ML15224A779

FOIA/PA-2015-0393 - Resp 2 - Final, Part 1 of 1

ML15224A779
Person / Time
Site:	Oconee
Issue date:	08/07/2015
From:	Office of Information Services
To:
References
FOIA/PA-2015-0393
Download: ML15224A779 (75)

Text

' W UI" D eT lIsa";

REGULAkTORY COMMISSION

-* IL, i. C.205 t_ .o-June 3, 1977 Docket Nos. 50-269 ..5o-z~oRECEIVED and 50-287JU 97:,"DUKE POWER Duke Power Company* iJ# JOUm on:ATTN: Mr. WilliamO0.

Parker,: Jr. ---- i ~ ~~Vice President SPost Office Box 2178 "' ": L'q 422 South Church Street i Charlotte, North Carolina 28242* -Ge ntlemen:-- RE: OCONEE NUCLEAR STATION, UNITS 1, 2 AND 3 Wie are currently reviewing the onsite emergency power systems of all* o operating nuclear .power facilities to assess the susceptibility of their safety related electrical equipment with regard to (1) sustaineddegraded voltage conditions at the offsite power sources and (2) inter-action between the off site, and onsite emergency power systems.* We have completed our review of licensee responses to our previous Ci generic request for information relative to the electrical power O distribution systems. Based on this initial review, we have prepared the Safety Evaluation and Statement of Staff Positions contained in S E~ncl osure 1.We request that you compare the current design of the emergency power systems at your facility(i~es) with the Staff Positions stated in the enclosure and: (1) propose plant modifications as necessary to meet the Staff Positions, or (2) provide a detailed analysis which .shows your facility design has equivalent capabilities and protective features.Additionally.

we require that certain technical specifications be incorporated into all facility operating licenses.

Model technical specifications, consistent with the Staff Positions contained in Enclosure 1, are provided in Enclosure 2.0000L&770603A B42 i Duke Power Company June 3, 1977 Accordingly, we request that you apply, within forty-five days of the receipt of this letter, for an amendment to your facilit! operating license(s) to incorporate comparable technical specifications to those presented in the enclosure.

Additionally, you should provide a description and a schedul~e for the completlor' of a ny plant associated modi fications.

If you have any questions on this matter, please cnntact us.Sincerely, v,' < 9 4~A. Schwencer, Chief-o Operating Reactors Branch #1 Division of Operating Reactors

Enclosures:

1. Staff Positions-. 2. Model Technical Specitfi cati ons..cc w/encl osures:Mr. William L. Porter.Duke Power Company P. 0. Box 2178*,' 422 South Church Street, Charlotte,.

North Carolina 28242__ J. Michael McGarry, III-,; Esquire DeBevoise

& Libernan 700 Shoreham Building 806-15th Street, N. W.Washington, D. C. 20005 Oconee Public Library, 201 South Spring Street, Walhalla, South Carolilna 29691

• i i , J I ENCLOSURE 1' .SAFETY EVALUATION.AND STATEMENT OF STAFF POSITIONS RELATIVE TO THE EMERGENCY POWER SYSTEMS FOR OPERATING REACTORS A. INTRODUCTION") The onsite emergency power systems of operating nuclear power facilities are being reviewed to assess, the susceptibility of their associated redundant safety-related electrical equipment to:-(a) *Sustained.

degradeU voltage conditions at the offsite power source; and (b) Interaction of the offsite and onsite emergency power systems.We have completed our review, of the responses to our generic request foradditional 1/ relative to the electrical power distribution systems of currently ooeratinq nuclear Dower facilities.

In response to our request, all licensees have analyzed their system designs to O determine that the voltage levels at the safety-related buses have been optimized for the full load and nii~imum load conditions that are expected throughout the anti~ipated range of voltage variations for the offsite power sources. The transformer voltage tap adjustments that were necessary to optimize the voltage levels have been accomplished.

In addition to the above corrective action, we have developed tne following staff positions for use in evaluation of each of the operating nuclear wer plants with regard to the two items identified above. These positions ,.÷ '.i ,ir

icensee resr,'-1se t--,.m'Letters to all licensees, dated August 12 and 13, 1976.

• 0 requests for additional information and *f other related information as cited in the text.B. POSVTIONS 1) Position 1: Second Level of Under-or-Over Voltage Protection with a Time Delay Werequire that a second level of voltage protection for theonsite power system be provided and that this second level of r. voltage protection shall satisfy the followina criteria: F. a) The selection of voltage and time set Doints shall be determined from an an~lysis of the voltage requirements of the safety-related loads at all onsite system distribution

~levels;( b) The voltage protection shall include coincidence logic to I spurious trips of the off~ite power source;) *.c) The tihe delay selected shall be based on thelfollowing conditions:

.(1) The allowable time delay, including margin, shall notexceed the maximum time delay that is assumed in the FSAR accident analyses;(2) The time delay shall milnimize the effect of short duration disturbances from reducin9 the availability of the offsite power and (3) The allowable ti.re d-iration of a degraded voltage condition at all distribution~

system' levels gha1.1 rnot in f clreo safer7 syste-' or co~cone'ts;

,.w i , I; d) The voltage monitors shall automatically initiate the disconnection of offsite power sources whenever the voltage set point and time delay limits have been exceeded; i e) The voltage monitors be designed to satisfy the requirements of IEEE Std. 279-1971, "Criteria for Protection Systems for Nuclear] *S Power Generating Stations";

and f)The Technical Specifications shall include limiting conditions for I N operation,'survelllance requirements, trip set points with minimum.- and maximum limits, and allowable values for the second-level 0voltrage protection monitors.~.General Design Criterion 17 (GDC 17) "Electric Power Systems', of Appendix v- A, "General Design* Criteria for Nuclear Power Plants;" of 10 CFR Part 50 o0 requires: (a) two physically independent circuits from. the offsite trans-0 mnlssion network (although one, of these circuits may be a delayed access t, circuit, one c.ircuit must be automatically available within a few seconds following a loss-of-coolant accident); (b) redundant onsite A.C. power supplies; and (c) redundant D.C. power supplies.GDC-17 further requires that ,the safety function of each a.c. system (assuming the other system is not functioning) shall be to provide sufficient capacity and capability to assure that;: (a) specified acceptable fuel design limits.and the design conditions the reactor coolant pressure boundary are not exceeded as a result of antic~ie te~~.~c' l oc:';'-rnces; and (b) the core is ccok.td and

• .lte~r 4.,, o'her vit.al functions are maintained during any of the :postulated accidents.

Existing undervoltage monitors automatically perform the required func-tion of switching from offstte power, the preferred oower source, to the redundant onsite power sources when the monitored voltage degrades to a level of between SO to 70 percent of the nominal rated safety bus voltage.This Is usually accomplished ,after a one-half to one second time delay.These undervoltage monitors are designed to function on a complete loss of the offslte power source.:- The offsite power system is the co.ntnon source which normally suoolies 1~-..power to the redundant safetyl-related buses. Any transient or sustained degradation of this conmnon sojrce will be reflected onto the onsite system's safety-related busesI.Asustained degradation of offsite Dower system's voltage could result in the loss of capability of the redundant safety loads, their control circuitry, and the associated electrical components required for performing safety functiops.

The operating procedures and guidelines utilized by electric utilities* and their interconnected cooperative oroanizations minimize the pro-* bability for the above conditions to occur. However, since deoradation of an offsite Dower system that could lead to or cause the failure of redundant safety-related electrical equipment is unacceptable, we require the additional safety margins associated with implementation of the protective measures detailed above.

.I* 0-5-2) Position 2: Interaction of Onsite Power Sources with Load Shed Feature We require that the current system designs automatically prevent load shedding of the emergency buses once the onsite sources are supplying power to all sequenced loads on the emergency buses. The design shall also include the capability of the load shedding feature to be automatically reinstated if the onsite source supply breakers are tripped. The automatic bypass and reinstatement feature shall be verified during the periodic testing identified in Position 3.* --- In the event an adequate basis can be provided for retaining the load~shed feature when loads are energized by the onsite power system, we will require that the setpoint value in the Technical Specifications, which is currently specified as "...equal to or greater than..." be C) amended to specify L value having maximum and minimum limits. The olicensees' bases for the setpoints and limits selected must be documented.

GDC 17 requires that provisions be included to minimize the probability of losing electric power from any of the remaining supplies as a result of or coincident with the loss of power generated by the nuclear power unit, the loss of power from the transmission network, or the loss of power from the onsite electric power supplies. The functional safety requirement of the "loss-of-offsite power monitors" is to detect the loss of voltage on the offsite (preferred) power system and to initiate the necessary actions required to trans-fer the safety-related buises to the onsite system. The load shedding feature, which is required to function prior to connecting the onsite power sources to their respective buses can adversely interact withthe onstte power sources itf the load shedding feature is not bypassedafter it has performd i~s required function.

The load shed feature"- should also be to allow itlto perform its function if the~onsite sources are interr~upted and are subsequently required to be reconnected to their respective buses.3) Position 3: Onsite Power Source Testing C)~We require that the Technical Specifications include a test requirement m'I" to demonstrate the full functional .operability and independence of the onsite power sources at least once per 18 months during shutdown.

The Technical Specifications shall include a requirement for tests: (1)simulating loss of offsi~te power in conjunction with a safety injection actuation signal; and (2) simulating interruption and subsequent reconnection of onsite power sources to their respective buses. Proper operation shall be determined by: a) Verifying that on loss of offsite power the emergency buses have br~n ...-. that th: lo'.zhav'bee shed the ~b) Verifying that on, 19ss of offslte power the diesel generators i start from ambient condition on the autostart signal, the emergency buses are energized with permanently connected loads, the auto-connected emergency loads are energized through the load i sequencer, and the system operates for five minutes while the generators are loaded with the emergency loads.c) Verifying that on interruption of the onsite sources the loads I are shed from the emergency buses in accordance with design i i, m requirements and that subsequent loading of the onsite sources 1i is through the load sequencer.

GDC 17 requires that provisions be included to minimize the probabilityof losing electric power from any one of the remaining supplies as a Qresult of or colncident,with the loss of power generated by the reactor~power unit, the loss of power generated by the nuclear power unit,; the loss of power fronr the *transmission network, or the loss of power* from the onsite electric power supplies.The testing requirements identified in Position 3 will demonstrate the capability of the onsite power system to perform its required function.

The tests will also identify undesirable interaction between the offsite and onsite emergency power systems.

TABLE 3.3-3 (Continued)

ENGINEERED SAFETY FEATURE ACTUATION SYSTEM INSTRUMENTATION F.UNCTIONAL UNIT LOSS OF POWER a. 4.16 kv Energency Bus Undervoltage (Loss of.Vol tage)b. 4.16 kv Emergency Bus Undervol tage (Degraded Voltage)TOTAL NO.OF CHANNELS MiNIMUM CHANNELS CHIANNELS TO TRiP OPERABLE APPLI[CABLE OPERATINGIODES**

ACT[O__.,N***

4()*u 4(3)/Bus 2/Bus 2/Bus 3(2)/Bus 3(2)/Bus 1,2, 3 1, 2, 3 A or B 0 0.9-.-4'71 C'AerS I- tI C w-u g~Ill C,~-n'-4 C,*(Entries In parenthesis are applicable for 2 out of 3 coincidence logic)**Required when ESF equipment is required to be operable***Action A for 2 out of 4 logic Action B for 2 out of 3 logic I S S TABLE 3.3-3 (Continued)

ACTION STATEMENTS ACTION A .-With the number of OPERABLE channels one less than the Total Number of Channels operation may proceed provided both of theifollowing conditions are satisfied:

a. The inoperable channel is placed in the tripped condition within one hour.b. The Minimum Channels OPERABLE requirement is met; however, one additional channel may be'0 bypassed for up to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> for surveillance testing per Specification (4.3.2.1.1).

ACTION B -With the number of OPERABLE Channels one less than theTotal Number of Channels operation may proceed until-performance of the next required CHANNEL FUNCTIONAL TEST provided the Inoperable channel Is placed in thetripped condition within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />.

r~ ~j ~ *~ Q 1 7 ;: 7 TABLE 3.3-4 (Continued)

ENGINEERED SAFETY FEATURE ACTUATION SYSTEM INSTRUMENTATION TRIP VALUES FUNCTIONAL UNIT i.OS:; OF POWER TRIP VALUE ALLOWABLE VALUES S*'. 4.16 kv Emergency Bus Undervoltage (Loss of Voltage)h.. 4,16 ky Emergency Bus Undervoltage

...(De~graded Vol tage)( +Svolts with a second time delay+ _)volts with a second .time delay volts with a second time delay (+) volts with-a T_-) second time delay.1-v I U o 0 :. 4 6 0 I7 .;TABLE 4.3_-2 (Continued)

ENGINEERED SAFETY FEATURE ACTUATION SYSTEM INSTRUMENTATION SURVEILLANCE REOUIREI4ENT$

FU'2CTIONAL UNIT I.OSS OF POWER a. 4.16 kv Emergency Bus Undervoltage (Loss of Voltage)hK 4.16 kv Evmergency Bus Undervol tage--(Degraded

.........Voltage)CHANNEL CHANNEL CHECK CALIBRATION CHANNEL FUNCT IONAL TEST OPERAT ING MOBES IN WHICH SURVE ILLANCE REQUIRED.£S S R R H 14 1,2, 3 1, 2, 3 S = at least once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> R = at least once per 18 months N = at least once per 31 days

...... J- ....*ELECTRICAL POWER

• I N-SURVEILLANCE REQU!RE?4ENTS.

.. .r 4.8.l.1.X Each diesel shall be demonstrated OPERABLE: a. At least per 18 months during shutdown by: 1. Simulating a loss of offsite power in conjunction with a safetyinjection actuation test signal, and: a) Verifying de-energization of the emergency busses and load shedding from the emergency busses.b) Verifying the diesel starts from ambient condition on tihe auto-start signal, energizes the emergency busses with permanently connected loads, energizes the auto-connected emergency loads through the load sequencer and operates for > 5 minutes while its generator is loaded with th~ emergency loads.c) Verifying that on diesel generator trip, the loads are Shed from the emer'gency busses and the diesel re-starts on the auto-start signal, the emergency busses are energized with permanently connected loads, the auto-connected emergency loads are energized through the load sequencer and the diesel operates for > 5 minutes while its generator Is loaded with the .emergency loads.o)

~422 SOrUTn 1 CHVRCH ST~zsr. CRA!L.OTTE..

'. C. *July 21, 1977* g.*Mr. Edsou G. Case, Acting Director Office of Nuclear ReactoF RegulationU. S. Nuclear Regulator/:

Co~ission~Washington, D. C. 20555'* Onerating Reactors 3ranch ".'

Dear Mr. Case:

• a. Your letter of June 3., 1977 requested t.hat we compare t:he design of the, 0conee Nuclear Station power systems with the staf-f positlc-ns-- to assess the susceptiblilty of safety-related electrical equipment v-ihregard to C1) sustained degraded voltage conditions at the of fsite scur:es,~ ~and (2) interaction between' the offsite and. onsite emergency.

p ower sys:e-..s.It is our conclusion, documented in the attached analysis, that the,design of the 0conee emergency power system has equivalent capabilitiesand protective features t~o those described in the staff's position."', Your letter requested an amendment t.o the Facility 0perating Licensebe proposed to incorporate comparable Technical Specifications to tiosa il O provided in the staff p sition. This amendment

AlI be submitted by"September 13, 1977.ii .c, Very/truly yours William 0. Parker, MST:vr bec: Mr. 1t. B. Tucker Mr. Rt. T..Bond.bir. P. H. Barton I"Mr. T. P. Earrall Mr. F. C. Eaywortb -.r1. B. I. Rice Mr. K. S. Canady Mr. C. J. Wylie Mr. D. C. Eolt Master File OS 801.01 Ms. L. J. Bare Section File OS 801.0)1 -Mr J. E. Smit~h

.... .OCON~EE NUCLEAR STAtTI0N Resoonse to Staff Position on fle~raded System Condit~ons ml m U II m IN.0'-0-o 0 0 The design of the Oconee Ni clear Station ousite emergency power system has been reviewed and compared jw!th the Staff position as requested.

It has been determined that the protection system, relating to degraded offsite system conditions, [ha equivu~ent.

capabjLti£es and protection features to those described in the s position.The voltage protection i oae in the design consists of t.wo-out-of-three conlincident undervolcage relay logic mon!toring the offside power syscam. The undervol~age relays in thi4 logic have inverse time characteristcs that -il.Z protect the onsite distribut~ion system from the effects of varyi.ng degraded offsite system conditions.l The undervoltage protection will initiate sepa-ration of the onuite emergency buses from the offsite power systems irmedlately upon complete loss of offsite power or at a time delay depending on the axtent of the degraded condition.

For the postultated conditions when the emergency buses must be separated from the offiste power systems some degraded condition, emergency power is supplied from the onsite K~owee Hydro Sta~tiou.

Two 87.5 XVA hydro-electric generating units are avail~.ble to serve the emergency buses as described in FSAR Section 8.2.3. Due the enormous capacity of thease onsite emergency power sources, load shedding and sequencing of the emergency loads is no: required.

Therefore, the protection system incorporates all !eve._s of protection required fort degraded off site power system coudit~ons due the inherent caPabiltitiesjof the inverse time undervoltage relay.The following discussion a~dresses the comparison of the design of the Oconee Nuclear Station emergency power systems with t.he scared Staff positions; Position !a) In response t.o the Augfzsc 12, 1976 NRC request for info~uat~on, an analysis of the Oconaee electrical distribution system was performed, docunented, and.

to the Staff. A susmary of this report is enclosed as Attachment, I. This analysis, covering the voltage requi.-e-ue.nta of the electrical equipment under degraded conditions, defined the ,nder-voltage trip setpoint the inverse-time undervoltage protection relays as 882 of the rated voltage. This setpolnc will initiate tripping at the following voltage levels and time delays, thereby providing pro-tection over the full of voltage decays: Percent of Setpoin ie ea5.0 sec3.6 sec 8p2 2.0 sac s,0z 1.0 sec 352 _'0.8 sec* I[ -

"1-2-~This settina orovides adq~quate margin sufficient to assure the ooerability of the emergency loads m~der short-time or long-time voltage degradation within the capability

-" he equipment and wIthin the setpoinc limLits.b) The design of the voltage protection system conforms to this position in that it provides*

ewo-out'..of-three coincident undervoltage relay logic to preclude spuriously sepa "ating the emergency buses from the offsite power sources. -c) The time delays associated with the setpoints are listed in the preceding response to Posi,.ion 1(a) were selected based on the following considerations:-1) The allowable time d~lay, including margin to trip offsite power':i= and t.o provide emergency onsite power, does not exceed the 23 seconds period for ai LOCA condition or the 23 minute period for~a mon-LOCA condition 1 that is assumed in the accident analysis.* 2) The time delays sele~ted prevent short term transient conditionsl from reducing the av~.Ilabiliry of the offsire power sources and* -minimize the effects. of these disturbances.

• ~3) The inverse-time c~haract.erlscic of the undervotage relays used* for voltage protectlion is well within the allowable limits estab-* O lished for the safety systems equipment.

This protection will,.- therefore, separate t~he emergency buses from the offsice powersources before any level is reached which may be detrimental to the safety systems or components.

CDd) The undervolt.age protection logic automatically initiates the disconnec~i~n 0 of the offsite power so~rces from the emergency buses whenever the vol.tage oD setooinc and time delay have been exceeded.e) Aithouzh designed =riort ,o the issuance of IEE 279-1971.

the i protection logic satisfies the requirements of this standards.

! f) Technical will be revised to make provisions for the~voltage protection moni ors.Position 2~The onsite emergency power for the Oconee Station is supplied by the~Keovee Hydro. Station as des~rlbed in the 7SAR Sect!on 8.2.3. Because of the I ~ample capability of the tvo;Keowee units C87.5 .qVA each), no load she~ddng-or sequencing of emergency is required.

Therefore, no preventive inca: locks, automatic bypasses,lor re-instatement feat.ures are required.

i I* -' -J3 The Technical Specifications test requirements that demon independence of tihe onsite ... .'"-3-wi].] be :evised as appropriate to includethe full functional.

operab$iiy and pver sources at least one pwr 18 months.0 I#"

Ct..,#.~-AITACI4MENT I..: :.

• Summary of the Analvsi;s

!of Oconee Emercencv Pcwe r" Ost~ributlon System I. I NTROOUCT ION The following analysis system to determine if including associated c affected by short tern The evaluation has bee conditions (I.e., norn distribution system ar voltage condi tions.II. EViL UAT1!ON Figure 1 shows a one-~system which is the b the distribution 2 are similar to Unit allI units.evaluates the Oconee emergency power distribution the operability of safety-related equipment, ontrol circuitry and instrumentation is adversely or long term degradation in grid system voltage.n.directed toward identifying all possible voltage a,1 and degraded) that can exist on the plant_.d comparing equipment operating limits to these Ine diagram of the Oconee Unit 3 distribution sis of our analysis of voltage profiles through-out

m. Since the distribution systems for Units I and 3, the results of this analysis are applicable to 0 C3 In performing the ana ysis on the Oconee system, the limitations of the safety-related equlpm,=nt, including associated control circuitry and instrumentation; were lefined tO establish the voltage range over which the components could ,perate continuously in the performance of their design function.

The~e continuous operating voltage ranges are: Comoonent Motors M 0 Valves S Voltage 1, .Rating'fO00 V 575 V 200 V Limiting 'Joltaae Rance (+1O%) 44OO/3600v

(+/-0)22o/.l8ov 575 V Ii 200 V (j10%) Motor Controlles 600 V 51O'1 208 V (a85%) I77'i The voltage ranges defined for motor continuous operation are the restrictive operating~

conditions and, therefore, establish the bounds of continuous system pperation..

..This.analysis adresse s the condition when the normal auxiliary loads are being supplied byj 9 ffsite power from Duke's 230 kV system. These normal auxiliary loads are supplied from the offsite power system during refueling 1 plant startup, plant shutdown, and abnormal trip"-of the unit. During accident conditions the offsite sour:e is t~.e preferred source to s~upply the required safety loads also. This source of supply in e~ither normal or accident conditions it avaiiable through startup transformer CT3 which supplies the 4.16 1V distrt~ution buses.

the grid system is below the nominal 230 kV system voltage, startup transformer CT3 Is set~ on the 218, 500 volt tap In order to optimize voltage profiles throughout the auxiliary sy'stem. All load center* transformers as shown In Figure 1 are set on nominal taps. In order* to determine the voltage profiles at the safety-related buses for full-load and no-load condiltions and the range of normal grid voltages defined above, computyr studies were run for the following twoo cases: Case1: iththe voltage assumed operating at 227 kV and the auilary system undewi minimum loading conditions, the voltage profiles* for 'the safety-relate4 buses were calculated.

This :ase provides the i highest expected volt~ges of 4252/613/212VI on the 'safety-reiated.buses

-for the highest operating grid voltage. It should be noted that since a no load condi ion does not practically exist on the auxiliary system~the condition of minimum loading during cold shutdown has been used instead. Figure 2. summarlzes the results of this case.Cae2 With the voltage assumed operating at 217 kV and-the-- auxiliary system under maximum loading (i.e., full, load) conditions, the voltage profiles the safety-related buses w~ere calculated.

I'? This case provides th¶ lowest expected voltages of 9 V on O ~the safety-related buses for the lowestc normal operating grid voltage.Figure 2. summarizes the results of this case.For all other possblbl auxiliary system loading conditions with the230 kY grid system operating between 227 kV and 217 kV), the voltage profiles for the safety-related buses wi;ll 'be within the ranse.established by Case l and Case 2 defined above.Under normal conditions the Oconee Unit 3 auxiliary loads are carried~by the Unit 3 generatpr through unit auxiliary transformer 3T as sho~nin Figure 1. The normal operating range for the generator ter~iinal voltage Is 18.94 kV to 17.68 kV. In analyzing the voltage profilesat the safety-related 1 buses, computer studies were run for normal generator operating vpltages (i.e., Cases 3 and 4) as defined above and for degraded condtitionls (i.e., Cases 5 and 6) requiring generator I trip. The case studies are as follows:'Case : With the senerator voltage at its normal maximum vaIue orkV and the aux?1 liary system under minimum loading conditions

~corresponding to the (condition of the unit tied to the transmission

' system and under load,, the voltage profiles for the buses were determined.

This provides the highest expected 'volcaces* of 4397/633/219V on the safety-related buses for the highest nor-.al: generator operating yoltage. Figure 3.summarlzes the results of this case.Case 4: Wilth the generator voltage at its normal minimum value ¢17.68 1V and the auximliary system under maximum loadir~g conditi~rs,* ~the voltage profiles for the safety-related buses

" This provides the lov 1 est expected voltages of 3978/573/198V on t~e* safety-related buses for the lowest normal generator operaeing

.'o!tage.* Figure 3 summarizes results of this case.

"1 Case : 5 ' Wih genei~ator voltage assumed at" the overvoltage setpoint of 19.91 kV requiring generator trip and the auxiliary ,' system under minimum lgading conditions corresponding to the Unit tied to the transqiisslon system and under load 1 the voltage profiles for the safety-related buses were determined.

This provides the highest possible operatlng voltages of Lt.26/667/23OV on the safety-related buses witth theigenerator voltage at the overvoltage setpoint of the Volts/Hertz protective relaying.

Figure L, summ~arizes the results of this case.Case__._6:

With the 230 kV transmission system operating at its normal minimum value of 217 kV and with the generator assun-ed operating in a degraded loading condition (i.e., under-excited condition) corresponding to the loss-of-excitation relay setpoint, the voltage profiles (i.e., 3952/569/19711) for the 1 buses were determined.

Figure 4 suuuarizes the results: of this.III. CONCLUSIONSI

.'" All pert~inent combinatlions of operating conditions evaluated for the Oconee auxili ary system, and was determined that il safety-rellated loads, including associated control circuitry and instrumentation, will perform their saf~ety functions as required.-. To ensure that the ope~rability of system components is not adversely affected by short or long tern degradation in system grid voltage, othe undervoltage relays that monitor the offsite power system are Let at 88% (3660V). This ;ensures that an acceptable-voltage level required~for continuous operatljon of non-safety, and safety-related equipnent will"" %- exist. The time delay inherent in these relays will el iminate spurious*trips and ensure that idegraded undervoltages are detected and clearedbefore they can adversely affect safety-related loads.o "Figure 5 shows the results of Case 7 which provides the voltage profi.les S o on the safetyi-related ibuses under degraded offsite power conditions corresponding .to the mndervoltage relay setpoint of 88%/ (3660V).This Case that voltages below the continuous operating i ~limits of the safety-irelated loads cannot exist without :ausing a ( ~Separation from the cond (tion.I -.

f~ 0034601933 EU ~I4ny ~usI..SQ I4Ift~L'W.V C1, I .U.V (U,'lS.'S. *~*I S-I--.-4. 5. I/UIL ..11 4. 854.e I-.SJ"!*IIfl*' t.J AW455li 1.55;. -l I.

.................. ....... ......................

2,-.,0/L.230 KV SWYD a/.6v BUS ,

(" rAP: 41C, ov TAP 400oV 1"K (Vk- LOAD-I"IAP=21B.s I(CT 3 VOLT.z h3lW-CASE 1I 0.987 0.944-Pu..-1.IO ILos8 I.oz22 VOLT.£33 ulI 'PU. VOLT.-1.IO 22q, -lO~q220 1.021 l-I.O ZoS-P4.-l.0 217 KV 2o1KV--5.O O,.91540 Q13., .CASF. £ IWO O .IIL5 5158 o4~,3,. ItBo Ill) li: , 'I i~dlh, Lhttd II ilim Ipl*51e1ulll I Lhi bt)IIIJb 4)1: c(il~lt iiuot*l..

equ ljNH4.IL Opld1,,l i (lie.0.9i0-0.90 4I~.IUV&.1a.1 KV I LI .- IYIN Cq 0 6 V jv 9 I-.f LIMItT BN.(O9 V LOAD (C I (bkN RATINCG 59 KV TAI~ 3- -lIm.-- L 0Ap': 1IliOV 31-VOLT.I't. 9IKV 1%.l K'I I1".(,S KY I'll.VOLT. pt4.VOLT. PU.VOL1l PU.45"Ib L.I CASE 3 1 3 3J 1.10 I.50 5.046 -'4loo 2,'0-I --.-- ---- -'13tJ. I .oS7 53 .O5'4 a. 1 )-I.00 --0.')17'-.0 uOO -I- i.O 2,i)i -~- 1.0$73 0.955IJ) O.'j'a.

f_ ,qo 144, -"-

• t 3W0~x O.BG5 581 -Sil~o hie O.lfl5 II R'OLIE~:.

lheit di Lead Ii i .tc r Ili+/-sei taL LIhe l)oundih of t*uint Iaieu~ up. .gawl~ si,,u ,m~i 5..it Lio.VIGWi(E 3 -C SE 3 A!ND I'ViiiL.:IJL Prol~lles on Sdfiety"RelL.tud I~l~UICL. r ~iorhutSI sili I: i 3owLur coidi I Liu 0 I1~.IK'~J I-I YAP-Ai6OV Ll 9) :[,AJl20snV o18 V.i.)'AD LoAD SEN. RAT'IN&Il IKv TAP-- -1 7. 45 jLv "3V 4c)9(OV VOLT.1t991 gv 18.IKv.17.5 KV IPU.VOLT.PU. """ VOLT. PU. 45"/6 " CASE 5 4'400[.b7I I.III 230 iu. IO7 1.10O-.o10 4- 4-1.10'4)4)0 +/-I.I0 1,OS.633 2 e0.Io,0 14)0o l.O1.bOO 1.0I.O 0.94)9:5'J5~~CASt~ 6 0.9-I'I 'ii.0.')3"IqQ 0.9.iq 0.9 113~ I-. 0.9 S.Q S 3600 JOdI 4)5'19J .8'9.84)5 NOTE; Thi' dot ted l i'dpI t+/-segtL Ehe bouncl 5J c4 orLi nuoais L'dtujInaip,,pn , mtL-4[Iuf,.F I(GUItE Iitluju Profi leIt tiitdk r dwj~idonidd-CASIE 5ANQ6f tllll L *1 dl IL Iolns MAIN FE[bER EIMIII4"3O/")I/4bKY', 0 °u 4 KV SVJIY)LIHiITING. I- "AP: 41(,oY!,-~ LOAD"T-AP L 6)oov CI3-l 45*l/.I.10 _ _ ,bO i. i~i __ __ __ __ _ ___.lO__4400 1I.Obi 1I13 jt.054 ~ ZO 1.058 ks3OKV J.O1.41W,-1,0 1.0o .I I.O1.0 z.o'/)vv 0.91 114 i 3L3L 3L00 LA~d /0..i0 540 0.117l 524-----, 0.90 0.wi.p IUl 0.90 o.1371o o. 13iL Ifs I'I .-I~'NOtf "l *hu duit ttd IlIu itl e~pr.ecILt 1hu of contlIn~u.u

£UUI i p..ILE1t IIEt lIoi'.ll-FIGUIJIE !' -CASFI /I ,.1 V.)IdUuaj Prufi l-si ()fl 5salty-ltaultud IkueSu tllldI4l" de(JIcldtui

1) tlfsi Ie Id,LbW-r Ct)Id i l .eu. ol' p0l d l IO llJ 10Lo ildeL'vu I .90 L'I Ii

REGULA TORY COMMISSION

,** , 1978 Dockets Nos.: 50-269 ad50-270 nd50-287 Mr. William 0. Parker, Jr.Vice President

-Steam Production Duke Power Company 422 South Church Street Charlotte, North Carolina 28242

Dear Mr. Parker:

-- By our letter dated June 3, 1977, we requested you to assess thesusceptibility of the Class IE safety related electrical equipment to: (1) sustained degradation voltage conditions at the offsltepower supply and (2) interaction between the offsite and onsite emergency power systems. By letters dated July 21, 1977 and October 7,-1977, you submitted the detail design of the Oconee Nuclear Station's emergency power systems.The Oconee Nuclear Station originally had an undervoltage protection design to protect the Class XE equipment from a loss of voltage or a sustained degradation of grid voltage on the emergency buses. The protection system includes undervoltage relays with inverse timecharacteristics which have a trip setpoint set at 88% of the rated bus voltage, i~e., 4160 volts and with a five second time delay. This Sundervoltage protection design provides for two out of three coincidentlogic, monitoring the offsite power voltage on each 4160 volt bus. The undervoltage protection will initiate separation of the onsite emergency.. buses from the offsite power systems iluediately upon complete loss of offsite power or at a time delay depending on the extent of the degraded voltage condition below 88% of nominal voltage. The lower the voltage the faster the trip.For the conditions when the emergency buses must be separated from the offsite power systems due to a degraded voltage condition, the emergency buses are supplied power from the Keowee Hydro The two 87.5 MVA hydroelectric generating units, power transmission systems (overhead and underground), and the transformers and circuits have adequate capa-* bilities to serve the emergency buses with an acceptable voltage and.therefore, no load shedding nor sequencing of the emergency loads are required,.......0000LN781220A B68 i .U Mr. William 0. Parker, Jr.-2-In addition, we have determined through discussions with your staff that you have performed an acceptable voltage drop calculation of the 4160 volt and the 600 volt buses of the onsite system. As a result of your analysis, the transient (inrush) voltages were calculated to be 89% of the rated voltage on the 4160 volt bus and 82% of the rated voltage on the 600 volt bus. This voltage calculation was based on the assumptions of automatic transfer of plant loads from the unit auxil-iary transformer to the start-up transformer or to the Keowee Hydro units and with the worst case of allowable combination loading. The voltage levels are adequate for starting all the engineered safety feature (ESF) loads when being started from either the start-up transformer or the Keowee ilydro units.We have completed our review of the existing system design and have* determined that the design affords adequate protection against degraded grid undervoltage conditions in accordance with the NRC letter of... June 3, 1977, and is therefore acceptable.

~Sincerely,-cc: See next page Robert WV. Reid, Chief Operating Reactors Branch #4 Division of Operating Reactors D1:KE POWsa C~OMPAN',Y ,Oztober 7 , .97 Mr. .do 3. =ae c.ngDr~~: .:ie ,': ".;.tz.ear .e :.. e u. z.n.C, C. '555 /"

Mr. A. S,:hwenzer.

Thte.;-.: "* ne .',ic~et" .:a:3r.i0 Ceir Mr. 'as?:= e~r: u: 1 .* :" .~ d ha the -ks o: t-he ,'Th-nee emergency cwer ;7.Atem his and ;r.o:ec-.ive ec'2a&;en:

te those reee in t.he stat:fsf ~ ninyu 7et-eo. ,~ .9 1r.Ad oa~ ., t *4 .1- _. ::.qes.ted a :rnosed amendment.

to In-zor.rorate "ecn.+/-n:al 5vecLfi-:t%r;'. :'cmpaa.'bi to those in the staff ?ostt'on A.. .... i, ad ursan22.9').. o:'4xs'ei.e fi:nd, attzached a :.-oocsed a-endment to The "Thonee;.r:clear

att/..'- -zln' :a:l:73e.a:In; License. T'his change re-rises secttcns:n tiiar' e;:rt.-:ai and -iner~ernc', ?:wer ?eriodt- Te'.n".e:.'n::a1 Sc:e-ift:::;:.s.L "t i.n.,:"des tie

ondi'torns for ..:erarti~n mni :-'e requirene.n:s 5cr t-he s.-arzuom s.ucue ",co:a~e mcnitors, ibriz -itth a ncdtifcaticn t.e zn-size tower source zest.in; recuiraenents.

M:case %zte that ".he attachec-" :;-zs have been re':tsed to Incude the .-han.nes that tad been 7:r-vtzus>:? .u:umie:e as C .-rozesed am-.end-ent in ,-- :.etter -f'a A~t "ac.n~en : 100777 B109 3.7 3.7 AL'XILIARY ELECTRICAL AppI icabilltv Applit.- to the availability of ofU-qite and en-site electrical power for station operation and for operation of station auxiliaries.

CbjItte.To define thcse conditie..s of electrical pewer availability necessary to provide for safe reactor operation and to provide for continuing availability of enigineered safety features systems in an unrestricted manner and to pre-scribe safety evaluation and reporting requirements to be followed in the event that the auxiliary electric power systems become degraded.3.7.1 Except as per'nit:el.

by 3.7.2, 3.7.3, 3.7.4, 3.7.5, 3.7.6, and 3.7.7, the reactor shall not be heated above 200 0 F unless the following conditions are met.(a) At least two 230kV transmission lines, on separate towers, shall be in service.(b) Two startun transformers shall be operable and available to the unit's 4160 volt .Main Feeder Buses No.. I and No. 2.(c) One operable Keowee hydro unit shall be available to supply power through the Underground Feeder Bus, Transformer CT4 and the 41L0 volt Standby Buses No. 1 and No. 2 to the units 416,0 volt Main Feeder 3uses No. 1 and 2. The second Keowee hydro unit shall be available to supply power automatically through .1 startup transformer to the units 4160 volt Main Fee~er Buses No. I and 2.('I) The two volt main feeder buses shall be energized.(en The three A160 volt Engineered Safety Features switchgear buses shall be energized.(f) Three 600 volt load centers plus the three 60') volt-2OSV Engineered 5-ifety Features MCC Buses shall be energized.(g) For each unit, all 125 VflC instrumentation and control batteries with their respective chargers, buses, diode moni~tors, and diodes supplying the unit's vital instrtwnentat£on and the four instrum~entation and control panel boards shall be operable.(h) The 125 VDC svitching station batteries with their respective chargers, buses, and isolating diodes shall be operable.3.7-1 2911190o~

(I) The Keowee batteries with their respective chargers, buses and isolating diodes shall be operable.(i) The level of the K~owee Reservoir shall be at least 775 feet above sea level.(k) For each unit, three start-up source voltage monitoring channels shall be operable.3.7.2 During hot standby or power operation, provisions of-3.7.1 may be modified to allow any one of the following conditions to exist: (a) One of the two required startup transformers may be removed from service for 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> provided it is expected to be restored to service ,"ithin 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> and the other required startup trans-former is available for automatic connection to the unit's main feeder bus.(b) One Keowee hydro unit may be inoperable for periods not ex-ceeding 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> for test or maintenance provided the operable Koewee hydro unit 19 connected to the underground feeder circuit and is verified operable within one hour of the loss and every eig~ht hours thereafter.(c) The undergro~und fecler circuit ma:: be inoperable for periods not exceeding 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> far test and maintenance.(d) In each unit, the following items may be inoperable fornot 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />s: '. he 4 160O volt main feeder bus.2. On~e :omplete single string of any unit's Enginee~red Safety4160 volt switchgear bus, 60'1 volt load center -

MOC and their loads.string of anw; unit's 125 VDC Instru-mentation and control batteries, char~ers, buses, and all assocIated isolating and transfer diodes.,.One 125 instrumentation and control panel board and/or fts assocIated loads.(e) One complete singLe string of the 125 VDC switching station batteries, buses, chargers, and the related diode assemblies ma: be de-encrgtzed for test or maintenance for periods not exceeding 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.(f) %ne ccmplete single string of the Keowee batteries, chargers, buses, and diodes may be de-energlzed for test or for periods not exceeding 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.3. 7-2 (g) One 4160 volt standby bus may be inoperable for test: of maintenance for periods not exceeding 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.3.7.3 In the event that the conditions of Specification 3.7.1 are not met within the time specified in Specification 3.7.2, except as noted below in Specfifcation 3.7.4, 3.7.5, 3.7.6, and 3.7.7 the reactor shall be placed in a hot: shutdown condition within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. If these requirements are not net: within an additional 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, the reactor shall be placed in the cold shutdown condi-tion within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.3.7.4 In the event that all conditions in Specification 3.7.1 are met except that one of the two Keowee hydro units is expected to be unavailable for longer than the test or maintenance period of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, the reactor may be heated above 20° if previously shutdown or be per-ritted to remain critical or be restarted provided the following restrictions are observed.(a) Prior to heating the reactor above 200°F or prior to the* restart of a shutdown reactor or within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> of the Loss of one Keowee hydro unit, the 4160 volt: standby buses shall be energized by a Lee gas turbine through the 100 kV circuit. The Lee gas turbine and 100 kV transmission circuit shall be electrically separate from the system grid and non-safety-related loads.(b) The remaining Keowee hydro unit: s~hall be connected to the underground feeder circuit and this path shall be verified operable~

within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and weekly thereafter.(c) The remaining Keowee hydro unit shall be available to the overhead transmission circuit but generation to the system grid shall be prohibited except for peziods of test.(d) Operation in this node is restricted to periods not to exceed 45 days and the provisions of this specification nay be utilized without prior NRC approval only once in three years fbr each Keovee hydro unit. Office of Inspection and En-:orcement, Region II, will he notified within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.3.7.5 In the e~vent that all conditions of Specification 3.7.1 are net except that all 230 kV transmission lines are lost, the reactor shall be permitted to remain critical or be restarted provided the following restrictions are observed:[a) Prior to the restart of a shutdown reactor or within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of losing all 220 kV transmission lines for an operating reactor, the 4160 volt standby buses shall be energized by one of the Lee gas turbines through the 100 kV transmission~

circuit. The Lee gas t~urbine and the 100 kV transmis~ion circuit shall be completely separate from the system grid and non-safety-related loads.3.7-3 (b) The reactor coolant Taw shall be above 525°0 F. Reactor coolant Rump power may used to elevate the temperature from 500v to 525 F in the case of restart. if T de-creases below 500°F, restart is not permitted 3,7,6 In the event that all conditions of Specification 3.7.1 are met, and planned tests or maintenance is required which will make both Keowee units unavailable, the 4160 volt standby buses shall first be energized by a Lee gas turbine through. the 100 kV transmission circuit and shall be separate frcm the system grid and non-safety-related loads. The reactor shall then be permitted to remain critical for periods not to exceed 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> with both Keowee units unavailable.

3.7.7 In the event that all conditions of Specification 3,7.1 are met except that both Keowee hydra units become unavailable for un-planned reasons, the reactor shall be per-nitted to remain critical for periods not to exceed 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> provided the 4160 volt standby buses are energized within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> by tee gas turbine through the 100 kV transnission circuit and it shall be separate from the system grid and all offsite non safety-related loads.3.7.8 An', degradation beyond Specification 3.7.2, 3.7.4, 3.7.5, 3.7.6 or 3.7.7 above shall be reported to the Office of Inspection and Enforceioent, Region Ii, within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. A safety evaluation shall be performed by Duke Power Company for the specific sftua-tion involved which Justifies the safest course of action to be taken. The results of this evaluation together with plans for the return to che unrestricted operating conditions of Specification 3.7.1 above shall be submitted in a written report to the Office of Nuclear Reactor Regulation with a copy to the Office of Inspection and Enforcement, Region II, within five days.3,7.9 In the event that one channel of the unit's startup source voltage monitoring becomes inoperable, the reactor shall be permitted to remain critical or be restarted provided the inoperable channel is placed in the tripped condition within one hour.Base The auxiliary electrical power systems are designed to supply the required Engineered Safeguards loads in one unit and safe shutdown loads of the other two units and are so arranged that no single contingency can inactivate enough engineered safety features to jeopardize plant safety. These systems were designed to meet the following criteria: "Alternate power systems shall be provided and designed with adequate independency, redundancy, capacity and testability to permit the functions required of the engineered safety features of each unit." 3.7-4 The auxiliary power system meets the above criteria and the intent of AEC Criterion

17. The adequacies of the AC and DC systems are discussed below as are the bases for permitting degraded conditions for AC peer.Capacty~fAC Systems The auxiliaries of two units in hot shutdown (6.0MJa each) plus the auxiliaries activated by ESC signal in the other unit (4.8 MVa) require a total. AC power capacity of 16.8 M.'a. The continuous AC power capacity available from the on-site power systems (K~eowee Hydro Units) is 20 M%'a (limited by transformer CT4) if furnished by the underground circuit or 30 MVa (limited by CTI. or CT2)if furnished through the 230 kV off-site transmission lines. Capacity available from the backup 100 kV off-site transmission line (Lee Station Gas Turbine Generator) is 20 M%'a (lim~ted by CT5).Thus, the minimum available capacity from any one of the multiple sources of AG power, 20 MVa, is adequate.The startup source voltage monitors automatically initiate the disconnection of the offsite power sources from the safety-related buses upon either a sustained degradation of the offsite power system voltage or a complete loss of offslte power.Capaicity:

of DC Systems Ncr-mallv, for each unit AC power is rectified and supplies the DC system buses as well as keeping the storage batteries on these buses in a charged state. Upon loss of this normal AC source of power, each unit's DC auxiliary systems important to reactor safety have adequate stored capacity (ampere-hours) to independently supply their required emergency loads for at least one hour. One hour is considered to be conservative since there are redundantof AC pcwer providing energy to these DC auxiliary systems. The loss uC ill. AC pcwer t.o any DC system is expected to occur very infrequently, and fo~r very short periods of tine. The following tabulation demonstrates the mria.1n of installed battery charger rating and battery capacity when compared.o one hour of operation (a) with AC power (in amps) and (b) without AC power'Li am~pere hours) for each of the three safety-related D)C systems installed A. 125 'VDC Instrumentation and Control Power System Char~er XCA, XCB, or XCS a. 600 amps each 3attery ICA and 1CB Combined Capacity b. 698 ampere-hours aX 1 , 2, or 3)Actual active loads on beth 125 %'DC a. First mmn. -1371 amps I & C buses XDCA and X(DCB next 59 rai. -568.3 amps during 1st hour of LOCA b, 581.9 ampere-hours (X 1 , 2, or 3)S. 125 VDC Switching Station Power System Charger SY{-l, SY-2, or SY-s ,Rating a. 50 amps each Battery SY-l or SY-2 Capacity b. 14.4 ampere-hours 3.7-5

-nww~~~ -Actual active load per battery a. First min. -130 amps during 1st hour of LOCA next 59 mmn. -10 amps b. 12 ampere-hours C. 125 VDC Keowee Station Power Syste~m Charger No. 1, No. 2 or Standby Rating a. 200 amps each Battery No. 1 or No. 2 Capacity b. 233 ampere-hours Actual active load per battery a. First mmn. -1031 amps during 1st hour of LOCA next 59 min. -179.4 amps b. 193.6 ampere-hours Redundancy of AC Systems There are three 4160 engineered safety feature switchgear buses per unit.Each bus can receive power from either of the t-#o 4160 main feeder buses per unit. Each feeder bus in turn can receive power from the 230 kY switchyard through the startup transformers, through the unit auxiliary, transformer by backfeeding through the main transformer, or from the 4160V standby bus. Another unit's startup transformer serving as an alternate supply can be placed in service in one hour. The standby bus can receive power from Hy.dro Station through the underground feeder circuit or from a combustion turbine generator at the Lee Steam Station over an isolated 100 kV trans-mission line. The 230 kV swvitchyard can receive power from the on-site Keowee Hydro station or from several off-site sources via transmission lines which connect the Oconee Station with the Duke Power system'power distribution network.Redundancy of DC Systems A. 125 V.DC Instrument and Control Power System All reactor protection and engineered safety features loads on this system can be powered from either the Unit l and Unit 2 or Unit 2 and Unit 3 or Unit 3 and Unit 1 125 VDC Instrument and Control Pc'wer Buses.The units' 125 VDC Instru~ment and Control. Power Buses can be powered from two ba-ttery banks and three battery chargers.

As shown above, one battery (e.g., iCA) can supply all loac~s for one hour. Also, one battery, charger can supply all connected ESF anl reactor protection loads.3. 125 VflC Switching Station Powe~r System There are two essentially indepe'ident subs::stems each complete with an AC/DC power supply (battery charger), battery bank, a battery charger bus, motor control center (dltr~ibutz.

panel). All safet',-related equipment and the relay house in Which it is located are Class I (seismic)design. Each subsystem prov'des the neztessary DC pcwer to: a. Continuously monitor operations of the protective relaying.b. Isolate Oconee (including from all externa: 230 kV crid faults, 3.7-6

c. Connect an-site power to Oconee from a Ke'owee hydra unit or, d. Restore off-site power to Oconee from non-faulted portions of the external 2)0 kV grid.Provisions are included to manually connect a standby battery charger to either battery/charger bus.C. 125 VDCKeowee Station Power System There are essentially two independent physically separated Class I (seismic) subsystems, each complete with an AC/DC power supply (charger)a battery, bank, a battery/charger bus and a DC distribution center. Each subsystem provides the necessary power to automatically or manually Start, control and protect one of the hydrounits.

An. open or short in any one battery, charger of DC distribution center, cannot cause loss of both hydro units.The 230 KV sources, while expected to have excellent availability, are not under the. direct control of .the Oconee station and, based on past experience, cannot belassumed to be available at all tines,. However, the operation of*the on-site hydro-station is under the direct control-of the Oconee Station.and reqixtres no off-site power to startup. Therefore, an on-site backup source of auxiliary power is provided in the form of twin hydro-electric turbine generators powered through a common penstock by water taken from Lake Keowee.The use of a common penstock is justified on the basis of past hydro plant experience of the Duke Power Company (since 1919) which indicates that the cumulative need to dL'water the penstock can be expected to be ifmited to about one day a year, principally for inspection, plus perhaps four days every, tenth* a r.Operation with one Keowee Hydra unit out of service for periods less than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> is permnitted

.The operability of the remaining Keowee hydra unit is verified within one hour by starting the unit and energizing the standby buses through the underground feeder circuit. This action is repeated once every ei,~ht hours thereafter until the Keowee hydra unit is restored to service and will provide additional assurance of the operability of the remaining unit.Pr.wvisions have been established far those in Which long term pre2ventative maintenance or a Keowee Hycro unit ar necessary.

The long tern maintenance items are expected to be hydro turbine runner and dis-charge ring welding repairs which are estimated to be necessary every six to eight years.. Also, generator thrust and guide bearing replacements will be necessary.

Other items which manifest as failures are expected to be exJ tremely rare and could possibly be performed durinR the permitted .maintenance periods. Tine periods of up to 45 days for each Keowee Hydra unit are permitted every: three years. During these outages the remaining Keowee Hydro unit will be verified to. be operable within one hour and weekly thereafter by starrine the umnit and energizirng the underground feeder cftcuit. The remaining Keowee hydro unit Will also be available through the overhead transmission path and will not be used for system peaking. Additionally, the standby buses will be energized continuously by one of the Lee gas turbines through the 100 kY trans-mission circuits 3. 7-?

This transmission circuit would be electrically separated tram the system grid and all off-site non-safety-related loads. This arrangement provides a high degree of reliability, for the. emergency power systems.Operation with both Keowee Hydro units out of service is perm~itted for planned or unplanned outages for periods of 72 or 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> respectively.

Planned outages are necessary for the inspection of conmmon underwater areas such as the penstock and to enable the removal of one Keowee unit from service. This would be a controlled evolution in which the availability and condition of the off-site Rrid, startup transformers and weather would be evaluated and a Lee gas turbine would be placed in operation on the isolated 100 kV transmission line prior to co~encemicnt of the outage.A trn.' period of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for unplanned outages of both Keowee units is accept-all since a Lee gas turbine will be started within one hour and will energize the standby buses through the dedicated 100 kV transmission line. This period of time Is reasonable to determine and rectify the situation which caused the loss of both Keowee units.In the event that none of the sources of off-site power are aval~able and it is considered important'to continue to maintain an Oconee reactor critical or re-turn it to criticality from a hot shutdown condition, one of the Lee gas turbines can be .made available as an additional backup source of power, thus assuring centtnu'd availability as an auxiliary power to perform an orderly shutdown of a unit should a problem develop requiring shutdown of both hydro units.3.7-8 4.6.6E.MERGENCY POWER PERIODIC TESTING Applies to the periodic testing surveillance of the emergency power sources.Oblective To verify that the emergency power sources and equipment will respond promptly and properly when required.Spec if£cait~on 4.6.1 Monthly, a test of the Keowee Hydro units shall be performed to verify proper operation of these emergency power sources and associated equip-ment. This test shall assure that: a. Each hydro unit can be automatically started from the Unit 1 and 2 control room.b. Each hydro unit can be synchronized through the 230 kV overhead circuit to the startup transformers.

c. Each hydro unit can energize the 132.8 kV underground feeder.d. The 4.160 volt startup transformer main feeder bus breakers and standby bus breaker shall be exercised.

".6.2 Annually, the Keowee HIydro units shall be started using the emergency start circuits in each control room to verify that each hydro unit and associated equipment will carry the equivalent of the ,maximum safeguards load of one flconee unit within 25 seconds of a simulated requirementn for engineered safety features.&. .3 Monthly, the Keowee Underground Feeder Breaker Interlock shall be verified to be operable.4.6., Annua~l:, a simuhited emergency transfer of the 4160 volt main feeder buses to the startup transformer (CTI, CT2 or CT3) and to the-.16') volt standby buses, and a retransfer to the startup transformers shall be made to verify proper cperation.

,.6.5 uarterly, the External Grkd Trouble Protection System logic shall be tested to demonstrate its ability to provide an isolated power path between Keowee and Oconee.Annually and prior to p'.anned extended Keowee outages, it shall be demonst~rated that a Lee Station combustion turbine can be started and connected to the 100 k';? llne. It shall be demonstrated that the 100 kV line can be separated from the rest of the system and supply, po've2 to. the 4160 volt amai feeder buses.*.6-1 4.6.7 Annually, it shall be demonstrated that a Lee station combustion turbine can be started and connected to the isolated 100 kV line and carry the equivalent of the maximum safeguards load of one Oconee unit (4.8 XVA) within one hour.4.6.8 Annually, it shall be demonstrated that a Lee station combustion turbine can be started and carry the equivalent of the maximum safeguards load of one Oconee unit plus the safe shutdown loads of two Oconee units on the system grid.&.6.9 Batteries in the 125 'JDC systems shall be tested as follows: a. The voltage and temperature of a pilot cell in each bank shall be measured and recorded five times per week for *the Instrument and Control, Keowee Hydra, and Switching Station batteries.

b. The specific grivity and voltage of each cell shall he measured~and recorded monthly for the Instrument and Control, Keowee*Hydro, and Switching Station batteries.

c. Annually, a one-hour discharge test at the required maxinum safeguards load shall be made on the instrument and control batterleq.

d. Before initial operation and annually thereafter, a one-hour discharge test shall b2 made on the Keowee lHydro and Switching Station batteries.

&..[ The operability of the individual diode monitors in the Instrument and Control and Keowee Station 125 VDC systems shall be verified monthly by -imposing a simulated diode failure signal on the monitor.The peak inverse voltage capability of. each auctianeering diode in the Instrument and Control, Switchyard and Keowee Wydro 125 VDC systems shall be measured and recorded semiannua~llv.The tests specified in 4.6.9, 4.6.10, and 4.6.11 will be considered satisfactory if control room indication and/'or visual examination demonstrate that all components have operated properly.4.O).i1 Monthly, it shall be ed that each startup source voltage monitoring channel is operable.tAnnually, the startup source monitors shall be calibrated to ensure that they ca:b r.i.~ite a trip of the startup source breakers upon both a complete loss of voltage and a degraded voltage condition.

4.6-2 Bases The Keowee Hydro units, in addition to serving as the emergency power sources for the Oconee Nuclear Station, are power generating sources for the Duke system requirements.

As power generating units, they are operated frequently, normally on a daily basis at loads equal to or greater than required by Table 8.5 of the FSAR for ESF bus loads. Normal as well, as emergency startup and operation of these units w~ill be frem the Oconee Unit 1 and 2 Control Room. The frequent starting and loading of these units to meet Duke system power requirements assures the continuous availability for emergency power bor the Oconee auxiliaries and engineered safety features equipment.

It will bce verified that these units will carry the equipment of the maximum safeguards load within 25 seconds, including instru~mentation lag, after a simulated re-quirement for engineered safety features.

To further assure the reliability of these units as emergency power sources, they will be, as specified, tested for automatic start on a monthly basis from the Oconee control room, These tests wili include verification that each unit can be synchro~nized to the 230 kV bus and that each unit can energiae the 13.8 kV underground feeder.The interval specified for t esting of transfer to emergency power sources is bascd on maintaining maximum availability of redundant power sources.

a Lee Station gas turbine, separation of the 100 kV line from the renjinder of the system, and charglng of the 'i160 volt main feeder buses areled to assure the continuity and operability of this equipment.

The one hour tine limit is consi'Jpred the absolute maximum time limit that would be requilred to accomplish thiS.The source+/- volta~e monitors are provided to detect and initiate proper action for either a sustahned degradation of offsite power system voltage or icomplete loss of offsite power. Monthly these monitors will be functionally checke'd and annuall'y they will be calibrated to ensure proper operation with-in the required trip settings.

E F'3AR .ection 8 4.6-3.

il I Duhe Pouer Cmpany HALE Tuck P0.Box 33198 Vice President Charlotte, N C 28242 Nudeer Production (704)373.4531 OllllO dl May 8, 1990 U. S. Nuclear Regulatory Commission

--ATTN: Document Control Desk Washington, D.C. 20555

Subject:

Oconee Nuclear Station Docket Nos. 50-269, -270, -287 Switchyard Degraded Voltage

Dear Sir:

On April 26, 1990, a conference call between members of my staff and members of the NRC staff. was held. The purpose of the call was to discuss the switchyard degraded voltage issue. During this phone call, the staff requested that information regarding the proposed modification to resolve the problems identified be submitted to them for their information.

Tp this end, a description of the modification is provided.

En addition, simplified one line drawings to aid in the understanding of the modification are also provided.The initial concern was discovered as a result of the 230KV Design Basis Documentation (DBD) effort. It was discovered that during a LOCA event concurrent with a 230KV switchyard voltage less than 219KV, the unit could be vulnerable to a single failure event, due to the relative setpoint of the undervoltage relaying of the startup source breakers and the undervoltage relaying of the switchyard isolate circuitry.

This situation is fully described in LER 269/90-04 submitted April 30, 1990. This LER provides detailed information regarding this event, the root cause, the corrective actions taken and to be taken, the basis for continued safe operation of the units, and an assessment of the safety consequences and implications of the event. In addition, the LER also stated that anotheY concern was identified.

This new concern had identified the possibility that the E breakers could close when the 230KV switchyard voltage is degraded (less than 219KV). This finding was also determined to be reportable.

A separate LER on this problem will be submitted May 24, 1990. Please note that the operability evaluation provided by LER 269/90-04 is also applicable to the new concern identified.

B4 O000LD900508A Document Control Desk May 8, 1g90 Page 2 -...As I stated earlier, to resolve the problems identified, a modification to the plant was proposed.

This modification is to install three undervoltage relays to monitor the switchyard voltage on the line side of each of the three startup transformers.

Each of the undervoltage relays will be connected to one of three existing single phase spare potential transformers.

These relays will, be connected in a two out three configuration and timed to provide a permissive in each of the two redundant switchyard isolate circuits through one of two redundant Cutler Hawaer relays. This logic will provide inputs for alarms via the Operator Aid Computer, the Event Recorder, an annuniciator in the unit 1 and 2 control room, an alarm in the Power System Control Area Operation Center, and would initiate switchyard isolate if an ES signal is present on any of the three units. This logic which is safety related, will be fed from the switchyard 125VDC system.For your information, every effort is being made to implement this modification in a timely manner° I currently anticipate that the above modification will be installed on afl three units by no later than July 1, 1990. An outage of the units is not required to implement the modification.

If further discussion is desired regarding this issue or the modification, please don't hesitate to contact us through normal licensing channels.Very truly yours, Hal B. Tucker SYDVOLT / PEG xc: Mr S. D. Ebneter -Regional Administrator U. S. Nuclear Regulatory Commission Region II 101 Marietta St. NW Atlanta, GA 30323 Mr. P. H. Skinner NRC Resident Inspector Oconee Nuclear Station Mr. L. A. Wiens Office of Nuclear Reactor Regulation U. S. Nuclear Regulatory Commission Washington, DC 20555 MODIFICATION DESCRIPTION The modification will install equipment that will provide an annuniciator alarm in the Unit 1 and 2 control room, an alarm via the unit Operator Aid Computer an alarm to the Power Systems Control Area Operation Center and an event recorder point and, if an ES signal occurs on any unit while the voltage is at or below the setpoint, will automatically isolate the switchyard by initiating the External Grid Trouble Protection (EGTPS)system. The new logic will ensure the overhead power path from Keowee is available during an ES event, even if the switchyard voltage is below 219KV. The modification will install several relays to accomplish this logic.The EGTPS is designed to detect undervoltage or underfrequency conditions on both buses in the 230KV switchyard and to isolate the yellow bus, (and thus the Keowee overhead path), from the transmission system if these conditions occur. To address the difference between the minimum analyzed voltage for starting L.OCA loads and the voltage at which the EGTPS is.automatically initiated, the above modification was proposed.The voltage will be measured by existing potential transfornmers (PTs)..The failure modes of these PTs are in the safe direction.

The safety related voltage relay contacts used in the switchyard isolation logic will be arranged in a 2 out of 3 (2/3) logic. The output of the 2/3 logic w~ill be connected to actuate two redundant safety related relays. If this 2/3 logic is satisfied and an ES signal occurs on any of the three units, both channels of the EGTPS will be activated.

If the EGTPS is actuated by a failure of this new logic, unit generation would not be interrupted since the EGTPS does not operate the unit tie breakers.The Engineered Safeguards Protective System (ESPS) is a three Channel redundant system employing 2/3 coincidence between measured variables.

The ESPS consists of eight 2/3 coincidence logic networks for actuating the equipment in four safeguards systems, thus each system is actuated by a pair of 2/3 logic. Therefore a failure within one channel of the ESPS will not result in an ES signal being provided to the 230KV Switchyard Degraded Voltage Protection Circuitry (230KV SDVP). Further details regar'ding the ESPS at Oconee is provided by section 7.3.2 of the Oconee PSAR. An inadvertent EGTPS actuation would allow the units to continue to operate safely, since the generator output breakers would remain aligned to the system grid through the 230K(V Switchyard red bus (units 1 and 2) or 525KV Switchyard (unit 3). In this condition, the units' auxiliary electrical power would continue to be supplied from auxiliary transformer lT, 2T, or 3T, respectively.

An EGTPS actuation due to degraded grid voltage and a concurrent ESPS signal would, allow the unaffected units to continue to operate in the manner just .described, while power to the affected unit would be automatically available through:

a) standby buses if previously powered from the dedicated line teoth Lee Ga Turbines, b) The 4160V standby buses from the underground on-site emergency power path from Keowee, or c) The overhead on-site emergency power path from Keowee.

IPRELiMI NARY4 ESG 1 BSG 2 EBG 3 U. V. Trip Relay 27CT1 8wyd. I;IIAp IOM.co4 PT. 'LE. R.Iniate svyd. isolation chrome1 2 ESG 1 (ch lor2)t ESG 2 ESG 3' 9e PR ELMIAR Oconee Nuclear Station Preliminary Logic Diagram 230KV Switchyard Degraded Voltage Protection NSN ON-52850 Kay 4. 1990-.

S I, I'h.,,lef.r .N C' 2 Piucl'ru Pm )dij im nnDUKE DJWER June IB, 1990 Document Control Desk U. S. Nuclear Regulatory Commeission Washington.

D.C. 20555

Subject:

Oconee Nuclear Station Docket Nos. 50-269, -270, -287 Switchyard Degraded Voltage

Dear* Sir:

By my letter of May 8, 1990. 1 had provided preliminary information regarding a conceptual design of a proposed modification to resolve problems concerning the 230KV switchyard that my staff recently identified.

On June 6, 1990, a conterence call between members of my staff and members of the NRC staff was held. During the phone call, the staff raised a concern about the impact of degraded voltage on safety related equipment during normal plant operation.

To address this concern, Please find attached a discussion of the impact that degraded voltage has on safety related equipment during normal plant operation.

Thc resolution of the problems that we have identified through our Design Basis Documentation effort is a high priority item at Duke Power. The proposed modification to be implemented is moving forward. My. staff is developing a revision to the technical specification, which will be submitted in the near future. Your continued cooperation and assistance in resolving this issue is greatly appreciated.

Very truly yours, Hal B. Tucker voltOllpfg

• F'ji 4 061890 Bl13 INFORMATIOtN CONCERNING GRID VOLTAGE ADlEQUACY The N&E breakers utilize the Westinghouse CV-? relays for undervoltage detection.

Relays associated with these breakers are set at 105V tap with 3 sec time delay at 84 volts and tolerance of +/- 3%. Based on this setting and considering the tolerance factor, this setting could effectively be as low as 84.875% of the 4160V bus rating. These relays are inverse-time induction type relays.According to westinghouse type CV-7 relay published information and at the present relay setting, these relays would trip in approximately 6 seconds at 90% of relay setting. No information is provided on time required for relay to trip while voltage is at relay setting value. relay curves attached (Attachment U).Considering 84o875% cf bus voltage and normal unit loads running an analysis was performed to determine voltage levels at safety-related buses and load terminals.

An evaluation of the impact of this voltage on safety-related unit equipment was performed utilizing existing power system calculations and using engineering judgement.

A justification of voltage adequacy is summarized below:-4KV Motors: with 84.815% bus voltage the minimum voltage on a safety-related 4KV motor would be approximately 84.4% (4160V base) which is equivalent to 87.75% (motor base). An analysis was performed using Westinghouse information to examine impact of continuously running the motors at 80%voltage on motor life. This analysis concluded that this condition would not have significant impact on motor life.Copy of analysis is attached. (Attachment 2)-Overcurrent protective relaying on 4KV Motors: Safety-related motor overcurrent relays are set for motor starting.

The adequacy of these settings were examined for motor starting at voltages significantly less than 84.87%.The current values associated with continuously running at 84.87% are considerably below the overcurrent relay settings.-Bus & Cable: These are current sensitive equipment.

Lower voltage should not have any impact on them. Current capacity of buses &cables are not exceeded.-600V &208V Contactors:

84.875% of bus voltage should not impact contactor coils.see attached manufacturer test information. (Attachment

3)

-600/208VAC Motors: Based on an evaluation of the 600V RBCF motors and similarity to the 4KV motors, the 600/208V safety-related motors which are normally running should not be impacted by this condition.

Overload Heaters: In safety-related applications, one overload heater is sized properly for the load but it only provides alarm indication in the control room. Overload heaters capable of tripping the motors are considerably oversized for the load and is provided to protect the cable.Fuses associated with 600V & 208V Circuits: Generally, fuses are only provided to protect the control transformers.

Control transformers are sized significantly larger than what is recommended by starter manufacturer.

Control transformer and fuse current rating should not be exceeded due to lower voltage. Attachment 3 provides more information on this.DC Equipment:

The Battery Chargers are designed to provide rated output DC voltage with input voltage as low as -15% of nominal voltage (575V). With 84.875% of 4KV bus voltage, the input voltage at the chargers would be approximately 82.5% (600V base) or 86% (575V base).Based on that the DC system should be at rated voltage.(See attached manufacturer data sheet).AC Vital: Since the DC is at rated voltage this condition should not have any impact on the AC vital bus.

Ip r .-" --* TYPE CV RELAYS~L4~I.L. d1.3')zP ~'I U 2: 2..2.2* .r S.... I 344 3 t'+/-1atLL~.z+/-.+/-+/-~flL..uzhrJ.

-_____________

.-406C883 Fig. 16. T'yp6CuI 6O.Cycle #fine CV'V* S~of f~i tpe CV7 T~m. 0.e, o.d LUndetvo!Iage Relay, 13

(, oO(~UNITED STATES " o NUCLEAR REGULATORY COMMISSIONWASHINGTON, D. C. 20555/

14, 1990 Docket Nos. 50-269, 50-270 50-287 4#1 Mr. H. B. Tucker, Vice President Nuclear Production Department Duke Power Company P.O. Box 1007 Charlotte, North Carolina 28201-1007

SUBJECT:

SAFETY EVALUATION FOR DEGRADED GRID PROTECTION (TACs 76743/76744/76745)

Your Licensee Event Reports (LERs) 269/90-04 dated April 30, 1990, 269/90-04 dated May 24, 1990, and 269/90-05 dated May 24, 1990, reported situations related to design deficiencies of the degraded grid protection hardware and provided corrective actions. These deficiencies may leave the station vulnerable to a single failure and/or render safety-related equipment inoperable or damaged during a degraded voltage condition.

However, your letter of May 8, 1990, described conceptually a new permanent degraded grid protection modification to be installed in the near future that would, to a great extent, resolve these design deficiencies.

The NRC staff has completed a review of these submittals.

Enclosed is the related Safety Evaluation.

The staff has concluded that the proposed modifications to the design would provide additional Undervoltage protection.

Also, in consideration of the*complexity of the plant's existing undervoltage protection system and the on-site electrical distribution system, the staff finds the proposed degraded grid protection modification acceptable.

Sincerely,.

LoadA. Wiens, Project Manager Project Directorate 11-3 Division of Reactor Projects -I/II Office of Nuclear Reaction Regulation

Enclosure:

As stated cc w/enclosure:

i See next page .,-.i.NOV 20 7.,990 DUKE FPOWER CO.REG__ULATOF-B12 O000LN9O1114A

.. .. UNITED STATES/) £{ ' NUCLEAR REGULATORY COMMISSIONSAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO DEGRADED GRID PROTECTION DUKE POWER COMPANY OCONEE NUCLEAR STATION. UNITS 1. 2 AND '3 DOCKET NOS. 50-269. 50-270 AND 50-287

1.0 INTRODUCTION

By Licensee Event Report (LER) 269/90-04 dated April 30, 1990, the licensee for Oconee Nuclear Station reported a situation where one of the two required onsite emergency electrical paths could be rendered inoperable during a degraded grid condition leaving the station vulnerable to a single failure. Also in LER 269/90-04 and LER 269/90-OS dated May 24, 1990, the licensee reported an additional situation where safety-related equipment could be subjected to low voltages which could render them inoperable or damaged during degraded grid conditions.

The root causes for these conditions were determined to be design deficiencies.

In a letter dated May 8, 1990. the licensee provided a description of the conceptual design for a degraded grid protection hardware modification Intended as the permanent corrective action. Wie have reviewed the conceptual design and find it acceptable as discussed below.2.0 DISCUSSION During normal operation, electrical power to each of the three Oconee units is supplied through Its corresponding auxiliary transformer and N breakers (see attached figure). If a unit's normal path is unavailable, electrical power is then supplied through the E breakers via the unit's startup transformer which is fed from the 230 kV switchyard.

On a loss-of-offsite power condition (230 kVY grid voltage below 160 kY)1 undervoltage relays, which are part of the External Grid Trouble Protection System, start the onsite Keowee hydroelectric units and isolate the-230 kV switchyard from the offsite electrical grid. Emergency electrical power is then-available from Keowee to each unit through the underground feeder circuit via transformer CT 4 and the SK breakers or through the overhead path via .the 230 kV switchyard and each unit's startup transformer and E breakers.

For the overhead path to be established through Keowee breakers, a "Switchyard Isolate Complete" signal must be generated when the necessary breakers in the 230 kV switchyard isolate the switchyard from the offsite grid and align the switchyard to the Keowee overhead path.For a degraded grid condition (230 kV grid voltage less than 211 kV)undervoltage relays (1 per phase with 2 out-of-three logic) on the secondary side of each unit's auxiliary transformer open the unit's N breakers.Similarly, undervoltage relays on the secondary side of each unit's startup transformer open the unit's E breakers.

Upon opening of the N and E breakers, non-safety related undervoltage relays on each unit's 4 kV main feeder buses sense a loss-of-voltage condition and start the Keowee hydroelectric units.Emergency power is available through the Keowee underground Path and, if the grid voltage continues to decrease below 160 kV, through the Keowee overhead path by the protective action of the External Grid Trouble Protection System.2.1 LER 269/90-04 In LER 269190-04, the licensee reported a design deficiency in the degraded grid protection circuitry.

As can be seen from the above discussion, when the grid voltage falls below 211 kV, emergency power is supplied to each unit via the underground path from the Keowee hydroelectric station but the redundant Keowee overhead path for emergency power is not available until the grid voltage falls below 160 kV. If the grid voltage should remain below 211 kV but above 160 kV, only the single underground path is available leaving all three Oconee units vulnerable to a single failure. During degraded grid conditions this could cause the inability of safety systems to mitigate the consequences of a design basis accident/transient unless the operator took action to manually align switchyard breakers for the overhead path. 2.2 LER 269/90-04 AND LER 269/90-05 In LER 269/90-04 and LER 269/90-05, the licensee reported an additional design defect involving the inability of the degraded grid protection circuitry to protect against electrical distribution system voltages falling below minimum values recommnended by equipment manufacturers and possibly causing equipment inoperability and/or damage. Between 1979 and 1982, the licensee submitted various analyses and justification to support the selection of 219 kV as the undervoltage relay setpoint for degraded grid protection.

The documentation submitted by the licensee established that with a grid voltage as low as 217 kV, corresponding voltages at class IE equipment input terminals would be sufficient to start and continuously operate the equipment within their voltage ratings for the worst case electrical System loading. With the actual setpoint placed at 211 kV (or as low as 203 kV considering instrument errors), the class lE equipment performance and/or condition was questionable for design basis scenarios occurring with grid voltages degraded between 217 kV and 203 kV. In LER 269/90-05 the licensee stated that all post-trip equipment except for post-LOCA 208 V MOVs (high and low pressure injection valves, building spray valves) would operate and that the reduction in 4 kY motor life is insignificant.

Operator action would be necessary to restore adequate voltage to the valves or to manually operate the MOVs during the degraded grid condition.

3.0 EVALUATION

For inmiediate corrective action of the design deficiencies, the plant operators will monitor the 230 kV switchyard voltage every two hours. If the voltage drops below 225.2 kV, an attempt to increase the grid voltage will be made, the Keowee underground path will be verified to be operable, electrical power from the Lee gas turbines will be made available to the units' standby buses, and Technical Specification 3.0 will be entered. If grid voltage remains degraded, the units will be in hot shutdown in 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and cold shutdown within the next 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. In a letter dated May 8, 1990, the licensee provided .a conceptual description of the permanent hardware modification intended to eliminate the design defi-ciencies.

New undervoltage relays with setpoints of 222.5kV will be installed utilizing existing potential transformers in one phase on the primary side of each unit's startup transformer.

Two-out-of-three logic will be used to generate an undervoltage signal. After a 9 second time delay this signal will then generate alarms in the control rooms and, if an ES signal from any unit's Engineered Safeguards Protective System exists, will then isolate the 230 kY switchyard from the offsite 230 kV electrical grid.The guidance for the staff's review of the proposed modification is contained in Branch Technical Position (BTP) PSB.-1, "Adequacy of Station Electrical Distribution System Voltages." The specific requirements of the BTP for degraded grid undervoltage protection of Class 1E equipment and our evaluation of the proposed design modification against those requirements are as follows: 1. Setpoints and time delays shall be determined from an analysis of Class lE equipment voltage requirements.

The licensee has selected a setpoint of 222.5 kV for the new undervoltage relays. This setpoint is based on the value 219 kY, which the staff previously approved, plus 1.6% to account for instrumentation errors. The time delay for the downstream timers has been fixed at 9 seconds to allow for short-duration voltage transients to occur without initiation of undervoltage alarms and equipment protective action.2. A short time delay shall be provided to allow motor starting transients to occur. Following this delay, a control room alarm should sound to alert the operator to the degraded grid condition.

If a subsequent LOCA should occur, the onsite Class 1E electrical distribution system should be separated immnediately from the offsite electrical grid. As stated above, the licensee has selected a 9 second time delay which should be adequate to allow for voltage transients during motor startup. After the 9 seconds have passed, a subsequent LOCA will result in immediate separation of the Class IE distribution from the offsite grid.3. A longer time delay, of limited duration such that Class lE equipment will not be damaged, shall be provided to allow the operator to attempt to restore adequate voltages to the Class lE equipment.

Following this delay, the Class LE distribution system should be separated from the offsite electrical grid if adequate voltage is unavailable.

The design modification has the 9 second fixed delay. A second, longer time delay has not been incorporated into the design. Also, the undervoltage condition in itself does not result in the separation of the Class lE distribution system from the offsite grids, an ES (LOCA, NSLB) signal must exist coincidentally before undervoltage protective action occurs.In response to a staff question, the licensee stated, in a phone conference call, that after a degraded grid alarm is received, steps will be taken to re-establish an adequate voltage level on the grid. For a sustained degraded grid condition, analyses (see licensee's letter dated June 18, 1990) related to LERs 269/90-04 and 269/90-05 have been performed covering equipment and plant performance down to the worst setpoint (203 kV) of the existing degraded grid protection circuitry.

This circuitry will remain installed and will provide automatic separatlon from the grid for scenarios without an ES signal and where voltages drop, to levels near where equipment/plant performance is unanalyzed.

L ---'-6-4. The voltage sensors of the undervoltage circuitry shall be Class 1E and shall be located at and electrically connected to Class lE swi tchgea r.In response to a staff question, the licensee stated in a phone call that all relays, timers, and auxiliary relays used in the new undervoltage scheme would be Class 1E. Although it is derived from a Class lE source, the 125 vdc control power will be non-Class 1E utilizing components similar to Class 1E components.

The non-Class lE potential transformers (PTs) are also similar to Class 1E PTs and are seismically mounted.5. An independent undervoltage scheme shall be provided for each Class lE division.The new degraded grid protection circuitry is not divisionalized and is shared by all three Oconee units. This is consistent with the overall design of the emergency electrical power system at Oconee which has two hydroelectric units shared by all three units with the overhead path from Keowee having some couinon components with the preferred offsite source. The overall design philosophy at Oconee is to ensure that all the emergency 4 kV buses are fed from the same reliable source selected by a "good voltage" seeking, automatic transfer scheme.6. Coincident logic on a per bus basis shall be utilized.The proposed degraded grid protection circuitry utilizes 2-out-of-3 coincident logic to preclude spurious trips. As stated above, the circuitry and its logic are not divisionalized and are not on a per bus basis. The coincident logic is shared by all three Oconee units. 7. Test and calibration capability during power operation shall be provided for the voltage sensors.a Since 2-out-of-3 coincident logic is utilized in the new design, it appears that the undervoltage sensors (PTs and relays) should be testable without interfering with normal operation.

8. Bypass annunciation shall be provided in the control room.The staff's review of the proposed design modification indicates that bypasses are not used in the design.9. Technical specifications shall include limiting conditions for operation, surveillance requirements, and trip setpoints and allowable values for undervoltage relays and time delay devices.In response to a staff question, the licensee stated that technical specifications will be proposed but setpoints and time delays will not be specifically identified.

4.0 CONCLUSION

From the discussion above, it can be concluded that the licensee's proposed modification does not fully meet BTP PSB-1 in several areas. Requirements similar to those contained in the BTP were generically applied to every plant (circa 1978). In the northeastern part of the country, low grid quality necessitated the staff to back away somewhat from the BTP requirements, particularly for the requirement to automatically separate the onsite Class IE electrical distribution system from the degraded grid. For the northeast plants, the staffmpermitted the use of alarms, procedures and manual operator actions, in lieu of automatic action, to ensure that the safety-related components of the Class 1E systems would not be adversely affected during low voltage conditions.

This compromise to the requirements of the BTP was granted due to the known weakness of the New England grid whereby the forced shutdown of one nuclear plant could lead to shutdown of other plants in a cascading manner. For Oconee, the proposed modification will add another layer of undervoltage protection to the existing, degraded grid protection circuitry.

Due to the complexity of the plant's existing undervoltage protection scheme and the onsite electrical distribution system coupled with the speculation that the quality of the grid servicing the Oconee site may have similar weaknesses to what exists in the Northeast, we conclude that-it is not prudent to impose the complete requirements of the BTP. Therefore, we find that the licensee's proposed degraded grid protection modification (excluding Technical Specification changes which will be evaluated In a separate SE) is acceptable.

I OCONEE NUCLEAR STATION Power System 230/525KV Switchyards KeowwoO Hydroelectric Generators Lee CT Generators Adequacy of Oconee Nuclear Station Electric Distribution System Undervoltage Protection During Postulated Degraded Grid Voltage Events 1. Executive Summary During the 2014 NRC Component Design Basis Inspection (CDBI) the NRC team identified an unresolved item (URI) to determine whether a performance deficiency exists with respect to the licensee's degraded voltage relay scheme (Degraded Voltage Relay Scheme [05000269, 270, 287/2014007-04 URI Section [R21 .2.b.iv)).

This paper will address both the current and historical licensing and technical issues related to the systems that are credited for both the detection and mitigation of a degraded grid event.The Oconee Nuclear Station (ONS) was originally constructed with two layers of off-site power degraded voltage protection.

These layers consisted of the Oconee 4kV Safety Related Power Undervoltage Protection.

System (4kV UV) and the Oconee External Grid Trouble Protective System (EGTPS).The Oconee Degraded Grid Undervoltage (DGUY) System was added in the 1990s dine frame to correct an issue identified in an April 30, 1990 License Event Report (LER)concerning unanticipated system interactions during an undervoltage condition in the 230kV switchyard.

These unanticipated interactions could have caused the Keowee Overhead path to be unavailable during certain postulated degraded grid scenarios and thus result in the failure of one of two power paths (Keowee Overhead and Underground paths) from the onsite emergency AC source. (Keowee).

This system alerts Oconee Nuclear Station operators and Duke Energy grid system operations to degraded grid voltage conditions prior to the actuation of the 4kV Undervoltage protection system.This system will also isolate the switchyard and start Keowee in the event of an Engineered Safeguards (ES) system actuation during the degraded grid condition as further explained in this document.An operating experience (OE) review was performed and it was determine that some nuclear power plants ultimately rely upon manual or administration actions (via their control rooms or their grid operation center) to protect safety related buses from adverse undervoltage effects related to degraded grid conditions.

Ultimately, Oconee relies upon the automatic actions of safety related components to protect Class iE equipment from adverse impacts due to undervoltage during postulated degraded grid conditions.

Page 1 of 15 FOR INFORMATION ONLY

2. Overview of ONS Degraded Off-site Voltagre Protection

a. Oconee External Grid Trouble Protective System Overview (EGTPS)The External Grid Trouble Protective System Undervoltage system consists of two redundant channels.

Each channel is physically and electrically separated.

Each channel consists of six undervoltage relays which are each connected to a phase of both the red and yellow buses. When 2 relays on the same phase actuate, this will then actuate a local red light and another event recorder point. If two out of three relays are actuated, these two relays will energize four tripping relays which will initiate the operation of the External Grid Trouble Protective System and automatically initiate a start of the Keowee Hydro units. Also, this will actuate a computer point, event recorder point, and status alarm.b. Oconee Degraded Grid Undervoltage (DGUV) System Overview The Degraded Grid Undervoltage relays consists of three undervoltage relays which are connected to the 230 kV Yellow Bus in a 2 out of 3 logic scheme. One relay is connected to each phase to detect any abnormal conditions.

When 2 out of 3 relays operate, this will start a 9 second timer. If the UV conditions recover above the relay setpoint, the 9-second timer will de-energize.

This is designed to eliminate any voltage transients that occur during switching and faults external to the Oconee switchyard.

If at the end of 9 seconds the undervoltage condition has not recovered, a signal will be sent to the statalarm, OAC, Dispatcher and Event Recorder.

If an undervoltage condition is present on 2 out of 3 phases along with an Engineered Safeguards (ES) signal, the 230 kV Yellow Bus will isolate and automatically initiate a start of the Keowee Hydro units to energize the startup transformers.

This system was added as an additional degraded voltage protection system to clear the onsite emergency power source overhead path. See section 3.d of this document for additional history regarding this system.c. Oconee 4kV Safety Related Power Undervoltage Protection System (4kV 1V) OVerview The 4kV normal incoming breakers provide power during normal operation to the Main Feeder Bus (MEB) from the respective unit's auxiliary transformer (l/2/3T).

The normal source of power to the unit auxiliary transformer is the unit generator, although the capability is provided for providing power to 1/2/3T from the switchyard.

If an undervoltage is sensed on two out of three phases of the normal source, the normal breakers will trip and isolate the safety related Main feeder Bus from the grid. The emergency source "E" breakers utilize the same logic.The 84.77% nominal voltage analysis is performed at the "must drop out" value of the 27N & E relays, 97% tap. At the 97% tap value, the 27N & E relays will begin to operate Page 2 of I5 FOR INFORMATION ONLY the disc and after a time delay will provide a trip to either the normal or startup breakers.This trip will isolate the safety related buses from the degraded source of power.A Source voltage of 84.77% nominal will bound all degraded Conditions due to the following:

1. It has been analyzed that all operating safety related equipment will survive a degraded voltage of 84.77% nominal.2. Uncertainty associated with the 84.77% nominal voltage setting (97% tap) is bounded by testing that is performed at 99% tap.3. It has been demonstrated that the undervoltage relays will drop out and actuate on 4kV undervoltage at 84.77% nominal.In. a July 21, 1977 letter from Oconee to the NRC regarding the assessment of the susceptibility of safety related equipment to sustained degraded voltage, it was shown analytically that the safety related loads are protected from degraded grid voltage conditions.

Attachment 1, Section Ill "Conclusions" states the following:

To ensure that the operability of system components is not adversely affected by short term or long term degradation in system grid voltage, the undervoltage relays that monitor the offsite power system are set at 88% (3660V) .This ensures that an acceptable voltage level required for continuous operation of non-safety, and safety-related equipment wvill exist. The time delay inherent in. these relays will eliminate spurious trips and ensure that degraded undervoltages are detected and cleared before they can adversely affect safety-related loads.Figure 5 shows the results of Case 7 which provides the voltage profiles on the safety-related buses under degraded offsite power conditions corresponding to the undervoltage relay setpoint of 88% (3660 V).This Case demonstrates that voltages below the continuous operating limits of the safety-related loads cannot exist without causing a separation from the degraded condition." In a December 20, 1978 letter from the NRC to Oconee, the NRC stated that, "the design affords adequate protection against degraded grid undervoltage conditions in accordance with the NRC letter of June 3, 1977, and therefore is acceptable.

See sections 3.a and b of this document for additional history regarding this system.Page 3 of 15 FOR INFORMATION ONLY

3. Licensing History a. Original Plant Design for the Class 1E Electrical Distribution System Undervoltage Protection No original licensing documentation could be located that explicitly describes and evaluates the undervoltage protection features of the Class 1E electrical distribution system. The Oconee Nuclear Station originally had an undervoltage protection design (4kV UV) to protect the Class IE equipment from a loss of voltage or a sustained degradation of grid voltage on the emergency buses. This undervoltage protection design provides for two out of three coincident logic, monitoring the offsite power voltage on each 41 60 volt bus. The undervoltage protection will initiate separation of the onsite emergency buses from the offsite power systems immediately upon complete loss of offsite power or at a time delay depending on the extent of the degraded voltage condition.

Due to the inverse time trip characteristics of the undervoltage relays, the lower the voltage, the faster the trip.b. August 12, 1976 to December 20, 1978 Correspondence Related to the Millstone Event In an August 12, 1976 letter from the NRC to Oconee, the plant operation and equipment failures during a degraded grid voltage condition events that occurred at Millstone Unit No. 2 were described.

At that time the NRC requested that Oconee investigate the vulnerability of their facility to similar degraded voltage conditions and provide a response by telephone.

In a June 3, 1977 letter from the NRC to Oconee, the NRC felt that it was necessary for all licensees to conduct a thorough evaluation of the problem and submit formal reports regarding the design of their respective Class IE electrical distribution systems and their vulnerability to both long and short term degradation in the grid system voltage within the range where the offsite power is relied upon to supply important equipment.

As requested, Oconee provided multiple responses to the NRC describing the operation of our Class lE electrical distribution systems. In a July 21, 1977 letter from Oconee to the NRC, an evaluation performed that showed the Class 1E system is not vulnerable to the same conditions that were experienced during the Millstone event. The letter states the following: "To ensure that the operability of system components is not adversely affected by short term or long term degradation in system grid voltage, the undervoltage relays that monitor the offsite power system are set at 88% (3660 V). This ensures that an acceptable voltage level required for continuous operation of non-safety and safety-related equipment will exist. The time delay inherent in these relays will eliminate spurious trips and ensure that degraded undervoltages are detected and cleared before they can adversely affect safety-related loads." Page 4 of 15 FOR IN FORMATION ONLY In a December 20, 1978 letter from the NRC to Oconee, the NRC stated that, "the design affords adequate protection against degraded grid undervoltage conditions in accordance with the NRC letter of June 3, 1977, and therefore is acceptable.

The NRC further stated in this letter, "The Oconee Nuclear Station originally had an undervoltage protection design to protect the Class IE equipment from a loss of voltage or a sustained degradation of grid voltage on the emergency buses. The protection system includes undervoltage relays with inverse time characteristics which have a trip setpoint set at 88% of the rated bus voltage, i.e., 4160 volts and with a five second time delay. This undervoltage protection design provides for two out of three coincident logic, monitoring the offsite power voltage on each 4160 volt bus. The undervoltage protection will initiate separation of the onsite emergency buses from the offsite power systems immediately upon complete loss of offsite power or at a time delay depending on the extent of the degraded voltage condition below 88% of nominal voltage. The lower the. voltage, the faster the trip." c. August 8, 1979 to*March 21, 1983 Correspondence Related to the Arkansas Nuclear One (ANO) Event In an August 8, 1979 Generic Letter from the NRC to all Power Reactor Licensees, an event was discussed that occurred at the Arkansas Nuclear One (ANO) station on September 16, 1978 that brought into question the conformance of the station electric distribution system to GDC-1 7, in two separate regards. Specifically, licensees must confirm the acceptability of the voltage conditions on the station electric distribution systems with regard to both (1) potential overloading due to transfers of either safety or non-safety loads, and (2) potential starting transient problems in addition to the concerns excpressed in our June 2, 1977 correspondence with regard to degraded voltage conditions due to conditions originating on the grid.GDC- 17 requires, in part, that (1) electric power from the transmission network for the onsite distribution system shall be supplied by two physically independent circuits (not necessarily on separate-rights of way) designed and located so as to miimze to the extent practical the likelihood of their simultaneous failure under operating and environmental conditions and (2) provision shall be included to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident

• with, the loss of power generated by the nuclear unit, or the loss of power from the transmission network. The ANO station did not fully meet these requirements.

In a letters from Oconee to the NRC on March 13, 1980 and June 4, 1980, Oconee further described Class 1E electrical distribution system operation and analyses in light of the ANO event and GDC-17. Oconee is not a GDC-17 plant due to its licensing prior to General Design Criterion.

In a March 21, 1983 letter from the NRC to Oconee, the NRC stated that they had completed their review and determined the following:

Page 5 of 15 FOR INFORMATION ONLY "Based on the results of your distribution system voltage verification tests, performed in accordance with our guidelines, for the Unit 3 distribution system, we find your voltage analysis acceptable, Due to the close similarity of the design and loading of the distribution systems for all 3 units, we agree to accept the results of the Unit 3 tests as being valid for Units 1 and 2 also. Therefore separate verification testing for Units 1 and 2 will not be necessary.

The voltage analysis you submitted, indicates that the distribution voltages at the safety buses were unacceptable when one unit startup transformer is shared between two units. Your staff has agreed to implement Technical Specifications (TSs) to prohibit the connection of more than one unit auxiliary and Class 1E loads to a single startup transformer." Oconee Technical Specification 3.8.1 Condition A states the following, "Both required offsite sources and the overhead emergency power path inoperable due to inoperable unit startup transformer." NRC Conclusions We have reviewed the EG&G Technical Evaluation Report and concur in the findings that: 1. The voltages are within the operating limits of Class 1 E equipment for projected combinations of plant load and offsite power grid conditions provided one startup transformer is used for one unit.2. Spurious separation from the offsite power system due to the operation of voltage protective relays will not occur (with the offsite grid voltage within its expected limits) as a result of starting safety loads.3. DPC has determined (by analysis) that no potential for either a simultaneous or consequential loss of both offsite power sources exists.4. The tests performed by DPC verifies the accuracy of their analysis.We, therefore, find Oconee Nuclear Units 1, 2 and 3 design to be acceptable with respect to adequacy of station electric distribution system voltages subject to the implementation of technical specifications change prohibiting the use of one startup transformer for more than one unit." d. April 30, 1990 to November 14, 1999 Correspondence Related to the Oconee License Event Reports In a April 30, 1990 Licensee Event Report (LER) from Oconee to the NRC, it was reported that Oconee Design Engineering, while developing a Design Basis Document, determined that the switchyard voltage could drop below the minimum voltage level (219kV) required for worst case loading during a unit trip and Loss-Of-Coolant-Accident on the tripped unit. Further review of the degraded voltage scenario revealed that one of the two required on-site emergency power paths, the Keowee Overhead, could be unavailable for automatic connection to the Oeonee 230 kV switchyard because of the relative setpoints of the under voltage relays serving the startup breaker logic and the external grid trouble protection system. In addition, this same undervoltage condition Page 6 of 15 FOR INFORMATION ONLY could prevent the startup transformer 4160 V breakers from closing in causing the 230 kV switchyard and its associated incoming transmission lines to be unavailable to provide their required support function.These conditions are possible because the 230 kV switchyard bus must be greater than 219 kV in order to adequately supply ES loads while the automatic actuation voltage setpoint for the Keowee Overhead emergency power path is less than 160 kY. If a degraded switchyard voltage exists between these relative set-points, then power to the ES buses may not be automatically available from either source.Design Engineering also initiated a Station Problem Report which resulted in the later development of Nuclear Station Modification (NSM) 52850. This NSM detailed the installation of an additional two out of three logic arrangement of undervoltage relays which sense the 230 kV input to each units startup transformers.

The NSM provided an annunciator, digital computer and events recorder indication to plant operators as well as input to the Operator Aid Computer (QAC) when 230 kY switchyard degraded voltage conditions exist. This modification automatically initiated existing switchyard isolate logic if degraded voltage conditions and an engineered safeguards (ES) signal on any Oconee unit occur concurrently.

This system is known today as Oconee Degraded Grid Undervoltage (DGUV) System.In a November 14, 1990 Safety Evaluation for Oconee Degraded Grid Protection, the NRC concluded the following: "Your Licensee Event Reports (LERs) 269/90-04 dated April 30, 1990, .269/90-04 dated May 24, 1990, and 269/90-05 dated May 24, 1990, reported situations related to design deficiencies of the degraded grid protection hardware and provided corrective actions.These deficiencies may leave the station vulnerable to a single failure and/or render safety-related equipment inoperable or damaged during a degraded voltage condition.

However, your letter of May 8, 1990, described conceptually a new permanent degraded grid protection modification to be installed in the near future that would, to a great extent, resolve these design deficiencies.

The NRC staff has completed a review of these subnmittals.

Enclosed is the related Safety Evaluation.

The staff has concluded that the proposed modifications to the design would provide additional undervoltage protection.

Also, in consideration of the complexity of the plant's existing undervoltage protection system and the on-site electrical distribution system, the staff finds the proposed degraded grid protection modification acceptable." 4. NRC Regzulatory Issue Summary, 2011-12. Revision 1. Adequacy of Station Electric Distribution System Voltages Criteria a) The selection of voltage and time delay set-points shall be determined from an analysis of the voltage requirements of the safety-related loads at all station electric power system distribution levels;Page 7 of 15.FOR INFORMATION ONLY Note: Voltage requirements of all safety-related loads should be determined based on manufacturers design and operating requirements.

For example, safety injection motors have starting and running voltage requirements.

Motor operated valves have minimum operating voltage requirements.

Motor Control Center contactors have minimum pickup and operating voltages.

All voltage requirements for all safety-related loads need to be preserved by the DVR circuit(s) during all operating and accident conditions.

Oconee's Design to Criteria a) The voltage setpoints for the 4kV Safety Related Power Undervoltage Protection System relays were shown via analyses to automatically protect the connected eqluipment during a postulated degraded grid scenario.Criteria b) The voltage protection shall include coincidence logic to preclude spurious trips of the offsite power source;Oconee's Design to Criteria b)The 4kV Safety Related Power System Undervoltage Protection and Degraded Grid Undervoltage (DGUV) Systems utilize 2 out of 3 logic. This requires that 2 out of the 3 phases are in a degraded voltage condition prior to actuation.

Criteria c) ThI~e time delay selected shall be based on the following conditions:

Criteria c-i) The allowable time delay, including margin, shall not exceed the maximum time delay that is assumed in the final safety analysis report (FSAR) accident analyses;Note: Time delay condition (1) indicates that the DVR circuits should be designed assuming coincident sustained degraded grid voltage and accident events. Upon the onset of the coincident accident and degraded grid event, the time delay for the DVR circuit should allow for separation of the IE buses from the offsite circuit(s) and connection to the 1E onsite supplies in time to support safety system functions to mitigate the accident in accordance with the FSAR accident analyses.Oconee's Design to Criteria e-i)The DGUV system, as stated in Section 2 of this paper, will actuate if an undervoltage condition is present on 2 out of 3 phases along with an Engineering Safeguard (ES)signal, the tripping relays (94V Channel 1 or 2) located in the External Grid Protection System (EGPS) will operate isolating the 230 kV Yellow Bus and starting Keowee Hydro to energize the startup transformers.

The time delay for this postulated event is well bounded by LOCA/LOOP analyses.

The 9 second degraded voltage relay timer + 11 second (transfer to standby bus) is less than the 23 seconds required by the UFSAR.Keowee will start from an ES signal and not walt for the 9 second timer.Page 8 of 15 FOR INFORMATION ONLY If an accident signal (ES) is not present, the buses will be protected by the 4kV UV system at each respective unit's 4kV bus. Evaluation showed that the 4kV UV system response time is one minute or less.Criteria c-2) The time delay shall override the effect of expected short duration grid disturbances, preserving availability of the offsite power source(s).

Oconee's Design to Criteria c-2)For the DGUV system, a 9 second delay is utilized to override the effect of expected short duration grid disturbances, preserving availability of the offsite power source.The 4kV UiV system voltage setpoints arelower than the DGUV .setpoints.

Expected -short duration grid disturbances would not reach the lower setpoints.

Due to the inverse time trip characteristics of the undervoltage relays, the lower the voltage, the faster the trip. This provides an inherent mechanism which is resistant to nuisance tripping.Criteria e-3) The allowable time duration of a degraded voltage condition at all distribution system levels shall not result in failure of safety-related systems or components.

Oconee's Design to Criteria c-3)Due to the design of the 4kV UiV system, during a degraded voltage below 87.33% -nominal it has been demonstrated that all operating equipment will survive and be available iffneeded for an ES actuation.

It has also been demonstrated that a safety related load can be started and survive to be able to operate at this degraded voltage.Additionally, it has been shown that the undervoltage relays would actuate at 84.77%nominal to separate the safety related loads from the degraded source of power. This actuation has been shown to occur in less than two minutes. It is also important to note that once the undervoltage relays drop out the voltage has to recover to 100% tap (105 volts) or higher to reset the relay. Although analysis demonstrates that all safety related loads would survive during a sustained degraded voltage condition of 84.77% nominal, the relays would automatically separate the ES buses from the degraded source or the voltage would have to recover to an acceptable level, 100% tap (87.5% nominal) or higher.Criteria d) The voltage monitors (or DVRs as defined above) shall automatically initiate the disconnection of offsite power source(s) whenever the voltage and time delay limits have been exceeded.Oconee's Design to Criteria d)The 4kV UV system undervoltage protection relays would actuate at 84.77% nominal to separate the safety related loads from the degraded source of power.Page 9 of 15 FOR INFORMATION ONLY The Oconee Degraded Grid Undervoltage (DGUV) system will isolate the switchyard and start Keowee in the event of an Engineered Safeguards (ES) system actuation during the degraded grid condition.

Any proceduralized manual actions for DGUV alarms are prel"iminary actions. The class lE buses are automatically protected by the 4kV UV system.Criteria e) The voltage monitors (DYRs) shall be designed to satisfy the requirements of IEEE Standard 279-1971, "Criteria for Protection Systems for Nuclear Power Generating Stations" Oconee's Design to Criteria e)All relays, timers, and auxiliary relays used in The Oconee Degraded Grid Undervoltage (DGUV) system are Class lE. Although they are derived from a Class 1E source, the 125 vdc control power are non-Class lE utilizing components similar to Class 1E components.

The non-Class lE potential transformers (PTs) are also similar to Class lE PTs and are seismically mounted.The 4kV UV system satistfies the requirements of IEEE 279-197 1 per a July 21, 1977 from Duke to the NRC.Criteria I) The Technical Specifications shall include limiting conditions for operation, surveillance requirements, trip setpoints with minimum and maximum limits, and allowable values for second-level voltage protection DVRs.Oconee's Design to Criteria f)The current Oconee Technical Specifications (TS) 3.3.19 include limiting conditions for operation (LCOs) and Surveillance Requirements (SRs). No trip setpoints are included in the TS.ONS Operating License and Technical Specifications were issued in the early 1970's. 10 CFR 50.36 (c)(2)(iii) states that a licensee is not required to propose to modify technical specifications that are included in any license issued before August 18, 1995, to satisfy the criteria in paragraph (c)(2)(ii) of this section. As such, ONS was not required to modify technical specifications to include items that meet Criterions 1, 2, 3, and 4. Note that 10 CFR 50.36 was modified to include criteria for inclusion of items in Technical Specifications in 1995. See section S.d of this document for additional background information.

The DGUV system channel redundancy limitations and setpoints are included in Oconee TS 3.3.19.Page 10 of 15 F OR iNFORMATION ONLY

5. NRC CDBI Questions/Concerns

a. Does scheme meet AEC 39 (UFSAR 3.1.39), 1977 letter?ONS Response to 5.a Criterion 39 (Emergency Power for Engineered Safety Features) states the following,"Alternate power systems shall be provided and designed with adequate independency, redundancy, capacity, and testability to permit the functioning required of the engineered safety features.

As a minimum, the on-site power system and the off-site power system shall each, independently, provide this capacity assuming a failure of a single active component in each power system.ONS UFSAR section 3.1.39 states: "The electrical systems meet the intent of the criterion as discussed in UFSAR Chapter 8.Three alternate emergency electric power supplies are provided for the station from which power to the engineered safety feature buses of each unit can be supplied.

These are the 230 KY switching station with multiple off-site interconnections and two on-site independent 87,500 KVA hydroelectric generating units. Each nuclear unit can receive emergency power from the 230 KY switching station through its start-up transformer as a preferred source. Each unit can receive emergency power from one hydroelectric generating unit through a 13.8 KY underground connection to standby transformer CT4.The other hydroelectric generating unit serves as a standby ~emergency power source and can supply power to each unit's startup transformer when required.

Both on-site hydroelectric generating units will start automatically upon loss of all normal power or upon an engineered safety feature action.Two additional sources of alternate power are available, as each nuclear unit is capable of supplying any other unit through the 230 KV switching station. In addition, a connection to the 100 KY transmission network is provided as an alternate source of emergency power whenever both hydroelectric generating units are unavailable." No single active failure could prevent the ability of the on-site power system and the off-site power system, independently, to provide power to the engineered safety features." b. Do manual actions "after a DG (Degraded Grid) Alarm steps t-o resolve" -are these required to protect 4kV,etc.?ONS Response to 5.b No. As described in sections 2(a-c) of this paper, the degraded voltage relay protection systems provide automatic isolation initiation prior to Class 1E electrical distribution system bus voltages reaching any analyzed limits. Proceduralized actions by Oconee operators are considered conservative and prudent measures to be taken prior to the initiation of automatic protective actions.Page 11 of 15 FOR INFORMATION ONLY C. Does the automatic systems each meet the requirements (1977, BTP, RIS)? (Analysis vs. set points)ONS Response to 5.c Yes. Past and current analyses show that the setpoints of the automatic system (4kV UV)are adequate to protect the Classl1E electrical distribution systems during postulated periods of degraded grid voltage. See section 3.b of this document for additional information.

d. Are 4kV set points credible since not in TS, and should they be per 10 CFR 50.36 (c)(2)('ili)?

ONS Response to $.d ONS Operating License and Technical Specifications were issued in the early 1970's. '10 CFR 50.36 (c)(2)(iii) states that a licensee is not required to propose to modify technical specifications that are included in any license issued before August 18, 1995, to satisfy the criteria in paragraph (c)(2)(ii) of this section. As such, ONS was not required to modify technical specifications to include items that meet Criterions 1, 2, 3, and 4. Note that 10 CER 50.36 was modified to include criteria for inclusion of items in Technical Specifications in 1995.The ONS Technical Specifications currently require three channels of each of the following EPSL voltage sensing circuits to be OPERABLE:

a) Startup Transformer, b)Standby Bus 1; c) Standby Bus 2: and d) Auxiliary Transformer in MODES 1, 2, 4,4, 5, Sand 6, and during movement of irradiated fuel assemblies.

The EPSL voltage sensing circuits are required for the engineered safeguards (ES) equipment to function in any accident with a loss of offsite power. Per the ONS TS 3.3.18 Bases the EPSL voltage sensing circuits satisfy Criterion 3 of 10 CFR 50.36. SR 3.3.18.1 requires a CHANNEL FUNCT[ONAL TEST be performed every 24 months (per SFCP). The test is a functional test of the logic and does not verify the setpoint.

This verification is performed by testing not controlled by Technical Specifications.

The exclusion of the setpoint verification from TSs is addressed below under TS history.EPSL TS History On March 11, 1993, Duke Energy Submitted a complete rewrite of Section 3.7, Auxiliary Electrical Systems, using a format consistent with standard technical specifications (NUJREG 1430). The custom Technical Specifications (CTS) that existed at the time of submittal did not include surveillance requirements for the EPSL voltage sensing circuits (4kV UV). As such, Duke Energy proposed to add surveillance requirements to require a refueling frequency CHANNEL TEST as an additional restriction that was not currently included in Technical Specifications.

The proposed TS Bases for the SR very clearly stated that the actual setpoints for the undervoltage relays on the N and E breakers are verified independently as a prerequisite to the TS SR. As a result of NRC Requests for Page 12 of 15 FOR INFORMATION ONLY Additional Information (RA~s) and associated Duke Energy RAT responses and to make.the LAR adhere to the STS Writers Guide and associated NUREG, Duke Energy re-submitted the proposed TS on September 3, 1997. No changes were made to the proposed TS on EPSL Voltage Sensing Circuits and the NRC issued the TS and Bases as originally proposed (Amendment No. 232, 232, and 231). NRC evaluated proposed TS 3.7.4 for EPSL Voltage Sensing Circuits starting on page 28 of the Safety Evaluation (SE) restating in their summary of proposed SR 3.7.4.1 that the actual setpoint values for the undervoltage relays for the N and E breakers are to be verified independently as a prerequisite to the this SR. The NRC concluded based on the bases of the discussion and evaluation provided in Section 4.0 of the SE that the technical requirements contained in TS 3.7 are consistent with design requirements, the current ONS TS 'with differences justified, the Bases for TS 3.7 and technical requirements contained in the revised STS (refer to Section 5.0 Stummary on page 46 of SE). Section 6.0 of the SE addresses ITS Involvement stating that the SE also provides the review for the technical changes that are included in Section 3.8 of the ONS ITS that is currently under review, but are beyond the scope of the ITS program indicating that both sets of specifications (3.7 for this amendment and 3.8 for the ITS conversion) address the same provisions of the electrical TS. As a result the NRC staff determined that it was satisfactory to approve TS 3.7 and delay implementation so that implementation was coincident with the ITS amendments.

Note that EPSL instrumentation was located in the instrumentation Section Of Technical Specification during ITS conversion so the TS for EPSL Voltage Sensing circuit. is 3.3.18 and for EPSL 230kV Switchyard DGVP is 3.3.19.e. Commitments to IEEE-603 / 279 for Emergency Power / Off-site connection ONS Response to S.e In a July 21, 1977 letter from Oconee to the NRC, regarding the 4kV UV system, it was stated that, "Although designed prior to the issuance of IEEE 279-1971, the undervoltage (4kV UV) protection logic satisfies the requirements of these standards." All relays, timers, and auxiliary relays used in The Oconee Degraded G-rid Undervoltage (DGUV) system are Class lE. Although they are derived from a Class lE source, the 125 vdc control power are non-Class lE utilizing components similar to Class 1E components.

The non-Class lE potential transformers (PTs) are also similar to Class !E PTs and are seismically mounted.6. Degraded Voltage Protection Industry Precedence and Operating Experience (OE)Summary: As shown below, due to the reliance on manual and administrative actions (instead of automatic actions) for the protective of safety related buses, the NRC decided to issue a backflt to implement modifications to bring these facilities in compliance with BTP PSB-1, "Adequacy of Station Electric Distribution System Voltages." Per a telephone conservation with Southern Nuclear Operating Company personnel on August 4, 2014, plants Farley and Hatch relied exclusively upon manual actions (either by plant operations or the transmission control department) to protect Safety related components Page 13 of 15 FOR INFORMATION ONLY w q from the adverse effects of degraded grid voltage protection.

Their argument was primarily based upon the improbability of such a degraded grid voltage condition.

a. Farley Nuclear Plant Backfit Issue Following a July 1976 event at Millstone involving a degraded voltage condition, the NRPC staff developed generic positions on power systems for operating reactors..Since degradation of the offsite power system can lead to or cause the failure of redundant Class I E safety-related electrical equiipment, the NRC required that licensees install degraded voltage protection as described in NRC letter dated June 2, 1977, "Statement of Staff Positions Relative to Emergency Power Systems for Operating Reactors" (ADAMS Legacy No. 4007002656).

The letter states that "the voltage monitors shall automatically initiate the disconnection of offsite power sources whenever the voltage setpoint and time delay limits have been exceeded." The letter further states that "the voltage monitors shall be designed to satisfy the requirements of IEEE Std. 279-1971, "Criteria for Protection Systems for Nuclear Power Generating Stations." This automatic feature ensures the adequacy of the offsite power system and the onsite distribution system and ensures that the electrical system has sufficient capacity and capability to automatically start and operate all required safety loads.Contrary to the June 2, 1977 letter, an NRC Safety Evaluation Report (SER) for FNP (ADAMS Legacy No. 951211 0043) accepted manual operator actions to compensate for degraded grid conditions.

b. Hatch Nuclear Plant Backfit Issue In a letter dated June 17, 2011!, SNC disagreed with the conclusion in the May 25, 2011, report and appealed the NRC's decision to issue the backfit under the "compliance exception" provision of 10 CFR 50.109(a)(4)(i).

In your appeal, you stated that a cost justified substantial safety backfit analysis, per 10 CFR 50.109(a)(3), was required.

At issue was the reliance on administrative controls and manual actions at HNP, as approved in the 1995 NRC Safety Evaluation Report (SER), for maintaining adequate voltage to protect Class 1E (safety-related) electrical equipment in the event of degraded voltage conditions.

Aider review and consideration of SNC's response, the NRC has concluded that the decision to use the "compliance exception" provision as allowed by 10 CFR 50.109(a)(4)(i) was appropriate.

The staff maintains its position that SNC's electrical analysis for I-INP' must show that the existing setpoints and time delays are adequate to ensure that all safety-related loads have the required minimum voltage measured at the component terminal to start and operate safety related equipment necessary to mitigate the consequences of the worst-case design basis event (DBE), without any credit for administratively controlled bus voltage levels. The staff maintains that this position is consistent with regulatory requirements specified in 10 CER 50.55a(h)(2) and GDC-17.This staff position is also consistent with the guidance provided in Standard Review Plan, NUREG-0800 (July 1981), Branch Technical Positions (BTPs) of Appendix 8-A (PSB), containing BTP PSB-1, "Adequacy of Station Electric Distribution System Voltages." Page 14 af 15 FOR INFORMATION ONLY 4 Further, the staff concludes that the NRC change in position, from that in the 1995 SER, regarding the acceptability of relying on manual operator action to demonstrate compliance with SNC 2 the applicable provisions of GDC-17 and 10 CFR 50.55a(h)(2),*constitutes backfitting as defined in 10 CFR 50.109(a)(1).

The backfitting action is necessary for compliance with GDC-17 and 10 CFR 50.55a(h)(2) and is consistent with applicable guidance and practices in effect at the time that the NRC staff erroneously approved the use of manual actions responding to degraded grid voltage condition in 1995.c. Operating Experience (OE) Summary In summary, the above backfit OE does not apply to Oconee due to the. fact that Oconee ultimately relies upon the automatic actions of the undervoltage relays on the incoming breakers for the safety related 4kV buses to protect the Class IE electrical power distribution system from degraded grid conditions.

As described in sections 2(a-c) of this paper, the degraded voltage relay protection system (4kV UV) provide automatic isolation initiation prior to Class 1E electrical distribution system bus voltages reaching any analyzed limits. Any manual actions by ONS are only conservative and p)rudent measures taken prior to reaching these limits.Page 15 of 15 FOR INFORMATION ONLY