ML18106A007

Issuance of Amendments Regarding Open Phase Protection Per NRC Bulletin 2012 01 (CAC Nos. MF9805, MF9806; EPID L-2017-LLA-0238)

ML18106A007
Person / Time
Site:	Surry
Issue date:	05/03/2018
From:	Cotton K Plant Licensing Branch II
To:	Stoddard D Virginia Electric & Power Co (VEPCO)
Cotton K, NRR/DORL/LPL2-1, 415-1438
References
CAC MF9805, CAC MF9806, EPID L-2017-LLA-0238
Download: ML18106A007 (37)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 May 3, 2018 Mr. Daniel G. Stoddard Senior Vice President and Chief Nuclear Officer Innsbrook Technical Center 5000 Dominion Blvd.

Glen Allen, VA 23060-6711

SUBJECT:

SURRY POWER STATION, UNIT NOS. 1 AND 2, ISSUANCE OF AMENDMENTS REGARDING OPEN PHASE PROTECTION PER NRC BULLETIN 2012-01 (MF9805, MF9806; EPID L-2017-LLA-0238)

Dear Mr. Stoddard:

The U.S. Nuclear Regulatory Commission (the Commission) has issued the enclosed Amendment No. 292 to Renewed Facility Operating License No. DPR-32 and Amendment No. 292 to Renewed Facility Operating License No. DPR-37 for the Surry Power Station, Unit Nos. 1 and 2, respectively. The amendments revise the Technical Specifications (TSs) in response to NRC Bulletin (NRCB) 2012-01, "Design Vulnerability in Electric Power System," as provided in application dated May 23, 2017, as supplemented by letters dated January 16, 2018, and March 14, 2018.

The amendments update the TSs Table 3.7-2 and associated Table Notations, Table 3.7-4 and Table 4.1-1 to reflect the installation of the Class 1E 4160V negative sequence voltage (open phase) protective circuitry at Surry Power Station, Unit Nos. 1 and 2, to address the potential for a consequential open phase condition (OPC) that could exist on one or two phases of a primary off-site power source, and that would not currently be detected and mitigated by the existing station electrical protection scheme.

D. Stoddard A copy of the related Safety Evaluation is also enclosed. The Notice of Issuance will be included in the Commission's biweekly Federal Register notice.

Sincerely,

~~~

Karen Cotton Gross, Project Manager Plant Licensing Branch 11-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket Nos. 50-280 and 50-281

Enclosures:

1. Amendment No. 292 to DPR-32

2. Amendment No. 292 to DPR-37

3. Safety Evaluation cc: Listserv

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 VIRGINIA ELECTRIC AND POWER COMPANY DOCKET NO. 50-280 SURRY POWER STATION, UNIT NO. 1 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 292 Renewed License No. DPR-32

1. The Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment by Virginia Electric and Power Company (the licensee) dated May 23, 2017, as supplemented by letters dated January 16, 2018, and March 14, 2018, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

Enclosure 1

2. Accordingly, the license is amended by changes to the Technical Specifications as indicated in the attachment to this license amendment, and paragraph 3.B of Renewed Facility Operating License No. DPR-32 is hereby amended to read as follows:

B. Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 292, are hereby incorporated in the renewed license. The licensee shall operate the facility in accordance with the Technical Specifications.

3. This license amendment is effective as of its date of issuance and shall be implemented at the completion of the Unit 1 Spring 2018 refueling outage.

FOR THE NUCLEAR REGULATORY COMMISSION

~~.~

Michael T. Markley, Chief Plant Licensing Branch 11-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

Attachment:

Changes to License No. DPR-32 and the Technical Specifications Date of Issuance: May 3, 2018

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 VIRGINIA ELECTRIC AND POWER COMPANY DOCKET NO. 50-281 SURRY POWER STATION, UNIT NO. 2 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 292 Renewed License No. DPR-37

1. The Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment by Virginia Electric and Power Company (the licensee) dated May 23, 2017, as supplemented by letters dated January 16, 2018, and March 14, 2018, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

Enclosure 2

2. Accordingly, the license is amended by changes to the Technical Specifications as indicated in the attachment to this license amendment, and paragraph 3.8 of Renewed Facility Operating License No. DPR-37 is hereby amended to read as follows:

B. Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 292, are hereby incorporated in this renewed license. The licensee shall operate the facility in accordance with the Technical Specifications.

3. This license amendment is effective as of its date of issuance and shall be implemented at the completion of the Unit 2 Fall 2018 refueling outage.

FOR THE NUCLEAR REGULATORY COMMISSION Michael T. Markley, Chief Plant Licensing Branch 11-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

Attachment:

Changes to License No. DPR-37 and the Technical Specifications Date of Issuance May 3, 2 o1 8

ATTACHMENT TO SURRY POWER STATION, UNIT NOS. 1 AND 2 LICENSE AMENDMENT NO. 292 RENEWED FACILITY OPERATING LICENSE NO. DPR-32 DOCKET NO. 50-280 AND LICENSE AMENDMENT NO. 292 RENEWED FACILITY OPERATING LICENSE NO. DPR-37 DOCKET NO. 50-281 Replace the following pages of the Licenses and the Appendix A Technical Specifications (TSs) with the attached revised pages. The revised pages are identified by amendment number and contain marginal lines indicating the areas of change.

Remove Pages Insert Pages License License License No. DPR-32, page 3 License No. DPR-32, page 3 License No. DPR-37, page 3 License No. DPR-37, page 3 TSs TSs TS 3.7-20 TS 3.7-20 TS 3.7-20a TS 3.7-24a TS 3.7-26 TS 3.7-26 TS 3.7-26a TS 4.1-Ba TS 4.1-Ba TS 4.1-8b

3. This renewed license shall be deemed to contain and is subject to the conditions specified in the following Commission regulations: 10 CFR Part 20, Section 30.34 of 10 CFR Part 30, Section 40.41 of 10 CFR Part 40, Sections 50.54 and 50.59 of 10 CFR Part 50, and Section 70.32 of 10 CFR Part 70; and is subject to all applicable provisions of the Act and the rules, regulations, and orders of the Commission now or hereafter in effect; and is subject to the additional conditions specified below:

A. Maximum Power Level The licensee is authorized to operate the facility at steady state reactor core power levels not in excess of 2587 megawatts (thermal).

B. Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 292 are hereby incorporated in the renewed license. The licensee shall operate the facility in accordance with the Technical Specifications.

C. Reports The licensee shall make certain reports in accordance with the requirements of the Technical Specifications.

D. Records The licensee shall keep facility operating records in accordance with the requirements of the Technical Specifications.

E. Deleted by Amendment 65 F. Deleted by Amendment 71 G. Deleted by Amendment 227 H. Deleted by Amendment 227 I. Fire Protection The licensee shall implement and maintain in effect the provisions of the approved fire protection program as described in the Updated Final Safety Analysis Report and as approved in the SER dated September 19, 1979, (and Supplements dated May 29, 1980, October 9, 1980, December 18, 1980, February 13, 1981, December 4, 1981, April 27, 1982, November 18, 1982, January 17, 1984, February 25, 1988, and Surry - Unit 1 Renewed License No. DPR-32 Amendment No. 292

E. Pursuant to the Act and 10 CFR Parts 30 and 70, to possess, but not separate, such by product and special nuclear materials as may be produced by the operation of the facility.

3. This renewed license shall be deemed to contain and is subject to the conditions specified in the following Commission regulations: 10 CFR Part 20, Section 30.34 of 10 CFR Part 30, Section 40.41 of 10 CFR Part 40, Sections 50.54 and 50.59 of 10 CFR Part 50, and Section 70.32 of 10 CFR Part 70; and is subject to all applicable provisions of the Act and the rules, regulations, and orders of the Commission now or hereafter in effect; and is subject to the additional conditions specified below:

A. Maximum Power Level The licensee is authorized to operate the facility at steady state reactor core power Levels not in excess of 2587 megawatts (thermal)

B. Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 292 are hereby incorporated in this renewed license. The licensee shall operate the facility in accordance with the Technical Specifications.

C. Reports The licensee shall make certain reports in accordance with the requirements of the Technical Specifications.

D. Records The licensee shall keep facility operating records in accordance with the Requirements of the Technical Specifications.

E. Deleted by Amendment 54 F. Deleted by Amendment 59 and Amendment 65 G. Deleted by Amendment 227 H. Deleted by Amendment 227 Surry - Unit 2 Renewed License No. DPR-37 Amendment No. 292

TABLE 3.7-2 (Continued)

ENGINEERED SAFEGUARDS ACTION INSTRUMENT OPERATING CONDITIONS Minimum Permissible Total Number OPERABLE Channels Bypass Operator Functional Unit Of Channels Channels To TriQ Conditions Actions

3. AUXILIARY FEEDWATER (continued)

e. Trip of main feedwater pumps - start motor driven 2/MFWpump 1/MFWpump 2-1 each 24 pumps MFWpump

f. Automatic actuation logic 2 2 1 22

4. LOSS OF POWER

a. 4.16 kv emergency bus undervoltage (loss of voltage) 3/bus 2/bus 2/bus 26

b. 4.16 kv emergency bus undervoltage (degraded voltage) 3/bus 2/bus 2/bus 26

c. 4.16 kv emergency bus negative sequence voltage (open 3/bus 2/bus 2/bus 27 phase)

5. NON-ESSENTIAL SERVICE WATER ISOLATION

a. Low intake canal level* 4 3 3 20

b. Automatic actuation logic 2 2 1 14

6. ENGINEERED SAFEGAURDS ACTUATION INTERLOCKS - Note A

a. Pressurizer pressure, P-11 3 2 2 23

b. Low-low Tavg, P-12 3 2 2 23

c. Reactor trip, P-4 2 2 1 24

7. RECIRCULATION MODE TRANSFER

a. RWST Level - Low-Low* 4 3 2 25

b. Automatic Actuation Logic and Actuation Relays 2 2 1 14 Note A - Engineered Safeguards Actuation Interlocks are described in Table 4.1-A

• There is a Safety Analysis Limit associated with this ESF function. If during calibration the setpoint is found to be conservative with

> respect to the Setting Limit but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined

~

i calibration tolerance before returning the channel to service. The calibration tolerances are specified in a document controlled under 10 CFR 50.59.

~g '""3 Cl) w z

0

...:i N

I er, 0

N

'° N

§ 0..

N

'° N

TABLE 3.7-2 (Continued)

ENGINEERED SAFEGUARDS ACTION INSTRUMENT OPERATING CONDITIONS Minimum Permissible Total Number OPERABLE Channels Bypass Operator Functional Unit Of Channels Channels To Tri12 Conditions Actions

8. RECIRCULATION SPRAY

a. RWST Level - Low Coincident with High High 4 3 2 20 Containment Pressure*

b. Automatic Actuation Logic and Actuation Relays 2 2 1 14

• There is a Safety Analysis Limit associated with this ESF function. If during calibration the setpoint is found to be conservative with respect to the Setting Limit but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The calibration tolerances are specified in a document controlled under 10 CFR 50.59.

3 g

0.. ~

3

('I) en w

~ ~

z 0

N 0

I

" i:,;

N

'°N

§ 0..

N

'° N

TS 3.7-24a TABLES 3.7-2 ANDS 3.7-3 (Continued)

TABLE NOTATIONS ACTION 27. With the number of OPERABLE channels less than the Total Number of Channels, the negative sequence voltage (open phase) protection function may be considered OPERABLE provided the following conditions are satisfied:

a. The inoperable channel is placed in the tripped condition within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

Note: Action 27 .a does not apply if the negative sequence voltage (open phase) protection function cannot be performed.

b. The Minimum OPERABLE Channels requirement is met; however, the inoperable channel may be bypassed for up to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for surveillance testing of other channels per Specification 4.1.

c. If the negative sequence voltage (open phase) protection function cannot be performed (e.g., the Potential Transformer Blocking Device is tripped),

the negative sequence voltage (open phase) protection function does not have to be declared inoperable provided verification is performed at least once per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> that an open phase condition does not exist on the primary side of transformer TX-2, transformer TX-4, and the Reserve Station Service Transformers, as well as the Unit I/Unit 2 Main Step-up Transformers when power is supplied by the dependable alternate source.

The negative sequence voltage (open phase) protection function shall be restored within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

If the conditions are not satisfied, restore the protection function within 7 days or be in at least HOT SHUTDOWN within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

Amendment Nos. 292 and 292

TABLE3.7-4 ENGINEERED SAFETY FEATURE SYSTEM INITIATION LIMITS INSTRUMENT SETTING No. Functional Unit Channel Action Setting Limit 6 AUXILIARY FEEDWATER

a. Steam Generator Water Level Aux. Feedwater Initiation z 16.0% narrow range Low-Low* SIG Blowdown Isolation

b. RCP Undervoltage Aux. Feedwater Initiation z 70% nominal C. Safety Injection Aux. Feedwater Initiation All S.I. setpoints

d. Station Blackout Aux. Feedwater Initiation z 46.7% nominal

e. Main Feedwater Pump Trip Aux. Feedwater Initiation N.A.

7 LOSS OF POWER

a. 4.16 KV Emergency Bus Undervoltage Emergency Bus Separa- z 2975 volts and~ 3265 volts with a 2 (+5, -0.1)

(Loss of Voltage) tion and Diesel start second time delay

b. 4.16 KV Emergency Bus Undervoltage Emergency Bus Separa- 2 3830 volts and~ 3881 volts with a 60 (+/-3.0)

(Degraded Voltage) tion and Diesel start second time delay (Non CLS, Non SI) 7 (+/-0.35) second time delay (CLS or SI Conditions)

c. 4.16 KV Emergency Bus Negative Emergency Bus Separa- ~ 7% voltage imbalance Sequence Voltage (Open Phase) tion and Diesel start 8 NON-ESSENTIAL SERVICE WATER ISOLATION

a. Low Intake Canal Level* Isolation of Service Water 23 feet-5.85 inches flow to non-essential loads 9 RECIRCULATION MODE TRANSFER

a. RWST Level-Low-Low* Initiation of Recirculation 212.7%

Mode Transfer System ~ 14.3%

10 TURBINE TRIP AND FEEDWATER ISOLATION

i>- a. Steam Generator Water Level Turbine Trip ~ 76% narrow range

~

0..

High-High* Feedwater Isolation iz

• There is a Safety Analysis Limit associated with this ESF function. If during calibration the setpoint is found to be conservative with respect to the Setting Limit but outside its predefined calibration tolerance, then the channel shall be brought back to within its

>-3 Cl) w

...:i 0

en predefined calibration tolerance before returning the channel to service. The calibration tolerances are specified in a document N I

N controlled under 10 CFR 50.59. 0\

I.O N

§ 0..

N I.O N

TABLE 3.7-4 ENGINEERED SAFETY FEATURE SYSTEM INITIATION LIMITS INSTRUMENT SETTING No. Functional Unit Channel Action Setting Limit 11 RWST Level Low (coincident with High Recirculation Spray Pump ~59%

High Containment Pressure)* Start  ::;;61%

• There is a Safety Analysis Limit associated with this ESP function. If during calibration the setpoint is found to be conservative with respect to the Setting Limit but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The calibration tolerances are specified in a document controlled under 10 CPR 50.59.

~::s 0..

~::s >-3 Cl)

..... w z0 -...J N

I N

I.O

°'

~

N

§ 0..

N I.O N

TABLE 4.1-1 (Continued)

MINIMUM FREQUENCIES FOR CHECK, CALIBRATIONS AND TEST OF INSTRUMENT CHANNELS Channel Description Check Calibrate Test Remarks

32. Auxiliary Feedwater

a. Steam Generator Water Level Low-Low SFCP SFCP SFCP (1) 1) The auto start of the turbine driven pump is not included in the periodic test, but is tested within 31 days prior to each startup.

b. RCP Undervoltage SFCP SFCP SFCP (1)(2) 1) The actuation logic and relays are tested within 31 days prior to each startup.

2) Setpoint verification not required.

c. S.I. (All Safety Injection surveillance requirements)

d. Station Blackout N.A. SFCP N.A.

e. Main Feedwater Pump Trip N.A. N.A. SFCP

33. Loss of Power

a. 4.16 KV Emergency Bus Undervoltage N.A. SFCP SFCP (1) 1) Setpoint verification not required.

(Loss of Voltage)

b. 4.16 KV Emergency Bus Undervoltage N.A. SFCP SFCP (1) 1) Setpoint verification not required.

(Degraded Voltage)

c. 4.16 KV Emergency Bus Negative N.A SFCP SFCP (1) 1) Setpoint verification not required.

Sequence Voltage (Open Phase)

34. Deleted

35. Manual Reactor Trip N.A. N.A. SFCP The test shall independently verify the operability of the undervoltage and shunt trip attachments for the manual reactor trip function.

The test shall also verify the operability of the bypass breaker trip circuit.

> 36. Reactor Trip Bypass Breaker N.A. N.A. SFCP (1), 1) Remote manual undervoltage trip sg SFCP (2) immediately after placing the bypass 0..

breaker into service, but prior to commencing reactor trip system testing or

~ cA

-z 0

[JO required maintenance.

2) Automatic undervoltage trip.

~

00 I

~

N

\0 N

§ 0..

N

\0 N

TABLE 4.1-1 (Continued)

MINIMUM FREQUENCIES FOR CHECK, CALIBRATIONS AND TEST OF INSTRUMENT CHANNELS Channel Description Check Calibrate Test Remarks

37. Safety Injection Input to RPS N.A. N.A. SFCP

38. Reactor Coolant Pump Breaker N.A. N.A. SFCP Position Trip

39. Steam/Feedwater Flow and Low SIG SFCP SFCP SFCP (1) 1) The provisions of Specification 4.0.4 are not Water Level applicable

40. Intake Canal Low (See Note 1) SFCP SFCP SFCP (1), 1) Logic Test SFCP (2) 2) Channel Electronics Test

41. Turbine Trip and Feedwater Isolation

a. Steam generator water level high SFCP SFCP SFCP

b. Automatic actuation logic and N.A. SFCP SFCP (1) 1) Automatic actuation logic only, actuation relays actuation relay tested each refueling

42. Reactor Trip System Interlocks

a. Intermediate range neutron flux, N.A. SFCP (1) SFCP (2) 1) Neutron detectors may be excluded from the P-6 calibration

b. Low reactor trips block, P-7 N.A. SFCP (1) SFCP (2) 2) The provisions of Specification 4.0.4 are not applicable.

c. Power range neutron flux, P-8 N.A. SFCP (1) SFCP (2)

d. Power range neutron flux, P-10 N.A. SFCP (1) SFCP (2)

e. Turbine impulse pressure N.A. SFCP SFCP 3

CD i:l 0..

3 CD >-3 en

....i:l z0 N

+>-

I 00 O"'

I.O N

§ 0..

N I.O N

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO. 292 TO RENEWED FACILITY OPERATING LICENSE NO. DPR-32 AND AMENDMENT NO. 292 TO RENEWED FACILITY OPERATING LICENSE NO. DPR-37 VIRGINIA ELECTRIC AND POWER COMPANY SURRY POWER STATION, UNIT NOS. 1 AND 2 DOCKET NOS. 50-280 AND 50-281

1.0 INTRODUCTION

By letter dated May 23, 2017 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML17150A302), as supplemented by letters dated January 16, 2018 (ADAMS Accession No. ML18023A403) and March 14, 2018 (ADAMS Accession No. ML18075A328), Virginia Electric and Power Company (the licensee) submitted a request for changes to the Surry Power Station (Surry), Unit Nos. 1 and 2, Technical Specifications (TSs).

The requested changes would add operability requirements required actions, instrument settings, and surveillance requirements (SRs) to the TSs for the 4160 Volt (V) emergency bus negative sequence voltage (open phase) protection function. The supplements dated January 16, 2018 and March 14, 2018, provided additional information that clarified the application, did not expand the scope of the application as originally noticed, and did not change the U. S. Nuclear Regulatory Commission (NRC, the Commission) staff's original proposed no significant hazards consideration determination as published in the Federal Register on October 10, 2017 (82 FR 47040).

The proposed changes would revise the TS Table 3.7-2 and associated Table Notations, Table 3.7-4 and Table 4.1-1 to reflect the implementation of a Class 1E 4160V negative sequence voltage (open phase) protective circuitry at Surry, Unit Nos. 1 and 2, to address the potential for a consequential open phase condition (OPC) that could exist on one or two phases of a primary off-site power source and that would not currently be detected and mitigated by the existing station electrical protection scheme.

Enclosure 3

2.0 REGULATORY EVALUATION

The NRC staff considered the following NRC regulations in the evaluation of the proposed license amendment request (LAR):

• Surry Power Station Updated Final Safety Analysis Report (UFSAR), Section 1.4, provides, in part, that Surry was designed to meet the intent of the "Proposed General Design Criteria for Nuclear Power Plant Construction Permits" published in July 1967.

The Surry construction permits were issued prior to May 1971. This UFSAR, however, addresses the NRC General Design Criteria (GDC) published as Appendix A to Title 10 of the Code of Federal Regulations (10 CFR) Part 50 in July 1971. GDC 17 of 10 CFR Part 50, Appendix A, establishes requirements for the electric power system design of power plants. The Surry UFSAR, Criterion 1.4.24, "Emergency Power for Protection Systems" and Criterion 1.4.39, "Emergency Power for Engineered Safeguards," set forth plant-specific criteria similar to GDC 17. The following criteria relating to onsite and offsite electric power are applicable to Surry:

o UFSAR 1.4.24, "Emergency Power for Protection Systems," states, in part, that:

In the event of loss of all offsite power, sufficient alternative sources of power are provided to permit the required functioning of the protection systems.

o UFSAR 1.4.39, "Emergency Power for Engineered Safeguards," states, in part, that:

Alternative power systems are provided and designed with adequate independence, redundancy, capacity, and testability to permit the functioning required of the engineered safeguards. As a minimum, the onsite power system and the offsite power system each, independently, provide this capacity, assuming the failure of a single active component in each power system.

o 10 CFR 50.36(c)(2), "Limiting conditions for operation," provides the requirement for the establishment of TS limiting conditions for operation (LCOs). Specifically, a TS LCO of a nuclear reactor must be established for each item meeting one or more of the criteria of 10 CFR 50.36(c)(2)(ii). Criterion 3 states that a structure, system, or component

[SSC] that is part of the primary success path and which functions or actuates to mitigate ~ design basis accident [DBA] or transient that either assumes the failure of or presents a challenge to the integrity of a fission product barrier.

• 10 CFR 50.36(c)(3), "Surveillance requirements," states, "Surveillance requirements are requirements relating to test, calibration, or inspection to assure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions for operation will be met."

• The regulation at 10 CFR 50.55a(h)(2), "Protection systems," states, "For nuclear power plants with construction permits issued after January 1, 1971, but before May 13, 1999, protection systems must meet the requirements in IEEE [Institute of Electrical and

Electronics Engineers] Std [Standard] 279-1968, 'Proposed IEEE Criteria for Nuclear Power Plant Protection Systems,' or the requirements in IEEE Std 279-1971, Criteria for Protection Systems for Nuclear Power Generating Stations, or the requirements in IEEE Std 603-1991, "Criteria for Safety Systems for Nuclear Power Generating Stations," and the correction sheet dated January 30, 1995. For nuclear power plants with construction permits issued before January 1, 1971, protection systems must be consistent with their licensing basis or may meet the requirements of IEEE Std. 603-1991 and the correction sheet dated January 30, 1995." The construction permits for Surry, Unit Nos. 1 and 2, were issued prior to January 1, 1971. Consequently, its protection systems must be consistent with their licensing basis.

• In Section 6.0, "Conclusion," of the licensee's submittal dated May 23, 2017, the licensee stated, in part, "The design function of the Emergency Power System and the station's compliance with GDC 17 are being enhanced by the proposed change as it facilitates the detection of and protection from an OPC on the primary off-site power source." Therefore, the NRC staff review of the Surry electric power distribution system considered the current GDC 17 requirements specific to the proposed OPC modifications.

10 CFR Part 50, Appendix A, GDC 17, "Electric power systems," states, in part, that the electric power system shall provide sufficient capacity and capability to assure that (1) specified acceptable fuel design limits and design condition of the reactor coolant pressure boundary are not exceeded as a result of anticipated operational occurrences and (2) the core is cooled and containment integrity and other vital function are maintained in the event of postulated accidents, and sufficient independence, redundancy, and testability to perform their safety function assuming a single failure and provisions shall be included to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit, the loss of power from the transmission network, or the loss of power from the onsite electric power supplies.

The NRC staff also considered the following guidance:

• NRC Branch Technical Position (BTP) 8-9, "Open Phase Conditions in Electric Power System" (ADAMS Accession No. ML15057A085). The purpose of this BTP is to provide guidance to the staff in reviewing various licensing actions related to electric power system design vulnerabilities due to open phase conditions in offsite electric power systems in accordance with Appendix A to 10 CFR Part 50, GDC 17, or principal design criteria specified in the updated final safety analysis report, 10 CFR 50.55a(h)(2),

10 CFR 50.55a(h)(3), and 10 CFR 50.36(c)(2) and 10 CFR 50.36(c)(3).

IEEE Std. 279, "Criteria for Protection Systems for Nuclear Power Generating Stations."

• IEEE Std. 308-1974, "IEEE Standard Criteria for Class IE Power Systems for Nuclear Power Generating Stations."

• Regulatory Guide (RG) 1.105, Revision 3, "Setpoints for Safety-Related Instrumentation,"

dated December 1999 (ADAMS Accession No. ML993560062), which describes a method acceptable to the NRC staff for complying with the NRC's regulations for

ensuring that setpoints for safety-related instrumentation are initially within and remain within the TS limits. RG 1.105 endorses Part 1 of Instrument Society of America (ISA)

Standard (S) 67.04-1994, "Setpoints for Nuclear Safety-Related Instrumentation." This standard provides a basis for establishing setpoints for nuclear instrumentation for safety systems and addresses known contributing errors in a particular channel from the process (including the primary element and sensor) through and including the final setpoint device.

• On July 27, 2012, the NRC issued NRC Bulletin 2012-01, "Design Vulnerability in Electric Power System," states in part, to: (1) request information regarding each facility's electric power system design in light of the recent operating experience that involved the loss of one of the three phases of the offsite power circuit at Byron Station, Unit 2; and (2) require that the licensees comprehensively verify compliance with the regulatory requirements of GDC 17 or the applicable principal design criteria in the updated final safety analysis report, and the design criteria for protection systems under 10 CFR Part 50.55a(h)(2) and 10 CFR Part 50.55a(h)(3).

3.0 TECHNICAL EVALUATION

3.1 Electric System Design and Operation In its letter dated October 24, 2012 letter (ADAMS Accession No. ML12305A017), the licensee responded to the NRC Bulletin 12-01 for Surry and other Dominion operated plants. By letter dated December 20, 2013 (ADAMS Accession No. ML13351A314), the NRC requested additional information to verify that licensees have completed interim corrective actions and compensatory measures, and to determine the status of each licensee's long-term corrective actions. The licensee provided its response for Surry in Attachment 2 to a letter dated February 3, 2014 (ADAMS Accession No. ML14035A458). In that letter, the licensee stated that, "The Dominion nuclear fleet plants committed to the generic schedule provided in the Industry OPC Initiative. In this letter, the licensee has revised its schedule for completion of functionality for all applicable transformers, which assumes that viable solution for both voltage-based and current-based solutions have been developed and tested by December 31.

2014, is now December 31, 2019, for Surry Station." The new schedule date reflects the proposed installation of the equipment needed to support a license amendment to implement OPC design changes.

In Section 3.3.1, of its LAR dated May 23, 2017, the licensee proposed to install a Class 1E protective relaying scheme on the Engineered Safety Features (ESF) buses that will detect consequential OPCs that are not readily detectable by the existing electrical system protection scheme. The proposed Surry Class 1E solution consists of the installation of 12 voltage unbalance (negative sequence) Basler BE1-47N relays that will provide consequential OPC detection and protection on the 4160V Emergency Switchgear buses. The relays will be configured in a two out of three logic scheme that will detect consequential OPCs, trigger an annunciator in the control room indicating an OPC exists, and automatically initiate protective actions to mitigate the event. A blocking feature is also being included in the logic scheme to enhance the reliability of the protection system and to prevent inadvertent actuation in the event of a failed or degraded potential transformer {PT).

In addition, the licensee proposed to install a non-Class 1E protective relaying scheme on the primary-side of Transformer TX-1 located in the switchyard. As described in Section 3.3.3 of

the LAR, this installation is necessary due to undetected OPCs (OPCs above the 1 percent unbalance threshold and below the Basler relay capabilities) that result in a negative sequence voltage between 1 percent and 3.66 percent on the safety buses when the offsite power is fed from Transformer TX-1. In Section 4.1 of the LAR, the licensee states that it is currently planning to complete the Surry, Unit Nos. 1 and 2, OPC modifications by the completion of the 2018 fall Unit No. 2 refueling outage, which would meet the December 31, 2018, completion date specified in the NEI Initiative.

3.2 Description of Proposed Changes By letter dated May 23, 2017, the licensee submitted a request for changes to the Surry, Unit Nos. 1 and 2, TSs that would add operability requirements, required actions, instrument settings, and SRs to the TSs for the installation of the 4160V emergency bus negative sequence voltage (open phase) protection function for Surry, Unit Nos. 1 and 2. The proposed changes would complete the actions required to resolve the issues identified in Bulletin 2012-01. The licensee proposed the following changes to the TSs:

• Insert new item 4.c in TS Table 3.7-2, "Engineered Safeguards Action Instrument Operating Conditions," which would state:

Total Minimum Channels Permissible Operator Functional Unit Number Operable to Trip Bypass Actions of Channels Conditions Channels C. 4.16kv [Kilovolt] 3/bus 2/bus 2/bus 27 emergency bus negative sequence voltage (open phase)

• Revise Table Notations of TS Tables 3.7-2 and 3.7-3 by inserting new Action 27, which would state:

ACTION 27. With the number of OPERABLE channels less than the Total Number of Channels, the negative sequence voltage (open phase) protection function may be considered OPERABLE provided the following conditions are satisfied:

a. The inoperable channel is placed in the tripped conditions within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

Note: Action 27.a does not apply if the negative sequence voltage (open phase) protection function cannot be performed.

b. The Minimum OPERABLE Channels requirement is met; however, the inoperable channel may be bypassed for up to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for surveillance testing of other channels per Specification 4.1.

c. If the negative sequence voltage (open phase) protection function cannot be performed (e.g., the Potential Transformer Blocking Device is tripped), the negative sequence voltage

{open phase) protection function does not have to be declared inoperable provided verification is performed at least once per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> that an open phase condition does not exist on the primary side of transformer TX-2, transformer TX-4, and the Reserve Station Service Transformers, as well as the Unit 1/Unit 2 Main Step-up Transformers when power is supplied by the dependable alternate source. The negative sequence voltage (open phase) protection function shall be restored within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

If the conditions are not satisfied, be in at least HOT SHUTDOWN within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

• Insert new item 7.c, in TS Table 3.7-4, "Engineered Safety Feature System Initiation Limits Instrument Setting," which would state:

Functional Unit Channel Action Setting Limit C. 4.16kv Emergency Bus Negative Emergency Bus s 7% voltage Sequence Voltage (Open Phase) Separation and Diesel imbalance start

• Insert new item 33.c, in TS Table 4.1-1, "Minimum Frequencies for Check, Calibrations and Test of Instrument Channels," which would state:

Channel Description Check Calibrate Test Remarks C. 4.16kv Emergency N.A. SFCP SFCP 1) Setpoint Bus Negative [Surveillance (1) verification Sequence Voltage Frequency not (Open Phase) Control required.

Program]

3.3 NRC Staff's Technical Evaluation of Methodology Plant-specific design criteria is provided in UFSAR Sections 1.4.24 and 1.4.39. BTP 8-9 provides guidance to the NRC staff for reviewing licensing actions related to electric power system design vulnerabilities in an open phase condition. Specifically, the guidance in BTP 8-9 has the following criteria:

For operating reactors and new reactors with active design safety features, reviewed under 10 CFR Part 50 and 10 CFR Part 52, "Licenses, Certifications, and Approvals for Nuclear Power Plants," the following criteria should be satisfied when evaluating OPCs:

a. The OPC should be automatically detected and alarmed in the main control room under all operating electrical system configurations and plant loading conditions. The detection circuits should be sensitive enough to identify OPCs under all operating electrical system

configurations and plant loading conditions for which the offsite power supplies are required to be operable in accordance with plant technical specifications (TSs) for safe shutdown.

The detection circuit should minimize spurious indications for an operable offsite power source in the range of voltage perturbations such as switching surges, transformer inrush currents, load or generation variations, lightning strikes, etc., normally expected in the transmission system. If the plant auxiliaries are supplied from the main generator and the offsite power circuit to the ESF bus is configured as a standby power source, then any failure (i.e., OPC) should be alarmed in the main control room for operators to take corrective action within a reasonable time. In such cases, the consequences of not immediately isolating the degraded power source should be evaluated to demonstrate that any BTP 8-9-5 Revision O- July 2015 subsequent design bases conditions that rely on offsite power circuit(s) for safe shutdown do not create plant transients or abnormal operating conditions. Also, the remaining power source(s) can be connected to the ESF buses within the time assumed in the accident analysis.

b. If offsite power circuit(s) is (are) functionally degraded due to OPCs, and safe shutdown capability is not assured, then the ESF buses should be designed to be transferred automatically to the alternate reliable offsite power source or onsite standby power system within the time assumed in the accident analysis and without actuating any protective devices, given a concurrent design basis event.

c. The design of protection features for OPCs should address the following:

(i) Power quality issues caused by OPCs such as unbalanced voltages and currents, sequence voltages and currents, phase angle shifts, and harmonic distortion that could affect redundant ESF buses. The ESF loads should not be subjected to power quality conditions specified in industry standards such as Institute of Electrical and Electronic Engineers (IEEE) Standard (Std) 308-2001, "Criteria for Class 1E Power Systems for Nuclear Power Generating Stations," Section 4.5, "Power Quality," with respect to the design and operation of electrical systems as indicated in Regulatory Guide (RG) 1.32 "Criteria for Power Systems for Nuclear Plants."

(ii) Protection scheme should comply with applicable requirements including single failure criteria for ESF systems as specified in 10 CFR Part 50, Appendix A, GDC17, and 10 CFR 50.55a(h)(2) or 10 CFR 50.55a(h)(3), which require compliance with IEEE Std 279-1971 "Criteria for Protection Systems for Nuclear Power Generating Stations" or IEEE Std 603-1991, "Standard Criteria for Safety Systems for Nuclear Power Generating Stations." RG 1.153, "Criteria for Power, Instrumentation, and Control Portions of Safety Systems," provides additional guidance on this topic.

If protective features are provided in a non-Class 1E system only, a failure of the non-Class 1E scheme should not preclude the onsite electrical power system from performing its safety function given a single failure in the onsite power system.

(iii) Protection scheme design should minimize misoperation, maloperation, and spurious actuation of an operable off-site power source. Additionally, the protective scheme should not separate the operable off-site power source in the range of voltage perturbations such as switching surges, load or generation variations etc.,

normally expected in the transmission system.

(iv) The unbalanced voltage/current conditions for ESF components expected during various operating and loading conditions should not exceed motor manufacturer's recommendations. The International Electrotechnical Commission (IEC) Standard IEC 60034-26, National Electrical BTP 8-9-6 Revision O - July 2015 Manufacturers Association (NEMA) Standard (MG 1) Parts 14.36 and 20.24, and IEEE Std C37.96-2012 (Guide for AC Motor Protection), Section 5.7.2.6, "Unbalanced Protection and Phase Failures," may be used for general guidance.

Technical Specification Surveillance Requirements and Limiting Conditions of Operation for equipment used for mitigation of OPCs should be identified and implemented consistent with the operability requirements specified in the plant TSs and in accordance with 10 CFR 50.36(c)(2) and 10 CFR 50.36(c)(3). RG 1.93 "Availability of Electric Power Sources," provides additional guidance on this topic.

Licensee Methodology In its letter dated May 23, 2017 the licensee stated, in part, that:

Based on the current licensing basis and 10 CFR Part 50, Appendix A, GDC 17 requirements, and the issuance of NRC Bulletin 2012-01, the licensee determined that the existing protection circuitry of Surry may not detect some consequential single or double OPCs on an off-site power source. This design vulnerability could result in the affected off-site power source being unable to supply sufficient power to perform its safety function. The design needs to ensure that the negative sequence voltage (open phase) function will not spuriously actuate for minor voltage imbalances that may be present during normal operating conditions.

Based on an analysis of the historical phase voltage differentials, using the Electromagnetic Transients Program - Restructured Version (EMTP-RV), and under the potential OPC conditions that are described in sections 3.1.1 to 3.1.4 of the LAR, the licensee calculated the maximum historical negative sequence voltage on buses 1H, 2H, 1J, and 2J for steady-state grid imbalance as 4.20V as measured on the instrument side of the phase potential transformers. The resulting value from this calculation is less than the minimum negative sequence voltage relay pickup including a calculated channel statistical allowance (CSA), which is 4.28V for buses 1J and 2J and 5.35V for buses 1H and 2H. Therefore, the relays would not be expected to spuriously pick up on a maximum expected steady-state grid imbalance of 4.20V.

Based on the maximum and minimum historical steady-state negative sequence voltages of buses 1H, 1J, 2H, and 2J that are provided in Table 1, "Summary of Negative Sequence Voltages of Open Phase Conditions on Each Transformer," of the LAR, the licensee performed a calculation to determine the appropriate CSA for the Basler BE1-47N voltage phase sequence relays, and evaluated the uncertainty of the instrument channel, as compared to the historical lowest and highest differential of the negative phase sequence voltages that have occurred during plant operation. Based on this evaluation, a setpoint of 6 percent(%) of nominal voltage (120 VAC) for the Basler BE1-47N relay was selected by the licensee.

The above 4 criteria and methodology proposes to satisfy the design requirements needed to address OPC at Surry, Unit Nos. 1 and 2.

3.4 NRC Staff's Technical Evaluation of OPC Detection and Alarm Features The NRC staff reviewed the licensee's LAR and proposed modifications to Surry's electrical design in accordance with BTP 8-9. In particular, the staff evaluated features to automatically detect and alarm in the MCR due to the occurrence of an OPC event under expected operating electrical system configurations and plant loading conditions.

In order to achieve automatic detection of OPC in the offsite power system of the plant, the detection schemes have to be sensitive enough to identify OPCs for all operating electrical system configurations and loading conditions. In Section 3.1.2 of the submittal dated May 23, 2017, "Open Phase Location Considered," the licensee listed that analyses were performed based on OPC occurring on the high voltage side terminals of the preferred and alternate power transformers. BTP 8-9, Section B states that licensees should "have considered all potential OPCs on the high voltage and low voltage side of transformers and interconnecting onsite auxiliary power circuits. Any connections that are not evaluated should be documented with an adequate justification." In request for additional information (RAI) No. 2 (ADAMS Accession No. ML17313A063), the NRC staff requested the licensee to indicate how the low voltage side of each transformer was considered as part of the analyses to determine if the OPC occurring on the high voltage side of the transformers are the bounding conditions. In a letter dated January 16, 2018 (ADAMS Accession No. ML18023A403), the licensee stated that due to the electrical configuration of the transformers, (Reserve Station Service Transformer (RSST)-A, RSST-B, and RSST-C are in series with TX-1, TX-2, and TX-4 transformers) the OPCs that were evaluated on the high voltage side of the RSSTs are the same as the OPCs on the low voltage side of TX-1, TX-2, and TX-4. This is due to the fact that when an OPC occurs on the high voltage side of RSSTs, coupling is not reproduced on the low voltage side of TX-1, TX-2, and TX-4. Therefore, the licensee concluded that an OPC was not considered on the low voltage side of transformers TX-1, TX-2, and TX-4. An OPC was not considered on the low voltage side of RSST-A, RSST-8, or RSST-C because the voltage on the affected phase or phases would not be reproduced by transformer coupling. Instead, a very low voltage on the lost phase would result, which would cause the Basler BE1-47N voltage unbalance relays on the affected safety buses to trip. In addition, the licensee stated that OPCs were not considered on the low voltage side of GSU-1 or GSU-2 (high voltage side of Station Service Transformers (SSTs) 1A, 1B, 1C, 2A, 28, or 2C) because the isolated phase bus construction is not subject to this failure mode.

The NRC staff concludes that with the isolated phase bus configuration each phase conductor is enclosed in its own separate grounded metal housing with each housing being separated from each other. When conductors in separate housings are enclosed there is considerable protection from faults between the generator and the transformer. Therefore, the NRC staff concludes that the licensee's justification for the evaluation of the high voltage and low voltage side of the GSU-1 and GSU-2 transformers are bounding due to its isolated phase bus configuration and its protection against negative voltage imbalances on the bus. The NRC staff concludes that, after reviewing a summary of Calculation EE-0883, Revision 0, "Open Phase Condition Detection Analysis," and the supplemental response, the licensee has considered all potential OPCs occurring on the transformers and it meets the BTP 8-9 criterion for detection features.

In LAR Section 3.1.4, "Loading Conditions Considered," the licensee states that various transformer loading conditions (zero load through maximum) and plant alignments were considered in the analyses. In RAI No. 3, the NRC staff requested the licensee to provide a summary of the worst case analyses, key assumptions used, and the results obtained for all the loading conditions and operating configurations including plant trip(s) followed by bus transfers for OPC events. In a letter dated January 16, 2018, the licensee stated that the open phase analyses, assumptions, and results for all loading conditions and operating configurations that were considered in the analyses are contained in Dominion Calculations EE-0883 and EE-0886.

The NRC staff reviewed a summary of these calculations provided by the licensee in a letter dated March 14, 2018. Some of the key assumptions used in the licensee's analyses include:

• The maximum voltage source models (used to represent the maximum grid source voltage magnitude and maximum short circuit strength at the 230 kV and 500 kV switchyards) are assumed to be infinite sources.

• All transformer impedances are nominal regardless of the tap position.

• Open phase event is assumed to occur coincident with the safety injection (SI)/

consequence limiting safeguards (CLS) signal.

In addition, the NRC staff reviewed the results of the calculations detailed in Table 1 of the licensee's submittal dated May 23, 2017, which provides a summary of the maximum and minimum steady-state negative sequence voltages seen at switchgear Buses 1H, 1J, 2H, and 2J for OPCs on the high voltage side of each transformer considered in the above calculations.

The NRC staff determined that assumptions used in the licensee's analyses, loading conditions, operating configurations, and simulations of plant trips followed by bus transfers for OPC events were reasonable.

In LAR Section 3.3.1, "Class 1E Design Solution," the licensee states that the Class 1E design solution consists of twelve Basler BE1-47N negative sequence relays arranged such that three relays are connected to each of the Emergency Bus PTs. Three negative sequence relays and associated auxiliary relays will be used to develop a two out of three logic scheme such that two or more relays must sense an unbalanced voltage greater than 6 percent to initiate protection of the emergency bus. A feature that blocks actuation of the negative sequence voltage (open phase) protection function is also included in the logic scheme. This feature enhances the reliability of the protection system and prevents the protection scheme from actuating in the event of a failed or degraded PT. To achieve this feature, one ASEA Brown Boveri (ABB) 60 voltage balance relay is installed per bus. In RAI No. 4, the NRC staff requested the licensee to provide a discussion that clearly demonstrates the negative sequence voltage relay scheme (detection, alarm, and protection) including the feature that blocks actuation of the negative sequence voltage (open phase) protection using the ABB 60 voltage balance relay and how it interfaces with the existing undervoltage (UV) relay protection scheme, which trips the offsite power circuits at the ESF bus level and initiates emergency diesel generator (EDG) starts.

In a letter dated January 16, 2018, the licensee provided a logic diagram of the Emergency Bus 1H negative sequence voltage relay scheme. The licensee has stated that the emergency buses (1 H, 1J, 2H, and 2J) consist of three Basler BE1-47N negative sequence relays connected to each of the emergency bus PTs. In the logic scheme, the licensee has installed a feature that blocks the open phase protection scheme from actuating in the event of a failed or degraded 4kV bus PT. To achieve this feature, one ABB 60 voltage balance relay is installed per bus. The relay compares 4kV emergency bus PT voltages with 480V emergency bus PT voltages. The relay contact outputs specific to each voltage source actuate if the given source

reaches the voltage setpoint. If a 4kV PT failure occurs, the relay senses a voltage imbalance and opens an auxiliary relay contact which blocks the open phase protection system. One auxiliary relay contact is also used to operate a white light on the front of the relay panel and provides a Plant Computer System (PCS) alarm that will alert operators that open phase protection is disabled. The NRC staff evaluated the logic diagram and the licensee's response and determined that the ABB 60 voltage balance relay will not interfere with the existing UV relay protection scheme because the ABB 60 voltage balance relay is designed to only actuate when it senses a discrepancy between the 4kV emergency bus PT voltages and the 480V emergency bus PT voltages on the open phase protection scheme only. The logic diagram demonstrates no interference between the open phase protection scheme and the existing UV relay protection scheme. Therefore, the existing UV relay protection scheme will actuate with a 2 out of 3 logic scheme regardless of the actuation of the emergency bus PT block on the open phase protection scheme. As long as the emergency bus PTs function as designed, the open phase protection scheme will detect consequential OPCs at the safety buses. The licensee stated that the relay logic diagrams for emergency buses 1J, 2H, and 2J are similar in nature.

In Table 2, "Design Compliance with the NEI Open Phase Initiative and NRC BTP 8-9 Guidance," of the LAR, the licensee stated that negative sequence voltage (open phase) protection circuitry will be installed at Surry, Unit Nos. 1 and 2, to enhance the ability of plant operators to identify and respond to an OPC in an offsite, primary power source. OPCs that produce unbalanced voltages above the protective circuitry relay setpoint will result in annunciator alarms in the MCR and on the PCS. Section 2.5, "OPC Relay Surveillance Frequencies," of the LAR states that the negative sequence voltage (open phase) protection function design includes a PCS alarm to alert operators when a relay loses power, suffers a power supply failure, or experiences another failure that deenergizes the relay.

In RAI No. 8, the NRC staff requested the licensee to provide a discussion explaining the setpoints for the alarm and operator actions taken in accordance with plant procedures. In a letter dated January 16, 2018, the licensee stated that when an OPC is sensed and protection of the emergency bus is actuated, and an overhead annunciator is illuminated in the MCR.

When an open phase overhead annunciator is received, the operators will check the bus voltage imbalance and verify that the associated EDG has started and loaded as required.

Operators will determine the cause of the open phase by checking the switchyard status panel and checking the overhead bus work at the RSSTs and switchyard transformers TX-1, TX-2, and TX-4. The NRC staff reviewed the licensee's response and determined that the PCS alarm and operator actions taken meet the intent of the guidance in BTP 8-9 regarding automatic detection and providing alarm in the control room.

The NRC staff concludes that the proposed electrical design features satisfy the guidance provided in BTP 8-9 as it relates to automatic OPC detection and alarm in the MCR because the design features of the proposed safety-related and non-safety-related relays are such that an OPC will be automatically detected and alarmed in the MCR under all operating electrical system configurations and plant loading conditions. In addition, the licensee will test the relays to ensure that an OPC and faults are automatically detected and alarmed in the MCR in accordance with plant procedures. Also, the licensee will develop OPC training and procedures for operators. Therefore, the NRC staff concludes that the licensee has addressed to BTP 8-9 expectations for automatic detection of OPCs and providing alarm in the MCR.

3.5 NRC Staff's Technical Evaluation of OPC Protection Features Safety-Related OPC Protection Features In LAR Section 3.2.1, "Negative Sequence Analysis," the licensee states that the negative sequence voltage relay settings protect important to safety equipment on the 4kV emergency buses from consequential OPCs and remain secure for the maximum level of steady-state voltage unbalance at the switchyard bus. Also, the licensee states "The analytical limits and time delay of the negative sequence voltage (open phase) relays were also developed. These limits and time delays are used as input for the open phase relay setting calculation." In RAI No. 5, the NRC staff requested the licensee to identify the analytical limits for negative sequence voltage and time delays chosen for the TS changes for OPC detection and protection.

In a letter dated January 16, 2018, the licensee stated that the Basler BE1-47N relays have a negative sequence voltage pickup setting of 6 percent on a 120V nominal voltage base and a time dial setting of 10.0. The relay is modeled in electric system analysis software (Electromagnetic Transients Program - Restructured Version (EMTP- RV)) based on the nominal trip curve. Dominion Calculation EE-0885 provides the total CSA for the Basler BE1-47N relays. Also, Calculation EE-0885 demonstrates the negative sequence voltage relays on Buses 1H and 2H that may pick up between 5.35V to 9.05V, and the negative sequence voltage relays on Buses 1J and 2J that may pick up between 4.28V to 10.12V.

In Section 8.5 of the Surry UFSAR, similar to UV or degraded voltage conditions, for an open phase event coincident with an SI or CLS signal, the licensee has stated that emergency buses should be re-energized by the diesel generator within 10 seconds (the time delay assumed in the accident analysis), including a 2.2 second residual voltage time delay. To be within the time frame considered in the accident analysis, the open phase protection relay tripping time delay should be less than or equal to 7 seconds for an open phase event coincident with an SI or CLS signal. This is consistent with the time delay used for degraded voltage protection during accident conditions. The analysis results show that for all consequential open phase cases in which the negative sequence protection relay trips, the combined tripping time of the negative sequence voltage relay and existing UV protection is less than 5 seconds after the open phase event occurs. That is, for all cases where the tripping time of the negative sequence voltage relay is 5 seconds or longer, the bus voltages on at least two of the three phases are less than the 2975V TS limit for the loss of voltage relay. Thus, for these cases, the loss of voltage relay will drop out and trip after a two second time delay. This is within the time delay considered in the accident analysis for a loss of offsite power coincident with an accident.

Based on the above, the NRC staff concludes that the licensee's justification for the selection of the analytical limits for negative sequence voltage and time delays chosen for the TS changes for OPC detection and protection system are bounding. This is, in part, due to its ability to detect all consequential OPCs and transfer the safety-related loads to the alterr:,ate source prior to a loss of safety function within the timeframe assumed in the accident analysis and in accordance with the guidance provided in BTP 8-9.

In RAI No. 5, the NRC staff requested the licensee to explain how percentage voltage imbalance is calculated based on negative sequence voltage. In addition, the NRC requested the licensee to explain whether other sequence components such as zero and positive sequence components have been considered in determining the power system imbalance. In a letter dated January 16, 2018, the licensee stated that calculation EE-0886 defines voltage unbalance in terms of negative sequence voltage as a percent of rated positive sequence voltage. The licensee stated that this approach is used because it directly relates to the

operating quantity of the Basler BE1-47N (negative sequence voltage magnitude). For low levels of unbalance (1-5 percent) the definition using negative sequence voltage is approximately equal to the National Electrical Manufacturers Association (NEMA) definition of unbalance based on the available industry literature. The station EMTP-RV model used to determine the analytical limits uses all symmetrical components (positive, negative, and zero) to determine the power system unbalance for the open phase conditions. The NRC staff reviewed the licensee's response along with Section 9.6.1 in Calculation EE-0886 and determined that the voltage imbalance is calculated based on a percent of rated positive sequence voltage and all symmetrical components (positive, negative, and zero) which in turn can confirm that the negative sequence voltage relays will appropriately detect OPCs on the ESF buses.

Section 3.2.1 of the LAR states, in part, that an OPC causes a voltage unbalance to the induction motors and motor-operated valves (MOVs), which introduces a negative sequence voltage. This negative sequence voltage produces a flux in the air gap that opposes the rotation of the rotor. The resulting induced currents in the rotor are at twice the line frequency, which can cause additional heating in the rotor due to the skin effect (for higher frequency currents, the skin effect will increase the apparent rotor resistance, resulting in additional rotor heating).

The NEMA Standard MG-1 states that for a voltage unbalance above 1 percent of motor nameplate voltage, motor horsepower should be de-rated to account for the additional heat.

Conservatively (without including the effects of motor cooling), for a voltage unbalance greater than 5 percent (on the motor nameplate voltage base), the negative sequence voltage protection relays will trip and isolate the motor loads before the integrated negative sequence current squared multiplied by the time duration is equal to 20 pu (per unit) to allow for sufficient remaining thermal capability for the motors to restart on the EDGs.

The NEMA Standard MG-1 part 14.36 states that operation of a motor with above a 5 percent unbalance condition is not recommended, and will probably result in damage to the motor. In RAI No. 5, the NRC staff requested the licensee to explain why the proposed setting limit in TS Table 3.7-4, item 7c (:s; 7% voltage imbalance) is conservative and acceptable. In a letter dated January 16, 2018, the licensee stated that the results of Calculation EE-0886 show that, for OPCs that cause a voltage unbalance of greater than 5 percent at the safety buses, the negative sequence voltage will be greater than the Basler BE1-47N pickup setpoint and the relay will trip to isolate the affected loads before equipment damage occurs and before any loads are tripped and locked out. The licensee also stated that there were no open phase cases that resulted in voltage unbalance between 5 percent and the pickup setting of the Basler relays. Therefore, after a review of the analysis of Calculation EE-0885 and the licensee's response, the NRC staff concludes that the proposed setting limit in TS Table 3.7-4, item 7c

(:s; 7% voltage imbalance) is conservative based on analysis demonstrating that safety-related motors on the ESF buses will be isolated and protected due to a relay trip that is designed to occur at a setpoint that is greater than 5 percent when an unbalance of the system is detected from an OPC event.

The NRC staff concludes that the proposed design changes to add safety-related protection relays to protect against OPCs, addresses guidance in BTP 8-9 as it relates to the automatic transfer to alternate power source or onsite standby power system (EDG), because the proposed safety-related protective relays are designed to transfer to alternate power source or EDGs due to an OPC. The NRC staff concludes that the proposed design also addresses 10 CFR 50.55a(h)(2) for safety systems, including relays to mitigate OPC events, since the design meets the single failure criteria and independence requirements of the safety-related divisions. The NRC staff concludes that the licensee addresses guidance in BTP 8-9 for protection features to mitigate and provide a response to the OPC events. In summary, the

NRC staff concludes that the proposed design meets Surry plant design criteria in UFSAR 1.4.24 and 1.4.39 and the intent of GDC 17 as it pertains to OPC.

Non-Safety-Related OPC Protection Features In LAR Section 3.3.3, "Non-Class 1E Design Solution," the licensee states that "for switchyard TransformerTX-1, there are OPCs that result in a negative sequence voltage between 1% and 3.66% on the safety buses. This is above the 1% unbalance threshold (which means it could affect plant equipment), and below the Basler relay capabilities (which means it could potentially go undetected). Therefore, a non-Class 1E Alstom OPD [open phase detection] system is required on Transformer TX-1 because consequential OPCs on the primary side of the transformer would otherwise go undetected." The NRC staff noted from Figure 1 in the LAR that there is an offsite power path from Transformer TX-1 that can provide a source of power downstream to the ESF buses (Switchgear 2H).

In RAI No. 1, the NRC staff requested the licensee to describe the effects of the non-Class 1E Alstom OPD system if it malfunctions or fails during an OPC when ESF buses are aligned to Transformer TX-1 as the offsite power source given a single failure in the onsite power system.

In letters dated January 16, 2018 and March 14, 2018, the licensee states that emergency power remains available to plant safety systems should a failure of the non-Class 1E Alstom OPD System occur. Specifically, the letters state that the non-Class 1E Alstom OPD System has detailed failure modes and effects analysis which uses relays to independently evaluate the need for an open phase alarm or trip with outputs configured in a two-out-of-three voting scheme. The two-out-of-three relay logic scheme reverts to two-out-of-two logic for many relay failure modes. This means that for an unloaded transformer, one failure mode considered in the analysis results in loss of open phase detection; however, the loaded transformer detection circuit remains unaffected by this failure mode. Therefore, the licensee has stated that OPC detection remains available to protect loads once they are aligned to the transformer for this failure mode. For a loaded transformer, the only failure modes considered in the analysis that result in loss of open phase detection are the product of the failure of multiple OPD system components. The loaded transformer failure modes that result in loss of OPD generate alarms that will alert operators to the loss of OPD thereby allowing them to diagnose and address the problem. The remaining failure modes do not result in loss of OPD and do not result in spurious trips.

Additionally, the licensee has stated that in the unlikely event that an OPC occurs concurrent with an Alstom OPD System failure resulting in loss of open phase detection, one emergency bus per unit remains unaffected due to the switchyard and transformer alignment. The NRC staff notes that if a single failure occurs in the Class 1E system concurrent with Alstom OPD System failure, manual action is required to align the ESF bus to an alternate power source.

The NRC staff concludes that the Class 1E Basler BE1-47N negative sequence relays and its protection schemes are adequate to protect the safety-related equipment from the consequences of OPCs without any reliance on the non-Class 1E Alstom OPD System relay scheme. This is due to the fact that the NEMA in its Motors and Generators Standards MG1 states that operation of a motor with up to 5 percent unbalance condition is acceptable for operation. The NRC staff notes that the licensee has the option of aligning other switchyard power transformers to ESF buses such that ESF buses are always protected by the Class 1E Basler BE1-47N negative sequence relays. In addition, the licensee's analysis indicates that for an OPC occurring on the high or low side of the RSST-A, RSST-B, and RSST-C transformers,

the Basler BE1-47N negative sequence relays are sufficient to protect the safety-related equipment.

3.6 NRC Staff's Technical Evaluation of Technical Specifications Changes The NRC staff reviewed the LAR to verify that the setpoint values provided are adequate to assure, with a high confidence level, that the required protective actions will be initiated before the associated plant process parameter exceeds its analytical limit.

3.6.1 Revise TS Table 3.7-4 Surry TS Table 3.7-4, "Engineered Safety Feature System Initiation Limits Instrument Setting,"

Item 7, "Loss of Power," would be revised to add Item 7.c, "4.16 KV Emergency Bus Negative Sequence Voltage (Open Phase)." An unbalanced voltage setting limit of less than or equal to 7 percent was determined based on the 6 percent relay setpoint with an applied 1 percent device uncertainty.

The NRC staff reviewed Table 1, "Summary of Negative Sequence Voltages for Open Phase Conditions on Each Transformer," in Attachment 1 of LAR to evaluate the following:

1. 10 CFR 50.36(c)(1)(ii)(A) requires that limiting safety system settings (LSSSs) for variables that have significant safety functions. The regulation states "Where a

[LSSS] is specified for a variable on which a safety limit has been placed, the setting must be so chosen that automatic protective actions will correct the abnormal situation before a safety limit is exceeded." The Analytical Limit is the limit of the process variable at which a safety action is initiated, as established by the safety analysis, to ensure that a Safety Limit (SL) is not exceeded. Any automatic protection action that occurs on reaching the Analytical Limit therefore ensures that the SL is not exceeded.

The licensee's methodology discussed in Section 3.3 of this SE followed NEMA MG-1-2009, "Motors and Generators." The NRC staff evaluated the licensee's selected setpoint of 6 percent for the Basler BE1-47N relay and found that the NEMA MG-1-2009 section 14.36, "Effects of Unbalanced Voltages on the Performance of Polyphase Induction Motors," states "the operation of the motor above a 5-percent voltage unbalance condition is not recommended," because the motor is predicted to create additional heating considered detrimental to its operation. However, the instruction manual for Basler BE1-47N voltage

• phase sequence relay states the negative sequence voltage pickup setpoints are only adjustable from 2 to 32 percent of the nominal voltage in 2 percent increments. Therefore, the relay is capable of being set in +/- 2 percent increments, with 4 percent generating possible unnecessary (spurious) trips, and 6 percent being evaluated in the following section and found to be adequate to protect the loads as 10 CFR 50.36(c)(1)(ii)(A) requirements.

The NRC staff notes, from the Westinghouse Generic Setpoint Control Program Recommendations (ADAMS Accession No. ML12058A445), the CSA term is "the combination of the various channel uncertainties via Square-Root-Sum-of-the-Squares (SRSS), statistical, or algebraic techniques. It includes instrument (both sensor and process rack) uncertainties and non-instrument related effects." This parameter is compared with the total of all uncertainties to determine the minimum required instrument channel margin (margin between the Analytical Limit (AL) and Limiting Trip Setpoint (LTSP)). In the LAR,

Section 3.2.4, "Security Cases," the licensee determined the applicable uncertainty terms through a computation the CSA.

The licensee evaluated the accuracies of the relay and potential transformer, and calculated the CSA for the Basler BE1-47N voltage phase sequence relays. In the LAR, the licensee stated that the maximum uncertainty (i.e., CSA) for the Basler relay at the 4kV emergency buses was calculated to be +/- 2.4 percent.

Span 120V (line-to-line) = 120V / ../3 - 69.3V (line-to-neutral)

CSA is+/- 2.4% of span 69.3V = +/- (69.3V x (2.4 /100)) - +/- 1.68V (line-to-neutral)

- +/- (1.68V * ../3) - +/- 2.92V (line-to-line)

2. NRC Setpoint Evaluation:

The NRC staff applied the guidance in RG 1.105 to independently confirm whether there is adequate margin for instrument channel performance uncertainty between the LTSP and associated AL (in the worst case, minimum Negative Sequence Voltage for OPC).

Regulatory Guide 1.105, Revision 3, specifies acceptable methods for combining uncertainties in determining a trip setpoint and its allowable values. Based on Section 4.4 of the American National Standards Institute (ANSl)/ISA-S67.04-1994, which is endorsed in RG 1.105, the Total Loop Uncertainty (TLU) on an increasing process would be calculated by the following equations.

LTSP = AL-TLU Thus, TLU = AL-LTSP Where:

The AL and LTSP values for the OPC Negative Sequence Voltage with selected 6 percent setpoint that are from Figure 2, "OPC Negative Sequence Voltage Protection,"

in Attachment 1 of the LAR:

Upper Analytical Limit (UAL)  : 11.2% (13.39V line-to-line)

Limiting Trip Setpoint (LTSP)  : 6% (7.2V line-to-line)

Upper Limiting Trip Setpoint (ULTSP): 6% Setpoint + 2.4% = 8.4 % (10.12V line-to-line)

Lower Limiting Trip Setpoint (LLTSP): 6% Setpoint - 2.4% = 3.6% (4.28V line-to-line)

Lower Analytical Limit (LAL)  : 1% (1.2V line-to-line)

Lower levels of voltage imbalance are provided only for TX-1 during normal and accident conditions. The licensee noted that: "These levels are high enough to affect plant equipment. TX-1 is removed as a station off-site power source when this condition is detected by the Alstom OPD System installed by the non-Class 1E solution." Thus, the NRC staff evaluated the upper level of the OPC negative sequence voltage.

The TLU is the total amount by which an instrument channel's output is in doubt (or the allowance made for such doubt) due to possible errors, either random or systematic.

The uncertainty is generally identified within a probability and confidence level. Random error is described as a variable whose value at a particular future instant cannot be predicted exactly but can only be estimated by a probability distribution function. Bias is an uncertainty component that consistently has the same algebraic sign and is expressed as an estimated limit of error.

Margin, in setpoint determination, is an allowance added to the instrument channel uncertainty. Margin moves the setpoint farther away from the analytical limit.

Margin = UAL - ULTSP The NRC calculation results are reflected in the Negative Sequence Voltage Figure 1 below.

Negative Sequence Voltage Upper Analytical Limit (13.39V)

'. '~ (UAL)

C: Margin B:TLU

% Margin= ((C/8)*100%) = ((3.27V/6.19V) X 100%) = 52.83%

(Limiting Trip Sepoint + CSA) (10.12V)

(ULTSP)

+2.9V A:CSA

,, ', Limiting Trip Setpoint (7.2V)

(LTSP)

-2.9V

,, (Limiting Trip Setpoint - CSA) (4.28V)

---,-~---- (LLTSP)

This level is produced only at TX-1 during normal and accident conditions Inconsequential 1% (1.2V)

Figure 1: NRC Staff Margin Calculation The NRC staff independently calculated the margin between AL and LTSP and found that this margin is adequate (as indicated in the Figure 1, above), at a value greater than or equal to 52 percent. This margin reflects that the trip setpoints have been chosen to assure that a trip or safety actuation will occur significantly before the measured process reaches the UAL level.

The NRC staff verified that the proposed setpoint of 6 percent for the Basler BE1-47N relay provides a sufficient negative sequence voltage margin between AL and LTSP for the OPC and meets the performance criteria of RG 1.105, and, therefore, satisfies the requirements of the regulation at 10 CFR 50.36(c)(1)(ii)(A).

3. In Table 3.7-4, "Engineered Safety Feature System Initiation Limits Instrument Setting,"

the licensee requested to add the item 7c, "4.16kV Emergency Bus Negative Sequence Voltage (Open Phase)," for Emergency Buses Separation and Diesel Start Channel with imbalanced voltage limit setpoint of less than or equal to (S) 7 percent into the Function Unit 7, "Loss of Power."

The NRC staff reviewed the Basler Relay Instruction Manual to verify that the Basler relay has 1 percent device uncertainty.

Based on the 6 percent relay setpoint that was evaluated in this section of this SE, and an applied 1 percent device uncertainty, the licensee's selection of an imbalanced phase voltage setting limit of the 4.16kV Emergency Bus Negative Sequence Voltage (Open Phase) for Emergency Buses Separation and Diesel Start Channel of s 7 percent is acceptable.

Based on the above, the NRC staff concludes that the licensee's imbalanced voltage setting limit for the 4.16kV Emergency Bus Negative Sequence Voltage (Open Phase) for Emergency Buses Separation and Diesel Start Channel is an adequate nominal setpoint with a high confidence level in protecting against an OPC Negative Voltage and satisfies the requirements of the regulation at 10 CFR 50.36(c)(1)(ii)(A).

3.6.2 Revise TS Table 4.1-1 Surry TS Table 4.1-1, "Minimum Frequencies for Check, Calibrations and Test of Instrument Channels," Item 33, "Loss of Power," would be revised to add Item 33.c, "4.16 KV Emergency Bus Negative Sequence Voltage (Open Phase)," surveillance requirements. The relay calibration and testing requirements would be added to the Surveillance Frequency Control Program (SFCP). The proposed OPC negative sequence voltage relays' calibration and testing frequencies to be included in the SFCP are "once per 18 months." The NRC staff concludes that this is consisted with the current undervoltage and degraded voltage relay frequencies in the Surry TS and, therefore, concludes that it meets the intent of 10 CFR 50.36(c)(3).

3.6.3 Revise TS Table 3.7-2 and Table Notations for Tables 3.7-2 and 3.7-3 Surry TS Table 3.7-2, "Engineered Safeguards Action Instrument Operating Conditions," Item 4, "Loss of Power," would be revised to add Item 4.c, "4.16 kv emergency bus negative sequence voltage (open phase)," instrument operating condition requirements. In LAR Section 2.4, "Description of Proposed Change," the licensee states, in part, that:

Operator Action 27 is also being added to identify the actions required when the number of operable negative sequence voltage (open phase) relay channels is less than the total number of channels, similar to the existing loss of voltage and degraded voltage protection circuitry .... Specifically, Action 27.c states that the negative sequence voltage (open phase) protection function does not have to be declared inoperable provided verification is performed at least once per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> that an OPC does not exist on the primary side of transformer TX-2, transformer TX-4, and the RSSTs, as well *as the Unit 1/Unit 2 main step-up transformers when power is supplied by the dependable alternate source, until the negative sequence voltage (open phase) protection function has been returned to service.

If the negative sequence voltage (open phase) protection function has not been returned to service within 90 days, the plant shall be in at least HOT SHUTDOWN within the next six hours and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

The NRC staff notes that the proposed Operator Action 27 for LCO for an inoperable open phase protection function is 90 days in the licensee's original submittal dated May 23, 2017.

The NRC requested justification for the 90 day Completion Time. Since the inoperable relay cannot take any automatic protective function for an OPC and remains connected to the Class 1E ESF 4160V buses downstream, it could render the onsite emergency power system incapable of performing its designated safety function.

In RAI No. 6, the NRC staff requested the licensee to provide either justification for the Completion Time of 90 days or provide appropriate markup of changes in the TSs for the required action for inoperable OPC relay consistent with 10 CFR 50.36(c)(2). In its letter dated January 16, 2018, the licensee stated that the proposed Operator Actions 27.a and 27.b for Table 3.7-2 are consistent with other relays specified in Surry TS Table 3.7-2 for loss of power instrumentation. Specifically, the required time frames in the proposed Operator Actions 27.a and 27.b are the same as the required time frames in the existing Operator Actions 26.a and 26.b for undervoltage and degraded voltage. In a letter dated March 14, 2018, the licensee clarified that regarding Operator Action 27 .c, the Completion Time is revised from 90 days to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. In addition, the terminal action for Operator Action 27 is revised to state "If the conditions are not satisfied, restore the protection function within 7 days or be in at least HOT SHUTDOWN within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />."

These revisions align the proposed Operator Action 27 completion times with the existing requirements in Operator Action 26 for inoperable channels. The terminal action for Operator Action 26 states "If the required conditions are not satisfied, declare the associated EDG inoperable."

Based on the above, the NRC staff concludes that the proposed 4.16 kv emergency bus negative sequence voltage (open phase) instrument operating condition requirements and 72-hour LCO are acceptable and would continue to meet 10 CFR 50.36(c)(2) and 10 CFR50.36(c)(3).

3.6.2 Proposed Changes to Design and Licensing Basis Documents In LAR Table 2, the licensee states "A UFSAR change request has been initiated to revise the UFSAR to describe the open phase analysis and detection/protection scheme implemented by this modification. It will be implemented in accordance with the station design control process."

In RAI No. 7, the NRC staff requested the licensee to provide a draft mark-up of the proposed UFSAR Section 8.5 update to include items reflected in the proposed TSs changes. In its letter dated January 16, 2018, the licensee provided a UFSAR mark-up including:

• For an open phase condition (nominally, above 6% negative sequence voltage), the two-out-of-three logic scheme will energize an Undervoltage Protection auxiliary relay for the associated bus which starts the EDG and transfers following the same process as the Undervoltage/Degraded voltage protection scheme. The open phase condition negative sequence voltage relays include an inverse time characteristic which introduces a trip time delay based on the magnitude of negative sequence voltage sensed. A time dial setting of 10 is used for the open phase condition negative sequence voltage relays which results in a trip time delay of less than 5 seconds for any open phase condition sensed at an emergency bus.

The NRC staff reviewed the UFSAR mark-up of the OPC detection and protection schemes and has reasonable assurance that conforming changes will be made to the design and licensing

basis. The NRC will expect to receive the UFSAR update, in accordance with 10 CFR 50.71(e),

that includes discussions of the design features and analyses related to the effects of, and protection for, any open phase condition design vulnerability.

3. 7 Technical Conclusion The NRC staff concludes that the proposed descriptions and design changes are acceptable as they satisfy the relevant requirements such as Surry plant design criteria in USFAR 1.4.24 and 1.4.39, and the intent of GDC 17, for the offsite and onsite electric power system. The proposed changes are in accordance with 10 CFR 50.36(c)(2) and (c)(3), and 10 CFR 50.55a(h)(2) and provide reasonable assurance for functionality of SSCs important to safety during postulated events at Surry, Unit Nos. 1 and 2.

4.0 STATE CONSULTATION

In accordance with the Commission's regulations, the Virginia State official was notified April 20, 2018, of the proposed issuance.of the amendments. The State official had no comments.

5.0 ENVIRONMENTAL CONSIDERATION

The amendments change requirements with respect to the installation or use of facility components located within the restricted area as defined in 10 CFR Part 20 and change surveillance requirements. The NRC staff has determined that the amendments involve no significant increase in the amounts and no significant change in the types of any effluents that may be released offsite and that there is no significant increase in individual or cumulative occupational radiation exposure. The Commission has previously issued a proposed finding that the amendments involve no significant hazards consideration, and there has been no public comment on such finding dated October 10, 2017 (82 FR 47040). Accordingly, the amendments meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9).

Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendments.

6.0 CONCLUSION

The Commission has concluded, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) there is reasonable assurance that such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendments will not be inimical to the common defense and security or to the health and safety of the public.

Principal Contributors: S. Morris, NRR/DE/EEOB H. Vu, NRR/DE/EICB D~e: May 3, 2018

ML18106A007 *per SE OFFICE DORL/LPL2-1/PM DORL/LPL2-1 /LA EEOB/BC* EICB/BC*

NAME KCotton KGoldstein JQuichocho MWaters DATE 04/12/18 04/17/18 04/12/18 02/08/18 OFFICE OGC-NLO DORL/LPL2-1 /BC DORL/LPL2-1 /PM NAME JWachtuka MMarkley KCotton DATE 04/20/18 05/03/2018 05/03/2018 UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 May 3, 2018 Mr. Daniel G. Stoddard Senior Vice President and Chief Nuclear Officer Innsbrook Technical Center 5000 Dominion Blvd.

Glen Allen, VA 23060-6711

SUBJECT:

SURRY POWER STATION, UNIT NOS. 1 AND 2, ISSUANCE OF AMENDMENTS REGARDING OPEN PHASE PROTECTION PER NRC BULLETIN 2012-01 (MF9805, MF9806; EPID L-2017-LLA-0238)

Dear Mr. Stoddard:

The U.S. Nuclear Regulatory Commission (the Commission) has issued the enclosed Amendment No. 292 to Renewed Facility Operating License No. DPR-32 and Amendment No. 292 to Renewed Facility Operating License No. DPR-37 for the Surry Power Station, Unit Nos. 1 and 2, respectively. The amendments revise the Technical Specifications (TSs) in response to NRC Bulletin (NRCB) 2012-01, "Design Vulnerability in Electric Power System," as provided in application dated May 23, 2017, as supplemented by letters dated January 16, 2018, and March 14, 2018.

The amendments update the TSs Table 3.7-2 and associated Table Notations, Table 3.7-4 and Table 4.1-1 to reflect the installation of the Class 1E 4160V negative sequence voltage (open phase) protective circuitry at Surry Power Station, Unit Nos. 1 and 2, to address the potential for a consequential open phase condition (OPC) that could exist on one or two phases of a primary off-site power source, and that would not currently be detected and mitigated by the existing station electrical protection scheme.

D. Stoddard A copy of the related Safety Evaluation is also enclosed. The Notice of Issuance will be included in the Commission's biweekly Federal Register notice.

Sincerely,

~~~

Karen Cotton Gross, Project Manager Plant Licensing Branch 11-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket Nos. 50-280 and 50-281

Enclosures:

1. Amendment No. 292 to DPR-32

2. Amendment No. 292 to DPR-37

3. Safety Evaluation cc: Listserv

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 VIRGINIA ELECTRIC AND POWER COMPANY DOCKET NO. 50-280 SURRY POWER STATION, UNIT NO. 1 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 292 Renewed License No. DPR-32

1. The Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment by Virginia Electric and Power Company (the licensee) dated May 23, 2017, as supplemented by letters dated January 16, 2018, and March 14, 2018, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

Enclosure 1

2. Accordingly, the license is amended by changes to the Technical Specifications as indicated in the attachment to this license amendment, and paragraph 3.B of Renewed Facility Operating License No. DPR-32 is hereby amended to read as follows:

B. Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 292, are hereby incorporated in the renewed license. The licensee shall operate the facility in accordance with the Technical Specifications.

3. This license amendment is effective as of its date of issuance and shall be implemented at the completion of the Unit 1 Spring 2018 refueling outage.

FOR THE NUCLEAR REGULATORY COMMISSION

~~.~

Michael T. Markley, Chief Plant Licensing Branch 11-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

Attachment:

Changes to License No. DPR-32 and the Technical Specifications Date of Issuance: May 3, 2018

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 VIRGINIA ELECTRIC AND POWER COMPANY DOCKET NO. 50-281 SURRY POWER STATION, UNIT NO. 2 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 292 Renewed License No. DPR-37

1. The Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment by Virginia Electric and Power Company (the licensee) dated May 23, 2017, as supplemented by letters dated January 16, 2018, and March 14, 2018, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

Enclosure 2

2. Accordingly, the license is amended by changes to the Technical Specifications as indicated in the attachment to this license amendment, and paragraph 3.8 of Renewed Facility Operating License No. DPR-37 is hereby amended to read as follows:

B. Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 292, are hereby incorporated in this renewed license. The licensee shall operate the facility in accordance with the Technical Specifications.

3. This license amendment is effective as of its date of issuance and shall be implemented at the completion of the Unit 2 Fall 2018 refueling outage.

FOR THE NUCLEAR REGULATORY COMMISSION Michael T. Markley, Chief Plant Licensing Branch 11-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

Attachment:

Changes to License No. DPR-37 and the Technical Specifications Date of Issuance May 3, 2 o1 8

ATTACHMENT TO SURRY POWER STATION, UNIT NOS. 1 AND 2 LICENSE AMENDMENT NO. 292 RENEWED FACILITY OPERATING LICENSE NO. DPR-32 DOCKET NO. 50-280 AND LICENSE AMENDMENT NO. 292 RENEWED FACILITY OPERATING LICENSE NO. DPR-37 DOCKET NO. 50-281 Replace the following pages of the Licenses and the Appendix A Technical Specifications (TSs) with the attached revised pages. The revised pages are identified by amendment number and contain marginal lines indicating the areas of change.

Remove Pages Insert Pages License License License No. DPR-32, page 3 License No. DPR-32, page 3 License No. DPR-37, page 3 License No. DPR-37, page 3 TSs TSs TS 3.7-20 TS 3.7-20 TS 3.7-20a TS 3.7-24a TS 3.7-26 TS 3.7-26 TS 3.7-26a TS 4.1-Ba TS 4.1-Ba TS 4.1-8b

3. This renewed license shall be deemed to contain and is subject to the conditions specified in the following Commission regulations: 10 CFR Part 20, Section 30.34 of 10 CFR Part 30, Section 40.41 of 10 CFR Part 40, Sections 50.54 and 50.59 of 10 CFR Part 50, and Section 70.32 of 10 CFR Part 70; and is subject to all applicable provisions of the Act and the rules, regulations, and orders of the Commission now or hereafter in effect; and is subject to the additional conditions specified below:

A. Maximum Power Level The licensee is authorized to operate the facility at steady state reactor core power levels not in excess of 2587 megawatts (thermal).

B. Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 292 are hereby incorporated in the renewed license. The licensee shall operate the facility in accordance with the Technical Specifications.

C. Reports The licensee shall make certain reports in accordance with the requirements of the Technical Specifications.

D. Records The licensee shall keep facility operating records in accordance with the requirements of the Technical Specifications.

E. Deleted by Amendment 65 F. Deleted by Amendment 71 G. Deleted by Amendment 227 H. Deleted by Amendment 227 I. Fire Protection The licensee shall implement and maintain in effect the provisions of the approved fire protection program as described in the Updated Final Safety Analysis Report and as approved in the SER dated September 19, 1979, (and Supplements dated May 29, 1980, October 9, 1980, December 18, 1980, February 13, 1981, December 4, 1981, April 27, 1982, November 18, 1982, January 17, 1984, February 25, 1988, and Surry - Unit 1 Renewed License No. DPR-32 Amendment No. 292

E. Pursuant to the Act and 10 CFR Parts 30 and 70, to possess, but not separate, such by product and special nuclear materials as may be produced by the operation of the facility.

3. This renewed license shall be deemed to contain and is subject to the conditions specified in the following Commission regulations: 10 CFR Part 20, Section 30.34 of 10 CFR Part 30, Section 40.41 of 10 CFR Part 40, Sections 50.54 and 50.59 of 10 CFR Part 50, and Section 70.32 of 10 CFR Part 70; and is subject to all applicable provisions of the Act and the rules, regulations, and orders of the Commission now or hereafter in effect; and is subject to the additional conditions specified below:

A. Maximum Power Level The licensee is authorized to operate the facility at steady state reactor core power Levels not in excess of 2587 megawatts (thermal)

B. Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 292 are hereby incorporated in this renewed license. The licensee shall operate the facility in accordance with the Technical Specifications.

C. Reports The licensee shall make certain reports in accordance with the requirements of the Technical Specifications.

D. Records The licensee shall keep facility operating records in accordance with the Requirements of the Technical Specifications.

E. Deleted by Amendment 54 F. Deleted by Amendment 59 and Amendment 65 G. Deleted by Amendment 227 H. Deleted by Amendment 227 Surry - Unit 2 Renewed License No. DPR-37 Amendment No. 292

TABLE 3.7-2 (Continued)

ENGINEERED SAFEGUARDS ACTION INSTRUMENT OPERATING CONDITIONS Minimum Permissible Total Number OPERABLE Channels Bypass Operator Functional Unit Of Channels Channels To TriQ Conditions Actions

3. AUXILIARY FEEDWATER (continued)

e. Trip of main feedwater pumps - start motor driven 2/MFWpump 1/MFWpump 2-1 each 24 pumps MFWpump

f. Automatic actuation logic 2 2 1 22

4. LOSS OF POWER

a. 4.16 kv emergency bus undervoltage (loss of voltage) 3/bus 2/bus 2/bus 26

b. 4.16 kv emergency bus undervoltage (degraded voltage) 3/bus 2/bus 2/bus 26

c. 4.16 kv emergency bus negative sequence voltage (open 3/bus 2/bus 2/bus 27 phase)

5. NON-ESSENTIAL SERVICE WATER ISOLATION

a. Low intake canal level* 4 3 3 20

b. Automatic actuation logic 2 2 1 14

6. ENGINEERED SAFEGAURDS ACTUATION INTERLOCKS - Note A

a. Pressurizer pressure, P-11 3 2 2 23

b. Low-low Tavg, P-12 3 2 2 23

c. Reactor trip, P-4 2 2 1 24

7. RECIRCULATION MODE TRANSFER

a. RWST Level - Low-Low* 4 3 2 25

b. Automatic Actuation Logic and Actuation Relays 2 2 1 14 Note A - Engineered Safeguards Actuation Interlocks are described in Table 4.1-A

• There is a Safety Analysis Limit associated with this ESF function. If during calibration the setpoint is found to be conservative with

> respect to the Setting Limit but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined

~

i calibration tolerance before returning the channel to service. The calibration tolerances are specified in a document controlled under 10 CFR 50.59.

~g '""3 Cl) w z

0

...:i N

I er, 0

N

'° N

§ 0..

N

'° N

TABLE 3.7-2 (Continued)

ENGINEERED SAFEGUARDS ACTION INSTRUMENT OPERATING CONDITIONS Minimum Permissible Total Number OPERABLE Channels Bypass Operator Functional Unit Of Channels Channels To Tri12 Conditions Actions

8. RECIRCULATION SPRAY

a. RWST Level - Low Coincident with High High 4 3 2 20 Containment Pressure*

b. Automatic Actuation Logic and Actuation Relays 2 2 1 14

• There is a Safety Analysis Limit associated with this ESF function. If during calibration the setpoint is found to be conservative with respect to the Setting Limit but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The calibration tolerances are specified in a document controlled under 10 CFR 50.59.

3 g

0.. ~

3

('I) en w

~ ~

z 0

N 0

I

" i:,;

N

'°N

§ 0..

N

'° N

TS 3.7-24a TABLES 3.7-2 ANDS 3.7-3 (Continued)

TABLE NOTATIONS ACTION 27. With the number of OPERABLE channels less than the Total Number of Channels, the negative sequence voltage (open phase) protection function may be considered OPERABLE provided the following conditions are satisfied:

a. The inoperable channel is placed in the tripped condition within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

Note: Action 27 .a does not apply if the negative sequence voltage (open phase) protection function cannot be performed.

b. The Minimum OPERABLE Channels requirement is met; however, the inoperable channel may be bypassed for up to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for surveillance testing of other channels per Specification 4.1.

c. If the negative sequence voltage (open phase) protection function cannot be performed (e.g., the Potential Transformer Blocking Device is tripped),

the negative sequence voltage (open phase) protection function does not have to be declared inoperable provided verification is performed at least once per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> that an open phase condition does not exist on the primary side of transformer TX-2, transformer TX-4, and the Reserve Station Service Transformers, as well as the Unit I/Unit 2 Main Step-up Transformers when power is supplied by the dependable alternate source.

The negative sequence voltage (open phase) protection function shall be restored within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

If the conditions are not satisfied, restore the protection function within 7 days or be in at least HOT SHUTDOWN within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

Amendment Nos. 292 and 292

TABLE3.7-4 ENGINEERED SAFETY FEATURE SYSTEM INITIATION LIMITS INSTRUMENT SETTING No. Functional Unit Channel Action Setting Limit 6 AUXILIARY FEEDWATER

a. Steam Generator Water Level Aux. Feedwater Initiation z 16.0% narrow range Low-Low* SIG Blowdown Isolation

b. RCP Undervoltage Aux. Feedwater Initiation z 70% nominal C. Safety Injection Aux. Feedwater Initiation All S.I. setpoints

d. Station Blackout Aux. Feedwater Initiation z 46.7% nominal

e. Main Feedwater Pump Trip Aux. Feedwater Initiation N.A.

7 LOSS OF POWER

a. 4.16 KV Emergency Bus Undervoltage Emergency Bus Separa- z 2975 volts and~ 3265 volts with a 2 (+5, -0.1)

(Loss of Voltage) tion and Diesel start second time delay

b. 4.16 KV Emergency Bus Undervoltage Emergency Bus Separa- 2 3830 volts and~ 3881 volts with a 60 (+/-3.0)

(Degraded Voltage) tion and Diesel start second time delay (Non CLS, Non SI) 7 (+/-0.35) second time delay (CLS or SI Conditions)

c. 4.16 KV Emergency Bus Negative Emergency Bus Separa- ~ 7% voltage imbalance Sequence Voltage (Open Phase) tion and Diesel start 8 NON-ESSENTIAL SERVICE WATER ISOLATION

a. Low Intake Canal Level* Isolation of Service Water 23 feet-5.85 inches flow to non-essential loads 9 RECIRCULATION MODE TRANSFER

a. RWST Level-Low-Low* Initiation of Recirculation 212.7%

Mode Transfer System ~ 14.3%

10 TURBINE TRIP AND FEEDWATER ISOLATION

i>- a. Steam Generator Water Level Turbine Trip ~ 76% narrow range

~

0..

High-High* Feedwater Isolation iz

• There is a Safety Analysis Limit associated with this ESF function. If during calibration the setpoint is found to be conservative with respect to the Setting Limit but outside its predefined calibration tolerance, then the channel shall be brought back to within its

>-3 Cl) w

...:i 0

en predefined calibration tolerance before returning the channel to service. The calibration tolerances are specified in a document N I

N controlled under 10 CFR 50.59. 0\

I.O N

§ 0..

N I.O N

TABLE 3.7-4 ENGINEERED SAFETY FEATURE SYSTEM INITIATION LIMITS INSTRUMENT SETTING No. Functional Unit Channel Action Setting Limit 11 RWST Level Low (coincident with High Recirculation Spray Pump ~59%

High Containment Pressure)* Start  ::;;61%

• There is a Safety Analysis Limit associated with this ESP function. If during calibration the setpoint is found to be conservative with respect to the Setting Limit but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The calibration tolerances are specified in a document controlled under 10 CPR 50.59.

~::s 0..

~::s >-3 Cl)

..... w z0 -...J N

I N

I.O

°'

~

N

§ 0..

N I.O N

TABLE 4.1-1 (Continued)

MINIMUM FREQUENCIES FOR CHECK, CALIBRATIONS AND TEST OF INSTRUMENT CHANNELS Channel Description Check Calibrate Test Remarks

32. Auxiliary Feedwater

a. Steam Generator Water Level Low-Low SFCP SFCP SFCP (1) 1) The auto start of the turbine driven pump is not included in the periodic test, but is tested within 31 days prior to each startup.

b. RCP Undervoltage SFCP SFCP SFCP (1)(2) 1) The actuation logic and relays are tested within 31 days prior to each startup.

2) Setpoint verification not required.

c. S.I. (All Safety Injection surveillance requirements)

d. Station Blackout N.A. SFCP N.A.

e. Main Feedwater Pump Trip N.A. N.A. SFCP

33. Loss of Power

a. 4.16 KV Emergency Bus Undervoltage N.A. SFCP SFCP (1) 1) Setpoint verification not required.

(Loss of Voltage)

b. 4.16 KV Emergency Bus Undervoltage N.A. SFCP SFCP (1) 1) Setpoint verification not required.

(Degraded Voltage)

c. 4.16 KV Emergency Bus Negative N.A SFCP SFCP (1) 1) Setpoint verification not required.

Sequence Voltage (Open Phase)

34. Deleted

35. Manual Reactor Trip N.A. N.A. SFCP The test shall independently verify the operability of the undervoltage and shunt trip attachments for the manual reactor trip function.

The test shall also verify the operability of the bypass breaker trip circuit.

> 36. Reactor Trip Bypass Breaker N.A. N.A. SFCP (1), 1) Remote manual undervoltage trip sg SFCP (2) immediately after placing the bypass 0..

breaker into service, but prior to commencing reactor trip system testing or

~ cA

-z 0

[JO required maintenance.

2) Automatic undervoltage trip.

~

00 I

~

N

\0 N

§ 0..

N

\0 N

TABLE 4.1-1 (Continued)

MINIMUM FREQUENCIES FOR CHECK, CALIBRATIONS AND TEST OF INSTRUMENT CHANNELS Channel Description Check Calibrate Test Remarks

37. Safety Injection Input to RPS N.A. N.A. SFCP

38. Reactor Coolant Pump Breaker N.A. N.A. SFCP Position Trip

39. Steam/Feedwater Flow and Low SIG SFCP SFCP SFCP (1) 1) The provisions of Specification 4.0.4 are not Water Level applicable

40. Intake Canal Low (See Note 1) SFCP SFCP SFCP (1), 1) Logic Test SFCP (2) 2) Channel Electronics Test

41. Turbine Trip and Feedwater Isolation

a. Steam generator water level high SFCP SFCP SFCP

b. Automatic actuation logic and N.A. SFCP SFCP (1) 1) Automatic actuation logic only, actuation relays actuation relay tested each refueling

42. Reactor Trip System Interlocks

a. Intermediate range neutron flux, N.A. SFCP (1) SFCP (2) 1) Neutron detectors may be excluded from the P-6 calibration

b. Low reactor trips block, P-7 N.A. SFCP (1) SFCP (2) 2) The provisions of Specification 4.0.4 are not applicable.

c. Power range neutron flux, P-8 N.A. SFCP (1) SFCP (2)

d. Power range neutron flux, P-10 N.A. SFCP (1) SFCP (2)

e. Turbine impulse pressure N.A. SFCP SFCP 3

CD i:l 0..

3 CD >-3 en

....i:l z0 N

+>-

I 00 O"'

I.O N

§ 0..

N I.O N

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO. 292 TO RENEWED FACILITY OPERATING LICENSE NO. DPR-32 AND AMENDMENT NO. 292 TO RENEWED FACILITY OPERATING LICENSE NO. DPR-37 VIRGINIA ELECTRIC AND POWER COMPANY SURRY POWER STATION, UNIT NOS. 1 AND 2 DOCKET NOS. 50-280 AND 50-281

1.0 INTRODUCTION

By letter dated May 23, 2017 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML17150A302), as supplemented by letters dated January 16, 2018 (ADAMS Accession No. ML18023A403) and March 14, 2018 (ADAMS Accession No. ML18075A328), Virginia Electric and Power Company (the licensee) submitted a request for changes to the Surry Power Station (Surry), Unit Nos. 1 and 2, Technical Specifications (TSs).

The requested changes would add operability requirements required actions, instrument settings, and surveillance requirements (SRs) to the TSs for the 4160 Volt (V) emergency bus negative sequence voltage (open phase) protection function. The supplements dated January 16, 2018 and March 14, 2018, provided additional information that clarified the application, did not expand the scope of the application as originally noticed, and did not change the U. S. Nuclear Regulatory Commission (NRC, the Commission) staff's original proposed no significant hazards consideration determination as published in the Federal Register on October 10, 2017 (82 FR 47040).

The proposed changes would revise the TS Table 3.7-2 and associated Table Notations, Table 3.7-4 and Table 4.1-1 to reflect the implementation of a Class 1E 4160V negative sequence voltage (open phase) protective circuitry at Surry, Unit Nos. 1 and 2, to address the potential for a consequential open phase condition (OPC) that could exist on one or two phases of a primary off-site power source and that would not currently be detected and mitigated by the existing station electrical protection scheme.

Enclosure 3

2.0 REGULATORY EVALUATION

The NRC staff considered the following NRC regulations in the evaluation of the proposed license amendment request (LAR):

• Surry Power Station Updated Final Safety Analysis Report (UFSAR), Section 1.4, provides, in part, that Surry was designed to meet the intent of the "Proposed General Design Criteria for Nuclear Power Plant Construction Permits" published in July 1967.

The Surry construction permits were issued prior to May 1971. This UFSAR, however, addresses the NRC General Design Criteria (GDC) published as Appendix A to Title 10 of the Code of Federal Regulations (10 CFR) Part 50 in July 1971. GDC 17 of 10 CFR Part 50, Appendix A, establishes requirements for the electric power system design of power plants. The Surry UFSAR, Criterion 1.4.24, "Emergency Power for Protection Systems" and Criterion 1.4.39, "Emergency Power for Engineered Safeguards," set forth plant-specific criteria similar to GDC 17. The following criteria relating to onsite and offsite electric power are applicable to Surry:

o UFSAR 1.4.24, "Emergency Power for Protection Systems," states, in part, that:

In the event of loss of all offsite power, sufficient alternative sources of power are provided to permit the required functioning of the protection systems.

o UFSAR 1.4.39, "Emergency Power for Engineered Safeguards," states, in part, that:

Alternative power systems are provided and designed with adequate independence, redundancy, capacity, and testability to permit the functioning required of the engineered safeguards. As a minimum, the onsite power system and the offsite power system each, independently, provide this capacity, assuming the failure of a single active component in each power system.

o 10 CFR 50.36(c)(2), "Limiting conditions for operation," provides the requirement for the establishment of TS limiting conditions for operation (LCOs). Specifically, a TS LCO of a nuclear reactor must be established for each item meeting one or more of the criteria of 10 CFR 50.36(c)(2)(ii). Criterion 3 states that a structure, system, or component

[SSC] that is part of the primary success path and which functions or actuates to mitigate ~ design basis accident [DBA] or transient that either assumes the failure of or presents a challenge to the integrity of a fission product barrier.

• 10 CFR 50.36(c)(3), "Surveillance requirements," states, "Surveillance requirements are requirements relating to test, calibration, or inspection to assure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions for operation will be met."

• The regulation at 10 CFR 50.55a(h)(2), "Protection systems," states, "For nuclear power plants with construction permits issued after January 1, 1971, but before May 13, 1999, protection systems must meet the requirements in IEEE [Institute of Electrical and

Electronics Engineers] Std [Standard] 279-1968, 'Proposed IEEE Criteria for Nuclear Power Plant Protection Systems,' or the requirements in IEEE Std 279-1971, Criteria for Protection Systems for Nuclear Power Generating Stations, or the requirements in IEEE Std 603-1991, "Criteria for Safety Systems for Nuclear Power Generating Stations," and the correction sheet dated January 30, 1995. For nuclear power plants with construction permits issued before January 1, 1971, protection systems must be consistent with their licensing basis or may meet the requirements of IEEE Std. 603-1991 and the correction sheet dated January 30, 1995." The construction permits for Surry, Unit Nos. 1 and 2, were issued prior to January 1, 1971. Consequently, its protection systems must be consistent with their licensing basis.

• In Section 6.0, "Conclusion," of the licensee's submittal dated May 23, 2017, the licensee stated, in part, "The design function of the Emergency Power System and the station's compliance with GDC 17 are being enhanced by the proposed change as it facilitates the detection of and protection from an OPC on the primary off-site power source." Therefore, the NRC staff review of the Surry electric power distribution system considered the current GDC 17 requirements specific to the proposed OPC modifications.

10 CFR Part 50, Appendix A, GDC 17, "Electric power systems," states, in part, that the electric power system shall provide sufficient capacity and capability to assure that (1) specified acceptable fuel design limits and design condition of the reactor coolant pressure boundary are not exceeded as a result of anticipated operational occurrences and (2) the core is cooled and containment integrity and other vital function are maintained in the event of postulated accidents, and sufficient independence, redundancy, and testability to perform their safety function assuming a single failure and provisions shall be included to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit, the loss of power from the transmission network, or the loss of power from the onsite electric power supplies.

The NRC staff also considered the following guidance:

• NRC Branch Technical Position (BTP) 8-9, "Open Phase Conditions in Electric Power System" (ADAMS Accession No. ML15057A085). The purpose of this BTP is to provide guidance to the staff in reviewing various licensing actions related to electric power system design vulnerabilities due to open phase conditions in offsite electric power systems in accordance with Appendix A to 10 CFR Part 50, GDC 17, or principal design criteria specified in the updated final safety analysis report, 10 CFR 50.55a(h)(2),

10 CFR 50.55a(h)(3), and 10 CFR 50.36(c)(2) and 10 CFR 50.36(c)(3).

IEEE Std. 279, "Criteria for Protection Systems for Nuclear Power Generating Stations."

• IEEE Std. 308-1974, "IEEE Standard Criteria for Class IE Power Systems for Nuclear Power Generating Stations."

• Regulatory Guide (RG) 1.105, Revision 3, "Setpoints for Safety-Related Instrumentation,"

dated December 1999 (ADAMS Accession No. ML993560062), which describes a method acceptable to the NRC staff for complying with the NRC's regulations for

ensuring that setpoints for safety-related instrumentation are initially within and remain within the TS limits. RG 1.105 endorses Part 1 of Instrument Society of America (ISA)

Standard (S) 67.04-1994, "Setpoints for Nuclear Safety-Related Instrumentation." This standard provides a basis for establishing setpoints for nuclear instrumentation for safety systems and addresses known contributing errors in a particular channel from the process (including the primary element and sensor) through and including the final setpoint device.

• On July 27, 2012, the NRC issued NRC Bulletin 2012-01, "Design Vulnerability in Electric Power System," states in part, to: (1) request information regarding each facility's electric power system design in light of the recent operating experience that involved the loss of one of the three phases of the offsite power circuit at Byron Station, Unit 2; and (2) require that the licensees comprehensively verify compliance with the regulatory requirements of GDC 17 or the applicable principal design criteria in the updated final safety analysis report, and the design criteria for protection systems under 10 CFR Part 50.55a(h)(2) and 10 CFR Part 50.55a(h)(3).

3.0 TECHNICAL EVALUATION

3.1 Electric System Design and Operation In its letter dated October 24, 2012 letter (ADAMS Accession No. ML12305A017), the licensee responded to the NRC Bulletin 12-01 for Surry and other Dominion operated plants. By letter dated December 20, 2013 (ADAMS Accession No. ML13351A314), the NRC requested additional information to verify that licensees have completed interim corrective actions and compensatory measures, and to determine the status of each licensee's long-term corrective actions. The licensee provided its response for Surry in Attachment 2 to a letter dated February 3, 2014 (ADAMS Accession No. ML14035A458). In that letter, the licensee stated that, "The Dominion nuclear fleet plants committed to the generic schedule provided in the Industry OPC Initiative. In this letter, the licensee has revised its schedule for completion of functionality for all applicable transformers, which assumes that viable solution for both voltage-based and current-based solutions have been developed and tested by December 31.

2014, is now December 31, 2019, for Surry Station." The new schedule date reflects the proposed installation of the equipment needed to support a license amendment to implement OPC design changes.

In Section 3.3.1, of its LAR dated May 23, 2017, the licensee proposed to install a Class 1E protective relaying scheme on the Engineered Safety Features (ESF) buses that will detect consequential OPCs that are not readily detectable by the existing electrical system protection scheme. The proposed Surry Class 1E solution consists of the installation of 12 voltage unbalance (negative sequence) Basler BE1-47N relays that will provide consequential OPC detection and protection on the 4160V Emergency Switchgear buses. The relays will be configured in a two out of three logic scheme that will detect consequential OPCs, trigger an annunciator in the control room indicating an OPC exists, and automatically initiate protective actions to mitigate the event. A blocking feature is also being included in the logic scheme to enhance the reliability of the protection system and to prevent inadvertent actuation in the event of a failed or degraded potential transformer {PT).

In addition, the licensee proposed to install a non-Class 1E protective relaying scheme on the primary-side of Transformer TX-1 located in the switchyard. As described in Section 3.3.3 of

the LAR, this installation is necessary due to undetected OPCs (OPCs above the 1 percent unbalance threshold and below the Basler relay capabilities) that result in a negative sequence voltage between 1 percent and 3.66 percent on the safety buses when the offsite power is fed from Transformer TX-1. In Section 4.1 of the LAR, the licensee states that it is currently planning to complete the Surry, Unit Nos. 1 and 2, OPC modifications by the completion of the 2018 fall Unit No. 2 refueling outage, which would meet the December 31, 2018, completion date specified in the NEI Initiative.

3.2 Description of Proposed Changes By letter dated May 23, 2017, the licensee submitted a request for changes to the Surry, Unit Nos. 1 and 2, TSs that would add operability requirements, required actions, instrument settings, and SRs to the TSs for the installation of the 4160V emergency bus negative sequence voltage (open phase) protection function for Surry, Unit Nos. 1 and 2. The proposed changes would complete the actions required to resolve the issues identified in Bulletin 2012-01. The licensee proposed the following changes to the TSs:

• Insert new item 4.c in TS Table 3.7-2, "Engineered Safeguards Action Instrument Operating Conditions," which would state:

Total Minimum Channels Permissible Operator Functional Unit Number Operable to Trip Bypass Actions of Channels Conditions Channels C. 4.16kv [Kilovolt] 3/bus 2/bus 2/bus 27 emergency bus negative sequence voltage (open phase)

• Revise Table Notations of TS Tables 3.7-2 and 3.7-3 by inserting new Action 27, which would state:

ACTION 27. With the number of OPERABLE channels less than the Total Number of Channels, the negative sequence voltage (open phase) protection function may be considered OPERABLE provided the following conditions are satisfied:

a. The inoperable channel is placed in the tripped conditions within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

Note: Action 27.a does not apply if the negative sequence voltage (open phase) protection function cannot be performed.

b. The Minimum OPERABLE Channels requirement is met; however, the inoperable channel may be bypassed for up to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for surveillance testing of other channels per Specification 4.1.

c. If the negative sequence voltage (open phase) protection function cannot be performed (e.g., the Potential Transformer Blocking Device is tripped), the negative sequence voltage

{open phase) protection function does not have to be declared inoperable provided verification is performed at least once per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> that an open phase condition does not exist on the primary side of transformer TX-2, transformer TX-4, and the Reserve Station Service Transformers, as well as the Unit 1/Unit 2 Main Step-up Transformers when power is supplied by the dependable alternate source. The negative sequence voltage (open phase) protection function shall be restored within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

If the conditions are not satisfied, be in at least HOT SHUTDOWN within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

• Insert new item 7.c, in TS Table 3.7-4, "Engineered Safety Feature System Initiation Limits Instrument Setting," which would state:

Functional Unit Channel Action Setting Limit C. 4.16kv Emergency Bus Negative Emergency Bus s 7% voltage Sequence Voltage (Open Phase) Separation and Diesel imbalance start

• Insert new item 33.c, in TS Table 4.1-1, "Minimum Frequencies for Check, Calibrations and Test of Instrument Channels," which would state:

Channel Description Check Calibrate Test Remarks C. 4.16kv Emergency N.A. SFCP SFCP 1) Setpoint Bus Negative [Surveillance (1) verification Sequence Voltage Frequency not (Open Phase) Control required.

Program]

3.3 NRC Staff's Technical Evaluation of Methodology Plant-specific design criteria is provided in UFSAR Sections 1.4.24 and 1.4.39. BTP 8-9 provides guidance to the NRC staff for reviewing licensing actions related to electric power system design vulnerabilities in an open phase condition. Specifically, the guidance in BTP 8-9 has the following criteria:

For operating reactors and new reactors with active design safety features, reviewed under 10 CFR Part 50 and 10 CFR Part 52, "Licenses, Certifications, and Approvals for Nuclear Power Plants," the following criteria should be satisfied when evaluating OPCs:

a. The OPC should be automatically detected and alarmed in the main control room under all operating electrical system configurations and plant loading conditions. The detection circuits should be sensitive enough to identify OPCs under all operating electrical system

configurations and plant loading conditions for which the offsite power supplies are required to be operable in accordance with plant technical specifications (TSs) for safe shutdown.

The detection circuit should minimize spurious indications for an operable offsite power source in the range of voltage perturbations such as switching surges, transformer inrush currents, load or generation variations, lightning strikes, etc., normally expected in the transmission system. If the plant auxiliaries are supplied from the main generator and the offsite power circuit to the ESF bus is configured as a standby power source, then any failure (i.e., OPC) should be alarmed in the main control room for operators to take corrective action within a reasonable time. In such cases, the consequences of not immediately isolating the degraded power source should be evaluated to demonstrate that any BTP 8-9-5 Revision O- July 2015 subsequent design bases conditions that rely on offsite power circuit(s) for safe shutdown do not create plant transients or abnormal operating conditions. Also, the remaining power source(s) can be connected to the ESF buses within the time assumed in the accident analysis.

b. If offsite power circuit(s) is (are) functionally degraded due to OPCs, and safe shutdown capability is not assured, then the ESF buses should be designed to be transferred automatically to the alternate reliable offsite power source or onsite standby power system within the time assumed in the accident analysis and without actuating any protective devices, given a concurrent design basis event.

c. The design of protection features for OPCs should address the following:

(i) Power quality issues caused by OPCs such as unbalanced voltages and currents, sequence voltages and currents, phase angle shifts, and harmonic distortion that could affect redundant ESF buses. The ESF loads should not be subjected to power quality conditions specified in industry standards such as Institute of Electrical and Electronic Engineers (IEEE) Standard (Std) 308-2001, "Criteria for Class 1E Power Systems for Nuclear Power Generating Stations," Section 4.5, "Power Quality," with respect to the design and operation of electrical systems as indicated in Regulatory Guide (RG) 1.32 "Criteria for Power Systems for Nuclear Plants."

(ii) Protection scheme should comply with applicable requirements including single failure criteria for ESF systems as specified in 10 CFR Part 50, Appendix A, GDC17, and 10 CFR 50.55a(h)(2) or 10 CFR 50.55a(h)(3), which require compliance with IEEE Std 279-1971 "Criteria for Protection Systems for Nuclear Power Generating Stations" or IEEE Std 603-1991, "Standard Criteria for Safety Systems for Nuclear Power Generating Stations." RG 1.153, "Criteria for Power, Instrumentation, and Control Portions of Safety Systems," provides additional guidance on this topic.

If protective features are provided in a non-Class 1E system only, a failure of the non-Class 1E scheme should not preclude the onsite electrical power system from performing its safety function given a single failure in the onsite power system.

(iii) Protection scheme design should minimize misoperation, maloperation, and spurious actuation of an operable off-site power source. Additionally, the protective scheme should not separate the operable off-site power source in the range of voltage perturbations such as switching surges, load or generation variations etc.,

normally expected in the transmission system.

(iv) The unbalanced voltage/current conditions for ESF components expected during various operating and loading conditions should not exceed motor manufacturer's recommendations. The International Electrotechnical Commission (IEC) Standard IEC 60034-26, National Electrical BTP 8-9-6 Revision O - July 2015 Manufacturers Association (NEMA) Standard (MG 1) Parts 14.36 and 20.24, and IEEE Std C37.96-2012 (Guide for AC Motor Protection), Section 5.7.2.6, "Unbalanced Protection and Phase Failures," may be used for general guidance.

Technical Specification Surveillance Requirements and Limiting Conditions of Operation for equipment used for mitigation of OPCs should be identified and implemented consistent with the operability requirements specified in the plant TSs and in accordance with 10 CFR 50.36(c)(2) and 10 CFR 50.36(c)(3). RG 1.93 "Availability of Electric Power Sources," provides additional guidance on this topic.

Licensee Methodology In its letter dated May 23, 2017 the licensee stated, in part, that:

Based on the current licensing basis and 10 CFR Part 50, Appendix A, GDC 17 requirements, and the issuance of NRC Bulletin 2012-01, the licensee determined that the existing protection circuitry of Surry may not detect some consequential single or double OPCs on an off-site power source. This design vulnerability could result in the affected off-site power source being unable to supply sufficient power to perform its safety function. The design needs to ensure that the negative sequence voltage (open phase) function will not spuriously actuate for minor voltage imbalances that may be present during normal operating conditions.

Based on an analysis of the historical phase voltage differentials, using the Electromagnetic Transients Program - Restructured Version (EMTP-RV), and under the potential OPC conditions that are described in sections 3.1.1 to 3.1.4 of the LAR, the licensee calculated the maximum historical negative sequence voltage on buses 1H, 2H, 1J, and 2J for steady-state grid imbalance as 4.20V as measured on the instrument side of the phase potential transformers. The resulting value from this calculation is less than the minimum negative sequence voltage relay pickup including a calculated channel statistical allowance (CSA), which is 4.28V for buses 1J and 2J and 5.35V for buses 1H and 2H. Therefore, the relays would not be expected to spuriously pick up on a maximum expected steady-state grid imbalance of 4.20V.

Based on the maximum and minimum historical steady-state negative sequence voltages of buses 1H, 1J, 2H, and 2J that are provided in Table 1, "Summary of Negative Sequence Voltages of Open Phase Conditions on Each Transformer," of the LAR, the licensee performed a calculation to determine the appropriate CSA for the Basler BE1-47N voltage phase sequence relays, and evaluated the uncertainty of the instrument channel, as compared to the historical lowest and highest differential of the negative phase sequence voltages that have occurred during plant operation. Based on this evaluation, a setpoint of 6 percent(%) of nominal voltage (120 VAC) for the Basler BE1-47N relay was selected by the licensee.

The above 4 criteria and methodology proposes to satisfy the design requirements needed to address OPC at Surry, Unit Nos. 1 and 2.

3.4 NRC Staff's Technical Evaluation of OPC Detection and Alarm Features The NRC staff reviewed the licensee's LAR and proposed modifications to Surry's electrical design in accordance with BTP 8-9. In particular, the staff evaluated features to automatically detect and alarm in the MCR due to the occurrence of an OPC event under expected operating electrical system configurations and plant loading conditions.

In order to achieve automatic detection of OPC in the offsite power system of the plant, the detection schemes have to be sensitive enough to identify OPCs for all operating electrical system configurations and loading conditions. In Section 3.1.2 of the submittal dated May 23, 2017, "Open Phase Location Considered," the licensee listed that analyses were performed based on OPC occurring on the high voltage side terminals of the preferred and alternate power transformers. BTP 8-9, Section B states that licensees should "have considered all potential OPCs on the high voltage and low voltage side of transformers and interconnecting onsite auxiliary power circuits. Any connections that are not evaluated should be documented with an adequate justification." In request for additional information (RAI) No. 2 (ADAMS Accession No. ML17313A063), the NRC staff requested the licensee to indicate how the low voltage side of each transformer was considered as part of the analyses to determine if the OPC occurring on the high voltage side of the transformers are the bounding conditions. In a letter dated January 16, 2018 (ADAMS Accession No. ML18023A403), the licensee stated that due to the electrical configuration of the transformers, (Reserve Station Service Transformer (RSST)-A, RSST-B, and RSST-C are in series with TX-1, TX-2, and TX-4 transformers) the OPCs that were evaluated on the high voltage side of the RSSTs are the same as the OPCs on the low voltage side of TX-1, TX-2, and TX-4. This is due to the fact that when an OPC occurs on the high voltage side of RSSTs, coupling is not reproduced on the low voltage side of TX-1, TX-2, and TX-4. Therefore, the licensee concluded that an OPC was not considered on the low voltage side of transformers TX-1, TX-2, and TX-4. An OPC was not considered on the low voltage side of RSST-A, RSST-8, or RSST-C because the voltage on the affected phase or phases would not be reproduced by transformer coupling. Instead, a very low voltage on the lost phase would result, which would cause the Basler BE1-47N voltage unbalance relays on the affected safety buses to trip. In addition, the licensee stated that OPCs were not considered on the low voltage side of GSU-1 or GSU-2 (high voltage side of Station Service Transformers (SSTs) 1A, 1B, 1C, 2A, 28, or 2C) because the isolated phase bus construction is not subject to this failure mode.

The NRC staff concludes that with the isolated phase bus configuration each phase conductor is enclosed in its own separate grounded metal housing with each housing being separated from each other. When conductors in separate housings are enclosed there is considerable protection from faults between the generator and the transformer. Therefore, the NRC staff concludes that the licensee's justification for the evaluation of the high voltage and low voltage side of the GSU-1 and GSU-2 transformers are bounding due to its isolated phase bus configuration and its protection against negative voltage imbalances on the bus. The NRC staff concludes that, after reviewing a summary of Calculation EE-0883, Revision 0, "Open Phase Condition Detection Analysis," and the supplemental response, the licensee has considered all potential OPCs occurring on the transformers and it meets the BTP 8-9 criterion for detection features.

In LAR Section 3.1.4, "Loading Conditions Considered," the licensee states that various transformer loading conditions (zero load through maximum) and plant alignments were considered in the analyses. In RAI No. 3, the NRC staff requested the licensee to provide a summary of the worst case analyses, key assumptions used, and the results obtained for all the loading conditions and operating configurations including plant trip(s) followed by bus transfers for OPC events. In a letter dated January 16, 2018, the licensee stated that the open phase analyses, assumptions, and results for all loading conditions and operating configurations that were considered in the analyses are contained in Dominion Calculations EE-0883 and EE-0886.

The NRC staff reviewed a summary of these calculations provided by the licensee in a letter dated March 14, 2018. Some of the key assumptions used in the licensee's analyses include:

• The maximum voltage source models (used to represent the maximum grid source voltage magnitude and maximum short circuit strength at the 230 kV and 500 kV switchyards) are assumed to be infinite sources.

• All transformer impedances are nominal regardless of the tap position.

• Open phase event is assumed to occur coincident with the safety injection (SI)/

consequence limiting safeguards (CLS) signal.

In addition, the NRC staff reviewed the results of the calculations detailed in Table 1 of the licensee's submittal dated May 23, 2017, which provides a summary of the maximum and minimum steady-state negative sequence voltages seen at switchgear Buses 1H, 1J, 2H, and 2J for OPCs on the high voltage side of each transformer considered in the above calculations.

The NRC staff determined that assumptions used in the licensee's analyses, loading conditions, operating configurations, and simulations of plant trips followed by bus transfers for OPC events were reasonable.

In LAR Section 3.3.1, "Class 1E Design Solution," the licensee states that the Class 1E design solution consists of twelve Basler BE1-47N negative sequence relays arranged such that three relays are connected to each of the Emergency Bus PTs. Three negative sequence relays and associated auxiliary relays will be used to develop a two out of three logic scheme such that two or more relays must sense an unbalanced voltage greater than 6 percent to initiate protection of the emergency bus. A feature that blocks actuation of the negative sequence voltage (open phase) protection function is also included in the logic scheme. This feature enhances the reliability of the protection system and prevents the protection scheme from actuating in the event of a failed or degraded PT. To achieve this feature, one ASEA Brown Boveri (ABB) 60 voltage balance relay is installed per bus. In RAI No. 4, the NRC staff requested the licensee to provide a discussion that clearly demonstrates the negative sequence voltage relay scheme (detection, alarm, and protection) including the feature that blocks actuation of the negative sequence voltage (open phase) protection using the ABB 60 voltage balance relay and how it interfaces with the existing undervoltage (UV) relay protection scheme, which trips the offsite power circuits at the ESF bus level and initiates emergency diesel generator (EDG) starts.

In a letter dated January 16, 2018, the licensee provided a logic diagram of the Emergency Bus 1H negative sequence voltage relay scheme. The licensee has stated that the emergency buses (1 H, 1J, 2H, and 2J) consist of three Basler BE1-47N negative sequence relays connected to each of the emergency bus PTs. In the logic scheme, the licensee has installed a feature that blocks the open phase protection scheme from actuating in the event of a failed or degraded 4kV bus PT. To achieve this feature, one ABB 60 voltage balance relay is installed per bus. The relay compares 4kV emergency bus PT voltages with 480V emergency bus PT voltages. The relay contact outputs specific to each voltage source actuate if the given source

reaches the voltage setpoint. If a 4kV PT failure occurs, the relay senses a voltage imbalance and opens an auxiliary relay contact which blocks the open phase protection system. One auxiliary relay contact is also used to operate a white light on the front of the relay panel and provides a Plant Computer System (PCS) alarm that will alert operators that open phase protection is disabled. The NRC staff evaluated the logic diagram and the licensee's response and determined that the ABB 60 voltage balance relay will not interfere with the existing UV relay protection scheme because the ABB 60 voltage balance relay is designed to only actuate when it senses a discrepancy between the 4kV emergency bus PT voltages and the 480V emergency bus PT voltages on the open phase protection scheme only. The logic diagram demonstrates no interference between the open phase protection scheme and the existing UV relay protection scheme. Therefore, the existing UV relay protection scheme will actuate with a 2 out of 3 logic scheme regardless of the actuation of the emergency bus PT block on the open phase protection scheme. As long as the emergency bus PTs function as designed, the open phase protection scheme will detect consequential OPCs at the safety buses. The licensee stated that the relay logic diagrams for emergency buses 1J, 2H, and 2J are similar in nature.

In Table 2, "Design Compliance with the NEI Open Phase Initiative and NRC BTP 8-9 Guidance," of the LAR, the licensee stated that negative sequence voltage (open phase) protection circuitry will be installed at Surry, Unit Nos. 1 and 2, to enhance the ability of plant operators to identify and respond to an OPC in an offsite, primary power source. OPCs that produce unbalanced voltages above the protective circuitry relay setpoint will result in annunciator alarms in the MCR and on the PCS. Section 2.5, "OPC Relay Surveillance Frequencies," of the LAR states that the negative sequence voltage (open phase) protection function design includes a PCS alarm to alert operators when a relay loses power, suffers a power supply failure, or experiences another failure that deenergizes the relay.

In RAI No. 8, the NRC staff requested the licensee to provide a discussion explaining the setpoints for the alarm and operator actions taken in accordance with plant procedures. In a letter dated January 16, 2018, the licensee stated that when an OPC is sensed and protection of the emergency bus is actuated, and an overhead annunciator is illuminated in the MCR.

When an open phase overhead annunciator is received, the operators will check the bus voltage imbalance and verify that the associated EDG has started and loaded as required.

Operators will determine the cause of the open phase by checking the switchyard status panel and checking the overhead bus work at the RSSTs and switchyard transformers TX-1, TX-2, and TX-4. The NRC staff reviewed the licensee's response and determined that the PCS alarm and operator actions taken meet the intent of the guidance in BTP 8-9 regarding automatic detection and providing alarm in the control room.

The NRC staff concludes that the proposed electrical design features satisfy the guidance provided in BTP 8-9 as it relates to automatic OPC detection and alarm in the MCR because the design features of the proposed safety-related and non-safety-related relays are such that an OPC will be automatically detected and alarmed in the MCR under all operating electrical system configurations and plant loading conditions. In addition, the licensee will test the relays to ensure that an OPC and faults are automatically detected and alarmed in the MCR in accordance with plant procedures. Also, the licensee will develop OPC training and procedures for operators. Therefore, the NRC staff concludes that the licensee has addressed to BTP 8-9 expectations for automatic detection of OPCs and providing alarm in the MCR.

3.5 NRC Staff's Technical Evaluation of OPC Protection Features Safety-Related OPC Protection Features In LAR Section 3.2.1, "Negative Sequence Analysis," the licensee states that the negative sequence voltage relay settings protect important to safety equipment on the 4kV emergency buses from consequential OPCs and remain secure for the maximum level of steady-state voltage unbalance at the switchyard bus. Also, the licensee states "The analytical limits and time delay of the negative sequence voltage (open phase) relays were also developed. These limits and time delays are used as input for the open phase relay setting calculation." In RAI No. 5, the NRC staff requested the licensee to identify the analytical limits for negative sequence voltage and time delays chosen for the TS changes for OPC detection and protection.

In a letter dated January 16, 2018, the licensee stated that the Basler BE1-47N relays have a negative sequence voltage pickup setting of 6 percent on a 120V nominal voltage base and a time dial setting of 10.0. The relay is modeled in electric system analysis software (Electromagnetic Transients Program - Restructured Version (EMTP- RV)) based on the nominal trip curve. Dominion Calculation EE-0885 provides the total CSA for the Basler BE1-47N relays. Also, Calculation EE-0885 demonstrates the negative sequence voltage relays on Buses 1H and 2H that may pick up between 5.35V to 9.05V, and the negative sequence voltage relays on Buses 1J and 2J that may pick up between 4.28V to 10.12V.

In Section 8.5 of the Surry UFSAR, similar to UV or degraded voltage conditions, for an open phase event coincident with an SI or CLS signal, the licensee has stated that emergency buses should be re-energized by the diesel generator within 10 seconds (the time delay assumed in the accident analysis), including a 2.2 second residual voltage time delay. To be within the time frame considered in the accident analysis, the open phase protection relay tripping time delay should be less than or equal to 7 seconds for an open phase event coincident with an SI or CLS signal. This is consistent with the time delay used for degraded voltage protection during accident conditions. The analysis results show that for all consequential open phase cases in which the negative sequence protection relay trips, the combined tripping time of the negative sequence voltage relay and existing UV protection is less than 5 seconds after the open phase event occurs. That is, for all cases where the tripping time of the negative sequence voltage relay is 5 seconds or longer, the bus voltages on at least two of the three phases are less than the 2975V TS limit for the loss of voltage relay. Thus, for these cases, the loss of voltage relay will drop out and trip after a two second time delay. This is within the time delay considered in the accident analysis for a loss of offsite power coincident with an accident.

Based on the above, the NRC staff concludes that the licensee's justification for the selection of the analytical limits for negative sequence voltage and time delays chosen for the TS changes for OPC detection and protection system are bounding. This is, in part, due to its ability to detect all consequential OPCs and transfer the safety-related loads to the alterr:,ate source prior to a loss of safety function within the timeframe assumed in the accident analysis and in accordance with the guidance provided in BTP 8-9.

In RAI No. 5, the NRC staff requested the licensee to explain how percentage voltage imbalance is calculated based on negative sequence voltage. In addition, the NRC requested the licensee to explain whether other sequence components such as zero and positive sequence components have been considered in determining the power system imbalance. In a letter dated January 16, 2018, the licensee stated that calculation EE-0886 defines voltage unbalance in terms of negative sequence voltage as a percent of rated positive sequence voltage. The licensee stated that this approach is used because it directly relates to the

operating quantity of the Basler BE1-47N (negative sequence voltage magnitude). For low levels of unbalance (1-5 percent) the definition using negative sequence voltage is approximately equal to the National Electrical Manufacturers Association (NEMA) definition of unbalance based on the available industry literature. The station EMTP-RV model used to determine the analytical limits uses all symmetrical components (positive, negative, and zero) to determine the power system unbalance for the open phase conditions. The NRC staff reviewed the licensee's response along with Section 9.6.1 in Calculation EE-0886 and determined that the voltage imbalance is calculated based on a percent of rated positive sequence voltage and all symmetrical components (positive, negative, and zero) which in turn can confirm that the negative sequence voltage relays will appropriately detect OPCs on the ESF buses.

Section 3.2.1 of the LAR states, in part, that an OPC causes a voltage unbalance to the induction motors and motor-operated valves (MOVs), which introduces a negative sequence voltage. This negative sequence voltage produces a flux in the air gap that opposes the rotation of the rotor. The resulting induced currents in the rotor are at twice the line frequency, which can cause additional heating in the rotor due to the skin effect (for higher frequency currents, the skin effect will increase the apparent rotor resistance, resulting in additional rotor heating).

The NEMA Standard MG-1 states that for a voltage unbalance above 1 percent of motor nameplate voltage, motor horsepower should be de-rated to account for the additional heat.

Conservatively (without including the effects of motor cooling), for a voltage unbalance greater than 5 percent (on the motor nameplate voltage base), the negative sequence voltage protection relays will trip and isolate the motor loads before the integrated negative sequence current squared multiplied by the time duration is equal to 20 pu (per unit) to allow for sufficient remaining thermal capability for the motors to restart on the EDGs.

The NEMA Standard MG-1 part 14.36 states that operation of a motor with above a 5 percent unbalance condition is not recommended, and will probably result in damage to the motor. In RAI No. 5, the NRC staff requested the licensee to explain why the proposed setting limit in TS Table 3.7-4, item 7c (:s; 7% voltage imbalance) is conservative and acceptable. In a letter dated January 16, 2018, the licensee stated that the results of Calculation EE-0886 show that, for OPCs that cause a voltage unbalance of greater than 5 percent at the safety buses, the negative sequence voltage will be greater than the Basler BE1-47N pickup setpoint and the relay will trip to isolate the affected loads before equipment damage occurs and before any loads are tripped and locked out. The licensee also stated that there were no open phase cases that resulted in voltage unbalance between 5 percent and the pickup setting of the Basler relays. Therefore, after a review of the analysis of Calculation EE-0885 and the licensee's response, the NRC staff concludes that the proposed setting limit in TS Table 3.7-4, item 7c

(:s; 7% voltage imbalance) is conservative based on analysis demonstrating that safety-related motors on the ESF buses will be isolated and protected due to a relay trip that is designed to occur at a setpoint that is greater than 5 percent when an unbalance of the system is detected from an OPC event.

The NRC staff concludes that the proposed design changes to add safety-related protection relays to protect against OPCs, addresses guidance in BTP 8-9 as it relates to the automatic transfer to alternate power source or onsite standby power system (EDG), because the proposed safety-related protective relays are designed to transfer to alternate power source or EDGs due to an OPC. The NRC staff concludes that the proposed design also addresses 10 CFR 50.55a(h)(2) for safety systems, including relays to mitigate OPC events, since the design meets the single failure criteria and independence requirements of the safety-related divisions. The NRC staff concludes that the licensee addresses guidance in BTP 8-9 for protection features to mitigate and provide a response to the OPC events. In summary, the

NRC staff concludes that the proposed design meets Surry plant design criteria in UFSAR 1.4.24 and 1.4.39 and the intent of GDC 17 as it pertains to OPC.

Non-Safety-Related OPC Protection Features In LAR Section 3.3.3, "Non-Class 1E Design Solution," the licensee states that "for switchyard TransformerTX-1, there are OPCs that result in a negative sequence voltage between 1% and 3.66% on the safety buses. This is above the 1% unbalance threshold (which means it could affect plant equipment), and below the Basler relay capabilities (which means it could potentially go undetected). Therefore, a non-Class 1E Alstom OPD [open phase detection] system is required on Transformer TX-1 because consequential OPCs on the primary side of the transformer would otherwise go undetected." The NRC staff noted from Figure 1 in the LAR that there is an offsite power path from Transformer TX-1 that can provide a source of power downstream to the ESF buses (Switchgear 2H).

In RAI No. 1, the NRC staff requested the licensee to describe the effects of the non-Class 1E Alstom OPD system if it malfunctions or fails during an OPC when ESF buses are aligned to Transformer TX-1 as the offsite power source given a single failure in the onsite power system.

In letters dated January 16, 2018 and March 14, 2018, the licensee states that emergency power remains available to plant safety systems should a failure of the non-Class 1E Alstom OPD System occur. Specifically, the letters state that the non-Class 1E Alstom OPD System has detailed failure modes and effects analysis which uses relays to independently evaluate the need for an open phase alarm or trip with outputs configured in a two-out-of-three voting scheme. The two-out-of-three relay logic scheme reverts to two-out-of-two logic for many relay failure modes. This means that for an unloaded transformer, one failure mode considered in the analysis results in loss of open phase detection; however, the loaded transformer detection circuit remains unaffected by this failure mode. Therefore, the licensee has stated that OPC detection remains available to protect loads once they are aligned to the transformer for this failure mode. For a loaded transformer, the only failure modes considered in the analysis that result in loss of open phase detection are the product of the failure of multiple OPD system components. The loaded transformer failure modes that result in loss of OPD generate alarms that will alert operators to the loss of OPD thereby allowing them to diagnose and address the problem. The remaining failure modes do not result in loss of OPD and do not result in spurious trips.

Additionally, the licensee has stated that in the unlikely event that an OPC occurs concurrent with an Alstom OPD System failure resulting in loss of open phase detection, one emergency bus per unit remains unaffected due to the switchyard and transformer alignment. The NRC staff notes that if a single failure occurs in the Class 1E system concurrent with Alstom OPD System failure, manual action is required to align the ESF bus to an alternate power source.

The NRC staff concludes that the Class 1E Basler BE1-47N negative sequence relays and its protection schemes are adequate to protect the safety-related equipment from the consequences of OPCs without any reliance on the non-Class 1E Alstom OPD System relay scheme. This is due to the fact that the NEMA in its Motors and Generators Standards MG1 states that operation of a motor with up to 5 percent unbalance condition is acceptable for operation. The NRC staff notes that the licensee has the option of aligning other switchyard power transformers to ESF buses such that ESF buses are always protected by the Class 1E Basler BE1-47N negative sequence relays. In addition, the licensee's analysis indicates that for an OPC occurring on the high or low side of the RSST-A, RSST-B, and RSST-C transformers,

the Basler BE1-47N negative sequence relays are sufficient to protect the safety-related equipment.

3.6 NRC Staff's Technical Evaluation of Technical Specifications Changes The NRC staff reviewed the LAR to verify that the setpoint values provided are adequate to assure, with a high confidence level, that the required protective actions will be initiated before the associated plant process parameter exceeds its analytical limit.

3.6.1 Revise TS Table 3.7-4 Surry TS Table 3.7-4, "Engineered Safety Feature System Initiation Limits Instrument Setting,"

Item 7, "Loss of Power," would be revised to add Item 7.c, "4.16 KV Emergency Bus Negative Sequence Voltage (Open Phase)." An unbalanced voltage setting limit of less than or equal to 7 percent was determined based on the 6 percent relay setpoint with an applied 1 percent device uncertainty.

The NRC staff reviewed Table 1, "Summary of Negative Sequence Voltages for Open Phase Conditions on Each Transformer," in Attachment 1 of LAR to evaluate the following:

1. 10 CFR 50.36(c)(1)(ii)(A) requires that limiting safety system settings (LSSSs) for variables that have significant safety functions. The regulation states "Where a

[LSSS] is specified for a variable on which a safety limit has been placed, the setting must be so chosen that automatic protective actions will correct the abnormal situation before a safety limit is exceeded." The Analytical Limit is the limit of the process variable at which a safety action is initiated, as established by the safety analysis, to ensure that a Safety Limit (SL) is not exceeded. Any automatic protection action that occurs on reaching the Analytical Limit therefore ensures that the SL is not exceeded.

The licensee's methodology discussed in Section 3.3 of this SE followed NEMA MG-1-2009, "Motors and Generators." The NRC staff evaluated the licensee's selected setpoint of 6 percent for the Basler BE1-47N relay and found that the NEMA MG-1-2009 section 14.36, "Effects of Unbalanced Voltages on the Performance of Polyphase Induction Motors," states "the operation of the motor above a 5-percent voltage unbalance condition is not recommended," because the motor is predicted to create additional heating considered detrimental to its operation. However, the instruction manual for Basler BE1-47N voltage

• phase sequence relay states the negative sequence voltage pickup setpoints are only adjustable from 2 to 32 percent of the nominal voltage in 2 percent increments. Therefore, the relay is capable of being set in +/- 2 percent increments, with 4 percent generating possible unnecessary (spurious) trips, and 6 percent being evaluated in the following section and found to be adequate to protect the loads as 10 CFR 50.36(c)(1)(ii)(A) requirements.

The NRC staff notes, from the Westinghouse Generic Setpoint Control Program Recommendations (ADAMS Accession No. ML12058A445), the CSA term is "the combination of the various channel uncertainties via Square-Root-Sum-of-the-Squares (SRSS), statistical, or algebraic techniques. It includes instrument (both sensor and process rack) uncertainties and non-instrument related effects." This parameter is compared with the total of all uncertainties to determine the minimum required instrument channel margin (margin between the Analytical Limit (AL) and Limiting Trip Setpoint (LTSP)). In the LAR,

Section 3.2.4, "Security Cases," the licensee determined the applicable uncertainty terms through a computation the CSA.

The licensee evaluated the accuracies of the relay and potential transformer, and calculated the CSA for the Basler BE1-47N voltage phase sequence relays. In the LAR, the licensee stated that the maximum uncertainty (i.e., CSA) for the Basler relay at the 4kV emergency buses was calculated to be +/- 2.4 percent.

Span 120V (line-to-line) = 120V / ../3 - 69.3V (line-to-neutral)

CSA is+/- 2.4% of span 69.3V = +/- (69.3V x (2.4 /100)) - +/- 1.68V (line-to-neutral)

- +/- (1.68V * ../3) - +/- 2.92V (line-to-line)

2. NRC Setpoint Evaluation:

The NRC staff applied the guidance in RG 1.105 to independently confirm whether there is adequate margin for instrument channel performance uncertainty between the LTSP and associated AL (in the worst case, minimum Negative Sequence Voltage for OPC).

Regulatory Guide 1.105, Revision 3, specifies acceptable methods for combining uncertainties in determining a trip setpoint and its allowable values. Based on Section 4.4 of the American National Standards Institute (ANSl)/ISA-S67.04-1994, which is endorsed in RG 1.105, the Total Loop Uncertainty (TLU) on an increasing process would be calculated by the following equations.

LTSP = AL-TLU Thus, TLU = AL-LTSP Where:

The AL and LTSP values for the OPC Negative Sequence Voltage with selected 6 percent setpoint that are from Figure 2, "OPC Negative Sequence Voltage Protection,"

in Attachment 1 of the LAR:

Upper Analytical Limit (UAL)  : 11.2% (13.39V line-to-line)

Limiting Trip Setpoint (LTSP)  : 6% (7.2V line-to-line)

Upper Limiting Trip Setpoint (ULTSP): 6% Setpoint + 2.4% = 8.4 % (10.12V line-to-line)

Lower Limiting Trip Setpoint (LLTSP): 6% Setpoint - 2.4% = 3.6% (4.28V line-to-line)

Lower Analytical Limit (LAL)  : 1% (1.2V line-to-line)

Lower levels of voltage imbalance are provided only for TX-1 during normal and accident conditions. The licensee noted that: "These levels are high enough to affect plant equipment. TX-1 is removed as a station off-site power source when this condition is detected by the Alstom OPD System installed by the non-Class 1E solution." Thus, the NRC staff evaluated the upper level of the OPC negative sequence voltage.

The TLU is the total amount by which an instrument channel's output is in doubt (or the allowance made for such doubt) due to possible errors, either random or systematic.

The uncertainty is generally identified within a probability and confidence level. Random error is described as a variable whose value at a particular future instant cannot be predicted exactly but can only be estimated by a probability distribution function. Bias is an uncertainty component that consistently has the same algebraic sign and is expressed as an estimated limit of error.

Margin, in setpoint determination, is an allowance added to the instrument channel uncertainty. Margin moves the setpoint farther away from the analytical limit.

Margin = UAL - ULTSP The NRC calculation results are reflected in the Negative Sequence Voltage Figure 1 below.

Negative Sequence Voltage Upper Analytical Limit (13.39V)

'. '~ (UAL)

C: Margin B:TLU

% Margin= ((C/8)*100%) = ((3.27V/6.19V) X 100%) = 52.83%

(Limiting Trip Sepoint + CSA) (10.12V)

(ULTSP)

+2.9V A:CSA

,, ', Limiting Trip Setpoint (7.2V)

(LTSP)

-2.9V

,, (Limiting Trip Setpoint - CSA) (4.28V)

---,-~---- (LLTSP)

This level is produced only at TX-1 during normal and accident conditions Inconsequential 1% (1.2V)

Figure 1: NRC Staff Margin Calculation The NRC staff independently calculated the margin between AL and LTSP and found that this margin is adequate (as indicated in the Figure 1, above), at a value greater than or equal to 52 percent. This margin reflects that the trip setpoints have been chosen to assure that a trip or safety actuation will occur significantly before the measured process reaches the UAL level.

The NRC staff verified that the proposed setpoint of 6 percent for the Basler BE1-47N relay provides a sufficient negative sequence voltage margin between AL and LTSP for the OPC and meets the performance criteria of RG 1.105, and, therefore, satisfies the requirements of the regulation at 10 CFR 50.36(c)(1)(ii)(A).

3. In Table 3.7-4, "Engineered Safety Feature System Initiation Limits Instrument Setting,"

the licensee requested to add the item 7c, "4.16kV Emergency Bus Negative Sequence Voltage (Open Phase)," for Emergency Buses Separation and Diesel Start Channel with imbalanced voltage limit setpoint of less than or equal to (S) 7 percent into the Function Unit 7, "Loss of Power."

The NRC staff reviewed the Basler Relay Instruction Manual to verify that the Basler relay has 1 percent device uncertainty.

Based on the 6 percent relay setpoint that was evaluated in this section of this SE, and an applied 1 percent device uncertainty, the licensee's selection of an imbalanced phase voltage setting limit of the 4.16kV Emergency Bus Negative Sequence Voltage (Open Phase) for Emergency Buses Separation and Diesel Start Channel of s 7 percent is acceptable.

Based on the above, the NRC staff concludes that the licensee's imbalanced voltage setting limit for the 4.16kV Emergency Bus Negative Sequence Voltage (Open Phase) for Emergency Buses Separation and Diesel Start Channel is an adequate nominal setpoint with a high confidence level in protecting against an OPC Negative Voltage and satisfies the requirements of the regulation at 10 CFR 50.36(c)(1)(ii)(A).

3.6.2 Revise TS Table 4.1-1 Surry TS Table 4.1-1, "Minimum Frequencies for Check, Calibrations and Test of Instrument Channels," Item 33, "Loss of Power," would be revised to add Item 33.c, "4.16 KV Emergency Bus Negative Sequence Voltage (Open Phase)," surveillance requirements. The relay calibration and testing requirements would be added to the Surveillance Frequency Control Program (SFCP). The proposed OPC negative sequence voltage relays' calibration and testing frequencies to be included in the SFCP are "once per 18 months." The NRC staff concludes that this is consisted with the current undervoltage and degraded voltage relay frequencies in the Surry TS and, therefore, concludes that it meets the intent of 10 CFR 50.36(c)(3).

3.6.3 Revise TS Table 3.7-2 and Table Notations for Tables 3.7-2 and 3.7-3 Surry TS Table 3.7-2, "Engineered Safeguards Action Instrument Operating Conditions," Item 4, "Loss of Power," would be revised to add Item 4.c, "4.16 kv emergency bus negative sequence voltage (open phase)," instrument operating condition requirements. In LAR Section 2.4, "Description of Proposed Change," the licensee states, in part, that:

Operator Action 27 is also being added to identify the actions required when the number of operable negative sequence voltage (open phase) relay channels is less than the total number of channels, similar to the existing loss of voltage and degraded voltage protection circuitry .... Specifically, Action 27.c states that the negative sequence voltage (open phase) protection function does not have to be declared inoperable provided verification is performed at least once per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> that an OPC does not exist on the primary side of transformer TX-2, transformer TX-4, and the RSSTs, as well *as the Unit 1/Unit 2 main step-up transformers when power is supplied by the dependable alternate source, until the negative sequence voltage (open phase) protection function has been returned to service.

If the negative sequence voltage (open phase) protection function has not been returned to service within 90 days, the plant shall be in at least HOT SHUTDOWN within the next six hours and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

The NRC staff notes that the proposed Operator Action 27 for LCO for an inoperable open phase protection function is 90 days in the licensee's original submittal dated May 23, 2017.

The NRC requested justification for the 90 day Completion Time. Since the inoperable relay cannot take any automatic protective function for an OPC and remains connected to the Class 1E ESF 4160V buses downstream, it could render the onsite emergency power system incapable of performing its designated safety function.

In RAI No. 6, the NRC staff requested the licensee to provide either justification for the Completion Time of 90 days or provide appropriate markup of changes in the TSs for the required action for inoperable OPC relay consistent with 10 CFR 50.36(c)(2). In its letter dated January 16, 2018, the licensee stated that the proposed Operator Actions 27.a and 27.b for Table 3.7-2 are consistent with other relays specified in Surry TS Table 3.7-2 for loss of power instrumentation. Specifically, the required time frames in the proposed Operator Actions 27.a and 27.b are the same as the required time frames in the existing Operator Actions 26.a and 26.b for undervoltage and degraded voltage. In a letter dated March 14, 2018, the licensee clarified that regarding Operator Action 27 .c, the Completion Time is revised from 90 days to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. In addition, the terminal action for Operator Action 27 is revised to state "If the conditions are not satisfied, restore the protection function within 7 days or be in at least HOT SHUTDOWN within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />."

These revisions align the proposed Operator Action 27 completion times with the existing requirements in Operator Action 26 for inoperable channels. The terminal action for Operator Action 26 states "If the required conditions are not satisfied, declare the associated EDG inoperable."

Based on the above, the NRC staff concludes that the proposed 4.16 kv emergency bus negative sequence voltage (open phase) instrument operating condition requirements and 72-hour LCO are acceptable and would continue to meet 10 CFR 50.36(c)(2) and 10 CFR50.36(c)(3).

3.6.2 Proposed Changes to Design and Licensing Basis Documents In LAR Table 2, the licensee states "A UFSAR change request has been initiated to revise the UFSAR to describe the open phase analysis and detection/protection scheme implemented by this modification. It will be implemented in accordance with the station design control process."

In RAI No. 7, the NRC staff requested the licensee to provide a draft mark-up of the proposed UFSAR Section 8.5 update to include items reflected in the proposed TSs changes. In its letter dated January 16, 2018, the licensee provided a UFSAR mark-up including:

• For an open phase condition (nominally, above 6% negative sequence voltage), the two-out-of-three logic scheme will energize an Undervoltage Protection auxiliary relay for the associated bus which starts the EDG and transfers following the same process as the Undervoltage/Degraded voltage protection scheme. The open phase condition negative sequence voltage relays include an inverse time characteristic which introduces a trip time delay based on the magnitude of negative sequence voltage sensed. A time dial setting of 10 is used for the open phase condition negative sequence voltage relays which results in a trip time delay of less than 5 seconds for any open phase condition sensed at an emergency bus.

The NRC staff reviewed the UFSAR mark-up of the OPC detection and protection schemes and has reasonable assurance that conforming changes will be made to the design and licensing

basis. The NRC will expect to receive the UFSAR update, in accordance with 10 CFR 50.71(e),

that includes discussions of the design features and analyses related to the effects of, and protection for, any open phase condition design vulnerability.

3. 7 Technical Conclusion The NRC staff concludes that the proposed descriptions and design changes are acceptable as they satisfy the relevant requirements such as Surry plant design criteria in USFAR 1.4.24 and 1.4.39, and the intent of GDC 17, for the offsite and onsite electric power system. The proposed changes are in accordance with 10 CFR 50.36(c)(2) and (c)(3), and 10 CFR 50.55a(h)(2) and provide reasonable assurance for functionality of SSCs important to safety during postulated events at Surry, Unit Nos. 1 and 2.

4.0 STATE CONSULTATION

In accordance with the Commission's regulations, the Virginia State official was notified April 20, 2018, of the proposed issuance.of the amendments. The State official had no comments.

5.0 ENVIRONMENTAL CONSIDERATION

The amendments change requirements with respect to the installation or use of facility components located within the restricted area as defined in 10 CFR Part 20 and change surveillance requirements. The NRC staff has determined that the amendments involve no significant increase in the amounts and no significant change in the types of any effluents that may be released offsite and that there is no significant increase in individual or cumulative occupational radiation exposure. The Commission has previously issued a proposed finding that the amendments involve no significant hazards consideration, and there has been no public comment on such finding dated October 10, 2017 (82 FR 47040). Accordingly, the amendments meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9).

Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendments.

6.0 CONCLUSION

The Commission has concluded, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) there is reasonable assurance that such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendments will not be inimical to the common defense and security or to the health and safety of the public.

Principal Contributors: S. Morris, NRR/DE/EEOB H. Vu, NRR/DE/EICB D~e: May 3, 2018

ML18106A007 *per SE OFFICE DORL/LPL2-1/PM DORL/LPL2-1 /LA EEOB/BC* EICB/BC*

NAME KCotton KGoldstein JQuichocho MWaters DATE 04/12/18 04/17/18 04/12/18 02/08/18 OFFICE OGC-NLO DORL/LPL2-1 /BC DORL/LPL2-1 /PM NAME JWachtuka MMarkley KCotton DATE 04/20/18 05/03/2018 05/03/2018