Revision 0

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.15 (continued)

REQUIREMENTS Surveillances, and achieve the required voltage and frequency within 12 seconds. The 12 second time is derived from the requirements of the accident analysis to respond to a design basis large break LOCA. The 18 month Frequency is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(5).

This SR Is modified by two Notes. Note 1 ensures that the test Is performed with the diesel sufficiently hot. The load band Is provided to avoid routine overloading of the DG. Routine overoads may result In more frequent teardown inspections in accordance with vendor recommendations inorder to maintain DG OPERABILITY. The requirement that the diesel has operated for at least 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months at full load conditions prior to performance of this SuTveiltance Is based on manufacturer recommendations for achieving hot conditions. Momentary transients due to changing bus loads do not Invalidate this test. Note 2 allows all DG starts to be preceded by an engine prelube period to minimize wear and tear on the diesel during testing.

SR 3.8.1.16 As required by Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(6), this Surveillance ensures that the manual synchronization and automatic load transfer from the DG to the offsite source can be made and the DG can be retumed to ready to load status when offsite power Is restored. It also ensures that the autostart logic is reset to allow the DG to reload If a subsequent loss of offsite power occurs.

The DG is considered to be in ready to load status when the DG Is at rated speed and voltage, the output breaker is open and can receive an autoclose signal on bus undervoftage, and the load sequence timers are reset.

The Frequency of 18 months Is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(6), and takes Into consideration unit conditions required to perform the Surveillance.

This SR Is modified by a Note. The reason for the Note Is that performing the Surveillance would remove a required offsite circuit from service, te el riur dstribtion system, an challeneae INSERT 2 (continued)

CALLAWAY PLANT B 3.8.1-23 Revnsion 0

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.17 REQUIREMENTS (continued) Demonstration of the test mode override ensures that the DG availability under accident conditions vll not be compromised as the result of testing and the DG will automatically reset to ready to load operation If a safety injection signal Is received during operation In the test mode. Ready to load operation Is defined as the DG running at rated speed and voltage with the DG output breaker open. These provisions for automatic switchover are required by IEEE-308 (Ref. 13), paragraph 6.2.6(2).

The requirement to automaticafy energize the emergency loads vwth offsite power Is essentially Identical to that of SR 3.8.1.12. The Intent In the requirement associated with SR 3.8.1.17.b Is to show that the emergency loading was not affected by the DG operation In test mode. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the emergency loads to perforn these functions is acceptable.

This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The 18 month Frequency Is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(8), takes Into consideration unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

This SR is modified by a Note. The reason for the Note Is that performing the Surveillance would remove a required offsite circuit from service, tubthe electrical distributon system, and challen f t t INSERT 3 SR 3.8.1.18 Under accident and loss of offsite power conditions loads are sequentially connected to the bus by the Load Shedder and Emergency Load Sequencer. The sequencing logic controls the permissive and staring signals to motor breakers to prevent overloading of theDGs due to high motor starting currents. The 10% load sequence time Interval tolerance ensures that suffcient time exists for the DG to restore frequency and voltage prior to applying the next load and that safety analysis assumptions regarding ESF equipment time delays are not violated.

Reference 2 provides a summary of the automatic loading of ESF buses.

The Frequency of 18 months is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(2), takes Into (conUnued)

CALLAWAY PLANT B 3.8.1-24 Revision 0

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.18 (continued)

REQUIREMENTS consideration unt conditions required to perform the Surveilance, and Is intended to be consistent with expected fuel cycle lengths.

This SR Is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service, prubte electrical distribion s tern, and allene afet s tems INSERT 4 SR 3.8.1.19 In the event of a DBA coincident with a loss of offsite power, theDGs are required to supply the necessary power to ESF systems so that the fuel, RCS, and containment design limis are not exceeded.

This Surveillance demonstrates the DG operation, as discussed In the Bases for SR 3.8.1.11, during a loss of offsite power actuation test signal in conjunction with a safety injection signal. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the DG system to perform these functions is acceptable.

This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The Frequency of 18 months takes into considerafion unit conditions required to perform the Surveillance and is intended to be consistent with.

an expected fuel cycle length of 18 months.

This SR is modified by two Notes. The reason for Note I Is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions, that Is, wth the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations for DGs. The reason for Note 2 s that the performance of the SurveMance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems.

INSERT 1 The ESW pump starting transient during the LOCAsequencin9test will be demonstrated to be within a minimum voltage of 3120 Vac and to recover to 3680 Vac within 3 seconds and to be within a maximum votage of 4784 Vac and wcover to 4320 Vac within 2 seconds. This is based on Regulatory Guide 1.9 Revision 3 SecUon 1.4 and past trending of ESW pump starting transient performance (Refs. 14 and 15).

(continued)

CALLAWAY PANT B 3.8.1-25 Revision 0

0 DC Sources - Operating B 3.8.4 BASES SURVEILLANCE SR 3.8.4.4 and SR 3.8.4.5 (continued)

REQUIREMENTS and to reduce terminal deterioration. The visual nspection for corrosion is not intended to require removal of and inspection under each terminal connection. The removal of visible corrosion Is a preventve maintenance SR. The presence of visible corrosion does not necessarily represer a failure of this SR provided visible corrosion is removed during performance of SR 3.8.4.4.

The Surveillance Frequencies of 18 months are based on operational experience.

SR 3.8.4.6 0 This SR requires that each battery charger be capable of supplying 300 amps and 130.2 V for2 I hou. These requirements are based on t je. the design rating of the chargers (Ref. 4) and the time needed to reach thermal equilibrium. According to Regulatory Guide 1.32 (Ref. 10). the d *,or {} battery charger supply Is required to be based on the largest combined demands of the various steady state loads and the charging capacity to restore the battery from the design minimum charge state to the fully charged state, irrespective of the status of the unit during these demand occurrences. The minimum required anperes and duration ensures that these requirements can be satisfied.

The Surveillance Frequency is acceptable, given the unit conditions required to perform the test and the other administrative controls existing.

to ensure adequate charger performance during these 18 month Intervals.

In addition, this Frequency is Intended to be consistent with expected fuel cycle lengths.

SR 3.8A.7 A battery service test Is a special test of battery capability, as found, to satisfy the design requirements (battery duty cycle) of the DC electrical power system. The discharge rate and test length should correspond to the design duty cyde requirements as specified In Reference 4.

The Surveillance Frequency of 18 months is consistent with the recommendations of Regulatory Guide 1.32 (Ref. 10) and Regulatory Guide 1.129 (Ref. 11), which state that lhe battery service test should be performed during refueling operations or at some other outage, with intervals between tests, not to exceed 18 months.

(continued)

CALLAWAY PLANT B 3.8.4-6 Revision 0

DC Sources - Operating B 3.8.4 BASES SURVEILLANCE SR 3.8.4.7 (continued)

REQUIREMENTS This SR is modiFed by two Notes. Note 1 allows the performance of a modified performance discharge test in lieu of a service test.

The modified performance discharge test Is a simulated duty cycle consisting of just two rates; the one minute rate published for the battery or the largest current load of the duty cyde, followed by the test rate employed for the performance test, both of which envelope the duty cycle of the service test. Since the ampere-hours removed by a rated one minute discharge represents a very small portion of the battery capacity, the test rate can be changed to that for the performance test without compromising the results of the performance discharge test. The battery terminal voltage for the modified performance discharge test should remain above the minimum battery terminal voltage specified in the battery service test for the duration of time equait to that of the service test.

A modified discharge test is a test of the battery capacity and its abil-ty to provide a high rate, short duration load (usually the highest rate of the duty cycle). This will often confirm the battery's ability to meet the critical period of the load duty cycle, in addition to determining its percentage of rated capacity. Initial conditions for the modified performance discharge test should be identical to those specified for a service test.

The reason for Note 2 is that performing the Surveillance would perturb the electrical distribution system and challenge safet systems.

iNsERT S SR 3.8.4.8 A battery performance discharge test Is a test of constant current capacity of a battery, normally done in the as found condition, after having been In service, to detect any change in the capacity determined by the acceptance test. The test is Intended to trend overall battery degradation due to age and usage.

A battery modified performance discharge test Is described in the Bases for SR 3.8.4.7. Either the battery performance discharge test or the modified performance discharge test Is acceptable for satisfying SR 3.8.4.8; however, only the modified performancedischarge test may be used to satisfy SR 3.8.4.8 while satisfying the requirements of SR 3.8.4.7 at the same time.

(continued).

CALLAWAY PLANT B 3.8.4-7 Revision 0

DC Sources - OperaUng B 3.8.4 BASES SURVEILLANCE SR 3.8.4.8 (continued)

REQUIREMENTS The acceptance criteria for this Surveillance are consistent with IEEE-450 (Ref. 9) and IEEE-485 (Ref. 5). These references recommend that the battery be replaced if its capacity is below 80% of the manufacturer's rating. A capacity of 80% shows that the battery rate of deterioration Is increasing, even if there is ample capacity to meet the load requirements.

The Surveillance Frequency for this test is normally 60 months. f the batery shows degradation, or Fthe battery has reached 85% of Its expected life the Surveillance Frequency Is reduced to 18 months.

Degradation Is Indicated, according to IEEE-450 (Ref. 9), when the battery capacity drops by more than 10% relative to Its capacity on the previous performance test or when it Is below 90% of the manufacturer rating.

This SR is modified by a Note. The reason for the Note Is that performing INSERT 5 the Surveillance would perturb the electrical distribution system and chle saf systems REFERENCES 1. 10 CFR 50, Appendix A, GDC 17.

2. Regulatory Guide 1.6, March 10, 1971.

3. IEEE-308-1978.

4. FSAR, Chapter 8.

5. IEEE-485-1983, June 1983.

6. FSAR, Chapter 6.

7. FSAR, Chapter 15.

8. Regulatory Guide 1.93, December 1974.

9. IEEE-450-1995.

10. Regulatory Guide 1.32, February 1977.

11. Regulatory Guide 1.129, February 1978.

I CALLAWAY PLANT B 3.8.4-8 Revision

Text Inserts for TS Bases Changes TS Bases Insert I The Note 2 restriction from normally performing the Surveillance In M)DE I or 2 is further amplified to allow portions of the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post-work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concems) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety Is maintained or enhanced when portions of the Surveillance are performed n MODE I or

2. Risk insights or deterministic methods may be used for this assessment.

TS Bases Insert 2 The restriction from normally performing the Surveillance in MODE 2, 3, or 4 Is further amplified to allow the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post-work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated :

OPERABILITY concerns) provided an assessment determines plant safety Is maintained or enhanced. This assessment shall, as a minimum, consider the potental outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when the Surveillance is performed in MODE 1, 2, 3 or 4 Risk insights or deterministic methods may be used for this assessment.

TS Bases Insert 3 The restriction from normally performing the Surveillance In MDDE I or 2 s further amplified to allow portions of the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post-work testing following correctve maintenance, corrective modification, deficient or Incomplete surveillance testing, and other unanticipated OPERABILITY concems) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety Is maintained or enhanced when portions of the Surveillance are performed in MODE I or

2. Risk insights or deterministic methods may beused for this assessment.

TS Bases Insert 4 The restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post-work testing following corrective maintenance, corrective modification, deficient or Incomplete surveillance testing, and other unanticipated OPERABILITY concems) provided an assessment determines plant safety is, maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are ffed together or operated independently for the Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when the Surveillance is performed In MODE I or 2. Risk insights or deterministic methods may be used for this assessment.

TS Bases Insert 5 The restricton from normally performing the Surveillance in MODE 1, 2, 3, or 4 is further amplified to allow portions of the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post-work testing following corrective maintenance, corrective modification, deficient or Incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partal Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the Surveillance are performed In MODE 1, 2, 3, or 4. Risk insights or deterministic methods may be used for this assessment.

ULNRC-04837, License Amendment Request OL-1228 Revision to Technical Specification Surveillance Requirements 3.8.1 and 3.8.4

Contents

Text

Subject:

3.1 DESCRIPTION

1.0 DESCRIPTION

2.0 PROPOSED CHANGE

3.0 BACKGROUND

5.0 REGULATORY ANALYSIS

6.0 ENVIRONMENTAL CONSIDERATION

7.0 REFERENCES

Subject:

Navigation menu

ULNRC-04837, License Amendment Request OL-1228 Revision to Technical Specification Surveillance Requirements 3.8.1 and 3.8.4

Text

Subject:

3.1 DESCRIPTION

1.0 DESCRIPTION

2.0 PROPOSED CHANGE

3.0 BACKGROUND

5.0 REGULATORY ANALYSIS

6.0 ENVIRONMENTAL CONSIDERATION

7.0 REFERENCES

Subject:

Navigation menu

Search